GhostVendors Exposed: Silent Push Uncovers Massive Network of 4000+ Fraudulent Domains Masquerading as Major Brands
Key Findings
- Silent Push Threat Analysts have uncovered a massive “fake marketplace” scam campaign we have dubbed “GhostVendors” involving online ads that impersonate dozens of major brands and spoof actual products on thousands of fraudulent websites.
- We found over 4,000 domains that are part of this fake marketplace network. This is a significant threat targeting social networks, major brands, advertising companies, and consumers worldwide.
- During our research, we found that after the threat actor posted its malicious Facebook Marketplace ads for a few days, it stopped its campaigns, thereby deleting all traces of them from the Meta Ad Library.
- We determined that the threat actors are exploiting an existing Meta policy to target major brands and then completely remove previously posted ads.
Executive Summary
Silent Push Threat Analysts are tracking a massive “fake marketplace” scam that uses thousands of fake websites to abuse dozens of major brands and buy Facebook ads to promote its scam products. Our team is labeling this group “GhostVendors,” and we suspect they are also purchasing ads on other networks to self-promote their scam sites. We will update this report accordingly as our investigation continues.
Our team also confirmed how a Facebook advertiser can buy ads which show up in the Meta Ad Library while they are running, and then stop their campaigns, thereby removing all evidence of their posted ads from the Meta Ad Library. In early May 2025, we documented the appearance of ads from this threat actor group that were searchable in the Ad Library, five days later, all evidence of their presence was removed from the Ad Library due to the ad campaigns stopping. This helped to confirm a known Meta ad library policy existed, and highlighted that potentially these threat actors were taking advantage of this by rapidly launching and stopping ads for similar products on different pages.
Based on the brands being impersonated, this campaign appears to focus on impersonating brands that buy large amounts of online ads—many of the impersonated brands are huge and well-known for purchasing significant quantities of ads. In contrast, other brands being impersonated are smaller ones that mostly use online sales processes.
Brands our team has observed being targeted by the GhostVendors campaign include:
Amazon, Costco, Bath & Body Works, Nordstrom, Saks Fifth Avenue, Lowes, L.L. Bean, Tommy Bahama, Rolex, Brooks Running, Birkenstock, Crocs, Skechers, Total Wine, Omaha Steaks, Instacart, Duluth Trading, Advance Auto Parts, Party City, Dollar General, Tractor Supply, Joann, Big Lots, Orvis, Alo Yoga, On Running, Tom Ford Beauty, Rebecca Minkoff, Yankee Candle, Hoka, Thrive Market, Vionic Shoes, Rock Bottom Golf, Vuori Clothing, Goyard, Icebreaker Clothing, NOBULL Sportswear, Alpha Industries, Volcom, Kizik Shoes, Vessi Shoes, Mammut Outdoor Gear, Buffalo Games & Puzzles, Ravensburger Puzzles, Fast Growing Trees, Gurney’s Seed and Nursery, Vivobarefoot, KaDeWe, Palmetto State Armory, Natural Life, Luke’s Lobster, Cousins Maine Lobster, White Oak Pastures, Seven Sons Farm, Arcade1Up Gaming, EGO Power+ Tools, Cobble Hill Puzzles, Popflex, Argos UK, Huk Clothing, 44 Farms, Tyner Pond Farm, Pipers Farms, Rebel Sport, The Woobles Crochet, Massimo Dutti, and GE Appliances.
Sign Up for a Free Silent Push Community Edition Account
Register now for our free Community Edition to use all the tools and queries highlighted in this blog.
Background
Silent Push Threat Analysts have tracked numerous types of “fake marketplace” scams. In 2024, we tracked a group we dubbed the “AIZ—Aggressive Inventory Zombies,” covering it with an in-depth report exclusively for our enterprise clients and a public blog.
Many threat actors create fake online marketplaces that promote real products, using them to conduct various types of financial fraud. This is achieved by either not delivering the ordered products or stealing victims’ payment details. Multiple variations of these types of scams exist, but the end goal for each is typically quick cashouts. Most of these networks abuse large numbers of domains due to the speed with which social networks and other sources respond and block their sites.
Our team recently received a tip about a Facebook Marketplace ad promoting a Milwaukee Tool Box at an impossibly low price via a domain clearly set up using a domain-generated algorithm (DGA), a common tactic employed in many malicious campaigns.
