By Fake Review Detector
A clone website is a pixel-perfect copy of a real online shop — same logo, same product photos, same prices, same layout — built to steal your payment. The only real difference is the web address. In November 2026 researchers uncovered a single network of more than 10,000 cloned stores impersonating 166 brands, and most shoppers cannot tell the copy from the original. This guide shows you the 9 signs that expose a copycat shop, and the 60-second check to run before you pay.
What Is a Clone Website?
A clone website — also called a copycat shop, lookalike site, or brand-impersonation store — is a fraudulent website that copies a legitimate brand's entire storefront. Scammers scrape the real site's design, product images, prices, and even its "About us" text, then rebuild it on a lookalike domain. The copy can be so close that even the brand's own customers cannot tell them apart at a glance.
This is different from a generic scam store. A generic scam store invents a brand nobody has heard of. A clone website steals the trust of a brand you already know — Nike, Adidas, Dr. Martens, UGG — so your guard is already down when you land on it. You think you are shopping at the official outlet sale. You are actually handing your card details to a stranger.
Clones reach you through the same channels real shops use: Google and social-media ads, sponsored search results, and increasingly through AI shopping assistants. In November 2026, NordVPN's Threat Intelligence team found that Perplexity's AI shopping assistant had recommended two cloned stores — vero-moda.es and drmartensie.com — as trustworthy shops, listing one alongside Zalando and La Redoute and presenting the other as the official Dr. Martens outlet for Ireland. If an AI assistant can be fooled, a busy shopper certainly can.
Clones are also cheap and fast to build now. AI website builders can reproduce a brand's entire storefront in about five minutes, and researchers link that to a 1,210% surge in impersonation scams. A scammer no longer needs design skills — they need a domain name and an afternoon.
How Big Is the Clone-Shop Problem in 2026?
Bigger than most shoppers realise, and it peaks exactly when you shop most: Black Friday and the holiday season.
In November 2026, NordVPN's Threat Intelligence team mapped a coordinated network of more than 10,000 counterfeit online stores, all built from a single cloned WordPress/WooCommerce template and impersonating 166 fashion and luxury brands across 26 countries. As of 3 November 2026, 1,549 of those stores were fully active, each presenting itself as the brand's official outlet in its target market. The most impersonated brands were Adidas with 52 copycat domains, Ralph Lauren with 30, Dr. Martens with 29, and Crocs and Massimo Dutti with 28 each. The evidence pointed to a single operator behind the whole network.
That is one network. The wider picture is just as stark. Savi Security's Scamwise Holiday Shopping Scam Report 2026, released 20 October 2026 and built from more than 250,000 shopping sites submitted by users between March and October 2026, judged over 100,000 of them definitely or likely a scam. Its users reported a new fake online store about every three minutes — roughly 500 a day — and 74% of the scam stores used AI-generated content. The brands scammers copied included Aéropostale, L.L.Bean, UGG, and La Roche-Posay. Clothing was the top category, at 30% of confirmed scam stores.
The financial damage is growing fast. Chargeflow's 2026 analysis of look-alike fraud found more than 30,000 impersonation domains targeting major brands, with reported losses jumping from $18.7 million in 2023 to $70 million in 2024 — a 274% increase in a single year. The Anti-Phishing Working Group logged 3.8 million phishing attacks across 2025.
And the core reason clones work is simple: most of us cannot spot the difference. A NordVPN survey of 2,010 Americans in August 2026 found that 74% could not identify a fake website address with a subtle spelling change, and 82% failed to recognise fraudulent CAPTCHA prompts. The clone does not need to fool an expert. It only needs to fool a shopper in a hurry.
The 9 Signs of a Copycat Shop
A clone is designed to pass a quick glance. It fails a careful one. Run through these nine signs before you enter any payment details — any two together should stop you.
