Same Scam Store Template Used to Impersonate Australian and New Zealand Brands

We are still seeing a campaign which has been prevalent all year of suspected online scam stores is targeting well-known Australian and New Zealand brands, using near-identical website templates to impersonate legitimate retailers and potentially deceive consumers into making purchases through fraudulent websites.

The sites follow a recognisable naming convention, typically combining a brand name with either -australia.com or -newzealand.com. Despite the different brands being impersonated, the websites appear to share the same underlying template, suggesting a common approach to building and deploying these suspected scam stores.

Australian Brands Targeted

The following domains impersonate Australian-facing versions of established international brands. The dates indicate when each domain was first observed in this campaign, rather than necessarily when it was registered or when fraudulent activity began.

New Zealand Brands Targeted

New Zealand consumers are also being targeted, with domains impersonating popular consumer brands, including Anker, Ooni and Labubu.

A Common Template, but Changing Infrastructure

One of the more notable aspects of this campaign is the apparent reuse of the same website template across multiple impersonated brands. This provides a useful detection opportunity: the combination of suspicious domain naming conventions and repeated website layouts can help identify other potentially fraudulent stores.

However, the supporting internet infrastructure has not remained consistent. Domain registrars, name servers and other infrastructure have changed between the observed sites.

This variation makes it more difficult to identify the campaign through infrastructure-based indicators alone. Blocking a single registrar, name server or hosting provider is unlikely to be a reliable solution when the operators can move between providers or establish new infrastructure.

Instead, defenders should consider a combination of indicators, including:

• Domain naming patterns: Look for brand names combined with australia.com or newzealand.com, including variations in hyphenation and spelling.
• Website similarity: Compare page layouts, product listings, checkout flows and other distinctive elements shared across suspected stores.
• Domain registration and DNS data: Track changes in registrars, name servers and hosting infrastructure to identify potential connections between sites.
• Brand monitoring: Monitor newly registered domains that incorporate the names of popular brands, particularly those presenting themselves as official regional stores.

What Consumers Should Look Out For

Consumers should be cautious when arriving at an online store through social media advertisements, unsolicited messages or unfamiliar search results. A website displaying a recognised brand logo and familiar products is not necessarily operated by that brand.

Before purchasing, consumers should verify the store through the brand’s official website and check whether the domain is linked from its recognised online channels. Unusually large discounts, unfamiliar payment arrangements and missing or suspicious contact details can provide additional warning signs.

The use of a .com domain does not establish that a retailer is Australian or New Zealand-based, nor does a country name in the domain demonstrate that the site is an authorised regional store.

Conclusion

The reuse of a common template across suspected scam stores impersonating multiple Australian and New Zealand-facing brands suggests that this activity is worth monitoring as a broader campaign rather than treating every domain as an isolated incident.

The changing infrastructure highlights the limitations of relying solely on hosting or DNS indicators. Combining domain-pattern detection with website similarity analysis and brand monitoring may provide a more resilient way to identify additional sites.

The domains listed above are indicators observed during this investigation. Their inclusion does not, by itself, establish who operates them or prove that every site has completed a fraudulent transaction. Consumers should verify retailers through official brand channels before making purchases.