By investigating the advertised products, examining various content clues, and tracking the campaign’s heavy use of technical practices, our team expanded our search from the initial suspicious site to thousands of marketplace scam websites targeting a wide range of social networks and individuals worldwide.
Milwaukee Tools’ Brand Spoofed via Facebook Marketplace Ads, Facebook Purges Ads’ Library of Proof
On May 7, 2025, Silent Push Threat Analysts captured a Facebook page promoting a fake marketplace that spoofed the “Milwaukee Tools” brand. The ad content used the word “Millaeke” while featuring an image of a Milwaukee Tool box:
Our team examined the ad for more information and confirmed that the advertiser’s name was “Millaeke,” while the domain they were promoting in the ad was wuurkf[.]com.
The full URL of the malicious sponsored Facebook Marketplace ad was:
“wuurkf[.]com/collections/Tool-Box/products/Milwaukee-56-Premium-18-Drawer-Tool-Box-Chest-and-Cabinet-Combo-with-Electronic-Keypad-Lock“
The UTM “link tracking” parameters appended to the URL after clicking the ad included:
“utm_medium=paid&utm_source=fb“
The Facebook page where these ads are bought could be seen at: “facebook[.]com/profile.php?id=61575534312860”, although once the campaign ended, all traces of the previously published Facebook posts disappeared.
After viewing Millaeke’s original ad, our team navigated to the Meta Ad Library and confirmed that the page was currently running numerous ads.
However, five days after our team discovered the ads, Millaeke must have stopped its campaign, as all the ads disappeared from the library, which you can see here.
Facebook’s Ad Library Only Includes Active Ads, Creating Threat Tracking Challenges
Our researchers continued to investigate details surrounding Facebook’s ad policy. What we found is that Meta retains ads in the Ad Library on social issues, elections, and politics that have run for the past seven years. However, Meta’s policy dictates that any other types of ads are ONLY saved while those ads are part of active campaigns.
As soon as a campaign ends, the ads are removed from the Ad Library, as exemplified by our monitoring of the fake marketplace ads. This makes tracking threats that abuse Facebook ads much more difficult. It also highlights a challenge for defenders, which can only be effectively addressed by scraping this source of data and creating an external repository—something that appears to be prohibited. As a result, it’s currently impossible to holistically track malicious ads on this network.
Silent Push Threat Analysts will continue to monitor the situation and update this report if additional facts emerge.
Tracking the GhostVendors’ Marketplace Scam
The previous campaign targeting Milwaukee Tools was using specific metadata for its scam, with clearly observable patterns:
“wuurkf[.]com/collections/Tool-Box/products/Milwaukee-56-Premium-18-Drawer-Tool-Box-Chest-and-Cabinet-Combo-with-Electronic-Keypad-Lock“
Recalling that these types of campaigns are typically “spray and pray” efforts, in which threat actors regularly spin up large amounts of infrastructure to mitigate takedown efforts, a common tactic in such efforts is for a threat actor to clone their websites rather than make each one unique. Doing so presents an opportunity for defenders.
When tracking campaigns, our analysts often look to the Google index due to its speed in indexing internal pages. Silent Push primarily scans homepages as part of our global content indexing effort, along with internal pages input by our users and threat researchers.
By performing a Google Search, we looked for the exact product name used in the scam ad:
“inurl:/products/milwaukee-56-premium-18-drawer-tool-box-chest-and-cabinet-combo-with-electronic-keypad-lock/“
The query returned fewer than 10 unique results – two entries appeared to be for legit marketplaces, but six other domains featured impossibly cheap prices, DGA domains, or, in this instance, were directly spoofing Wayfair:
- kpwmua[.]com – Currently offline
- vtmzox[.]com – Currently offline
- acudcct[.]com – Online
- toolzde[.]com – Online
- yvnbpm[.]com – Online, spoofing Wayfair
- gardonset[.]com – Online, spoofing Wayfair
![Screenshot of a fake tool chest ad on "acudcct[.]com"](https://www.silentpush.com/wp-content/uploads/ghostvs-image-5-acudcct-com-spoof.png)
![Fake ad spoofing Milwaukee brand tool chest ad on "yvnbpm[.]com"](https://www.silentpush.com/wp-content/uploads/ghostvs-image-6-yvmbpm-com-spoof.png)
![Fake ad spoofing Milwaukee brand tool chest ad on "gardonset.]com"](https://www.silentpush.com/wp-content/uploads/ghostvs-image-7-gardonset-com-spoof.png)
![Fake ad spoofing Milwaukee brand tool chest ad on "toolzde[.]com"](https://www.silentpush.com/wp-content/uploads/ghostvs-image-8-toolze-spoof.png)
Additional Facebook Advertisements from the GhostVendors’ Fake Marketplace Threat Actor
Silent Push Threat Analysts discovered two additional examples of Facebook Marketplace ads from the same threat actor group, promoting domains that matched our previous content fingerprints.
