The strongest protection against fake discount sites is to monitor lookalike domains before the season starts and to publish one official campaign address. When a fake site goes live, capture the evidence first, then report it the same day to the ad platform, the registrar and the hosting provider; if it harvests card or login details, report it to the national cyber authority as well. UDRP and .tr dispute filings take the domain for good, but they may not finish before the campaign does.
How does a fake campaign usually work?
It tends to start with a social media ad. Turkish newspaper Takvim reported on 21 January 2026 that the national cyber incident centre USOM had blocked access to 350 imitation supermarket sites promoted as "instant deals" on social media. Türkiye's Ministry of Trade warned consumers back in 2019, in a statement on sale campaigns, that sites reached through social media ads may be imitations.
| Stage | What happens | Signal to catch |
|---|---|---|
| Registration | A domain combining your brand with "sale", "outlet" or "deal" is registered | Newly registered lookalike domain |
| Build | Logo, product images and price list are copied | An empty page turning into a shop |
| Launch | Ads and social posts send traffic to the site | Unknown advertiser, unapproved landing page |
| Collection | Card details or bank transfers are taken, nothing ships | "My order never arrived" calls to your support team |
| Rebirth | The site closes and the same content moves to a new domain | Same images and contact details |
What should be ready before the season starts?
Hunting for documents and sign-offs after a campaign opens costs days you do not have. Close this list in advance:
- Domain list: common typos, your brand plus campaign words, other extensions. Register the riskiest few yourself. You cannot buy them all, so monitor the rest.
- One official campaign address: publish the campaign under your main domain and use the same address everywhere, so that "is this site yours?" has a one-line answer.
- Ad account list: your accounts and your agency's. An advertiser who is not on it is your starting point.
- Ready file: trademark certificates, power of attorney, a list of official domains and a one-page brand summary.
- Decision chain: who approves and who sends when a site turns up on a Saturday? Name one owner across marketing, legal and security.
- Customer service note: when someone reports a fake site, ask for the address, a screenshot and the payment time. All of it goes in the file.
What is the order once you find a fake site?
Capture first, because the site may vanish or change after a report. Take a screenshot, the full URL, the time, WHOIS, DNS and SSL details, the redirect chain and the link of the ad that led there. If litigation is possible, notarize before reporting; see whether a screenshot counts as evidence.
Then classify. Is the site collecting card or login details, selling fake goods, or just sitting empty? The answer decides which channel will work:
| Channel | When | Basis | Limit |
|---|---|---|---|
| Ad platform | Traffic comes from ads | Platform trademark and complaint rules | Return under a new ad account |
| Registrar | Phishing on a generic TLD | ICANN Registrar Accreditation Agreement, section 3.18 | The definition does not cover every fake shop |
| Hosting provider | Almost always | The provider's abuse rules | Response times vary |
| Cyber Security Presidency (Türkiye) | Fake company site, phishing | The authority's report form | The authority decides, no committed timeline |
| UDRP or .tr dispute | To take the domain permanently | ICANN UDRP, Internet Domain Names Regulation | May conclude after the campaign |
| Court or prosecutor | Organized, repeated cases | Industrial Property Law No. 6769 | Slow, needs counsel |
What does a registrar report actually achieve?
An ICANN contract amendment in force since 5 April 2024 requires accredited registrars to publish an abuse contact, acknowledge reports and investigate them. Under section 3.18.2, once a registrar has actionable evidence that a name it sponsors is being used for DNS abuse, it must promptly take the mitigation steps needed to stop or disrupt it.
The definition matters. DNS abuse means phishing, malware, botnets, pharming and spam used to deliver them. A site harvesting card details clearly qualifies. A site that only sells fake goods may not, so your report should show with a screenshot exactly what the site collects. The agreement does not cover .tr names.
When do you use the government report form?
According to USOM's own notice, its incident reporting and malicious link lists now run through the website of Türkiye's Cyber Security Presidency. The authority's report form explicitly lists fake bank, institution and company websites. Give the fake address, your official address and a short comparison. Customers who lost money can go to a public prosecutor separately; whether the brand files its own criminal complaint is for its counsel to assess.
When does a dispute filing make sense?
Use the permanent route when the domain survives the campaign or keeps being reused. Under the UDRP you prove similarity, no legitimate interest, and registration and use in bad faith; the remedy is cancellation or transfer. For .tr names, managed through TRABİS since 14 September 2022, Article 25 of the Internet Domain Names Regulation sends you to an accredited dispute resolution provider, and bad faith in either registration or use is enough. More detail is in our cybersquatting guide.
Damages and injunctions fall under Articles 7 and 29 of Law No. 6769. Article 7 expressly covers unauthorized use of a mark online as a domain name or keyword with commercial effect.
What does Authex do in this process?
Authex generates lookalike domain candidates and checks which are registered and live, recording WHOIS, DNS, SSL, the redirect chain and a screenshot. In ad libraries it finds advertisers who are not on your list and landing pages outside your approved domains. Findings are ranked by risk and assigned to your team, with draft abuse reports prepared for registrars and hosts. The rights holder or their lawyer files the report or dispute. See the domain monitoring page.
Sources
- Ministry of Trade, press statement on discount campaigns, 23 November 2019 (in Turkish)
- Takvim, report on USOM and 350 imitation sites, 21 January 2026 (in Turkish)
- ICANN, 2024 Global Amendment to Registrar Accreditation Agreements
- ICANN, Uniform Domain Name Dispute Resolution Policy
- Cyber Security Presidency of Türkiye, report form (in Turkish)
- USOM, notice on the transfer of services (in Turkish)
- BTK, announcement on the launch of TRABİS on 14 September 2022 (in Turkish)
- Internet Domain Names Regulation (mevzuat.gov.tr, in Turkish)
- Industrial Property Law No. 6769 (mevzuat.gov.tr, in Turkish)
