Fake Shopping Websites: One Operator, 166 Brands, 10,000 Domains
Ask an AI assistant where to buy Dr. Martens before Black Friday, and it might send you to a fake. Researchers have mapped more than 10,000 fake shopping websites, and some are already showing up in AI answers.
Who should care: online shoppers, retail brands, and companies whose staff shop on work laptops.
What could go wrong: you pay for sneakers that never ship, and your card lands with a criminal operation.
Do this: type the store’s address yourself. Never click a shop link a chatbot hands you.
Worth remembering: an AI recommendation is not proof a store is real.
What Happened With the Fake Shopping Websites?
On November 4, the threat intelligence team mapped a network of more than 10,000 counterfeit store domains impersonating 166 fashion and luxury brands across 26 countries. As of November 3, 1,549 stores were live. Researchers tie them all to one Chinese-speaking operator.
None of the shops run paid ads. When researchers asked AI assistants for shopping help in local languages, one assistant recommended two fake stores as trustworthy, listing one next to major European retailers. Two others cited shops from the same network.
How the Fake Shopping Websites Trap Works
One template, thousands of doors. Every store copies the same WordPress shop, dressed in local language, currency, and address.
Built to rank. Each shop runs an SEO plugin, a sitemap with a median of 1,312 URLs, and product data Google Shopping can read.
Lookalike names. Classic typosquatting: an extra letter, a stray hyphen, an odd ending like .com.se. Some are expired domains bought back for their search history.
Fake checkout. PayPal and Klarna logos everywhere. Neither works. Your card goes straight to the operator.
What’s the Impact?
Fake shopping websites cost shoppers twice: they lose money on goods that never arrive, and the operator gets their card details. Brands lose sales and trust. AI shopping answers have a new weak spot: a fake store that ranks well can earn a chatbot’s endorsement for free.
Adidas is the most copied brand, with 52 lookalike domains. France and Germany are the most targeted markets, and 91 domains target US shoppers.
How to Avoid Fake Shopping Websites
- Type the brand’s address yourself or use its official app, not links from search, social media or chatbots.
- Check the domain letter by letter. Extra letters, added hyphens, and odd endings are red flags.
- Ignore payment logos. If checkout only takes a raw card number, leave.
- Treat “Outlet,” “Sale,” and “Black Friday” banners on an unfamiliar site as a warning, not a deal.
- Entered your card on a sketchy site? Call your bank today and dispute the charges.
Indicators of Compromise
- Fake store domains: vero-moda[.]es, drmartensie[.]com, adidassamba[.]it, pradas[.]pl, loewe[.]com[.]se, diesel-uk[.]com
- Image staging hosts: osj[.]cc, 1ur[.]cc
- Site artifacts: admin user “adminxx”, support inbox “suppotr@”, payment plugins yunzipay, yipay and moyi_stripe
- Hosting: five servers at SpectraIP B.V. (Netherlands) running aaPanel
- No IP addresses have been published.
Your Staff Shop on Work Laptops, Too
Black Friday deals don’t stay on personal phones. When an employee pays one of these fake shopping websites from a work device, that card and inbox can fuel the next attack, including targeted phishing aimed at your company.
- SOC Teammate checks DNS and proxy logs against fresh indicators and triages every hit.
- Red Teammate attacks your defenses like this operator would and shows what got through.
- Blocking a domain waits for human approval. Your team sets the rules. AI teammates do the work.
- Asset discovery finds the unmanaged laptops where holiday shopping happens.
Attack. Harden. Prove. Repeat.
The Bottom Line
A chatbot’s confident answer is only as good as the web it reads. This season, that web holds 10,000 new liars. Type the address yourself.