Both of these examples were first seen on May 13, 2025.
![Screenshot of fake ad on "wrocxop[.]com"](https://www.silentpush.com/wp-content/uploads/ghostvs-image-9-fb-wrocxop-com-fb-spoof.png)
The first Facebook Marketplace ad was from the Facebook page “Rabx-B,” promoting the website “wrocxop[.]com,” on the same host as the previous websites.
The Meta Ad Library, accessed on May 13, 2025, listed 22 ads for this “Rabx-B” advertiser, with the first starting on May 9, 2025.
These ads direct users to product pages akin to this URL:
“wesonhz[.]shop/products/Cold-Water-Gas-Pressure-Washer-Powered-by-Honda%C2%AE-with-AAA-Triplex-Pump-(4400-PSI-at-4.0-GPM)?utm_medium=paid&utm_source=fb&utm_id=120225268056530127&utm_content
=120225269683470127&utm_term=120225269683300127&utm_campaign=120225268056530127“
The second Facebook Marketplace ad, captured on May 13, 2025, was for the same Facebook page advertiser, “Rabx-B,” but this time it was promoting a new domain, “wesuoey[.]shop.”
After comparing the new domain from the same advertiser to what was previously seen, we then returned to the Meta Ad Library to review all 22 Rabx-B ads. We confirmed they were promoting different domains and, importantly, noted that the visible domain in the ad did not match the final destination ad in all instances:
- wesuoey[.]shop – visible in ad text but link click redirects to wesonhz[.]shop
- wesonhz[.]shop
- wrocxop[.]com
Two ads from the same advertiser promoted the domain “wrocxop[.]com” within the visible ad, as seen below, yet redirected the user to “wesonhz[.]shop”.
![Screenshot of the Rabx-B ad promoting domain "wrocxop[.]com"](https://www.silentpush.com/wp-content/uploads/ghostvs-image-15-rabx-b-about-the-ad.png)
![Screenshot showing interstitial on Facebook after clicking Rabx-B ad promoting "wrocxop[.]com" that doesn't mention actual URL redirect](https://www.silentpush.com/wp-content/uploads/ghostvs-image-16-what-to-know.png)
![Screenshot of redirect from "wrocxop[.]com" showing product details hosted on "wesonhz[.]shop"](https://www.silentpush.com/wp-content/uploads/ghostvs-image-17-wrocxop-cop-redirect-to-wesonhz-shop-showing-prod-details.png)
It’s clear from this most recent Facebook Marketplace advertiser’s usage of multiple domains, combined with the effort undertaken on their previous campaigns to rapidly end them and thus remove all traces of their ads from the Meta Ad Library, that this particular threat actor has a thorough understanding of the platform’s advertising features and policies.
Our research team discovered another example of a malicious Facebook ad from this same threat actor on May 16, 2025. The ad was posted from the page “Tools Clearance” (facebook[.]com/profile.php?id=61574929192093), impersonating GE Appliances on the domain “geappliances[.]life”:
![Screenshot of our discovering a fake Facebook ad hosted on "geappliances[.]life" May 16, 2025](https://www.silentpush.com/wp-content/uploads/ghostvs-image-18-ge-appliances-on-99-usd.png)
The domain “geappliances[.]life” contains the same technical fingerprint used to track other websites in this campaign.
The ads for this “Tools Clearance” page were seen in the Meta Ad Library.
Discovering Four New Ads
Our research team discovered four additional fake marketplace advertisements:
By stopping the campaign, the threat actor was able to have its ads disappear from the Facebook Ad Library.
