Scammers have long learned to copy other people's websites and show a fake version only to visitors from a specific country — for example, Poland, Germany, or Kazakhstan. From Russia or Ukraine, you will open your real website and notice nothing, while a client from another country will land on a clone, enter their card details, and be left without money. We analyze why this is done, why clones are invisible from your office, and how to systematically search for them using proxies with different geolocations.
What are geo-clones of a website and why are they dangerous
A geo-clone is a website that copies the design, logo, texts, and structure of your real store but is set up to be shown only to visitors from a specific region. Technically, this is called "cloaking" by geolocation: the server determines the visitor's IP address, checks it against a geo-database, and depending on the country, either serves a harmless placeholder page or a fake copy with a payment form.
Such websites are particularly dangerous for brands that sell products through advertising on social networks or marketplaces and operate in several countries simultaneously. A client clicks on an ad, sees a familiar logo, places an order — and the money goes to the scammers, not you. After that, the victim writes angry reviews under your brand name, the reputation suffers, and you may not even suspect that there is a problem because from your office and your country, you only see the real website.
For sellers on Wildberries, Ozon, and AliExpress, a similar problem arises — clones of product cards and entire stores that are configured for a specific region and do not appear when checked from a home IP.
Why the clone is not visible from your country
The logic of scammers is simple: the longer the clone remains unnoticed by the brand owner, the longer it generates income. Therefore, they set up geo-filtering based on several parameters:
- IP address and its geo-tagging. The server checks which country the request came from, and if it is the "home" region of the brand, it shows a harmless page or redirects to the real site.
- Browser language and system settings. If the interface language matches the brand owner's language, the clone may automatically hide.
- User-Agent and device fingerprint. Bots and known search engine crawlers often also receive a "clean" version so that the clone does not get indexed and complaints do not reach the hosting.
- Repeated visits from the same IP. Some clones show the fake only once from a new address, and upon a return visit — a placeholder, to complicate the investigation.
Due to this multi-layered filtering, a simple check of "opened the site — everything seems fine" does not work. You need to simulate a real visitor from a specific country, and not just once, but regularly and from different types of IPs.
Who and why creates fake copies of stores
Most often, geo-clones are created by three types of offenders:
- Phishing groups. Their goal is to collect credit card information under the guise of order payment. The clone lives for several days or weeks until it is blocked, after which the domain is changed and everything repeats.
- Competitors or resellers. They copy product cards and intercept traffic from ads, selling fakes or not sending the product at all.
- Affiliate fraudsters. They run ads in the name of your brand on Facebook Ads or TikTok Ads for a specific country, receive payment, while the traffic and reputational risks fall on you.
Almost always, the geo-restriction is not chosen randomly: scammers target countries with high traffic from ads but low financial literacy of the audience or weak responses from local payment systems to complaints.
Signs that your brand has already been cloned
Before moving on to systematic checks, it is worth paying attention to indirect signals that often precede the discovery of a clone:
- A sharp increase in complaints and negative reviews from customers in countries where you do not have official delivery or representation.
- Support messages about an "order that never arrived," even though there is no such order in your system.
- Mentions of the brand in ads on Facebook Ads or TikTok Ads that you did not launch yourself.
- A drop in conversion in a specific country without visible reasons — traffic may be "leaking" to the clone even before placing an order.
- Foreign domains with similar spellings of the brand name (typosquatting) that are indexed in the local search results of another country.
How to search for clones: methodology using geo-proxies
The only reliable way to see a clone is to visit a suspicious domain or search engine results as if you are a real user from the target country. For this, you need an IP address physically tied to the desired region and a browser that does not show signs of automation or VPN.
A regular VPN is not suitable for this task: most anti-fraud systems and the clones themselves have long learned to recognize data center addresses and known VPN providers and either block them or show a "clean" version of the site specifically for verifiers. Therefore, for geo-checking, you need residential proxies — they use real IP addresses from home providers in a specific country and appear to the site as an ordinary local visitor.
If the clone is primarily spread through mobile advertising on TikTok Ads or through mobile applications, it is worth additionally checking through mobile proxies — IPs from mobile operators often fall into a separate, more "trusted" segment of geo-filtering, and the fake store may be shown to such users rather than those accessing from regular home Wi-Fi.
For mass scanning of dozens of domains and quick checks of "is the site alive at all," cheaper data center proxies will suffice — at this stage, the disguise as a real user is not as important as the speed of going through a large list of URLs.
