Fake Shops Using Your Brand: Spot Imitators Early in Q4

Why fake shops peak in the holiday season

Verbraucherzentrale NRW, the consumer advice centre of North Rhine-Westphalia, titled its press release of 20 November 2025 "Fake shops are booming". By then its checking tool for online shops had identified 86,000 fake online shops, and around 1,200 new ones were being added every month (Verbraucherzentrale NRW). The figures describe the status as of November 2025 and cover all detected fake shops, not only copies of known brands. They do show the scale, though: anyone running an online shop under their own name operates in an environment where new imitations keep appearing and disappearing.

The picture on the customer side is similar. In a Forsa survey commissioned by the Federation of German Consumer Organisations (vzbv) in September 2025, 70% of those who had shopped online in the previous two years said they had come across a shop that seemed dubious or fraudulent (vzbv). Almost one in eight online shoppers, 12%, fell for a fake shop during those two years (vzbv). The Cybersicherheitsmonitor 2026, a survey by Germany's Federal Office for Information Security (BSI) and the police crime prevention programme, reaches the same picture from a different angle: among respondents who had fallen victim to cybercrime in the twelve months before the survey in January 2026, online shopping fraud was the most frequently named offence at 22% (Cybersicherheitsmonitor 2026).

The reason copies appear in the fourth quarter in particular is simple: that is where the money is. The German Retail Federation expected online holiday sales of EUR 22.2 billion for November and December 2025 (HDE). Across all of retail, 18.5% of annual revenue falls into these two months (HDE), and for Black Friday and Cyber Monday alone the federation expected EUR 5.8 billion in sales in 2025 (HDE). Many buyers spend these weeks hunting for discounts, comparing quickly and deciding under time pressure. A shop that looks like yours and is noticeably cheaper meets exactly this mood, and an order is placed faster than anyone reads the legal notice.

What makes a shop copy under your brand

Not every fake shop targets a specific brand. Many sell well-known products under invented names at unrealistic prices and often vanish again after a short time. For retailers with their own name, a different variety matters more: the copy of their own shop. It takes over the logo, product photos and descriptions, often parts of the legal notice as well, and runs under a domain that looks confusingly similar to yours. Which domain variants attackers use for this, from typos and homoglyphs to a different ending, is covered in the article on typosquatting and lookalike domains. This article is about what the holiday season adds.

• The domain combines your name with an addition such as "sale", "outlet" or "black-friday", or runs under an ending you do not use yourself.
• Product photos and texts come from your shop, while prices are well below your own sale prices.
• Payment is by prepayment or through channels you do not offer yourself; buyer protection is missing.
• The legal notice and VAT ID are missing, invented or copied from your site. Verbraucherzentrale NRW names a missing legal notice and a fake VAT ID as typical features of dubious shops (Verbraucherzentrale NRW).
• The domain is often only a few days or weeks old and was registered shortly before the sale period.

Then there is speed. According to Verbraucherzentrale NRW, fake shops spread through paid ads in social networks are often advertised immediately after a new domain goes live and reach many potential victims within a short time, even before they rank prominently in search results (Verbraucherzentrale NRW). In September 2025, the vzbv compared the domains of 653 shops with a fake shop warning against the ad databases of two large platform operators; for half of them, paid advertising was running there (vzbv). For brand owners this means that only a few days may pass between the registration of a copy and the first orders. Searching for your own name once a week is usually not enough.

The figures show how widespread fraud in online retail is and how great the uncertainty among consumers is.

— Wolfgang Schuldzinski, Executive Director of Verbraucherzentrale NRW, press release of 20 November 2025 (translated)

Three public traces: domain, DNS and certificate

Before a shop copy accepts its first order, it leaves traces in public registries. It needs a registered domain, a DNS record pointing to a server and, as a rule, a TLS certificate, because browsers flag pages without HTTPS as not secure. Each of these traces can be observed from outside, without opening the copy and without access to anyone else's systems.