Example ad from the campaign above: “facebook[.]com/ads/library/?active_status=active&ad_type=all&country=US&id=120224586724400601&is_targeted_country
=false&media_type=all&search_type=page&source=info-sheet&view_all_page_id=654433934418507″
The second ad:
The ad had the screenshot captured below:
=false&media_type=all&search_type=page&source=info-sheet&view_all_page_id=654433934418507″
But soon thereafter, the advertiser must have ended the campaign since the ad disappeared:
The third ad:
This appears to be the page:
The screenshot below displays when the ads were displayed there:
But the Facebook Ad Library is now empty:
=false&media_type=all&search_type=page&source=page-transparency-widget&view_all_page_id=536613529533713″
The ad was promoting the domain: “supersale[.]top”:
![Another fake Wayfair ad spoofing Milwaukee for a tool chest on sale at the domain "supersale[.]top"](https://www.silentpush.com/wp-content/uploads/ghostvs-image-32-new-ad-3of4-5.png)
The fourth ad:
Below is a spoof of a “Milwaukee Clearance of Excess Inventory from 2025” sale:
There are dozens of pages with this “Holiday Celebration Sale” name and the same logo on Facebook: “facebook[.]com/search/pages/?q=holiday%20celebration%20sale”
=false&media_type=all&search_type=page&source=page-transparency-widget&view_all_page_id=582885318250730“
Many are active advertisers:
=false&media_type=all&search_type=page&source=page-transparency-widget&view_all_page_id=102448339253132“
The ads from these are the same as in the other aspects of the scheme (above):
Most of the advertiser accounts were empty, indicating that the advertiser had likely ended the campaigns. The previously captured ad appears to be gone, so it’s unclear which of the Facebook pages was behind the fourth ad.
Brands Targeted by the GhostVendors’ Campaign
These fake marketplace scam campaigns appear to target dozens of major brands. Some websites feature generic names, whereas others feature brands directly in the domain names.
It also appears that all the websites in this network feature major brands on the product pages, and many of the prices for the products being advertised for sale are unrealistically low.
Silent Push Threat Analysts have not yet tested any of the purchase processes. Even so, we believe it’s likely that many of these don’t deliver the promised products and may instead engage in financial fraud by abusing credit cards used during the attempted purchase process.
The following brands are some of the organizations targeted:
General Retail & Department Stores
- Amazon:
- myamazonboxnews[.]com
- myamazonbox[.]com
- amazonboxinc[.]com
- amzncenter[.]com
- amzglobalpallets[.]com
- shopamazonpallet[.]com
- Costco:
- costcosale[.]store
- cstcosaw[.]xyz
- Nordstrom:
- nordstromss[.]shop
- Saks Fifth Avenue:
- saksavenueoff5th[.]shop
- saksavenueoff5th[.]com
- off5th[.]online
- Dollar General:
- dolllargenerai[.]com
- dollargeneralsupermarket[.]com
- KaDeWe (German department store):
- kadewe-tasche[.]com
- kadewebag[.]com
- kadewehandtasche[.]com
- Argos UK:
- argosuk-save[.]shop
Home Improvement & Specialty Retail
- Lowes:
- lowessale[.]shop
- Tractor Supply:
- tractorsupply-us[.]com
- tractorsupply-co[.]online
- Advance Auto Parts:
- advanceautopartsog[.]com
- advanceautopartsdeal[.]com
- advancepartsauto[.]com
- advanceauto-clear[.]com
- Party City:
- partycity-clearance[.]shop
- partycitysupersale[.]shop
- partycity-preopen[.]com
- partycityliquidation[.]com
- partycitywarehouseusa[.]com
- Joann (Craft/Fabric):
- joannsave90[.]shop
- joannliquidations-us[.]com
- joann-clearing[.]com
- Big Lots:
- biglotsgifts[.]com
- EGO Power+ Tools:
- egopowerplus[.]store
- GE Appliances:
- geappliances[.]life
Footwear Brands
- Birkenstock:
- birkenoutlet-us[.]com
- birkenstockfootwearsale[.]shop
- birkenstockus[.]online
- birkenstock-dealer[.]com
