Fake / Counterfeit Canada Goose Website Tracking

Below please find notes detailing a counterfeit ring peddling fake Canada Goose gear via e-mail.  These scammers use a RetailMeNot.com template and use services from Linode, Alibaba, and Global Frag Networks to facilitate their criminal enterprise.

This same crew runs counterfeit rings for other gear as well.  Learn more about their other scams here:
https://pastebin.com/Bn09agfE - Fake Birkenstock
https://pastebin.com/JvFEGPN5 - Fake Christian Louboutin
https://pastebin.com/BEp6raet - Fake Louis Vuitton
https://pastebin.com/nv09GKaK - Fake Michael Kors
https://pastebin.com/8zqnUJiV - Fake Moncler
https://pastebin.com/5mwVjYVw - Fake Nike
https://pastebin.com/zJuMcPGv - Fake Ray-Ban

Subjects used in their typical e-mails peddling fake Canada Goose include:
- Cyber Week Huge Discount!!! - Goose Coats 70% OFF.!

20201215
SPAM Domain: hwsjw.cn
SPAM Registrar: China Internet Network Information Center (CNNIC)
SPAM IP: 23.228.120.6
SPAM ISP: LayerHost
Counterfeit website: http://suxrmoyya.wang/edme/tl.php?p=TEXT_STRING_HERE
Counterfeit website IP: 47.88.85.92
Counterfeit website ISP: AliCloud

20191203
SPAM Domain: lisyai.top
SPAM Registrar: Chengdu west dimension digital technology Co., LTD
SPAM IP: 104.223.155.164
SPAM ISP: Global Frag Networks
Counterfeit website: http://yuorey.top/mtaf/tl.php?p=TEXT_STRING_HERE
Counterfeit website IP: 47.90.205.22
Counterfeit website ISP: AliCloud