Certificate Transparency is built so that third parties can look closely: RFC 9162 describes the protocol as public logging of TLS certificates that allows anyone to notice the issuance of suspect certificates (RFC 9162). Browsers enforce this. In Chrome, publicly trusted certificates must be CT compliant to be accepted at all (Chrome CT Policy). A log must incorporate a certificate for which it has issued an inclusion promise within a fixed period; for logs following RFC 6962, this period may be no longer than four hours (Chrome CT Log Policy). How CT logs are structured and how to evaluate them continuously is explained in the article on monitoring Certificate Transparency logs.

For brand owners, the certificate is therefore often the earliest public signal. Whoever prepares a copy usually has a certificate issued before the site is advertised, because without HTTPS the browser warns visitors as soon as they open it. Between issuance and the first ad there is a window in which the hostname with your brand name is already publicly readable, but the copy has not yet reached any customers. That is the window to use.

What XICTRAQ monitors and what it does not

The Brand Protection feature generates up to 200 variants of your domain from nine techniques: swapping the ending, swapped and omitted letters, adjacent-key typos, inserted hyphens, homoglyphs, bit flips and typical prefixes and suffixes (XICTRAQ Brand Protection). These variants are checked in DNS every day. As soon as one of them resolves, XICTRAQ enriches the finding with the registrar from the registry record where the registry lists it, the certificate status, HTTP reachability and a risk score built from these factors. You mark your own defensively registered variants as legitimate; they then drop off the warning list but remain visible in the overview. The daily re-check runs for websites whose ownership has been verified in the account.

The Certificate Transparency Watch, described on the DNS and domain monitoring page, adds a view into the CT log. It compares newly issued certificates with your brand every day and classifies each match: your own domain, a lookalike variant, or your brand name as part of the hostname of someone else's domain. The last case catches copies with additions such as "-sale" under endings that are not on any variant list, provided a certificate of their own was issued for them. Every match receives a score from 0 to 100, and matches with a score of 50 or more trigger a one-time alert on your channels (XICTRAQ DNS & Domain). Both features are included from the Business plan; details are on the pricing page.

Important for expectations: XICTRAQ does not search ads in social networks, marketplaces or search engine ads, and the typosquat detection works with domains, not with the brand name in arbitrary text. Yet a large share of fake shops' reach comes precisely through paid ads. Monitoring domains and certificates therefore covers the part that can be measured automatically and early. Reports from customers remain the second source you should not do without during sale week.

Just over six weeks to Black Friday: the season plan

In 2026, Black Friday falls on 27 November and Cyber Monday on 30 November. From mid-October that leaves just over six weeks. That is enough to set up monitoring, define the procedures and have a few rounds with real matches behind you before sale week. Anyone who only starts in the last week of November ends up sorting out false alarms instead of reporting copies.

1. Mid-October, take stock: Record every domain you sell or advertise under, including country domains and campaign addresses. Switch on the brand watch for the main domain and route notifications via alerts and escalation to a place that someone checks every working day.
2. End of October, remove the noise: Review the first matches. Mark your own variants, redirect domains and partner domains as legitimate so that only genuine suspects remain during sale week.
3. Early November, prepare reporting channels: Decide for each type of match who reports and to whom: host, registrar, registry, lawyer. Write report templates and secure evidence of the original.
4. Sale week, react quickly: Handle high-score matches on the same day, give customer service a short agreed wording and keep a warning notice ready on your own site.
5. January, follow up: Evaluate matches, reports and response times, clean up the list of legitimate domains and decide which variants you will register yourself in future.

Whether to register variants yourself is mainly a question of cost. For the obvious spellings, such as the most important endings and the hyphenated variant, it often makes sense; holding every generated variant rarely pays off. More important than the number of your own registrations is that each of them is marked as legitimate in monitoring. Otherwise your own domains sit among the suspects during sale week, and genuine matches get lost in the noise.

From match to takedown

A match is a suspicion at first. Before you report it, check whether a copy is actually running under the domain and secure its state: a screenshot with date and full address, the certificate details such as issuer, serial number and issue date, the registrar from the registry record if the registry lists it and, where identifiable, the host. Evidence of the original is just as important. The screenshot changelog regularly captures your own pages and archives the before and after images with a date whenever it detects a change, which shows what your site looked like at which point in time.

