abralipedema.com

AI-Generated Fake Marketplaces Are Poisoning Search Results and Stealing Card Data A secondhand marketplace, plausible-looking, priced too good to be true. VirusTotal showed zero detections. Everything green. The domain had been registered a few months earlier. That was enough to go digging. **The setup** The marketplaces sell everything, calculators, clothing, electronics. Product images and descriptions are scraped directly from legitimate eBay and Amazon listings. The sites have “that AI vibecoded feeling”: competent enough to pass a quick glance, sloppy enough to notice if you look twice. Most have been registered within weeks of discovery. Traffic comes from SEO poisoning. Compromised WordPress sites, taken over via malicious plugins or stolen credentials, have thousands of fake product listing pages injected into their sitemaps. These rank in Google search results and silently redirect visitors to the fake marketplace. The same product listing appears across a dozen different compromised legitimate domains, all pointing at the same checkout infrastructure. **The checkout** The payment flow is a Shopify clone. Enter your card, get redirected to a second page requesting the same information again, then a PayPal-lookalike loading screen, the URL changes, then a thank-you page, despite the card being declined. The failure is visible in the URL: `failure_code=failed`. The confirmation renders anyway. What follows: multiple charge attempts over subsequent days at amounts different from the original purchase. The item never ships. The goal is card data and personal information, not fulfilled orders. **Why it works** VirusTotal shows clean. The domain is new but not flagged. The product images are real because they were stolen from real listings. The checkout looks like Shopify because it was built to. The Google ranking comes from a legitimate compromised site. There is nothing in the user’s standard toolkit that catches this before money leaves the account.