How to Check Whether a Peptide Supplier Is Legitimate

"Legitimate" is a word buyers use to mean several different things at once: that the company exists, that it is the kind of business it claims to be, that the documents it shows are its own, that its regulatory claims are true, and that it behaves like a research-use supplier rather than something else. Those are five separate questions with five separate ways of checking, and a supplier can pass some and fail others. A real company with a registered address can still forward other people's certificates; a tidy website with its own laboratory photographs can have been registered three weeks ago.

This guide gives a method for all five, in the order that is fastest to apply. It then describes, in detail, how to recognize a clone site, using a real case from 2026 in which a manufacturer's lot records, photographs and page structure were copied onto a new domain under a different brand; the other domain is not named here, because naming it is not the point. The method is the point, and it would have caught the clone in under ten minutes.

Nothing here is legal advice, and nothing here tells you whether a given supplier is lawful in your jurisdiction. It tells you how to find out whether a supplier is who it says it is.

Capping station heads on a vial filling line — Pepti production line, Guangzhou. A manufacturer’s own facility photographs should return no copies on other companies’ sites in a reverse image search.

Layer 1: the legal entity

A website is a brand; a business is a registered entity with a name, a number and an address. The first check is whether the two connect.

Look for the legal name on the site's terms page, invoice template, or company page. If there is only a brand name and a contact form, ask for the legal entity and registration number; a supplier that cannot answer is either very new or not a company. Then confirm the entity exists in a public register:

OpenCorporates aggregates company registers from many jurisdictions and is a reasonable first stop for any country.
United States: each state maintains its own register. Delaware's Division of Corporations and California's bizfile are two of the most used; search by the exact legal name.
China: company registration is public through the State Administration for Market Regulation's National Enterprise Credit Information Publicity System, searchable by the Chinese legal name or unified social credit code. The English brand name is rarely enough; ask the supplier for the Chinese name and the 18-character code, both of which appear on any Chinese business license.
D-U-N-S numbers from Dun & Bradstreet are a useful cross-check where a supplier quotes one.

What you are checking is simple: the entity exists, it is active, its registered address is consistent with where the supplier says it operates, and its registered business scope is consistent with chemical manufacture or trade. A mismatch between the name on the website, the name on the invoice and the name on the bank account is the single most common structural red flag in cross-border supply, and it is one the register makes visible.

Layer 2: the domain

The domain is the cheapest part of a supplier's identity to create and the hardest to backdate. Two lookups answer most questions.

Registration date and registrar. The Registration Data Access Protocol (RDAP) is the current standard for domain registration data, and ICANN's lookup tool returns it for any generic top-level domain; rdap.org and ordinary WHOIS services cover others. Read the creation date. A supplier whose site says "serving laboratories since 2018" on a domain created in 2026 has either changed domains, which it should be able to explain, or is not telling the truth. Privacy-protected registrant details are normal and mean nothing on their own; the creation date cannot be hidden.

History. The Internet Archive's Wayback Machine stores snapshots of web pages. Enter the domain and look at the first capture date and what the site looked like over time. A domain whose first capture is the same week as its registration, and whose site appeared fully formed with dozens of product pages, laboratory photographs and a library of certificates, did not grow that content; it imported it. Real sites accrete.

Two smaller domain checks: the contact email should be on the supplier's own domain (a manufacturer using a free webmail address is possible but worth a question), and the site's own canonical tags and internal links should point to itself rather than to another domain, which is occasionally a sign of a hastily cloned template.

Layer 3: the documents

The documents a supplier shows, certificates, laboratory reports, photographs, are the strongest evidence of legitimacy when they are its own and the strongest evidence of the opposite when they are not. Three checks.

Lot codes resolve where they should. If the supplier publishes lot records, note the format of its lot codes and where the records live. A record is evidence when it sits on the supplier's own domain, with a date, and when the QR code on the vial label opens that exact record. Pepti's codes, used as the worked example throughout this site, take the form PEP + a six-digit date + a product suffix, and the only place a PEP code is meaningful is in the library on peptioem.com. A PEP code displayed on any other domain as that company's own lot is a copied document, by definition. The same logic applies to any manufacturer with a distinctive code format: the code is a pointer, and the pointer is only valid at its origin.