Which body is responsible depends on what you want to achieve. For a quick shutdown during the season, host and registrar are usually the shorter route; for the domain itself, the UDRP or, for .de domains, a DISPUTE entry at DENIC apply. The general takedown procedure is described in the article on lookalike domains and the takedown process; for the holiday season, these routes matter most:

• Host: Under Article 16 of the Digital Services Act, providers of hosting services must offer an electronic notice and action mechanism. A notice should contain an explanation, the exact URL, name and email address and a statement that the information is accurate and complete in good faith (DSA).
• Registrar: For generic endings, the RDAP record names the registrar together with its abuse contact; for .de domains, DENIC does not publish the registrar. Many registrars suspend domains when abuse is demonstrated; how quickly is governed by their own terms.
• .de domains: A DISPUTE entry at DENIC prevents the domain from being transferred to third parties, but the holder can still use it. It initially applies for one year and can be extended (DENIC). It therefore does not directly stop a running shop; it secures the domain for later resolution: if the domain is deleted, it passes to the holder of the DISPUTE entry.
• Generic endings: The UDRP can lead to the transfer or cancellation of a domain if three conditions are proven: identity or confusing similarity with your trademark, no rights or legitimate interests of the holder, and registration and use in bad faith (ICANN UDRP). After a decision, the registrar also waits ten business days before implementing it (ICANN UDRP).
• Trademark law and criminal complaint: Anyone using a sign identical or confusingly similar to your trademark in the course of trade for identical or similar goods without consent can be required to cease and desist if there is a risk of repetition (Section 14(2) and (5) of the German Trademark Act, MarkenG). Fraud against customers can also be reported to the police; your secured evidence helps with that.

In 2025, WIPO handled more than 6,200 domain name disputes, more than in any previous year (WIPO). This shows how common the route through dispute resolution is, but also that it is meant for lasting resolution and not for sale week. If you find a copy on the Friday before the first Sunday of Advent, a complete report to the host usually achieves more than a procedure whose implementation can drag on well beyond sale week.

Informing customers without losing their trust

Customers often see copies before you do, for example because they are shown an ad that your domain monitoring does not capture. Make it easy for them to report a suspicion and easy to recognise the original. A short page with official information, linked from the footer and the order confirmation, answers the most common questions and takes pressure off customer service during sale week. It should be worded soberly: a shop that warns about fake shops without causing panic comes across as more trustworthy than one that keeps quiet about the issue.

• the domains you actually sell under and the social media accounts you advertise through
• the payment methods you offer and a note that you do not ask for transfers to private accounts
• your complete legal notice with VAT ID as a point of comparison
• a reporting address or form for suspicious shops and ads
• a note on what affected customers can do: contact their bank, report to the police, secure evidence

Your own pricing also contributes to protection. If you advertise strikethrough prices, you should be able to document the reference price; a traceable discount stands out from a copy's fantasy prices. How to document the reference price for sale discounts properly is shown in the article on strikethrough prices on Black Friday.

After the season: maintain the list, measure response time

In January, a sober look back pays off. How many matches were there, how many were genuine copies, and how long did it take in each case from the CT log entry to the alert, from the alert to the report and from the report to the shutdown? These time spans show where the procedure needs to get faster next year. Quite often the bottleneck is not detection but the step between alert and report, because nobody was responsible or the evidence was missing.

Your own domain also belongs on the list. Imitators are one side, the takeover of your real domain at the registrar is the other; how a registry lock against domain hijacking protects you is covered in a separate article. And because the holiday season is a technical stress test as well, the brand watch belongs in the same preparation as load tests and outage plans, which the article on Q4 traffic peaks describes.

Switch on the brand watch before Black Friday

Fake shops using your brand cannot be prevented, but they can be seen earlier. Domain variants and new certificates are public signals that often appear before the first ad runs. If you evaluate them daily, keep your own domains properly marked as legitimate and have defined the reporting channels before sale week, you shorten the time in which a copy reaches customers. The live demo shows what matches and risk scores look like in the dashboard; monitoring is set up via Brand Protection.