// Case Studies
Fake-Shop Cluster & Ad-Cloaking: 2,200+ Disguised Fraud Domains Behind Social Media Ads
A sponsored post in a social media feed promises up to 80% off branded furniture, winter apparel or footwear. Tapping on a smartphone opens a pixel-perfect online store — complete with copied corporate details and genuine product photography. Yet when a security analyst opens the exact same domain directly on a desktop browser, a harmless demo catalogue of generic bags or toys appears instead. In this investigation we reconstructed the conditional delivery (ad-cloaking) behind such a campaign (exemplified by domains like 6pmseason-styles[.]shop) in an isolated environment, extracted the technical fingerprint of the underlying SaaS kit (SHOPOEM / oemsaas), and correlated 88+ shared reverse-proxy IPs to expose a cluster of more than 2,200 active disposable domains across DACH, Poland and the EU.
Updated: 2026-11-03
How the case was handled
- 1Expose conditional delivery (ad-cloaking) in isolation: The server validates the mobile User-Agent, target-country Geo-IP and ad-click referrer parameters (such as fbclid), serving automated scanners and desktop visitors a benign decoy catalogue.
- 2Detect brand impersonation beyond lookalike domains: Over 20 documented clones of a major retail chain did not contain the brand name anywhere in the URL — rendering traditional keyword-based domain alerts blind.
- 3Capture the platform fingerprint in DOM and network telemetry: Recurring script paths, shared storefront templates (SHOPOEM / oemsaas) and three concurrent tracking pixels firing during checkout reveal industrialised campaign orchestration.
- 4Correlate the wider cluster via shared infrastructure: By passively mapping 88+ recurring reverse-proxy IPs, TLS certificate issuance patterns and shared nameserver pools, more than 2,200 linked fraud domains were attributed.
- 5Deconstruct forged trust anchors on the storefront: Copied commercial-register numbers (HRB), real street addresses of unrelated European companies in the legal notice and static payment-badge graphics fabricate legitimacy.
- 6Analyse the 3D Secure harvesting trap at checkout: While the victim waits on a fake loading spinner, operators initiate a real-time card charge or digital-wallet provisioning request in the background and intercept the one-time bank code.
- 7Execute structured takedown and mitigation workflows: Submit bundled cluster evidence (IOCs) to registrars, CDN/proxy providers, ad networks and browser blocklists, and immediately freeze any exposed payment cards.
What to avoid
- Never rely solely on visual storefront quality or a printed legal notice when clicking social media ads offering 70% to 80% discounts.
- Never approve a 3D Secure code or banking-app push prompt without verifying the exact merchant name, currency and amount displayed by your bank.
- Do not assume brand protection is complete if it only monitors domain names containing your trademark — ad-cloaked campaigns routinely use generic domains.
- Do not open suspicious ad links directly on corporate networks or unmanaged personal mobile devices when investigating a report.
// BRAND PROTECTION & TYPOSQUATTING DEFENSE
Protect Your Brand: Stop Lookalike Domains & Impersonations Early
We monitor freshly registered domains, certificate transparency logs, and fake profiles impersonating your brand. Proactive takedown coordination and evidentiary documentation before your clients are deceived.
FAQ
- Why does an office desktop show a harmless page while mobile users see a cloned brand store?
- Because of server-side ad-cloaking: the site checks in real time whether the visitor arrives from a mobile device in the target country via a paid social ad link carrying a click ID. Direct desktop visits fail those checks and receive a harmless decoy store.
- Why do conventional domain monitoring tools miss these fake shops?
- Operators deliberately register generic domain names (combining seasonal or fashion words under .shop, .top or .store) that contain zero letters of the targeted brand. The impersonated brand assets are rendered only inside the cloaked mobile session.
- I entered my card details and a 3D Secure code — what should I do immediately?
- Freeze or cancel the card immediately via your banking app or emergency hotline, check whether an unauthorized Apple Pay or Google Pay device token was provisioned, dispute any pending charges with your bank, and preserve screenshots including the ad URL.