Fake ‘Olympics Shop’ Ads on Meta Lead Netizens to Cloned Websites Promising 80% Off Merch

Bitdefender Labs is tracking an ongoing scam campaign on Meta platforms targeting people in the EU and the US, using fraudulent “Olympics Shop” advertisements that offer discounts of up to 80% on Milano Cortina 2026 merchandise.

Users who click on these ads and interact with the fraudulent websites expose themselves to several risks. Many similar scam operations are designed to steal payment card information at checkout, harvest personal details such as names, addresses, phone numbers, and email accounts, and in some cases collect login credentials.

Victims may also receive counterfeit merchandise — or nothing at all — after completing a purchase. In many instances, the sites disappear shortly after processing payments, leaving buyers with no way to recover their money.

At a glance, the ads look legitimate.

They feature official Olympic imagery, professional product photos, and convincing promotional messages such as:

“Olympics Exclusive! Up to 80% OFF.
30 Days No Excuse Free Return.
🛒Get Yours Before Out of Stock!”

“Olympics Esclusivo! Sconti fino all'80%.”
“Reso gratuito entro 30 giorni, senza domande.”
“Acquistalo prima che finisca!”

But the danger begins after the click.

Near-Perfect Clones of the Official Olympics Shop

The fraudulent websites are not crude copies – they are near-perfect replicas of the official Olympics merchandise store.

Bitdefender Labs observed that the scam sites use:

• The same product photos
• Identical color schemes
• The same merchandise collections
• Official branding elements
• Similar layout structure

At a glance, most users would struggle to tell the difference.

The deception lies in the small details.

For example:

• The legitimate store promotes “Sign up & Save 15%.”
• The scam websites advertise “Sign & Save 80%.”

Official Olympics Shop

Fake Olympics Shop

That small wording change reflects the core tactic: inflate discounts to trigger a sense of urgency and bypass skepticism.

Font rendering may be slightly different. Minor layout inconsistencies appear in certain sections. Domain names look similar but are newly registered and unrelated to the official organization.

These subtle discrepancies are easy to miss when a user is focused on a limited-time deal.

Coordinated Scam Infrastructure

This campaign shows clear signs of coordination, and as Labs researcher Andreea Olariu points out, most of the fraudulent domains were registered within days of each other:

• www.olympics2026[.]store – created Feb 3
• Olympicseu[.]shop – created Feb 9
• olympics-sale[.]top – created Feb 9
• olympics-hot[.]top –  created Feb 9
• www.olympics-top[.]shop –created  Feb 10
• Olympicssportswear[.]shop – created Feb 10
• Olympexapparel[.]shop – created Feb 10
• Lifestylecollection[.]shop – created Feb 10
• www.2026olympics[.]store – created Feb 11

Following the initial detection of the scam advertisements, Olariu observed ongoing domain registrations consistent with the same impersonation strategy. The daily appearance of new lookalike domains indicates an adaptive infrastructure designed to evade detection and extend the campaign’s lifespan.

Most recent domains include:

• Olymponline[.]top – created Feb 11
• Postolympicsale[.]com created Feb 11
• sale-olympics[.]top - created Feb 11
• olympics-save[.]top  - created Feb 11
• olympicssportswears[.]shop - created Feb 11
• olympicsfashionhub.[]shop - created Feb 12

All these domains are flagged as fraudulent by Bitdefender security systems.

In some instances, ads appear to display the official shop preview but silently redirect users to www.olympics2026[.]store for example.

Newly Created Facebook Pages Running the Ads

Another strong indicator of fraud: the Facebook pages promoting these ads are newly created.

Bitdefender Labs observed that several of these pages were set up on the same day the scam domains were registered. This suggests a rapid deployment model:

1. Register domain
2. Clone official website
3. Create Facebook page
4. Launch ad campaign
5. Begin collecting payments

All within a short time window.

Legitimate global brands rarely create brand-new pages and immediately launch aggressive 80% discount campaigns tied to major international events.

The sophistication of the cloning significantly increases the risk. When scam sites mirror official branding almost perfectly, users default to visual familiarity instead of domain verification.

That’s exactly what attackers are counting on.

How to Stay Safe

Major sporting events always attract copycat fraud. Here’s how to stay safe:

Check the domain carefully.
Official global brands rarely operate from newly registered domains created days ago. Be suspicious of extensions like .top or unfamiliar .shop variations.

Look beyond the visuals.
Scam sites may copy images and branding perfectly. Focus on the URL, domain age, and subtle wording differences.

Be wary of extreme discounts.
An 80% discount on official Olympic merchandise should raise immediate questions.

Check the Facebook page transparency.
When was the page created? Does it have authentic history and engagement? Newly created pages pushing high-pressure sales are a red flag.

Verify suspicious links before clicking.
If you’re unsure about a website, run the URL through Bitdefender Link Checker. It can quickly tell you whether a domain is known to be malicious.

Ask Scamio to analyze the offer for you.
You can also paste suspicious messages, ads, or website links into Bitdefender Scamio. Scamio uses advanced AI to analyze content and tell you if it matches known scam patterns.

Avoid rushing purchases.
Urgency is a manipulation tactic. Take a moment to verify before entering payment or personal information.

Use layered protection.
Security solutions that detect scam domains in real time can block fraudulent sites before you submit sensitive data.