SEASONAL THREAT - COUNTERFEIT STOREFRONTS

The fake Gucci store is registered in August. It opens on Black Friday.

Researchers counted 1,213 domains impersonating 23 luxury brands in a single six week window, and most of them were sitting empty when they were found. That is not a failed campaign. That is the campaign.

SB

SafeBrowz Threat Research Security Research · 13 August 2026 · 8 min read

What the numbers actually describe

Between mid August and late September 2025, BforeAI's PreCrime Labs counted 1,330 suspicious domains, of which 1,213 impersonated one of 23 luxury brands: Gucci, Prada, Louis Vuitton, Rolex, Chanel, Dior, Versace and Dolce & Gabbana among them. Around 800 of those, roughly two thirds of everything found, were registered in late September alone.

The interesting part is what the researchers found when they looked: most of the sites were parked or inactive. An empty domain sounds like a campaign that failed. It is the opposite. Registering early and staying dark is how you arrive at the shopping season with hundreds of clean addresses that no filter has ever seen, no shopper has ever reported, and no brand has ever asked to have taken down.

That timing is the reason this is worth reading in August rather than in November. The domains for this year are being bought now.

The words that give them away

The registrations cluster around a small vocabulary: outlet, store, sale and vip, attached to a brand name. Those words work because they sound like something a real company might plausibly operate, and because they carry the promise of a discount, which is the part that stops a shopper reading the address at all.

Here is the thing worth memorising. Luxury houses control distribution tightly, which is most of what the price pays for. They do not run a separate discount domain, and they do not hold seventy percent off sales on current stock. So the pattern is not merely suspicious. It contradicts how the business works.

Counterfeit sellers use the same construction, which is why a site can look convincing and even ship you something. What arrives is fake, the payment details are gone either way, and there is no returns process because there is no company.

Checking before the price convinces you

1. Read the address before anything else. The brand name should be the domain, not a word attached to one: the real house sits at its own name, not at a hyphenated variation of it.
2. Reach the brand the way you already know how. Type the name into your browser or use a bookmark, then look for the item there. If a sale is real it will be on the brand's own site.
3. Treat a discount as the reason to slow down, not the reason to hurry. Urgency is the mechanism, not a side effect.
4. Pay by card if you do buy, never by bank transfer or crypto. A card payment can be reversed. The others cannot.

If you want the general version of this, our guide on how to spot a fake online store covers the mechanics across every category, and back to school shopping scams shows the same seasonal pattern earlier in the year.

Catching a storefront that has no history yet

This threat is awkward for reputation based tools by design. A domain registered in August and switched on in November has no history to check, no complaints filed against it and no time in any blocklist. Waiting for a site to earn a bad reputation means waiting until after it has taken money from people.

SafeBrowz reads the page rather than its record. Layer 1 matches the address against a local brand and pattern list in the browser itself, so a brand name sitting next to outlet or vip in a domain is judged before anything loads. Layer 2 checks reputation feeds and our blocklist for the ones already known. Layer 3 runs AI content analysis on what the page actually serves, which is what catches a storefront on its first day online when there is nothing to look up.

Honest scope: we judge the site, not the goods. A page can pass every check and still ship you a counterfeit, and no scanner can tell you what is in the box. What we can do is tell you when the shop you are about to type a card into is not the brand it claims to be.