A customer buys from examplebrand-loja.com. The website has the Example Brand logo, the catalog photos and even the same "about us" page. Payment is made by Pix (Brazil's instant payment), the order never arrives, and the complaint goes to the real company.
This article is for those who manage the brand, marketing and the legal team. It shows how the fake website scam works, how to tell it apart from a legitimate reseller, what to store before acting and whom to ask to take the website down.
How the scam works
The lookalike domain. The scammer registers an address that resembles the official one:
- a swapped letter:
examplebrarnd.com.br; - a hyphen:
example-brand.com.br; - another ending:
examplebrand.cominstead ofexamplebrand.com.br; - words such as "loja", "oficial", "sac" or "promo" (Portuguese words common in scams in Brazil) next to the name:
examplebrand-loja.com; - the brand at the start of another address:
examplebrand.com.br.promo-online.com, where the real domain ispromo-online.com.
The copy. The website repeats the look, the logo, the photos and the texts of the real website. To someone in a hurry, it looks like the company.
The entry point. Often, a paid ad with "official website" in the text appears above the real website in search results. Whoever searches for the brand to buy or get help clicks the first result.
The goal. Selling without delivering, charging "fees" or capturing login and card data.
Warning signs, and the difference from a reseller
No single sign decides; what matters is the combination. The most common ones on a fake website:
- a recently registered domain;
- a price far below the official one, with pressure to close the purchase;
- payment only by Pix or boleto (a Brazilian payment slip), to an individual or a company with another name;
- a footer without a CNPJ (Brazil's company registration number), or with another company's CNPJ;
- a "contact us" button that leads to a WhatsApp number outside the official list.
The browser padlock does not mean the website is real: it only shows that the connection is encrypted.
A legitimate reseller is different. It uses its own name and its own CNPJ, mentions the brand to sell the original product, as the law allows (art. 132, III, of Brazil's Industrial Property Law, the LPI), and does not present itself as the "official website". The fake website tries to pass itself off as the company; the reseller does not.
Store the evidence before acting
A fake website changes or disappears quickly, often right after the first report. That is why the evidence comes first. A good capture includes:
- the full page, not just the visible part;
- the full address and the date and time of access;
- the page code (HTML), which shows where buttons and links lead;
- the integrity code (such as SHA-256) and a timestamp from an external authority;
- the public registration data of the domain at that moment.
Some websites use cloaking: they show an ordinary page to those who inspect them and the scam to customers. That is why the capture should be made under the conditions in which the customer sees the website, for example on a mobile phone, with those conditions recorded.
The ways to take the website down
It is worth going from the fastest path to the slowest, and using more than one at the same time.
The hosting provider. It hosts the website and can take the page down. The abuse contact appears in the public data of the website's IP address.
The service that protects the website. Many websites sit behind protection and delivery services, such as Cloudflare. In those cases, that service's abuse form receives the report and forwards it to the hosting provider.
The domain registrar. It is the company through which the domain was registered, and it can suspend the domain in cases of abuse, such as phishing. For .com and other generic endings, the abuse contact appears in the registration lookup (WHOIS or RDAP). Since April 2024, registrars accredited by ICANN must act promptly on actionable evidence of phishing (RAA 3.18.2).
.com.br domains. Registro.br, which manages .br domains, shows the public data of the domain. To dispute who has the right to the domain, there is SACI-Adm, an administrative procedure run by accredited institutions such as ABPI, CCBC and WIPO. To take the content down faster, the path is still the hosting provider.
A .br domain with false data. Registering a .br domain requires a CPF or CNPJ (Brazil's individual and company taxpayer numbers), and the holder must provide truthful data. Under Resolution CGI.br/RES/2008/008, the domain may be cancelled when there is an irregularity in the holder's name or CPF or CNPJ and the holder does not correct it within 14 days of being notified by NIC.br. If the fake website uses a domain registered with another company's CNPJ or with data that does not match, you can inform Registro.br through its official contact channels. The review and the decision belong to Registro.br.
CERT.br. The official guidance from CERT.br, the security incident response center for the Brazilian internet, is to notify the abuse contact of the network where the website is hosted, with cert@cert.br in copy. CERT.br is the contact point of last resort, useful when you do not know whom to notify.
Google. Reporting phishing through Safe Browsing makes browsers show a warning to anyone who tries to open the website. If there is a paid ad, the owner can file a Google Ads trademark complaint, which covers the brand in the visible text of the ad, not the keyword purchased.
Whoever receives the money. If the website charges by Pix or boleto, the practical recommendation is to report the account to the receiving bank through its fraud reporting channels, with the key or the boleto data used in the scam. The decision to block the account belongs to the bank.
When no one acts. A well-prepared out-of-court notice, with the exact link, the evidence and the reason, now carries more weight. Under the theses of Brazil's Supreme Federal Court (STF) on the Marco Civil da Internet, Brazil's Internet Civil Framework (June 2025, with the theses clarified in the motions for clarification decided in June 2026), the provider may be held liable if it does not remove unlawful content after being notified, unless there is reasonable doubt. As the application of these theses is still being defined by the courts, check with a lawyer before relying on them in a specific case.
In every path, a good request includes: who is asking, the right (the trademark registration at INPI, Brazil's trademark office), the exact link, the evidence with date and time, the reason in a few sentences and what you want (taking the page down or suspending the domain).
When it is worth buying or recovering the domain
Taking it down is not always the best path.
- A parked domain for sale, with no scam. Buying it may be cheaper and faster than a procedure. But do not negotiate with someone who is running a scam with the domain.
- A domain used in bad faith. SACI-Adm, for
.br, and the UDRP, for generic endings, can transfer the domain to the trademark owner. Under the UDRP, the owner must show that the domain is identical or confusingly similar to the trademark, that the registrant has no rights or legitimate interests in it, and that it was registered and is being used in bad faith. These procedures take longer than an abuse report and are useful when the goal is to keep the domain. - Prevention. Registering the most obvious variations of your own domain, such as the
.comand the hyphenated version, closes doors before the scammer walks in.
Keep watching, because the scam tends to come back
Keep the report numbers and check the address again after a few days. The same scam often comes back with another domain, another provider or another ad. Each new address needs its own evidence and request, and continuous monitoring shortens the time to the next removal.
How Patentiq helps
Patentiq searches every day for domains similar to your brand and shows what deserves attention in a decision queue, with a risk score and the reason. The evidence is sealed, with an integrity code and a timestamp, before any request. The takedown request is contracted separately: when the company hires the takedown service and marks a domain as fraud, Patentiq sends the request with the evidence. The decision to remove belongs to whoever receives the request; Patentiq makes sure it arrives complete and well documented.
To see the full monitoring for your brand, request a demo.