Fake stores mimic 166 brands for Black Friday — and some appear in AI shopping recommendations

A sprawling network of fake Black Friday stores is impersonating 166 brands, with some even appearing in shopping recommendations from artificial intelligence tools.

Here's what to know

As of Nov. 3, the network included 1,549 active stores presenting themselves as official brand outlets. NordVPN investigators identified upward of 10,000 bogus retail domains spanning 26 countries, according to Cord Cutters News.

Familiar payment logos and location-specific details — addresses, currencies, and languages — helped the sites appear authentic. Adidas was the most frequently impersonated brand, with 52 domains, followed by Ralph Lauren with 30 and Dr. Martens with 29.

In tests using local-language shopping queries, NordVPN found that Perplexity recommended two counterfeit stores as trustworthy destinations. One, vero-moda.es, appeared alongside legitimate retailers Zalando and La Redoute; another, drmartensie.com, was presented as Ireland's official Dr. Martens outlet.

The investigators also found that ChatGPT and Gemini cited sites linked to the operation, extending the fraudulent stores' reach beyond conventional search results.

More background

NordVPN identified 597 domains whose DNS records confirmed access to Google Search Console, according to Cord Cutters News. The sites also supplied Google Shopping-compatible product data and kept extensive sitemaps.

NordVPN investigators found shared technical features suggesting a single Chinese-speaking operator was behind the network, including matching WordPress and WooCommerce installations, payment plugins, and a shared administrator account name. A recurring typo in support email addresses — "suppotr" — provided another connection.

NordVPN investigators found that 109 domains sent visitors onward to 14 collector shops that remained active. Researchers also confirmed 100 cases in which expired domains were re-registered to take advantage of their existing search history and backlinks.

What can be done?

NordVPN recommends visiting a brand's website directly or using its app rather than following shopping links from search engines, social media, or AI assistants. Check website addresses for extra letters, inserted hyphens, or unexpected country-code extensions.

Familiar payment logos don't guarantee safety, either. NordVPN investigators found counterfeit stores displayed Visa, Mastercard, PayPal, or Klarna logos but used other systems to collect credit card information.

NordVPN also advises resisting pressure from "outlet," "sale," and "Black Friday" promotions. 

Security software and browser protections can help identify sites already known to be malicious. Anyone who entered card details on a suspicious store should immediately ask their bank to block the card and challenge charges they did not authorize, NordVPN recommends.

"Every one of these stores is designed to look exactly like the official brand website for your country," NordVPN chief technology officer Marijus Briedis said, per Cord Cutters News. "They show the right language, the right currency, a prestigious local address, and familiar payment logos. The logos are fake, but by the time a shopper realises that, they have already handed over their card details."

Where can I learn more?

Scammers also use familiar brand names and bargain offers to lure shoppers through search results and social media ads. 

• In the U.K., fake H&M ads are steering shoppers toward unrelated websites.

• A shopper clicked a 70%-off Calpak search result before discovering $2,000 in fraudulent charges.

• In Singapore, 246 shoppers lost $1.4 million to phishing scams after clicking cheap social media ads.

Get TCD's free newsletters for easy tips, smart advice, and a chance to earn $5,000 toward home upgrades. To see more stories like this one, change your Google preferences here.