1. The URL is almost right, but not quite. This is the single most reliable tell. Clones use typosquatting: an extra letter (fashionnestt.co instead of fashionnest.co), a missing letter, a swapped character, an added hyphen (vero-moda.es), a trailing "s" (pradas.pl), a different ending (.shop, .store, .deals instead of .com), or a country suffix that looks official (loewe.com.se). Read the address bar character by character. Never trust a link from an ad or a message — type the brand's real address yourself or use a bookmark.
2. The prices are too good for a real brand. A genuine Adidas or Dr. Martens outlet does not sell current-season stock at 80–90% off. Clones use impossible discounts as bait: "closing down sale", "80% off everything, today only". If the price would bankrupt the real brand, it is not the real brand.
3. The site is brand-new. Around 40% of scam stores in the Scamwise 2026 data were under 90 days old when checked, and 7 in 10 were gone again within 90 days. A "brand outlet" whose domain was registered last month is not an outlet. You can check a domain's age free through any WHOIS lookup — a real brand's domain is years old.
4. Payment options are narrow or strange. Real brands accept cards, PayPal, Apple Pay, and similar mainstream methods. Clones often push bank transfer, cryptocurrency, gift cards, or a single obscure payment gateway — methods with no chargeback protection. If the checkout page has no card option, or it asks you to pay outside the site, leave.
5. Contact details are missing, fake, or copied. Check the contact page: a real brand lists a verifiable address, a phone number that answers, and an email on its own domain. Clones use generic Gmail addresses, no phone number, or an address that belongs to someone else. In the NordVPN network, every cloned store shared the same misspelled support address (suppotr@) — a tiny crack in an otherwise perfect copy.
6. The reviews are all perfect — and all recent. A clone's review section is usually stuffed with five-star praise posted within days of each other, often with no verified-purchase badges and no negative reviews at all. Copy a sentence from a review and search it: cloned stores frequently reuse the same fake review text across dozens of domains. If the reviews on the product page look suspiciously perfect, paste the review text into our fake review checker at fakereviewdetector.org/fake-review-checker — it flags the language patterns of paid and AI-written reviews.
7. The product catalogue is a copy with cracks. Clones scrape the real site's catalogue, so the images match — but look closer. Sizes that never go out of stock, every colour available in every size, product descriptions with odd grammar, prices in the wrong currency for the supposed country, or image files that still load from the scammer's staging server. A real shop has sold-out sizes. A clone has infinite stock of everything.
8. The legal pages are identical — or empty. Privacy policy, terms, returns policy: clones copy these from the real brand, so they often still name the real company, or they carry the same timestamp across hundreds of unrelated stores. Read the returns page: a clone promising "30-day free returns" with no return address and no process is making a promise it will never keep.
9. The site found you, not the other way round. Clones are promoted through ads, social posts, and messages — a "flash sale" ad on Facebook or Instagram, a sponsored Google result above the real brand, a WhatsApp message about a secret outlet. If you arrived through an ad rather than by typing the brand's address, treat the site as guilty until proven innocent.
The URL Check: 30 Seconds That Expose Most Clones
The address bar is the one place a clone cannot fully fake. Spend thirty seconds on it and you will catch most copycat shops before they cost you anything.
First, compare the domain with the brand's real one. Open a new tab and search for the brand, then look at the official domain in the search result — do not click the ad at the top, click the organic result or type the address you know. Now put the two side by side. Is there an extra letter? A hyphen? A different ending? The NordVPN network's tricks were deliberately subtle: a trailing "s" on the brand name, an inserted hyphen, or a country-code suffix that made the domain look like a legitimate local version of the real shop.
Second, watch for subdomains that pretend to be the brand. "adidas-outlet.com" is not Adidas. "nike.sales-shop.net" is not Nike. The real brand owns its name at the start of the address, not buried in the middle of a longer domain.
Third, check for the padlock — but do not trust it. A clone can have a valid HTTPS certificate and a padlock icon in minutes, for free. The padlock only means the connection is encrypted; it says nothing about who is on the other end. A padlocked clone is still a clone.
