# Wuffy AI Toy Dog Scam Network: 250+ Fake Storefronts Laundering Proceeds Through Shell Companies (Huntress Declassified: Money Train, Episode Four)

> Huntress and Mastercard describe a cybercrime-enabled retail fraud network operating 250+ near-identical storefronts that sell a cheap battery-operated plush toy as an 'AI' robot dog (Wuffy) at $30, marked down from $100. Mastercard attributed roughly $50 million in transactions to merchant IDs tied to the operation; the merchant of record was a Lithuania-based company while the sites showed a US address.

- **Published:** 2026-11-03T19:24:32Z
- **Last reviewed:** 2026-11-03T19:24:32Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5171
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5171.png
- **ID:** TL-2026-5171
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 13 (3 shown free below)

## Description

The Wuffy scam is a bulk fake-storefront operation. Per Huntress (Declassified: Money Train, Episode Four, published 2026-11-03), more than 250 near-identical websites sold an 'AI' toy dog at a $30 price presented as a 70% discount from a fictitious $100 regular price. The product that arrives is a battery-operated stuffed/mechanical toy with no AI functionality. The sites displayed a consistent 4.7-star rating and offered responsive customer support to appear legitimate.

Mastercard cyber investigators, tipped off about the scam site, ordered a unit from Get Wuffy (getwuffy.com) and found the payment record named a company headquartered in Lithuania while the website listed a US address. Mastercard's analysis of its own network found about $50 million in transactions associated with merchant IDs identified in the investigation, and noted the true scale was likely larger. Public reporting (BBB Scam Tracker, via search results) associates the merchant entity UAB Rara Digital, Gedimino pr. 20, Vilnius, Lithuania, with the Get Wuffy storefront. Victim reports describe carts that auto-add multiple units (billed for three or four dogs), countdown timers that reset on refresh, pre-selected bundles/upsells, AI-generated or stock-photo reviewer profiles, and returns requiring shipment to China at the buyer's expense. MalwareTips (2026-04-07) lists sister brands built from the same template: Dachy 2.0, Koaly Bear, FluffyBot Puppy; other reports mention Waggy and Digital Doggo.

The low unit price is a deliberate fraud-economics choice: small charges discourage chargebacks and fraud investigations, and when disputes occur the issuing bank absorbs the loss (Mastercard's Ann Johnson: 'When a store turns out to be a scam, the bank covers the loss. Scammers rarely have to pay any of it back, and they know it.'). Proceeds are routed through shell companies. Huntress describes the network as Lithuania-based with connections to Russian nationals and organized crime networks, and frames it alongside the UK NCA's Operation Destabilise, which traced ransomware proceeds through Garantex, crypto-for-cash swaps with UK drug gangs, and Russian-state-linked laundering, and which resulted in six convictions according to the Huntress write-up. The Huntress article draws the thematic link to money-laundering infrastructure; it does not publish a technical IOC set for the Wuffy sites, and attribution to specific individuals is not made in the sources.

Defender relevance: this is a payments-fraud and brand-abuse threat rather than an exploit chain. Useful controls are merchant-of-record vs. site-address mismatch checks, monitoring for look-alike storefront clusters and malvertising (YouTube/social ads for the product), and consumer/employee awareness. Source detail was gathered from a summarized extraction of the Huntress post, so specifics should be re-verified against the original.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.008 Malvertising
- T1684.001 Impersonation
- T1036 Masquerading
- T1583.006 Web Services
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Wuffy Fake Storefront Access via Web Proxy — Checkout Reach** (`TL-2026-5171-SPL-001`)

Flags web proxy requests to known Wuffy fake AI robot-dog storefront domains (getwuffy.com, wuffy.nl, wuffy.uk, gowuffy.checkoutera.com) and escalates when cart/checkout/payment URLs are hit, indicating a card-entry attempt on a scam storefront (TL-2026-5171). Behaviour-first: grouped per source and user so a checkout stage is separated from a passive visit.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1583.001, T1656, T1036
- **Data sources:** proxy:zscalernss-web, proxy:bluecoat:proxysg:access:syslog
- **Severity:** medium
- **Confidence:** high

### Splunk SPL

```spl
index=proxy (sourcetype="zscalernss-web" OR sourcetype="bluecoat:proxysg:access:syslog") earliest=-24h
(dest IN ("getwuffy.com","wuffy.nl","wuffy.uk","gowuffy.checkoutera.com","www.getwuffy.com","www.wuffy.nl","www.wuffy.uk") OR url="*getwuffy.com*" OR url="*gowuffy.checkoutera.com*" OR url="*wuffy.nl*" OR url="*wuffy.uk*")
| eval checkout_hit=if(match(url,"(?i)checkout|cart|payment"),1,0)
| stats count AS requests, sum(checkout_hit) AS checkout_requests, min(_time) AS firstTime, max(_time) AS lastTime, values(dest) AS storefront_hosts, values(http_referrer) AS referrers BY src, user
| eval stage=if(checkout_requests>0,"checkout_reached_possible_card_entry","storefront_visit")
| eval firstTime=strftime(firstTime,"%Y-%m-%d %H:%M:%S"), lastTime=strftime(lastTime,"%Y-%m-%d %H:%M:%S")
| eval threat_id="TL-2026-5171"
| table threat_id src user stage requests checkout_requests storefront_hosts referrers firstTime lastTime
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL)
| where DestinationHostName in~ ("getwuffy.com", "wuffy.nl", "wuffy.uk", "gowuffy.checkoutera.com") or RequestURL has_any ("getwuffy.com", "wuffy.nl", "wuffy.uk", "gowuffy.checkoutera.com")
| extend CheckoutHit = iff(RequestURL matches regex @"(?i)checkout|cart|payment", 1, 0)
| summarize Requests = count(), CheckoutRequests = sum(CheckoutHit), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), StorefrontHosts = make_set(DestinationHostName, 10) by SourceIP, SourceUserName
| extend Stage = iff(CheckoutRequests > 0, "checkout_reached_possible_card_entry", "storefront_visit")
| project SourceIP, SourceUserName, Stage, Requests, CheckoutRequests, StorefrontHosts, FirstSeen, LastSeen
```

