One Hundred Thousand Fake Websites

Cloning a brand used to take effort. A designer, a developer, some time, and enough attention to detail that most attempts still looked slightly wrong. That friction was doing more security work than anyone realized, and it is gone.

The cybersecurity firm Netcraft reported identifying one hundred thousand AI generated websites impersonating almost two hundred brands. Not one hundred thousand phishing emails. One hundred thousand sites. That number tells you something important about the shape of the problem. This is no longer a targeted attack you might personally attract. It is ambient. The clone of whatever you are using probably already exists, and it is indexed, and it may be buying ads against the real name.

The clones have also gotten deeper than a copied landing page. They ship with responsive fake support chatbots that answer questions in brand voice. They come as mobile applications distributed through official app stores, displaying server controlled data engineered to look like real performance. The counterfeit now includes the parts of the experience that used to be too expensive to fake, which means the old advice about checking for typos and awkward English is close to useless. The tell that everyone learned to look for was the tell that generative tools fixed first.

So the practical guidance has to shift from spotting fakes to arriving safely. These habits are unglamorous and they work.

Navigate by bookmark, not by search. Save the real address once, from a source you trust, and use only that. Search results are an auction, and the counterfeit can outbid the original.

Never install from a link sent to you, including a link sent by someone you know, whose account may not be theirs anymore.

In an app store, read the publisher name, not the app name. App names are trivially duplicated. Publisher identity is harder to forge and almost nobody checks it.

Treat urgency as a signal in itself. Cloned experiences depend on you moving quickly, because speed is what stops you from verifying. Any message that combines a link with a deadline deserves the opposite of the reaction it is engineering.

And confirm through a second channel that the attacker does not control. If something claims to be from a company, go to the company yourself rather than replying where you were contacted.

There is a broader point here about what scale does to trust. When producing a convincing copy costs almost nothing, the ability to visually distinguish real from fake stops being a viable defense for ordinary people. What remains is provenance. Where did this link come from. Who published this application. Which of these did I go find, versus which one came and found me.

We take this seriously for our own name because the same tools that will eventually clone us are already cloning everyone else at scale. Access the real thing through official links only, verify the publisher before installing anything, and assume that any Bluwhale communication reaching you through a direct message is not from Bluwhale.

Put your money to work without giving up the keys. bluwhale.com

‍