Tools: proxies, anti-detect browsers, monitoring services
To make the check look as natural as possible and not be detected by the clone as a "check from the brand owner," use a combination of three components.
| Tool | Task | When to use |
|---|---|---|
| Residential proxies | Simulating a real user from the desired country | Main check of suspicious domains |
| Mobile proxies | Checking clones targeting mobile traffic from ads | If complaints come from mobile users |
| Data center proxies | Quickly going through a large list of domains and ads | Mass primary screening |
| Anti-detect browser (Dolphin Anty, AdsPower, GoLogin, Octo Browser) | Unique browser fingerprint and interface language for each country | Always, together with proxies |
The anti-detect browser is just as important as the proxy. If you visit a suspicious site with a Russian interface language and Moscow time zone through a Polish IP, the clone may recognize the inconsistency and show a "clean" version. In Dolphin Anty, AdsPower, or GoLogin, create a separate profile for each country: set the browser language, time zone, and screen resolution corresponding to the region, link it to the geo-proxy of the desired country — and only after that open the domain.
Step-by-step guide for checking by countries
Below is a working algorithm that can be repeated every 1–2 weeks for each priority sales country.
- Compile a list of risk countries. First of all, these are the countries from which you receive advertising traffic through Facebook Ads, Google Ads, or TikTok Ads, even if you do not officially deliver there.
- Create a profile in an anti-detect browser for each country. The interface language, time zone, and screen resolution should match the region.
- Connect a residential proxy of the desired country to the profile. Ensure that the IP is indeed recognized by geo-checking services as the desired region, not as a data center.
- Check the search results for the brand name in the local version of Google and Yandex for that country — look for domains with similar spellings, extra letters, different domain endings (.ru instead of .com, hyphens, transliteration).
- Check the advertising results. Through the same session, look at the ad banner on social networks and in search — sometimes clones launch their own ads under the brand name specifically in that country.
- Visit suspicious domains and place a "test" order without real payment to see the card data entry form, delivery address, and payment recipient details.
- Take screenshots and save the HTML code of the page — this will be needed for complaints to the hosting, domain registrar, and payment system.
- Repeat the check through mobile proxies if the initial check through residential IPs showed nothing, but complaints from customers continue to come.
Tip: visit the same suspicious domain from different IPs of the same country with an interval of several days. Some clones rotate versions of the site and show the fake only to new visitors, while returning ones see a "clean" placeholder.
What to do if a clone is found
Detecting a clone is only the first step. It is important to act quickly while the scammers have not yet collected enough payments and changed the domain.
- Document the evidence. Screenshots, HTML code, whois data of the domain, payment form details — all this will be useful for complaints.
- File a complaint with the hosting provider. Use whois to determine which hosting the clone is on, and send an abuse complaint with evidence of the violation — phishing and fraud are usually blocked quickly.
- Contact the domain registrar. If the domain is similar to your trademark, you can file a complaint through UDRP (Uniform Domain-Name Dispute-Resolution Policy) or a similar national procedure.
- Notify payment systems. If the clone has a payment form through a known acquiring service or payment gateway, write to their security service — fraudulent seller accounts are blocked promptly.
- Report to advertising platforms. If the clone is promoted through Facebook Ads or TikTok Ads, file a complaint for trademark infringement — the scammer's ad account may be blocked along with the campaign.
- Warn customers. Post a warning about fake copies on your official website and social media, listing the official domains.
Checklist for regular monitoring
- ☐ The list of priority countries is updated quarterly based on geo advertising campaigns
- ☐ A separate profile in the anti-detect browser is set up for each country with the correct language and time zone
- ☐ A residential proxy of the desired region is linked to each profile
- ☐ Search results and ads are checked at least once every 1–2 weeks
- ☐ Suspicious domains are checked again with an interval of several days
- ☐ There is a complaint template for hosting, domain registrar, and payment system
- ☐ The official website and social media have a list of current official domains of the brand
Conclusion
Geo-clones of online stores are dangerous precisely because of their invisibility: the brand owner may not suspect a problem for months because they only see the real site from their country. Regular checks through IPs from the desired country, combined with an anti-detect browser and a properly configured profile, is an effective way to find such clones before they cause serious damage to reputation and income.
If you sell in several countries through advertising on Facebook Ads, TikTok Ads, or marketplaces, we recommend establishing regular monitoring using residential proxies to check websites "through the eyes" of a real local user — this is the most reliable way to see what your customers see, not what scammers want to show you.