- Crocs:
- crocs-outlets[.]com
- Skechers:
- us-skecherl[.]com
- Hike Footwear:
- hike-footwear-us[.]com
- hike-footwear-sale[.]com
- Vionic Shoes:
- vionic-online[.]com
- vionic-shoes[.]shop
- vionic-shoes[.]com
- Kizik Shoes:
- kizik-us[.]shop
- kizik-sale[.]com
- Vessi Shoes:
- vessi-sale[.]com
- Vivobarefoot:
- vivobarefoot-outlet[.]shop
Activewear & Athletic Apparel
- Brooks Running:
- brooksonlinesale[.]shop
- brooksrunning-us[.]shop
- brooksrunninguss[.]shop
- brooks-outlet[.]shop
- Alo Yoga:
- aloyogaoutlet[.]top
- On Running:
- onrunningsale-us[.]com
- storeonrunning[.]com
- on-running-outlets[.]com
- Vuori Clothing:
- vuoriclothing-us[.]shop
- vuoriclothing-world[.]shop
- vuoristore[.]shop
- Icebreaker Clothing:
- icebreaker-sale[.]com
- icebreaker-store[.]com
- NOBULL Sportswear:
- nobull-warehouse[.]shop
- Huk Clothing:
- hukgears[.]shop
- Natural Life Clothing:
- naturallife-outlet[.]shop
- naturallife-warehouse[.]shop
Fashion & Luxury Brands
- Rolex:
- 1908-rolexonline[.]com
- Tommy Bahama:
- tommybahama-megasale[.]shop
- tommybahama-bigsale[.]shop
- L.L. Bean:
- llbeanus[.]online
- llbean-megasales[.]shop
- Tom Ford Beauty:
- tomfordbeautys[.]shop
- Rebecca Minkoff:
- rebeccaminkoff-ny[.]com
- Goyard:
- goyardes[.]com
- goyardbagoutlet[.]vip
- Massimo Dutti:
- massimodutioutlets[.]com
- massimoduttioutlets[.]sbs
- Alpha Industries Outerwear:
- alphaindustries-us[.]shop
- Volcom Clothing:
- world-volcomsales[.]shop
- Popflex:
- popflexactiveclub[.]com
Outdoor & Sporting Goods
- Duluth Trading:
- duluthtradingclearance[.]com
- duluthtrading-bigsales[.]com
- Orvis:
- orvis-us[.]store
- Rock Bottom Golf:
- rockbottomgolfshops[.]com
- Palmetto State Armory (Gun store):
- palmettostateassrmoryus[.]shop
- palmetostaeassrmoryte[.]shop
- palmettoblitz[.]shop
- palmettobestdeal[.]com
- Mammut Outdoor Gear:
- mammut-discount[.]shop
- Rebel Sport (Australian retailer):
- rebelsportauonline[.]com
Food & Grocery
- Instacart:
- instaacart[.]shop
- Total Wine:
- totalwinus[.]cc
- totalwine-usa[.]com
- totalwineus[.]cc
- Omaha Steaks:
- omahasteakso[.]com
- omahasteakssales[.]com
- omahasteaksvip[.]com
- omahasteaks[.]online
- omahasteaks[.]discount
- omabbhasteaaks[.]shop
- Thrive Market:
- thrivemarketsale[.]shop
- Luke’s Lobster:
- lukeslobstershop[.]com
- lukeslobstermsc[.]com
- Cousin’s Maine Lobster:
- cousinsmainelobstershop[.]com
Farm & Garden
(It appears these farms were chosen due to their presence on Facebook)
- Fast Growing Trees (Online tree store):
- fastgrowtree[.]store
- fastgrowtree[.]com
- fastgrowingtree[.]store
- Gurney’s Seed and Nursery:
- gurneys[.]store
- White Oak Pastures:
- whiteoakpasturesbfp[.]com
- Seven Sons Farm:
- sevensonsfarm[.]shop
- sevensonsfarms[.]shop
- sevensonsbeef[.]shop
- 44 Farms:
- 44farms[.]shop
- Tyner Pond Farm:
- tynerpondfarm[.]shop
- Pipers Farms:
- pipersfarms[.]shop
Home & Hobbies
- Bath & Body Works:
- bathandbodyworks-us[.]sbs
- Yankee Candle:
- yankeecandles[.]shop
- Ravensburger Puzzles:
- ravensburger-online[.]sbs
- Buffalo Games & Puzzles:
- buffalogames-online[.]shop
- Arcade1Up Gaming:
- arcade1upshopbuy[.]shop
- Cobble Hill Puzzles:
- cobblehill[.]sbs
- cobblehillpuzzles[.]sbs
- The Woobles Crochet:
- thewoobles-sale[.]com
- thewoobles-us[.]com
Continuing to Track GhostVendors’ Marketplace Scam Websites
Silent Push Threat Analysts consider web shop and fake marketplace scams a prolific global threat to social networks, advertising networks, major brands, and the consumers who are unfortunate enough to encounter them.
It’s clear that many different threat actors launch these marketplace scams, and yet, fortunately, many reuse page and server templates to facilitate the speed of their deployments.
Our team will continue to investigate these scams and appreciates any leads that may help us identify new campaigns.
