Advent calendar buying guides are already appearing across the holiday shopping coverage this year. Social media can also put unfamiliar sellers directly in shoppers’ feeds. We found several stores using the same website template, product images with an AI-generated content watermark, and a TikTok account using one store’s branding to link straight to its product page.

We examined stores selling a Legend of Zelda music calendar, a Michael Jackson music calendar, a Lord of the Rings figure calendar, and Harry Potter character plant pots. Other stores, including one selling a Metallica calendar, use the same layout, low-stock warning, and recycled marketing lines. We found no licensing information on the stores, which is reason enough to avoid them.

Fake reviews and countdowns create a false sense of demand

Each store sells a single product. Its page surrounds polished product images with urgency cues: a sale that ends today, a low-stock warning, a five-minute cart reservation timer, a count of orders placed in the last day, and star ratings with thousands of reviews. Testimonials appear underneath, with “verified buyer” badges and timestamps such as “three hours ago.”

None of it is connected to anything. The ratings, review counts, and testimonials are entered into the site theme manually, rather than generated by a review system. The timestamps don’t change, and countdowns reset and run again—on some stores, every day.

Checkout runs through Shopify. That doesn’t establish whether orders will arrive or match their descriptions, and our investigation found no evidence that these pages were designed to steal card details. The risks we can support are misleading sales claims and the possibility of paying for something that never arrives or is very different from what was advertised. Several stores also offer optional checkout add-ons, including shipping protection, a queue-skip fee, and a mystery gift. On one store, these add-ons total nearly $35.

The Zelda calendar’s description contradicts itself

The clearest finding needs no technical analysis. The listing says each of the 25 discs holds a small chip storing your track data, and that the included player reads it and plays music through a built-in speaker with no app, no subscription and no Wi-Fi. Elsewhere on the same page it says the discs work with Spotify, Apple Music and YouTube, and that you can re-link any disc to a new song using a chip-writing app on your phone.

These claims cannot all be true. A device without a network connection can’t stream music from those services. And the instructions for linking discs to new songs suggest that each chip stores a link to a track, rather than the track itself. That’s how the legitimate version of this product works, according to our research: the chip holds a link, and a phone plays the music. Someone appears to have copied that mechanism and bolted a fictional standalone speaker onto it.

The bundle pricing also doesn’t add up. Two bundles claim savings of $15 and $33, but the prices shown below them work out to about $19 and $43 in savings.

The stores are copies of one another

Despite their different names, the stores we examined are nearly identical. They use the same commercial theme version and share an internal fingerprint indicating that their theme files are copies of one another. They also block right-clicking and access to developer tools.

The most direct link was left behind by accident, in that one store’s theme is still named after the file it was exported from, and that filename includes the web address of another store in the group. Other pages contain leftover text from a previous shop, including a warranty promising to replace costumes that don’t inflate properly and a scrolling banner with the unedited placeholder “use code X for X percent off.”

The stores’ files are timestamped from mid-July to the second week of September, with the newest store only days old when we examined it. Most merchant accounts are registered in Romania, while prices are shown in dollars. None of the calendar stores we examined listed a business address or phone number.

The pattern runs well past unlicensed character merchandise. We found advent calendars for fishing lures, squishy toys, charm bracelets, and wearable jumpers, with the same countdowns, stock warnings, and paid add-ons. Most appear to sell real, inexpensive goods at a steep markup. Their add-on prices differ, so we can’t conclude that the same person runs all of them. The evidence points to a shared sales playbook, not necessarily a shared owner.

What the evidence shows, and what it doesn’t

Product images from two of the calendar stores triggered a provenance checker for a watermark, indicating they were produced with OpenAI tools. The filenames agree: across three stores every product image follows the same automated naming pattern, and one store’s entire photography set is timestamped to a single afternoon.

A TikTok account uses one store’s name and branding and links directly to its product page. Several videos claim the store is collaborating with Walmart. They show retail scenes, including an oversized character figure outside a store and pallets of branded boxes. We found no evidence of such a partnership. The videos also depict scenes that don’t appear to be real. Combined with the shared website template and the filename linking two stores, this suggests that one operator or a closely connected group may be involved. It doesn’t establish who is behind the stores.

How to spot a questionable store before you pay

In our survey earlier this year, 22% of respondents said they had been “misled by AI-generated photos or product reviews.”
Here are some checks that can help you spot warning signs.

• Be wary of endless urgency. If a sale keeps “ending today” or low-stock warnings never change, don’t treat them as proof of a genuine deal.
• Check that the product could exist. Search the product type and read how the real version works. If the listing claims something the technology can’t do, stop there.
• Don’t arrive through a link. These stores sell largely through social video. Search the brand name separately and look for history, press, or customers outside its own website.
• Treat partnership claims as claims. A video saying a brand is stocked by a retailer isn’t evidence that it is. Partnerships are announced by the retailer too, not only by the seller.
• Look for a real business. A postal address, company registration and working phone number are easy for a legitimate seller to provide and were absent from these.
• Reverse-image search the photos. Generated images usually have no history anywhere else online. A complete absence of results is itself informative.
• Read the small print against itself. If a calendar’s warranty talks about inflatable costumes, the page wasn’t written for the product you’re buying.
• Check the spelling, including on the box. We found a misspelled artist name in a product title, a mangled savings line, and a calendar with the word spelled “calindar” on the packaging artwork itself. A real manufacturer proofreads its own box.
• Pay with a method that offers buyer protection. A credit card or payment service with buyer protection gives you a route to a refund. Bank transfers can be harder to reverse.

Malwarebytes Browser Guard blocks scam sites, which can help when a link appears in your feed before you’ve had a chance to look up the seller.

Malwarebytes Scam Guard lets you check a suspicious link, message, or screenshot when something feels off but you can’t say why.

If a purchase leads to follow-up texts or calls about delivery fees, customs charges, or a refund, Malwarebytes Scam Number Check can tell you whether the number has been reported. A follow-up message can turn a bad purchase into something worse.

---

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free →