Fourth, search the exact domain name. Type the store's domain into a search engine in quotes. A real brand returns years of history, news, and reviews. A clone returns almost nothing — or returns warnings from other shoppers and scam-reporting sites. If the only results are the store itself, that is a warning.
Finally, use a free checker before you pay. Our clone website checker at fakereviewdetector.org/clone-website-checker screens a store for copycat signals, and our website checker at fakereviewdetector.org/website-checker runs a broader trust check on any suspicious shop. Thirty seconds in a checker is cheaper than a chargeback.
The 60-Second Clone Check Before You Pay
Make this a habit for any shop you have not used before — especially one you reached through an ad or a "sale" link.
Step 1 — URL (15 seconds): read the address bar character by character and compare it with the brand's real domain. Any extra letter, hyphen, or odd ending is a fail.
Step 2 — Domain age (15 seconds): run a free WHOIS lookup on the domain. A brand outlet on a domain registered weeks ago is not a brand outlet.
Step 3 — Payment (10 seconds): does the checkout offer a credit card or PayPal? If it only takes bank transfer, crypto, or gift cards, stop.
Step 4 — Contact (10 seconds): is there a real address, a working phone number, and an email on the brand's own domain? A Gmail address and no phone number is a fail.
Step 5 — Reviews (10 seconds): do the product reviews look real — mixed ratings, dated over months, specific details? If every review is five stars and posted this week, paste the review text into our fake review checker at fakereviewdetector.org/fake-review-checker before you trust a word of it.
If the shop passes all five steps, it is probably genuine. If it fails even one, do not pay — find the same product on the brand's real site or a retailer you already trust. And if you are checking a seller rather than a shop, our verify-a-seller tool at fakereviewdetector.org/verify-a-seller covers the seller's trust signals too.
Clone Shops and Fake Reviews: The Double Trap
A clone shop rarely relies on a copied design alone. It pairs the copy with fake reviews, because a perfect-looking store with zero reviews still feels wrong — and a store full of glowing five-star reviews feels safe.
That is why the review section of a clone is almost always too good. Real products accumulate mixed feedback over months: a 4.6 average, a few one-star complaints about sizing or delivery, reviewers mentioning their city or the exact item they bought. A clone's reviews are usually posted in a burst, all five stars, all vague ("Great quality, fast delivery, highly recommend!"), and often written by accounts with no other activity.
The FTC's Fake Review Rule, in force since October 2024, makes buying, selling, or creating fake reviews illegal in the United States, and the EU's consumer-protection rules ban fake reviews too — but enforcement cannot keep up with stores that appear and vanish within 90 days. The practical defence is yours: never trust the reviews on the store's own page. Check the brand's reviews on Trustpilot or Google, check the product's reviews on a retailer you trust, and run any suspicious review text through a checker. Paste the review text into our fake review checker at fakereviewdetector.org/fake-review-checker — it will flag the patterns that mark paid or AI-generated praise, and it takes seconds.
Already Paid a Clone Shop? Do This Now
If you have already paid a copycat shop, speed matters. Act in this order.
First, contact your bank or card issuer immediately and ask for a chargeback. If you paid by credit card, you have strong protection: in the UK, Section 75 of the Consumer Credit Act 1974 makes the card issuer jointly liable for purchases between £100 and £30,000; in the US, the Fair Credit Billing Act gives you the right to dispute a charge for goods that never arrived or were not as described. Debit-card payments can also be disputed through your bank's chargeback scheme, though the protection is weaker. Tell the bank the site was a clone of a real brand — give them the real brand's name and the fake domain.
Second, preserve the evidence. Screenshot the site, the product page, your order confirmation, the payment receipt, and every email the shop sent you. Clone sites disappear fast — 7 in 10 scam stores in the Scamwise data were gone within 90 days — and once the site is down, your evidence goes with it. Our paid-a-scam-site guide at fakereviewdetector.org/paid-a-scam-site walks through the full recovery steps, and our evidence checklist at fakereviewdetector.org/blog/website-evidence-checklist shows exactly what to save.
