A coordinated network of more than 10,000 counterfeit online stores has been built to trap Black Friday shoppers, impersonating 166 fashion and luxury brands across 26 countries, according to NordVPN’s threat intelligence team.
The network, uncovered in research published on November 5, uses a single cloned template to copy the look of real retailers. As of November 3, 1,549 of the fake stores were fully active. The most impersonated brands are Adidas, with 52 fake domains, Ralph Lauren with 30, Dr. Martens with 29, and Crocs and Massimo Dutti with 28 each. The sites display fake PayPal and Klarna logos but do not actually accept those payment methods.
In a worrying twist, AI shopping assistants have recommended some of the fake stores as trustworthy — Perplexity listed one fake Vero Moda site among recommended shops and a fake Dr. Martens site as the brand’s official outlet for Ireland. NordVPN suspects a single Chinese-speaking operator behind the network.
Fake stores appear every three minutes
The NordVPN finding fits a wider pattern. A separate holiday shopping scam report from Scamwise and Savi Security, published on October 20, found about 500 new fake stores going live every day — one every three minutes — with more than 100,000 fake shopping sites flagged in 2026 out of 250,000 checked. Reports of holiday-themed fake stores grew fivefold in 60 days, and 85% of fake stores disappear within two weeks.
ConsumerAffairs and identity firm Veriff warned on November 4 that fake retail websites, fraudulent social-media ads, phishing and fake shipping notifications are the top holiday threats this year. Scammers are now using AI and fake identity-verification links, asking victims to scan an ID or selfie to “release” an order — actually opening accounts in their name.
How to stay safe
The advice from regulators and consumer groups is consistent: shop only on the retailer’s official site or app, never through links in ads or messages; check the web address carefully; be suspicious of prices far below every other seller; and never share ID documents to release a delivery. The US Federal Trade Commission opened public comment on November 2 on rules for imposter ads, weighing requirements for platforms to vet advertisers and remove scam ads. Comments are open until November 30.
