{
  "id": 19801221,
  "title": "over 10,000 counterfeit storefronts",
  "url": "https://urgent.news/2026/11/13/over-10-000-counterfeit-storefronts",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-13T12:04:47.000Z",
  "source": {
    "name": "Rest of World",
    "slug": "restofworld",
    "url": "https://elink32b.restofworld.org/ss/c/u001.SYvGPUo2iI5-xxE2tUBKU534v1qLPSoepA7rii38pMUVHPaV_neIKOPyCAW2srK45q9I8RdFzvCNUgt33VW45saJKT-DCg2coObN2JvnWf5-A4pfyycqohBfUMf0DxGAu0r865jHBlPVBwTf5OPCWk4OwCjGb7RQj-Nzxut-DRpw1tCOqfoftRQtGP2A8J5n_roEI3SzHUoeoUBlKpTvym5Xo06upWIfKtmIDmp_xM3_2SuLHU8oZeMKn3Khky3yCa0aIZRmfiGeOwCdgQpn-VgDd1gZKn1lnRXXVMGAgX2of4-LWsc9ldLsHbkewNvRsbe-ArrQ3DqHhkvHKdW1MIlS18ifHlBGyktrMdWK4_hQ_2kz6Lg7LAVIQfzSgVmSmj5YgSt9d1H3P_HNHtR015WJjYZ9XlyOfNb-FIPeRAA/4vp/IJKTNtThRrGZOOoB5wpwcA/h11/h001.M-bTWVBlAQUsyKnlBNYaVlLBto2lLfV8qfblNIOjx0c"
  },
  "original_language": "en",
  "account": "Black Friday shoppers commonly search the internet for the best deals on electronics and holiday gifts. However, the advent of a new investigation by NordVPN has revealed a vast network of over 10,000 counterfeit shopping websites, impersonating 166 fashion and luxury brands across 26 countries. The discovery is particularly alarming as some of these fraudulent stores have already surfaced in search results and AI-driven shopping recommendations, alongside legitimate retailers.\n\nAccording to NordVPN’s Threat Intelligence team, the operation employs over 10,000 domains with an identical website template, aiming to capitalize on the holiday shopping frenzy. As of November 3, the group identified 1,549 active stores, each posing as an authentic brand outlet within its target market. For consumers who rely on Google, ChatGPT, Perplexity, or similar AI tools for price comparisons, the findings serve as a stark warning: merely appearing in search results or AI-generated shopping recommendations does not guarantee legitimacy.\n\nThe counterfeit websites closely mimic official brand websites, featuring localized languages, currencies, addresses, product listings, and familiar payment logos. Prices are carefully calibrated to appear believable, such as Adidas stores selling sneakers for €38 to €89 and Vero Moda stores listing clothing for €12 to €22. Instead of employing exaggerated discounts to draw attention, these sites rely heavily on familiar shopping language like \"Outlet,\" \"Sale,\" and \"Black Friday,\" which can make them appear as genuine places to find exceptional deals, especially when shoppers compare prices across multiple websites.\n\nThe investigation highlights how these fraudulent stores reach shoppers. Rather than relying on traditional paid advertisements, the operation focuses on achieving organic search results. NordVPN discovered that the websites utilize search engine optimization tools, publish Google Shopping-compliant product information, and maintain extensive sitemaps. Moreover, 597 domains have verified Google Search Console access through DNS records. This heightened visibility becomes problematic as more individuals turn to AI assistants for shopping recommendations, as AI tools that utilize web search to gather information can surface these deceptive websites alongside traditional search results.\n\nTo test the validity of these stores, NordVPN conducted shopping queries in the target countries' local languages, and found that Perplexity recommended two counterfeit stores, such as vero-moda.es and drmartensie.com, alongside legitimate retailers like Zalando and La Redoute. Similarly, ChatGPT and Gemini cited other fraudulent stores, like adidassamba.it, which appeared in the You.com search index used by multiple AI applications. While not every AI shopping recommendation poses a threat, the findings underscore the importance of not treating an AI-generated recommendation as proof of a retailer's legitimacy.\n\nNordVPN's investigation also suggests that the operation is controlled by a single operator fluent in Chinese. The researchers identified identical technical fingerprints across thousands of domains, including the same WordPress and WooCommerce installations, a shared website theme, identical payment plugins, and a consistent administrator account name. A peculiar detail was the recurring spelling mistake in support email addresses, such as \"suppotr\" instead of \"support.\" Additionally, image files were still loading from two shared staging domains, indicating a connection between otherwise distinct stores.\n\nPerhaps the most concerning aspect of the investigation is the resilience of the network. When a fraudulent store is taken down, NordVPN identified that 109 domains redirect visitors to 14 active collector shops. The operator also re-registers expired domains with existing search-engine history and backlinks to boost the visibility of fraudulent stores. In total, the researchers confirmed 100 cases of redirection and identified 531 probable instances, demonstrating that taking down one fake store does not guarantee the end of the deception.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}