### Sigma

```yaml
title: Web Proxy Access to Wuffy Fake AI-Toy Storefronts
id: 5b1c0a7e-3f2d-4a8e-9c11-7d4e2a6b1001
status: experimental
description: Detects web proxy traffic to domains of the Wuffy fake AI robot-dog storefront network reported by Huntress and Mastercard (getwuffy.com, wuffy.nl, wuffy.uk, gowuffy.checkoutera.com).
references:
    - https://www.huntress.com/blog/declassified-money-train-episode-four
    - https://www.mastercard.com/europe/en/news-and-trends/stories/2026/scam-merchant-wuffy.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
    - attack.resource-development
    - attack.t1583.001
    - attack.defense-evasion
    - attack.t1656
logsource:
    category: proxy
detection:
    selection:
        cs-host|endswith:
            - 'getwuffy.com'
            - 'wuffy.nl'
            - 'wuffy.uk'
            - 'gowuffy.checkoutera.com'
    condition: selection
fields:
    - c-ip
    - cs-username
    - cs-host
    - c-uri
    - cs-referrer
falsepositives:
    - Consumers or analysts researching the scam (security teams, fraud investigators)
    - Threat-intel sandbox or URL-scanner traffic
level: medium

```

**Known false positives:**

- Fraud analysts or security staff investigating the Wuffy scam
- URL-scanner or sandbox traffic that fetches the storefronts

**Tuning notes:** Fields (dest, url, http_referrer, src, user) assume CIM-normalised Zscaler/Blue Coat web logs; adjust index/sourcetype to your proxy. Exclude analyst subnets and alert only where stage=checkout_reached_possible_card_entry to cut noise. Re-verify domains against the original Huntress post, since the source extraction was summarised.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Endpoint Browser Connection to Wuffy Fake Storefront Domains (locked: unlock with TL Creds)
- Auto-Added Multi-Unit Low-Ticket Orders at Suspect Merchant (locked: unlock with TL Creds)
- Community-Reported Malvertising Sibling Infrastructure — DNS Lookup and Installer Download (locked: unlock with TL Creds)
- DNS Resolution of Wuffy Storefront and Checkoutera Checkout Domains (locked: unlock with TL Creds)
- Transactions With UAB Rara Digital Merchant Entity (locked: unlock with TL Creds)
- Wuffy Template-Clone and Sister-Brand Storefront Domain Lexical Hunt (locked: unlock with TL Creds)
- Spoofed Merchant Identity — Merchant-of-Record vs Storefront Address Mismatch Cluster (locked: unlock with TL Creds)
- Malvertising Referral Chain to Wuffy Storefronts (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 13)

Defanged, TLP:CLEAR.

- Domain: `getwuffy[.]com`
- Domain: `wuffy[.]nl`
- Domain: `gowuffy[.]checkoutera[.]com`

Full set of 13 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Wuffy, Go Fetch the Money Trail…Even if it Leads to the Kremlin (Huntress, Declassified: Money Train Episode Four)](https://www.huntress.com/blog/declassified-money-train-episode-four)
- [Mastercard: scam merchant Wuffy](https://www.mastercard.com/europe/en/news-and-trends/stories/2026/scam-merchant-wuffy.html)
- [MalwareTips: Wuffy Robot Dog EXPOSED – Scam or Legit? Full Investigation](https://malwaretips.com/blogs/wuffy-robot-dog-exposed-scam-or-legit-full-investigation/)
- [MalwareTips: Wuffy Robot Puppy Review – Fake AI Dog from GetWuffy.com](https://malwaretips.com/blogs/?p=364473)
- [BBB Scam Tracker report: Get Wuffy / UAB Rara Digital](https://www.bbb.org/scamtracker/lookupscam/1132810)
- [Trustpilot: wuffy.nl reviews](https://ca.trustpilot.com/review/wuffy.nl)
- [Trustpilot: gowuffy.checkoutera.com reviews](https://ca.trustpilot.com/review/gowuffy.checkoutera.com)
- [KTLA: Buyers say Wuffy AI robot puppy falls short of online promises](https://ktla.com/news/local-news/buyers-say-wuffy-ai-robot-puppy-falls-short-of-online-promises/amp/)
- [The Hacker News: NCA busts Russian crypto networks (Operation Destabilise)](https://thehackernews.com/2024/12/nca-busts-russian-crypto-networks.html)
- [NCA: Operation Destabilise exposes billion-dollar money laundering network](https://www.nationalcrimeagency.gov.uk/news/operation-destabilise-nca-exposes-billion-dollar-money-laundering-network-that-purchased-bank-to-fund-russian-war-effort)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5171