Skip to main content

One of these stores gets the sale.

Same catalog, same photography, same discount language a shopper expects. One of them sends the payment somewhere else.

yourbrand-sale.com
EXTRA 70% OFF EVERYTHING · SALE ENDS TONIGHT
NORTHFELL ShopNewSale

Alpine Down Parka

$340 $102

Merino Base Knit

$120 $36

Field Tote 20L

$95 $28

Storefront · live clone with its own checkout Threat

Two results for your brand name

A customer searching for you sees both. The one that is not yours paid to be there.

Search result · position 1 Your store

Yourbrand — Official Store

yourbrand.com/collections/best-sellers

Domain
Yours
Payment
Shopify Payments
Certificate
Organisation-validated
Search result · position 3 (paid) Clone · taking payment

Yourbrand Outlet — 70% Off

yourbrand-outlet.com/collections/best-sellers

Domain
Registered 4 days ago
Payment
Third-party processor
Certificate
Domain-validated only

The clone does not have to be convincing for long. It only has to hold a card number once.

Recon follows every variant to what it actually serves — parked, dormant, or taking payment.

Illustrative example · synthetic data · demonstration domains are fictional

What Recon reads on every variant

Lookalike domains
Typos, character swaps, alternate TLDs and discount-shaped names, generated as 100+ variations and checked across 1,500+ TLDs.
38 registered
Storefront copies
Catalog overlap, product photography, pricing and theme fingerprint — the evidence that a site is your store rather than a competitor.
2 live
Redirect chain
Where a domain actually sends a customer, following every hop rather than reading the first response.
Followed
Payment destination
Whether payment stays on the storefront or hands off to a processor that has nothing to do with your business.
1 third-party
Certificate
A valid certificate is not a sign of legitimacy — a clone can get one in minutes. Recon records which kind was issued and when.
Recorded

See which variants of your name are registered.