Security Investigation: How a Fake Brooks Store Reached Prominent Google Search Results
A fraudulent Brooks storefront showed how brand impersonation, search visibility, payment processing and post-purchase deception can combine into a convincing retail fraud operation.
Original investigation date: 12 February 2024
Initial report to Brooks EU: 17 January 2024
Article type: Security investigation
Executive summary
In early 2024, while searching for Brooks running shoes in the Netherlands, I found a fraudulent site using the domain brooks-netherland.com appearing prominently in Google search results.
At the time of the investigation, the site was particularly convincing because it did more than display fake products. It reproduced much of the expected customer journey:
brand and product imitation;
shopping and checkout functionality;
payment processing;
support-style email;
shipping communication; and
in at least one observed pattern, delivery of a low-value item rather than the product ordered.
The site also appeared connected to infrastructure used by other fraudulent retail sites.
This made it a useful case study in how modern ecommerce fraud can operate as a distributed service rather than a single fake webpage.
How I found the site
The discovery began with an ordinary search for Brooks running shoes using a Netherlands-related search term.
A fraudulent site appeared very prominently in the results, close enough to the genuine brand presence that an ordinary customer could plausibly select it without realising that the domain was not operated by Brooks.
That is a critical part of the attack.
The victim does not necessarily arrive through a suspicious email. The victim can arrive through a legitimate search engine while intentionally looking for the real brand.
What the fraudulent store did
The site appeared to imitate the genuine Brooks retail experience and supported a checkout flow.
During the investigation I observed behaviour indicating that the operation was designed to do more than harvest a username and password.
The flow could potentially collect or process:
customer details;
account credentials;
delivery information; and
payment-card information.
The site showed weak input validation in places, but it was nevertheless capable of presenting a convincing transaction process.
Why post-purchase behaviour is important
A particularly effective fraud operation does not end immediately after payment.
Follow-up communication can make a victim believe that a genuine order is still being processed. Shipping messages, customer-service email and the delivery of a low-value item can all prolong that belief.
From an attacker's perspective, this has several benefits:
the victim may wait longer before disputing the transaction;
the transaction may superficially resemble a normal retail purchase;
a tracking number or delivered parcel can create additional ambiguity; and
the fraudulent storefront remains credible for longer.
This is an important reminder that fraud detection should examine the entire transaction lifecycle.
Infrastructure observations at the time
The original investigation identified several technical indicators associated with the domain and supporting services, including:
registration through an Alibaba-associated registrar service;
hosting and network relationships spanning multiple jurisdictions;
separate services used in the payment or verification flow;
email configuration that did not resemble a mature brand-owned domain; and
code comments containing Chinese-language text.
These observations were useful for abuse reporting and infrastructure mapping.
They were not enough to prove who operated the fraud or where the operators were physically located.
Shared infrastructure and related fake stores
The Brooks site appeared to share components or patterns with other fake ecommerce sites I examined, including a site impersonating a fashion brand.
Shared payment infrastructure is especially important because fraudulent storefront domains can be replaced quickly. A backend payment or processing service reused across multiple stores may reveal a larger network.
Investigators should therefore capture:
redirect chains;
form destinations;
payment endpoints;
script references;
analytics identifiers;
DNS records;
email infrastructure; and
hosting relationships.
The goal is to move from "this domain is fake" to "this is how the fraud operation is assembled."
Search ranking is part of the threat model
One of the most troubling aspects of this case was the site's search visibility at the time.
Users often treat search ranking as an informal trust signal. But ranking answers a relevance question, not necessarily a legitimacy question.
For well-known consumer brands, monitoring search results should therefore be part of brand-protection and security operations.
A fraudulent domain that appears prominently for brand-related searches is already in a position to intercept customers.
Reporting and takedown
The site had been reported to Brooks EU before the date of the original article and was still active when the article was written.
A coordinated takedown effort can require action across several layers:
Brand owner — confirm that the domain is unauthorised and warn customers.
Registrar — submit evidence of abuse and request investigation of the domain registration.
Hosting provider — report the fraudulent service and preserve evidence where appropriate.
DNS/CDN provider — report abuse where their service is involved.
Payment providers — report the merchant or payment infrastructure receiving funds.
Search platforms — report the fraudulent result.
Relevant authorities — report the incident through available fraud or cybercrime channels.
No single provider necessarily controls the whole operation, which is why takedown often requires persistence and coordination.
Recommendations for consumer brands
Monitor brand-related domains
Look for registrations containing the brand name, common misspellings, country names and retail terms.
Monitor search results
Do not assume customers will always reach the real site through your official domain.
Maintain a rapid abuse-response process
Know in advance who will gather evidence, contact providers and communicate with customers.
Follow infrastructure reuse
A fake domain may be temporary. Shared payment, hosting and email infrastructure can reveal other active sites.
Communicate clearly with customers
Publish the official domains and authorised retailers, particularly when an impersonation campaign is active.
Recommendations for consumers
Check the exact domain before paying.
Compare the site with the official brand website.
Be cautious when a country-specific domain is not linked from the brand's main site.
Treat extraordinary discounts as a reason to verify, not as proof of a bargain.
Do not assume Google ranking equals merchant verification.
Keep transaction records and act quickly if the order becomes suspicious.
Attribution: what can and cannot be said
The original research found Chinese-language comments and Chinese-linked registration services. Those are legitimate indicators to document.
They are not proof that the operators were Chinese, that the operation was directed from China, or that any state actor was involved.
A better analytical formulation is:
The infrastructure and code contained indicators associated with Chinese service providers or development artifacts, but the operator's identity and location could not be established from those indicators alone.
Conclusion
The fake Brooks site demonstrated how ecommerce fraud can exploit three separate forms of trust at once:
trust in a familiar brand;
trust in a search engine; and
trust in a normal-looking payment and delivery process.
The most effective response is therefore not simply better consumer awareness. Brands, search platforms, registrars, infrastructure providers and payment organisations all have a role in shortening the lifetime of fraudulent storefronts.
For security teams, the practical lesson is equally important:
Preserve the evidence, map the infrastructure, separate observation from attribution, and follow the payment path.
