Documented fake stores and clone sites, by brand
Every lookalike storefront we have documented and published, listed under the brand it copies: 60 hostnames across 56 brands. Each one links to a dated page recording what it served on the day we checked it, and the ten-second check anyone can run.
Holding a link? Check it before you read on.
This page is a record of addresses we have already checked, which is not the same as an answer about yours. Paste the link you are worried about and our server reads it live: whether the name resolves, the certificate served on the connection, its public registration record, and the page itself fetched with caching switched off.
A 0–100 scam risk score, a plain-English verdict, from “no red flags found” to “high risk”, and the two most serious red flags — each naming what we read and the day we read it.
Or tap one of the 60 hostnames documented here and we read it live now, the same way — what it serves today, not what our record says it served.
Point-in-time check of public information. Not monitoring, not advice. A link that is not in our published record is unchecked, not clean — the record is what we have looked at, nothing more. Nothing runs until you press a button. Each check spends live reads, so we never start one for you on page load.
Are you a brand being copied, rather than a shopper checking a link? Start here instead — the $29 sweep of your own name.
How many lookalikes of your name are answering right now?
Free, no email and no card: we generate the lookalike and typosquat names for your domain, resolve them, fetch the ones that answer and grade them against your own page — then show you the counts, two of the rows in full, and the rest withheld. We generate the lookalike and typosquat names from your domain — different endings, hyphenated forms, single-character swaps and drops, and the shop / store / outlet / sale / official patterns our own documented corpus is full of. Only hostnames we confirm resolving are counted as resolving — a name nobody has registered is counted, never padded into a list.
No email, no card, no account. The sweep runs live and usually takes under a minute.
Know what you need already? The $29 report is right here. The $29 report names every hostname behind these counts, with the dated readings for each, the copying evidence where we found it, a risk rating derived in code, our own published record where we already hold one — and the takedown request drafted for you to send.
- Lookalike and typosquat candidates generated from your own domain — different endings, hyphenated forms, character swaps, drops and doublings, and the -shop/-outlet/-store/-sale/-official patterns our own documented corpus is full of
- Every candidate resolved, and everything that resolves fetched live with cache bypassed — only hostnames we confirm resolving are listed, so a name nobody registered is counted rather than padded into your report
- Per hostname: the date-stamped readings behind it — DNS, the HTTPS certificate served, the public registration record, and the page as served
- Per hostname: a risk rating derived in code from what was observed, and the copying evidence where we found it — your own hosted files being served, your image filenames, your catalogue handles or part numbers, or your title wording reproduced
- Where we already publish a dated record for a hostname, our own published finding, quoted verbatim
- A ready-to-send takedown request with your details in square brackets, plus the dated evidence index it refers to
- Delivered the moment the reads finish — the checks run live when you pay, so there is no research queue in front of it
What this is not: the Evidence Report is the researched tier — it adds the registrar and the true upstream host per domain, a filing drafted separately for every desk, and research beyond the patterns generated here. The audit is the deterministic sweep of your own name plus live reads, delivered without a research queue.
This is a point-in-time audit of publicly observable information, not legal advice and not monitoring. We assemble the evidence and draft the request; on this tier you send it. We do not file on your behalf, we do not contact the registrant, and no outcome or timeline is promised — that decision belongs to each registrar, host and platform.
Most people reach these pages searching their own brand plus fake site, scam site, clone store, counterfeit store. Find your brand below — or, if it isn't listed, run the free exposure preview and we'll look for lookalikes of your domain live.
Of the 60 hostnames on this index: 31 were live, HTTP 200 when we last checked them; 19 do not resolve; 2 resolve but do not serve; 8 we could not re-check, because our own check failed. A hostname's state can change on any day, in either direction — one row on this list was observed “does not resolve” on 31 July 2026 and “live, HTTP 200” again on 2 September 2026. Every row stays on the record whatever its state: a dated observation is evidence of what a hostname served on the day we checked it, and that does not stop being true afterwards.
On 22 September 2026, 29 September 2026 and 6 October 2026 we read the TLD registries’ own RDAP records for the 19 hostnames on this index that did not resolve. Every one carried the status code “client hold”, none is deleted, and no registration has expired. Each row’s observed state is unchanged and still reads “does not resolve”: a registry read-back is a separate, dated observation, not a state. clientTransferProhibited on its own is the routine lock carried by nearly every registered domain and shows nothing by itself. What we record here is the combination, read together: a hold on the registry record, no answer in the DNS on our own checks, and a registration that has neither expired nor been deleted — the name is still registered, it is simply not in the zone. We hold no filing, no correspondence and no reference number for this domain. We do not know who asked for this, or why. A registrar or registry acting after we published is not a registrar or registry acting because we published, and we claim no part in it.
