Skip to content

Fake-shop warnings in your browser

If you open a shop from our warning list, the Fakeshop AI extension puts a warning over the page before you enter data or pay there. The matching runs in your browser.

As of 03/10/2026: The extension is built for Chrome, Edge, Firefox and Safari. It is not public in any store yet, so there is no install link.

See the warning

Preview · example of a warning. Redrawn with the texts of the extension. Shop, address and prices are made up.

What you see when a shop is listed

Four moments on a made-up shop. All text in the picture is taken word for word from the extension.

If the site is on the list with the assessment “Danger”, the warning covers the shop before you enter anything. It names the source and the list date and leaves you two ways forward.

technik-lager.invalid

Fakeshop AI

Danger (Note on this assessment)

This site is on our warning list

Our automated assessment for technik-lager.invalid is danger. Do not enter data or pay here before you have read the check report.

What we know

Assessment
Danger (automated)
Source
Fakeshop AI warning list
List as of
03/10/2026

Load source and check dateThis sends the address of this site to fakeshop.ai.

The match ran in your browser. The assessment is automated and not a legally binding determination.

Redrawn with the texts of the extension. Shop, address and prices are made up.

The list is based on our check results. It is a risk signal, not a legally binding finding. Methodology

What the extension does and what it transmits

What the extension does

  • Compare every page you open with the warning list locally, including parent domains

  • Overlay a warning on the page and colour the icon

  • Update the list every four hours

  • Offer exceptions and an on/off switch

What it transmits and stores

  • Every four hours it loads a list of checksum prefixes from fakeshop.ai. As with any request, the server sees your IP address.

  • On a possible match it requests the checksums for that prefix. Four bytes are sent; the domain stays in the browser.

  • The domain itself only reaches us when you click “Load excerpt”, “Open report” or “Report shop”.

  • List, settings and exceptions are stored in your browser. No warning from the extension is not an all-clear: for shops that are not on the list, the shop check remains the way.

How your domain stays with you

The list is downloaded and the matching runs in your browser. It uses hash prefixes, as Google Safe Browsing does.

  1. Load the list

    The extension only loads the first 4 bytes of HMAC-SHA256 checksums. It never receives the domains themselves.

  2. Compare locally

    For each page your browser computes the same checksum and checks whether its start is on the list. Usually it is not, and nothing is sent.

  3. Ask about the prefix

    On a match the extension asks only about that prefix and receives all full checksums that start with it.

  4. Decide for good

    Whether the page is listed is again determined by your browser. Only then does the warning appear.

Privacy in three points

Local check

The check runs in your browser. The domain you visit stays there and does not reach us in plain text.

k-anonymity

Only on a possible match does a 4-byte prefix of the checksum go out. Many domains share the same prefix, so it allows no conclusion about the page you visit.

Only the version number

Each request carries the extension’s version number and nothing else. Settings stay in your browser.

Which browsers the extension supports

The extension is built for these four browsers. It has not been submitted to or approved by any store. As soon as an entry is public, the link appears in this overview. Mobile details as of 3 October 2026.

  • Chrome

    not available yet
    Store and requirement
    Chrome Web Storecurrent Chrome version
    Release status
    Package ready. Also runs in Opera, Brave and Vivaldi.
    On mobile
    Chrome for Android does not allow extensions. We cannot warn automatically there. Paste a shop address into the shop check before you buy.

  • Edge

    not available yet
    Store and requirement
    Microsoft Edge Add-onscurrent Edge version
    Release status
    Uses the Chrome package.
    On mobile
    Edge for Android only has a curated catalogue with a few extensions. There is no route for ours.

  • Firefox

    not available yet
    Store and requirement
    Firefox Add-ons (addons.mozilla.org)Firefox 140 or later
    Release status
    Package ready for desktop and Android.
    On mobile
    Firefox for Android loads extensions from Firefox Add-ons when they are marked for it. Our package carries that marking. If you want automatic warnings on an Android phone, this is the most direct route once the listing is public.

  • Safari

    not available yet
    Store and requirement
    App Store (Safari extension)Safari 16 or later
    Release status
    The project for Mac, iPhone and iPad builds; the App Store listing is still missing.
    On mobile
    Safari takes extensions through an app from the App Store. Our project for it builds, but there is no store listing yet. On iPhone, Safari shows no icon badge; the warning over the page is the signal. Safari asks for permission per website or for all websites.

Technical details

Permissions
Storage, alarms (for updates), active tab and access to websites so the warning can be shown.
Stored locally
The prefix list with its date, your on/off switch and your exception list.
Network requests
Only two kinds: loading the list and asking about a prefix. Both go to fakeshop.ai and carry the extension’s version number.
Updates
Every 4 hours in the extension, right after installation and on request. On the server the list is rebuilt every 15 minutes.
Languages
German and English, depending on your browser’s language.

Frequently asked questions

More on this topic: detecting fake shops, current warning list and consumer tips.

Is the browser extension free?

Yes. The Fakeshop AI extension costs nothing and needs no registration.

Are the pages I visit transmitted?

No. The matching happens in your browser. Only if the 4-byte prefix of a page’s checksum appears on the list does the extension request that prefix and receive all full checksums sharing it; the final comparison happens locally again. The domain reaches us in plain text only if you click “View full check report” yourself.

Which browsers is the extension available for?

It is built for Chrome, Edge, Firefox (version 140 and later) and Safari. It is not public in any store yet, so there is no install link. The overview above shows the status per browser.

How up to date is the warning list?

The extension reloads the list every four hours, as well as right after installation and on request. On our server the list is rebuilt every 15 minutes. Shops we have not checked yet are not on it.

Does the extension collect data or track me?

No. There are no analytics or tracking tools and no advertising cookies. Apart from loading the list and the prefix lookup, the extension makes no network requests.

What happens if I open a listed shop?

A warning covers the page and the toolbar icon shows a warning sign. You can open the full report on fakeshop.ai or deliberately continue. “Continue anyway” only applies to this tab until you close it.

Can I set exceptions for shops I know?

Yes. In the settings you maintain an exception list, which also covers subdomains, and turn protection on or off.

Note

The warning is based on the automatically generated Fakeshop AI warning list. A shop we have not checked yet triggers no warning. The extension therefore cannot warn about every fake shop.

Automated assessment, partly generated with AI. No guarantee, not legal advice. Liability as set out in our terms of use. How we check.