Is That Really the Mill? How to Spot Cloned Steel Websites

October 18, 2026

Fraudsters copy the names, logos and certificates of well-known steel mills onto look-alike websites and email addresses, then take orders and payments. How to tell the real mill from the clone.

Short answer: find the mill's official website yourself, not through a link in an email, ad or chat. Compare the address letter by letter, and confirm any salesperson, order or bank account through the contacts listed on that official site.

How a clone works

An address that looks right: an extra letter or hyphen, a different ending, or the mill's name plus "steel", "group" or "trading".
Copied content: the real mill's logo, photos, certificates and company history.
Look-alike email: messages from the copied domain, or from a free email account using the mill's name.
A "sales office" that sells cheap: prices below the real mill's, small quantities of anything, and a request for advance payment.

What the mills themselves say

"Steel is not being delivered." A large German steel distributor warns that scammers are "registering numerous domains fraudulently advertising steel products with our brands", using misspellings of its name and invented "Inc." companies. Its summary is blunt: "The offers are made against advance payment. Steel is not being delivered."
Only official addresses. A European stainless steel producer lists the websites it sells through, says it does not sell through third-party marketplaces or online shops, and says its emails come only from its own domain. An "official store" somewhere else is therefore a warning sign.
Fake ads and chat profiles. A global steelmaker's Brazilian unit reports fraudulent websites and fake WhatsApp profiles using its brand since July 2023, with fake quotes asking buyers to pay into accounts in other names. It says criminals "even boost marketing campaigns for their ads on the Google Ads platform", tells buyers to check that the payment beneficiary matches the company, and to "never trust phone numbers listed on other websites." The same group's Mexican unit warned in October 2025 that nine look-alike company names had recently been registered in the United States.
A copied website. A Japanese steelmaker warned that a company "has been found to have plagiarized" its website, and that emails from two look-alike domains had nothing to do with it.

Real cases

Two letters off (2021). A domain two letters away from a global steelmaker's name was registered in February 2021 and used for "sending emails impersonating one of the Complainant's employees seeking to redirect payments". A WIPO panel found "bad faith intent to use the disputed domain name for purposes of soliciting fraudulent payments" and ordered the domain handed over to the steelmaker.
One extra letter (2020). A domain with one extra letter in a steel trader's name was used to email customers asking for bank details. It was transferred to the trader in January 2020.
US$3.7 million (2024). A US steel service company said in a court filing that fraudsters posing as a subsidiary of another steel company emailed it wire instructions, and that it sent US$3.7 million to two bank accounts.

The FBI counts more than US$55 billion in exposed losses from business email compromise worldwide between October 2013 and December 2023, and tells businesses to "be alert to hyperlinks that may contain misspellings of the actual domain name."

Warning signs

The web address is not the one in the mill's annual report or stock exchange filings.
The domain was registered recently.
Contact only through chat apps or free email.
A bank account that is not in the mill's name, or is in another country.
The "mill" will sell any product in any quantity, at a price the real mill would not match.

How to check a mill in five steps

Find the official address independently: from the mill's annual report, its stock exchange filings, or a source you trust, not from the message you received.
Compare it letter by letter with the address in the email and on the website.
Check the domain's age with a public WHOIS lookup. A site that claims decades of history but was registered last month is a clone.
Call the mill's main switchboard, using the number on its official site, and ask them to confirm the salesperson, the order and the bank account.
Check the contract party: the company on the contract, the company in the business registry and the holder of the bank account should be one and the same.

How SinoAli handles it

Your contract is with a registered Chinese company, and you choose who inspects. We can help clarify specifications, check documents, coordinate inspection and arrange dispatch steps. Any product on sinoali.com can be bought through a SinoAli contract.