Black Friday shoppers are used to hunting across the internet for the best prices on TVs, streaming devices, laptops, headphones, and other holiday gifts. But this year, finding a good deal could come with a much bigger risk than overpaying for a product.
A new investigation from NordVPN has uncovered a massive network of more than 10,000 counterfeit shopping domains impersonating 166 fashion and luxury brands across 26 countries. Even more concerning, some of these fake stores have already appeared in search results and AI shopping recommendations alongside legitimate retailers.
The operation appears designed to take advantage of the holiday shopping rush. As of November 3, NordVPN identified 1,549 active stores within the network, with each website presenting itself as an official brand outlet in its target market.
For shoppers who rely on Google, ChatGPT, Perplexity, or other AI tools to find discounts, the findings offer a warning: A website appearing in a search result or an AI-generated shopping recommendation isn’t necessarily legitimate.
A Massive Network of Fake Stores Is Preparing for Black Friday
According to NordVPN’s Threat Intelligence team, the operation uses more than 10,000 domains built around an identical website template. The stores impersonate 166 different brands, including some familiar names that shoppers may be searching for during the holiday season.
The most frequently impersonated brands include:
- Adidas: 52 domains
- Ralph Lauren: 30 domains
- Dr. Martens: 29 domains
- Crocs: 28 domains
- Massimo Dutti: 28 domains
- Birkenstock: 25 domains
- Stradivarius: 25 domains
These aren’t necessarily poorly designed websites that immediately look suspicious. NordVPN says the fake stores are built to resemble official brand websites, complete with localized languages, currencies, addresses, product listings, and familiar payment logos.
The prices are also designed to look believable. For example, fake Adidas stores advertised sneakers for €38 to €89, while counterfeit Vero Moda stores listed clothing for €12 to €22.
Instead of relying on an outrageous percentage discount to attract attention, the websites lean heavily on familiar shopping language such as “Outlet,” “Sale,” and “Black Friday.”
That can make the stores look like legitimate places to find an unusually good deal, particularly when shoppers are comparing prices across several websites.
“Every one of these stores is designed to look exactly like the official brand website for your country,” says Marijus Briedis, chief technology officer at NordVPN.
“They show the right language, the right currency, a prestigious local address, and familiar payment logos. The logos are fake but by the time a shopper realises that, they have already handed over their card details.”
Even AI Shopping Assistants Have Recommended Fake Stores
Perhaps the most troubling part of the investigation is how these websites are reaching shoppers.
The network isn’t primarily relying on traditional paid advertisements. Instead, its operators have put considerable effort into making the fake stores appear in organic search results.
NordVPN found that the websites use search engine optimization tools, publish product information compatible with Google Shopping listings, and maintain extensive sitemaps. The company also identified 597 domains with verified Google Search Console access through DNS records.
That visibility creates another problem as more people turn to AI assistants for shopping recommendations.
AI tools that use web search to gather information can surface the same websites that appear in traditional search results. If a fraudulent store ranks well enough, it could end up being recommended to someone who is looking for a discount.
NordVPN tested shopping queries in the target countries’ local languages and found that Perplexity recommended two counterfeit stores as trustworthy shopping destinations.
One example was vero-moda.es, which appeared among five recommended retailers alongside legitimate stores Zalando and La Redoute.
Another was drmartensie.com, which Perplexity presented as the official Dr. Martens outlet for Ireland.
NordVPN also found that ChatGPT and Gemini cited other websites belonging to the network. Meanwhile, Adidas Samba listings from adidassamba.it appeared in the You.com search index used by multiple AI applications.
The findings don’t mean every AI shopping recommendation is dangerous. However, they show why shoppers shouldn’t treat an AI-generated recommendation as proof that a retailer is legitimate.
A convincing website, a high search ranking, or a recommendation from a familiar AI assistant doesn’t replace checking the actual retailer. This isn’t the first time fraudulent websites have targeted people looking for help with their streaming technology. Cord Cutters News previously reported on scammers creating fake Roku tech support websites designed to trick customers searching for assistance with their devices.
One Operator Appears to Be Behind Thousands of Websites
NordVPN’s investigation also uncovered evidence suggesting that the operation is controlled by a single Chinese-speaking operator.
The researchers identified identical technical fingerprints across thousands of domains, including the same WordPress and WooCommerce installation, a shared website theme, identical payment plugins, and the same administrator account name.
One particularly unusual detail was a recurring spelling mistake in the websites’ support email addresses: “suppotr” instead of “support.” Additionally, the investigators found that image files were still loading from two shared staging domains, providing another connection between otherwise separate-looking stores.
Perhaps most concerning, the network appears designed to survive individual website takedowns. When a store is blocked or removed, NordVPN found that 109 domains redirect visitors to 14 active collector shops. The operator also appears to have re-registered expired domains with existing search-engine history and backlinks to help fraudulent stores gain visibility. The researchers confirmed 100 such cases and identified another 531 probable instances.
In other words, taking down one fake store doesn’t necessarily stop shoppers from being directed to another.
What This Means for Holiday Shoppers and Tech Buyers
Although the investigation focuses on fashion and luxury brands, the findings should matter to anyone shopping online this holiday season.
People searching for discounted streaming devices, smart TVs, computers, headphones, gaming accessories, and other electronics face similar risks when they encounter unfamiliar retailers or websites impersonating well-known brands.
Last year, we covered the findings from another NordVPN investigation on the rise of fake delivery websites. The study found an 86% increase in malicious postal service websites ahead of the holiday shopping season. Those websites impersonated delivery companies and attempted to collect personal information and payment details from people tracking packages.
Streaming customers have also been targeted by fraudulent promotions, with scammers impersonating Paramount+ and Hulu with fake streaming service deals. The latest findings show how the same broader problem can reach shoppers before they even make a purchase.
This also comes as shoppers increasingly use AI tools to compare products, research unfamiliar retailers, and find discounts. Although it is convenient and can save time, it also creates another path for fraudulent websites to reach potential victims.
How to Avoid Fake Shopping Websites This Holiday Season
NordVPN recommends taking a few precautions before entering payment information on an unfamiliar website.
Here are the biggest things shoppers should keep in mind:
- Visit the official retailer directly: Rather than clicking a shopping link from Google, social media, or an AI assistant, type the brand’s official website address into your browser or use its official app.
- Check the website address carefully: Scammers often make subtle changes to legitimate brand names. NordVPN identified examples involving an extra letter, an inserted hyphen, or an unusual country-code extension.
- Don’t trust payment logos: A website displaying Visa, Mastercard, PayPal, or Klarna logos doesn’t necessarily accept those payment methods. NordVPN found that the counterfeit stores used fake payment logos while relying on other credit card collection systems.
- Be skeptical of aggressive Black Friday promotions: The words “Outlet,” “Sale,” and “Black Friday” can be used to make a fraudulent website look like an official discount store. Don’t let a limited-time offer rush you into entering payment details.
- Use additional security protections: Security software and browser protections can help identify known malicious websites, but they shouldn’t replace checking a retailer’s identity.
If you’ve already entered your credit card information on a suspicious website, NordVPN recommends contacting your bank immediately to block the card and dispute any unauthorized charges.
Black Friday is a good time to save money on the technology and entertainment products you want. Just make sure the store offering the discount is actually the store it claims to be.