Open the full dataset — all 60 records with their dated decay history, the method as run, the 19 registry records read back in full, and a CSV and plain-text release you can cite and re-compute.
Read the decay study — the same 60 rows counted over the whole window: what changed state, in which direction, how long each gap was, and the rows we could not re-check.
The index — 60 documented hostnames, by brand
Read a row as: the hostname we checked, the evidence class it falls in, and the date we checked it. Nothing here names a registrar, host or IP — that attribution is in the paid report, not on a free page — and nothing here asserts anything about a registrant's intent. We describe what each page serves; we make no assertion about any registrant’s intent or criminality, and nothing here is legal advice.
Every brand name below is a link to that brand's own clone report: all of the hostnames we hold for it on one page, each with its evidence class, the state we observed, the date we observed it and every superseded observation still on the record — free to read and quote. Four brands here are documented at two hostnames, and the report is the one page that holds both.
Appointed
Branch Furniture
Carrolls Irish Gifts
COPPERTIST.WU
Elite Sports
Exult Planet
Fashion Brand Company
High Country Gardens
Keyway Designs
Lorena Canals
Luxe Bites
Michael Angelo's
Micro Kickboard
Miss Amara
Moxie Vinyls
MUSASHI
Nest Bedding
Once Again Nut Butter
Park Seed
Redneck Blinds
Riverbend Home
SeaMATE
Second Nature Brands
Stix Yarn
Studio Adorn
Team Sports America
True Treasures Inc
Woven Wood
Yearly Co.
Every hostname above also has a page for the shopper who has already paid it: the bank and card-issuer dispute route in plain language, that hostname's dated evidence, and a $19 Dispute Evidence Pack you can attach to your claim. Follow the Paid it? →link beside any hostname in the index. We do not recover funds and make no promise about any outcome — the decision is your issuer's.
Every row above is free to read, quote and cite, and so is each brand's own clone report. The one thing this index cannot tell you is what is out there under YOUR name that we have not documented — that is the $29 Brand Impersonation Audit: a deterministic sweep of your own domain, live reads on everything that resolves, every confirmed hostname named with its dated readings, and a takedown request drafted for you to send. Free counts first, and one complete report is published in full so you can read the document before you buy one.
An index is a record of what we have checked — never a statement that nothing else exists. Every brand here was found through one of two pieces of published research: the .shop clone kit teardown (one build pointed at many brands at once) and our own own-CDN asset check, which is how a copy serving the genuine brand's own hosted files gives itself away.
Your brand not on this list? That is not the same as clear.
This index only contains what we have already looked at. Enter your company and the domain you own, and we'll generate lookalike and typosquat candidates for it and check them live — DNS and HTTP, right now — then show you what actually answered. Free, no card, no account.
If there is something worth chasing, the $29 Brand Impersonation Audit is the written version: every confirmed-resolving hostname named with its dated readings, the copying evidence where we find it, a risk rating derived in code, and a takedown request drafted with your details in square brackets. You send it — we don't file for you. We publish one complete audit in full so you can read the document before you buy one.
The instant version of that sweep is on the first screen of this page: run the free lookalike scan on your own domain — candidates generated from the name you own, every one of them resolved, and the ones that answer fetched live, each reading stamped with the date it was taken.
If you have just found a copy of your store
- Someone cloned my store — what to do first: browser blocklisting before anything else, the three lookups that find the right desk, and the filing order.
- Did my takedown actually work?: reading registry status codes, and why
clientTransferProhibitedalone is not enforcement. - The ten-second own-CDN check: right-click an image on a suspected copy and read the hostname.
- The .shop clone kit teardown: 38 clone domains, 36 brands, one template.
- The re-verification dataset: the whole record as one citable page — the dated method, every hostname's decay history, the registry status read-back, and the same rows as a CSV.
- The decay study: what 60 documented hostnames did over the whole window — every state change, its direction and the gap between the two checks, counted from the record rather than asserted.
- Is this website a scam?: the shopper's entry point — paste any link for a free score and verdict, the checks you can run yourself in your own browser, and every documented hostname in one list.
- What's in each report · FAQ and scope
Scam Detective — pay-per-use scam intelligence. One-off checks, no subscription, no account.
Every finding here is an assessment of publicly available information at the time of the check, and is not legal advice. We produce the evidence and the correctly addressed request; on a Takedown Engagement we submit it to the abuse desks as the customer’s authorized agent, which is an administrative act and not legal representation. We do not monitor continuously and never contact the registrant on a customer’s behalf, and no outcome or timeline is guaranteed. Confirm your own trademark position before sending anything adversarial. Each row above carries the date its own finding was captured.
Are you a brand on this list and want the evidence for your row? scam-detective8@mail.acoco.ai