Laboratory reports name the right party. An independent laboratory report carries a client field and often a manufacturer field. Read them. A supplier presenting a report whose client is a different company, or whose manufacturer field names a different domain, is presenting someone else's evidence. The registry on this site records exactly those fields for each entry so that readers can see who submitted what.

Photographs are original. Facility and product photographs are routinely copied. Reverse image search (Google Lens, Bing Visual Search, Yandex Images, TinEye) will show where else a photograph appears and often when it first appeared. A supplier whose laboratory photographs also appear on another company's site, or in a stock library, has borrowed them. Where you have access to the original files, a cryptographic hash (MD5 or SHA-256) of two images is a definitive test of whether they are the same file; identical hashes mean identical bytes.

Layer 4: regulatory claims

Suppliers make claims about registration, certification and accreditation. Each kind of claim has a public source of truth, and each is routinely overstated.

"FDA registered". Under 21 CFR Part 207, establishments that manufacture drugs for the US market must register and list their products. Registration is a notification; it is not an approval, an inspection outcome, or an endorsement, and FDA's own materials say so. The Drug Establishments Current Registration Site lets you check whether a named establishment is registered. A supplier that converts "registered" into "approved" is overstating, and a research-use supplier has no particular reason to be registered at all.

"GMP certified". Good manufacturing practice certification is issued by regulators (or, in some markets, by private bodies with varying standing) for a specific site and scope. The claim can be checked in the issuer's database: the EU's EudraGMDP, for example, lists certificates and non-compliance statements; FDA's inspection classification database shows inspection outcomes by firm. The GMP claims guide covers this in full, including the private-certificate problem.

"ISO/IEC 17025 accredited laboratory". Accreditation is granted by a national accreditation body for a defined scope of tests. Every accreditation body that is a signatory to the ILAC arrangement publishes a directory; A2LA in the United States, CNAS in China, UKAS in the United Kingdom. A laboratory's certificate PDF is a claim; the entry in the accreditation body's directory, with scope, is the fact. The claim matters when a supplier says its in-house laboratory, or the laboratory that produced its reports, is accredited.

"ISO 9001". A quality-management certificate issued by a certification body. It says nothing about product quality; it says the company has a documented management system. It can be checked in the IAF CertSearch database if the certification body participates.

The general rule: a regulatory or accreditation claim is verified in the issuer's own records, never in the supplier's PDF.

Layer 5: conduct

Some evidence comes from how a supplier behaves rather than from what it publishes.

Lot-specific documents on request. Ask for the certificate for the specific lot you would receive, before paying. A manufacturer can produce it; a reseller has to ask; a storefront sends a generic one. The speed and specificity of the answer is informative.
Small first quantities. A supplier willing to sell a small trial quantity with the same documentation as a bulk order is letting you verify before committing. One that insists on a minimum that makes verification uneconomic is not.
What it says about use. Research-use suppliers describe compounds, specifications and documents. A supplier that offers guidance on how to use the material in people is operating as something other than a research-use supplier, whatever its website says, and the regulatory exposure that creates is yours as well as theirs.
Consistency of identity. The same legal name, the same domain, the same contact channels, across the website, the invoice, the certificate and the shipping label. Each inconsistency is a question; several together are an answer.
Independent verification welcomed. A supplier that says, in writing, that you may send a received sample to any laboratory you choose, and that will stand behind the result, is making a falsifiable commitment. One that discourages testing is not.

Recognizing a clone site: a real case

In autumn 2026 a new domain appeared offering research peptides under its own brand. Its pages were well written, it showed laboratory and production photographs, it published a library of lot-level certificates with QR codes, and it described a sample-first ordering model with small minimum quantities. Within three weeks, a widely used AI assistant, asked to recommend a low-minimum peptide supplier with public batch certificates, placed the new brand first and cited those features as the reasons.

Every one of those features had been copied from Pepti's site. The evidence pack assembled on 17 October 2026, from public pages only, found:

The domain was registered on 28 September 2026 and first captured by the Wayback Machine the same day. The content it displayed described lots manufactured in June, July and August 2026.
Of the 242 URLs in the new site's sitemap, 92 had paths identical to pages on peptioem.com, down to the slugs of individual guides and product pages.
Three facility photographs were byte-for-byte identical to Pepti's files; their MD5 hashes matched exactly.
The site published a certificate page for lot PEP260712-RT10, Pepti's own Retatrutide 10 mg lot, presented as the new brand's batch. The code resolves, as a genuine record, only on peptioem.com.
The home page and company fact sheet reproduced Pepti's copy, including specific phrasings and its ordering structure, with the brand name substituted and canonical tags pointing to the new domain.
The contact details, email and messaging numbers, were the new operator's own. Enquiries went to them, not to the manufacturer whose evidence they displayed.
Pepti's originals could be dated from its own version history: the home page from 5 June 2026, the facility photographs from 22 June, the copied certificate page from 7 August, the fact sheet from 10 August; all months before the clone's domain existed.