Third, report the clone. Report it to the real brand — most big brands have a brand-protection or abuse email and can get the domain taken down. Report it to Google Safe Browsing, to the FTC at reportfraud.ftc.gov in the US, or to Action Fraud in the UK. If the payment went through a platform, report the seller there too.
Fourth, protect your details. If you entered card details on a clone, ask your bank to replace the card — the scammers may try the card again or sell the details. If you reused the password you entered, change it everywhere you used it, and turn on two-factor authentication.
Do not wait to see if the parcel arrives. A clone's business model is taking the money and disappearing; every day you wait is a day closer to the site vanishing and the chargeback window narrowing.
How to Report a Clone Website
Reporting a clone helps the next shopper — and it is how these networks get shut down.
- Report to the real brand first: search "[brand] report fake website" or "[brand] brand protection" for the right contact. Brands act fastest because the clone is stealing their name.
- Report the domain to Google Safe Browsing (safebrowsing.google.com/safebrowsing/report_phish/) so Chrome and other browsers warn future visitors.
- In the US, report to the FTC at reportfraud.ftc.gov and to the FBI's Internet Crime Complaint Center (ic3.gov). In the UK, report to Action Fraud. In the EU, report to your national consumer authority.
- Report the ad if you found the clone through one: Google Ads and Meta both have "report ad" options, and ad platforms are under growing pressure — under the EU Digital Services Act, large platforms must act on reports of illegal content, including scam stores.
- Report the domain registrar and the hosting provider: a WHOIS lookup shows both, and most registrars have an abuse-report form. The NordVPN network's 865 analysed shops were hosted on just five servers — taking down the host hurts the whole network, not one store.
Frequently Asked Questions
How can I tell if a website is a clone of a real shop?
Compare the URL with the brand's real domain character by character — clones add a letter, a hyphen, or a different ending. Then check the domain's age, the payment methods, and the contact details. A real brand's domain is years old, takes cards, and lists a verifiable address. A clone usually fails at least one of those checks, and most fail two or three.
Are clone websites illegal?
Yes. Copying a brand's design, logo, and product images to sell goods is trademark infringement and fraud in the US, UK, and EU. The problem is enforcement: clone sites are often hosted abroad, use privacy-protected domain registrations, and disappear within weeks — which is why spotting them before you pay matters more than reporting them afterwards.
Can a clone website have HTTPS and a padlock icon?
Yes — and most do. A padlock only means the connection between your browser and the site is encrypted. It says nothing about who runs the site. Scammers get free HTTPS certificates in minutes. Never treat the padlock as proof a shop is genuine.
What should I do if I bought from a clone website?
Contact your bank or card issuer immediately and request a chargeback — credit-card holders have the strongest protection, including Section 75 in the UK for purchases of £100–£30,000. Screenshot everything before the site disappears, report the clone to the real brand and to the FTC (US) or Action Fraud (UK), and ask your bank to replace the card if you entered its details.
Why do clone shops appear in Google results and AI shopping answers?
Because clones are built for search: they copy the real site's product data, run SEO tools, and publish sitemaps — the NordVPN network's shops even verified Google Search Console on 63% of their domains. Some buy ads, and AI shopping assistants have recommended cloned stores as trustworthy. That is why the URL check matters more than where you found the link.
Your Next Step
Before your next online order — especially a "sale" you found through an ad — run the 60-second clone check: read the URL character by character, check the domain's age, confirm card payment is offered, verify the contact details, and scan the reviews for the too-perfect pattern. If anything fails, close the tab and buy from the brand's real site instead. And if a shop already looks suspicious, run it through our free clone website checker at fakereviewdetector.org/clone-website-checker and our website checker at fakereviewdetector.org/website-checker before you spend a cent — the check is free, and the clone's only defence is that you never look.
Explore the evidence behind your next question.
Start a website check