OSINT investigations
ThreatSnaps Blog
The storefront is only the surface.
Fake shops leave trails across images, domains, payment pages, and support channels.
ThreatSnaps Research • June 18, 2026 • 9 min read
OSINT for fake marketplaces: following the clues behind too-good-to-be-true stores
A fake marketplace rarely announces itself with one obvious red flag. It wins trust through borrowed product photos, countdown timers, fake reviews, and checkout pages that appear just polished enough. OSINT helps investigators move past the homepage and ask a better question: what infrastructure, content, and behavior does this shop share with known scams?
Start with the store’s origin story
Domain age, registrar patterns, DNS changes, and hosting neighbors can reveal whether a store appeared yesterday or belongs to a wider cluster. Newly registered domains are not automatically malicious, but a brand-new store selling scarce products at impossible discounts deserves more scrutiny.
Follow the borrowed details
- Reverse-search hero images and product photography for copied catalogs.
- Compare refund policies, “about us” pages, and contact addresses across suspicious shops.
- Inspect checkout providers, wallet addresses, and payment redirects.
- Look for templated review language and unnatural publication bursts.
Turn findings into action
The most useful report does not simply say “this looks fake.” It shows why: registration timeline, cloned content, payment risk, victim exposure, and links to related storefronts. That evidence supports payment processor abuse reports, marketplace warnings, and customer protection alerts.