When our research confirms that a named brand is being actively impersonated, we publish the corroborated evidence as a public, linkable page: every lookalike domain found, its registration profile, the red flags, and the independent sources that confirm it. Evidence, not accusations — each case below is verified before it appears here.
A fake Corkcicle storefront at corkcicle.us.com is running 70–90%-off social-media “clearance” ads to harvest customers’ credit card details.
Fake StoneX-branded trading platforms on lookalike domains are using pig-butchering outreach to steal crypto deposits — and StoneX itself has published an official fraud warning about them.
yepbit.com — a fake crypto exchange claiming affiliation with Fidelity Capital Investment Group — has been formally warned about by Ghana’s SEC, with documented victim losses.
Fake Owala storefronts — owalafyl.com, owala.store.us.com and more — clone the brand at 70–90% off, surface near the top of Google results, and harvest card details at checkout. Four domains are confirmed by BBB case files; EU/UK lookalikes are documented by Watchlist-Internet and Trustpilot.
A rotating crew of fake BrüMate storefronts — brumaste.shop, brumateonlineshop.com, brutmae.shop and more — clones the real store at 70–90% “off,” harvests card details at checkout, and swaps to a fresh domain within weeks of being flagged.
A 1,200-site fake-crypto-casino network uses MrBeast's name and fabricated promo codes — gozawin.com, beastarcade.com and hundreds of rotations — to steal crypto deposits. MrBeast has publicly warned fans about it multiple times.
A mass smishing campaign sends fake USPS package-on-hold texts linking to websites that clone USPS.com — then harvest personal and card details over a small “redelivery fee.” USPS itself has issued multiple public warnings about the surge.
recruitmentoutreachgroup.com sends polished fake job offers for roles at real brands — LEGO in the reported wave — from a domain with no connection to the brand, leading replies into advance fees, identity theft, or money muling.
A cluster of fake crypto AML checkers — safe-multi.app, multiscan.app, aml-transactions.app — copies AMLBot's name and look so the “check” can flag your funds high-risk and support can demand fees to “cleanse” them.
Fake Amazon order alerts and account-suspension emails sent from lookalike domains — amazon-security.com, amazon-billing.net, amazon-orders.co and rotations — harvest logins and card details at cloned login pages.
Fake Huawei Black Friday storefronts on lookalike domains — huawei-blackfriday.com, huawei-deals.net, huawei-outlet.store — advertise 70%-off phones with Huawei's real logo and product photos, then harvest card details.
Fake Daniel Wellington storefronts run “closing down” watch sales at 70–90% off through lookalike domains like danielwellington-outlet.com and dw-clearance.shop — stealing card details or shipping counterfeits.
Fake SodaStream storefronts impersonate the brand with 60–80%-off “closeout” and “factory direct” sales on lookalike domains — taking payment for machines that never arrive, or shipping generic knockoffs.
Fake CurrentBody storefronts — lookalike domains like currentbody-outlet.com and currentbody-sale.shop — sell $200–$500 LED masks at 60–80% off, harvesting card details or shipping unsafe counterfeits.
“Dreame Outlet” and “Dreame Clearance” copycat storefronts use Dreame's real product photos to sell $600 robot vacuums at $59–$89 “warehouse clearance” prices — then ship nothing, a knockoff, or repeated card charges.
Fake Grubhub delivery texts — “Your driver is on the way! Track your order here” — link to phishing domains like grubhub-track.net and grubhub-delivery.com that steal credentials or install malware.
Fake websites impersonating TikTok Shop — cloned checkout pages using the TikTok logo, pushed by phishing links over email and text — steal credit card details from shoppers. Real TikTok Shop purchases only happen inside the app.
A copied-store network is impersonating Ooni — oonidirect.shop with ~70% price cuts across the catalog, and ooniuk.shop named on Watchlist-Internet's fake-shop list in October 2026. The real pizza-oven brand sells only at ooni.com.
Five fake Simple Modern storefronts — usasimplemodern.com (confirmed fake by the company itself), simplemodern-canada.com (BBB case file), and a .shop rotation — clone the drinkware brand at deep discounts and harvest card details.
Nine fake Vessi storefronts — .shop lookalikes, UK and Australia regional fakes, a “factory outlet” and an Austrian clone — impersonate the footwear brand. Vessi itself publicly confirms only vessi.com and ca.vessi.com are its real stores.
Fake Swig Life storefronts are running 70%-off Facebook ads — a September 2026 BBB case file documents swiglifeshop.de.com, with victims’ stolen card details still being reused. The real brand sells only at swiglife.com.
A network of fake Barefoot Dreams stores — barefootdreamsonline.shop (caught still live on October 11, 2026) plus six domains on a published fraudulent-site list — clones the brand’s CozyChic blankets and apparel at deep discounts.
brokenheartloveaffairppc.com steals Midsummer Agency’s exact title and tagline — “Performance Marketing Powered By The Sun” — word for word, while running SMS task-scam recruiting. Hong Kong-registered on September 24, 2026, single-year registration: a burner, not an agency.
A lookalike domain clones Grow & Convert’s branding to run WhatsApp and text task-scam recruiting — fake marketing jobs that convert into pay-to-work task scams. The founder issued a public warning about it in October 2025.
wordibly-careers.com runs a fake “Proofreader (Remote)” recruiting campaign under Wordibly’s name — a remote, low-barrier job built to attract applicants fast. The real company operates only at wordibly.com.
Eleven hyphenated .io lookalikes — labrys-nft.io and labrys-market.io (named in Labrys’s own April 2026 warning) plus a nine-domain suffixed family — impersonate the blockchain consultancy to front fake NFT and crypto platforms on its own TLD.
arctoris.info sends fake $30/hr recruiter emails impersonating the robotics and AI drug-discovery lab, and arctoriss.com was a typosquat the company formally won back via WIPO UDRP in 2021 — a years-long impersonation history against one brand.
An active phishing wave impersonates Staffology payroll onboarding — cloned pages harvesting National Insurance numbers and financial details at the exact moment new employees expect to hand them over. The real Staffology is IRIS Software Group’s payroll product, served from iris.co.uk.
keenlogic.teams lookalikes impersonate the real IT consultancy (keenlogicinc.com) to run fake hiring — video-less Teams interviews, then fake offer letters that harvest financial details from people who believe they’ve been hired.
A dotinum .cc lookalike family — including dotinumXXo.cc, dotinumXXg.cc and dotinumXXa.cc — runs fake “Machine Learning Engineer” recruitment under the real company’s name. Dotinum won a registrar takedown against the family in July 2025; the pattern persists.
vosyn.ca impersonates the real AI company (vosyn.ai) to run fake recruitment — reported to the Canadian Anti-Fraud Centre in May 2025. The extension swap reads like the company’s Canadian site; Vosyn operates none.
These are brands we found being impersonated without being asked. A brand impersonation audit sweeps the domain landscape for your company — every lookalike, typosquat, and copycat store, each with evidence, a risk rating, and a takedown-request template.
Get my audit — $29