Two fake Typology stores shared the same infrastructure. Both looked like the real thing.
Our domain sweep found two live storefronts using Typology's identity and product catalogue. They were not loose references or parked domains. Both presented themselves as working skincare shops and both resolved to the same server.
- 90%
- Highest visual similarity
- 2
- Live storefronts
- 70%
- Typical discount
- 1
- Shared server IP
What the scanner saw
The official Typology homepage uses a deliberately restrained visual language: a black announcement bar, a centred Typology Paris mark, sparse navigation, pale editorial photography, and product-led copy. The fake stores reproduce that same hierarchy closely enough to feel familiar before a shopper reads a word.
The fake is not a pixel-perfect mirror. It swaps the hero photograph, moves search into a large field, changes the navigation labels, and shows prices in dollars. Those differences make it look like a regional storefront rather than an obvious duplicate.
A copy does not need the same pixels. It needs the same signals of legitimacy in the same order.
Four signals behind the finding
Both stores use the Typology wordmark with the PARIS lockup, centred above a sparse beauty-commerce navigation.
Real product names appear throughout, including Skin Texture Refiner T30, Hydrating Serum A3, and Tinted Concealer T20.
Products are repeatedly reduced to 30% of their listed price. A $41.50 product becomes $12.45 and a $31.50 product becomes $9.45.
typologydeal.co and typologydeal.com resolved to the same IP address and used the same pair of nameservers when captured.
Why two domains matter more than one
The two lookalike domains showed the same page title, the same storefront design, the same pricing pattern, the same nameservers, and the same A record. That is a cluster, not two unrelated coincidences.
One domain was registered on 17 August 2026. The other used a country-code extension whose public registration record was unavailable to the scanner. Infrastructure linked them even where ownership records could not.
How strong is the match?
The visual assessment scored typologydeal.co at 90% similarity with 93% confidence, and typologydeal.com at 88% similarity with 96% confidence. Both were classified as likely copycats.
The page text itself recorded no broad text overlap with the official homepage. The result came from the exact brand presentation, category, commerce structure, product naming, and visual treatment working together.
What the evidence supports next
A practical enforcement sequence based on the archived finding.
Archive the full cluster
Preserve both pages, DNS records, timestamps, product pages, and checkout paths before the operator can change them.
File with the host and registrar
Submit one evidence package that connects both domains to the same infrastructure and brand presentation.
Escalate the commerce layer
Identify the payment provider and report both storefronts together so the cluster is reviewed as one operation.
Watch the fingerprint
Monitor the shared IP, nameservers, page title, brand lockup, and product-copy pattern for the next domain.
The detail worth remembering
The word deal is the only warning in the domain. Everything after the click is designed to explain it away: a familiar brand, real products, polished photography, and prices that look like a promotion.
Finding one fake store removes one URL. Connecting the two stores changes the enforcement target from a page to an operator pattern.
Scan your own brand
What would the scanner find around your brand?
Run the same sweep across lookalike domains, storefronts, marketplaces, ads, and social accounts.
Next breakdown
Fake storefrontsA fake Nobody's Child store copied 12,817 products, and the brand's own terms of trade.
nobodyschildshop.com uses Nobody's Child's photos, product tags and legal pages, then marks everything about 70% off an inflated price. Three more lookalike stores were live, and two others had already been suspended.