Counterfeiters targeted Eli Lilly pill before launch

Counterfeit sellers were offering Eli Lilly's newly approved weight-loss pill online before it reached the market, according to internet intelligence company WhoisXML API. It said the activity began months before the medicine received US regulatory clearance.

Its investigation focused on Foundayo, Eli Lilly's pill-form obesity treatment based on the molecule orforglipron. Researchers found that a site at orforglipronpills[.]shop had been created well before approval and was still selling the product for USD $200 per order in strengths that do not match the approved dosing schedule.

The case highlights a broader issue for drugmakers preparing online product launches. Domain registrations meant to protect branding can also expose future product names through public WHOIS records, giving fraudsters time to build copycat websites and marketing materials before an official launch.

Eli Lilly registered foundayo.com almost two years before the drug was approved, WhoisXML API said. Its analysis found that the public ownership record identified Eli Lilly directly, making the name visible to anyone monitoring new registrations linked to the pharmaceutical group.

"While this practice helps prevent others from claiming the domains first, it also generates public WHOIS records. For foundayo.com, it lists 'Eli Lilly and Company, Lilly Corporate Centre, Indianapolis' as the owner and anyone who looked up new domains registered by Eli Lilly could see the name Foundayo two years before any regulator, physician, or patient had heard of it. By trying to protect the brand name, Eli Lilly made it public - and gave scammers an idea," said Alexandre François, DNS Threat Researcher at WhoisXML API.

WhoisXML API said the pattern was not unique. It found similar gaps between domain registration and regulatory approval for other obesity drugs, including Eli Lilly's Mounjaro and Zepbound and Novo Nordisk's Wegovy. In each case, the brand name appeared in domain records before formal approval.

Approval day rush

Researchers said one squatter registered getfoundayo[.]com less than a month before approval. On the day Eli Lilly announced the launch, five pharmacy-style domains containing the Foundayo name were registered within four seconds of each other.

Eli Lilly's first defensive registration linked to the new brand came two hours and 38 minutes later, according to WhoisXML API. Within a week, it counted 172 domains containing the Foundayo name in zone files, of which about 58 appeared to belong to Eli Lilly based on nameserver and registrant details.

The counterfeit pharmacy identified in the report did not use the Foundayo brand name. Instead, it used orforglipron, the generic molecule name already known from clinical trial disclosures. That may have reduced the need to wait for the final commercial name while still targeting consumers searching for the treatment.

The site listed four products priced at USD $200 each in doses of 3mg, 12mg, 24mg and 36mg, all described as available on backorder. Orders were routed through a WhatsApp contact labelled "Dr Mike", whose profile image used the Eli Lilly logo.

According to WhoisXML API, the approved strengths for Foundayo were 0.8mg, 2.5mg, 5.5mg, 9mg, 14.5mg and 17.2mg. Three of the four doses shown on the counterfeit site matched maintenance doses from Eli Lilly's Phase 3 trial programme, while the remaining dose had appeared in an earlier Phase 2 study.

Impersonation network

Researchers also said the pharmacy website's source code included links to another domain, orforglipron-lilly[.]com, designed to resemble an official Eli Lilly page. They said the site displayed the company logo and carried a footer reading "© 2026 Eli Lilly and Company."

Its blog section contained text copied from outlets including CNBC, WebMD and the New England Journal of Medicine, according to the analysis. WhoisXML API also said one copied link retained a live Google Ads campaign identifier associated with Eli Lilly, suggesting the operator had passed through the company's paid search route before copying material.

The fake site was not buried in obscure search results. In one observed US search, WhoisXML API said it ranked fourth on Google for "cheap orforglipron", above well-known health information sites. SimilarWeb data cited in the analysis suggested the traffic it recorded came from US users, although at low volume.

Wider lessons

The findings underline how pharmaceutical product launches now create a cybersecurity problem as well as a branding exercise. Fraudsters can combine public domain records, scientific literature, copied marketing assets and paid search tools to build credible imitations quickly, particularly in categories such as weight-loss drugs where consumer interest is high.

WhoisXML API argued that drugmakers should consider registering pre-launch domains through subsidiaries or trademark-holding entities rather than under a parent company name. It also said companies should monitor brand and product keywords daily, prepare defensive domain registrations in advance, and move quickly to challenge counterfeit pharmacy domains and impersonation pages.

No enforcement action had been taken against any orforglipron-related domain identified in the research at the time of publication, WhoisXML API said.