Fake iPhone 18 deal sites spiked the moment Apple went on stage

According to Guardian News and Media, criminals began registering fake iPhone sales sites in the same window Apple used to unveil its new phones. The timing was not a coincidence. It was a pattern, and it showed up in the domain registration data before a single scam site had tricked anyone.

Security researcher Alexandre François, who investigates scams for WhoisXML API, tracked domain names containing words like Apple and iPhone across the last four iPhone launches. Registrations peaked on keynote day itself, jumping to more than 200 new domains within 24 hours, against zero or one on a normal day. That spike happened before the scam sites had product photos, prices or fake battery claims. The registration itself was the earliest signal.

What the spike reveals

Most warnings about scam shopping sites focus on the finished fake: the too-good price, the countdown timer, the AI-generated product shots. Those things matter, but they appear late, after the site is built and live. The domain registration spike happens first, days before the site is dressed up to look real. That gap between registration and launch is where the scam is still forming rather than already operating.

Apple's iPhone 18 Pro starts at £1,199 and the 18 Pro Max at £1,299. Scam sites are expected to undercut both by a wide margin, and to add pressure tactics such as a deadline of a few hours to buy. François notes that once technical specifications are public, fraudsters can build sites that are far more convincing, because they can match real details to a fake storefront. The content gets better after launch. The intent, based on the registration data, was there before launch.

Why detection lags behind registration

Some of these sites are already flagged as dangerous by dozens of security engines, according to François, yet still sit outside the blocklists that browsers and security tools use. That means a site can be known to be fraudulent to researchers and still load normally for anyone who clicks the link. The problem is not that nobody notices. It is that noticing and blocking are two separate steps, and the second one is slower than the first.

This is the kind of pattern Flggd watches for: not the finished scam page, but the registration surge that precedes it, days before most people start searching for a cheap deal.

Paying by bank transfer to an unfamiliar site removes the usual card protections, and the source notes the sites often only accept payment this way. Anyone searching for a discounted iPhone 18 Pro or the new foldable iPhone Duo in the weeks after launch is searching in exactly the window these domains were built for.