Hijacked websites sent Rixo shoppers to a discount shop selling the Kornelia skirt for $99.
Our domain sweep checked 100 Rixo lookalike domains and found 8 that were registered or live. None of them was a Rixo store. The route to shoppers came from somewhere else. An exact-image search on 12 official Rixo product photos found the Kornelia skirt photo on 26 unrelated websites that had been indexed with Rixo product pages. When we arrived on those pages from a Google link, most sent us through the same redirect server, and one landed on tbqdeals.shop, a discount shop selling the skirt for $99 with Rixo's own photograph.
- 26
- Hijacked sites with Rixo pages
- 22
- Sent visitors to one redirect server
- $99
- Kornelia skirt on tbqdeals.shop, vs $275
- 98%
- Photo match, Kornelia skirt
What the scanner saw
The official Rixo homepage leads with a full-width campaign image for its Bay Garnett collaboration, the RIXO wordmark centred above it, and a short Shop, New in, Dresses, and Archive menu. The Kornelia skirt sits in Rixo's archive sale, behind an email sign-up.
tbqdeals.shop looks nothing like it. It calls itself 2026 Deals Shop, lists high-street and sportswear brands at half price, and has no Rixo branding in its header. Its Kornelia page, though, carries the Rixo product name, Rixo's studio photo of the skirt, and a You Might Also Like row of four more Rixo pieces, all shown with Rixo's own photography.
The shop never used the Rixo name in its header. It only needed Rixo's name in a search result, and Rixo's photo on the page.
Four signals behind the finding
26 websites with no connection to fashion, including university pages and a health practice, were indexed with titles such as Rixo Kornelia Silk-Velvet Mini Skirt Black 2026 Outlet Online. Each used a numbered web address, and 11 different Rixo product names appeared across them.
Opened from a Google link, 22 of the 26 pages sent the visitor to the same redirect server on camuya.shop. On our first visits it forwarded us on to three shop domains. Two, ebeinx.shop and wbcoxu.shop, no longer resolved. The third, tbqdeals.shop, was live.
The shop's image of the Kornelia skirt matches Rixo's official photo with a combined image-hash distance of 4, where 0 means identical. Its photo of the Jude Wool Jacket in Bliss Embroidery Brown has a distance of 0.
tbqdeals.shop sells the Rixo Kornelia Silk-Velvet Mini Skirt for $99.00 against a crossed-out $220.00, and calls it Authenticity Guaranteed. The skirt costs $275 on Rixo's US site and £185 in the UK.
The evidence from tbqdeals.shop
Left: Rixo's official Kornelia photo. Right: the image on tbqdeals.shop. Combined hash distance of 4.
The Jude Wool Jacket in Bliss Embroidery Brown. The image hashes match exactly.
Four more Rixo styles in a You Might Also Like row, under a TBQDEALS.SHOP footer.
How the pages send shoppers on
The hijacked pages show different things to different visitors. Opened directly, the ones we checked showed the site's normal homepage or a security check. Search engine crawlers were served a Rixo product page instead. One we checked was dressed up as a product page from a US electronics retailer, listing the Kornelia skirt at $77 alongside ten more Rixo styles, with images loaded both from Rixo's own servers and from a third-party image domain.
Visitors arriving from a Google link got a third version: a script that forwarded them to ns1.camuya.shop, which then chose a shop. The image folders on the hijacked page and on tbqdeals.shop share the same catalogue number, 2878, which suggests both draw on one product feed. After our first round of visits, the redirect server began sending us to an unrelated placeholder site instead, so we could not test every page against a live destination.
Disposable shop domains
The shop domains look built to be replaced. ebeinx.shop and wbcoxu.shop were registered through the same registrar on 27 January 2026, one second apart. Both were put on hold by the registrar at 13:45 UTC on 25 September, a little over an hour before our capture, which is why they no longer resolved. tbqdeals.shop was registered on 5 January 2026 through a different registrar, and the redirect server's domain, camuya.shop, on 3 February 2026 through a third.
tbqdeals.shop and the redirect server both sit behind Cloudflare, which hides the servers that host them. The shop's about page describes a general shopping centre selling shoes, bags, cosmetics, watches, and home accessories. Its shipping page quotes a $50 express charge and promises delivery outside Germany, but none of the pages we opened gives a company name or address.
Not every lookalike was a fake store
The image search also found 31 pages on another set of unrelated websites that used Rixo's Kornelia or Aara Red photos under other labels' product names, such as a black velvet mini skirt and a red cardigan set. We could not open those pages to see where they lead, so they are reported from the search index only.
The domain sweep was quiet. rixofashion.com is a store trading as RixoFashion that sells other labels' trainers, bags, and T-shirts plus bundles called RIXO COMBO DEAL, but no Rixo clothing; the scanner rated it a possible copycat at 41% similarity. myrixo.com is a clearance store named Miryxo selling unrelated goods, and rixostudio.com, registered on 24 August 2026, shows a coming-soon page. On the marketplaces, eBay returned second-hand Rixo resale at $50 to $350, Alibaba returned Rixo Enterprises and Rixos hotel furniture, and Amazon returned unbranded skirts.
What the evidence supports next
A practical enforcement sequence based on the archived finding.
Archive the chain
Preserve the hijacked page titles, the redirect URLs on camuya.shop, and the tbqdeals.shop product pages, with DNS and registration records, before the shop domains rotate.
Use the photographs
The Kornelia and Jude images on tbqdeals.shop match Rixo's own files. Send the matching pairs to Cloudflare to identify the host, then file copyright notices with that provider.
Report the redirect server
Send camuya.shop and tbqdeals.shop to their registrars with the evidence, noting that two sister shop domains have already been put on hold.
Report the hacked pages
Submit the 26 pages to the search engine as spam, and notify the site owners, who are unlikely to know their websites are advertising Rixo skirts.
The detail worth remembering
No Rixo lookalike domain was needed. Shoppers searching for a Rixo skirt could land on a university or clinic website, and be passed along to a shop that never shows the Rixo name in its header.
The domains in this chain are cheap and replaceable, and two had already been switched off on the day we looked. The photographs are the part that stays the same, and they are Rixo's own.
Scan your own brand
What would the scanner find around your brand?
Run the same sweep across lookalike domains, storefronts, marketplaces, ads, and social accounts.
Next breakdown
Fake storefrontsA fake Nobody's Child store copied 12,817 products, and the brand's own terms of trade.
nobodyschildshop.com uses Nobody's Child's photos, product tags and legal pages, then marks everything about 70% off an inflated price. Three more lookalike stores were live, and two others had already been suspended.