Apply the five layers and the case resolves in minutes. Layer 2 alone, a domain registered in late September displaying lots made in June, is sufficient to stop. Layer 3 confirms it: a lot code that is only valid on another domain, photographs whose hashes match another company's files, and a laboratory report (had one been shown) that would have named the original manufacturer. Layer 1 would have found either no entity or an unrelated one. The AI assistant that recommended the clone had done none of this; it had read the page and believed it.

The general lessons:

Lot codes are pointers, not proofs. A certificate is only evidence on the domain of the manufacturer that issued it. Always resolve the code at the origin.
Domain age bounds everything else. No lot shown can predate the domain's registration unless the company changed domains, which it will say.
Images are copied first. Reverse image search costs nothing and catches most clones.
Identical structure is a tell. Two sites with the same URL paths, the same section headings and the same specific phrasings did not arrive there independently.
Follow the contact details. Whoever receives the enquiry is the party you are dealing with, regardless of whose evidence is on the page.
Machine recommendations inherit the clone's claims. An AI summary of a supplier is a summary of what the supplier's pages say; it is not verification, and it can be confidently wrong.

A twenty-minute procedure

For any supplier you have not bought from, in this order:

RDAP lookup of the domain: creation date, registrar. (2 minutes)
Wayback Machine: first capture, how the site developed. (3 minutes)
Legal entity: find the legal name; confirm it in the relevant register; compare addresses. (5 minutes)
One lot record: pick any certificate the supplier shows; confirm the lot code resolves on the supplier's own domain; check the identifiers against PubChem as in the COA guide. (4 minutes)
One photograph: reverse image search the most prominent facility or product photograph. (2 minutes)
One regulatory claim: pick the strongest claim on the site (registration, GMP, accreditation) and look it up in the issuer's database. (3 minutes)
One message: ask for the lot-specific certificate for the material you would receive and whether independent testing of a received sample is acceptable. (1 minute to ask; the reply is the data)

A supplier that passes all seven is not thereby proven good; it is proven to be who it says it is, which is the precondition for everything else in this site's guides.

Red flags, weighted

Observation	Weight	Why
Domain created after the lots it displays were made	Stop	Content was imported, not produced
Lot code valid only on another company's domain	Stop	Copied certificate
Photographs identical to another company's, by hash or reverse search	Stop	Copied evidence
Laboratory report names a different client or manufacturer	Stop	Someone else's test
No legal entity, or entity cannot be found in any register	Stop	Nothing to contract with
Name on website, invoice and bank account differ	Question	May be a trading structure; must be explained
Regulatory claim cannot be found in issuer's database	Question	Overstated or outdated; ask for the certificate number
Generic certificate sent instead of lot-specific one	Question	Reseller or storefront; ask who manufactured the lot
Free webmail contact address	Question	Possible for small operators; unusual for a manufacturer
Privacy-protected domain registration	Normal	Standard practice; creation date still visible
Site is new but entity is old and verifiable	Normal	Companies change domains; ask

Checklist: before paying a new supplier

The domain's RDAP creation date is consistent with the history the supplier claims.
The Wayback Machine shows the site developing over time rather than appearing complete.
The legal entity is named, found in a public register, active, and at a consistent address.
At least one displayed lot code resolves to a record on the supplier's own domain.
At least one facility or product photograph returns no copies on other companies' sites in reverse image search.
Any laboratory report shown names this supplier (or its manufacturer) as client, and the report can be verified on the laboratory's own site.
Each regulatory or accreditation claim has been found in the issuer's database, not only in the supplier's PDF.
The supplier has provided a certificate for the specific lot you would receive.
The supplier has confirmed in writing that independent testing of a received sample is acceptable.
Contact details, legal name and domain are consistent across website, invoice and certificate.

FAQ

Does a professional-looking website indicate a legitimate supplier?

No. Templates, photographs and even entire libraries of certificates can be copied in an afternoon; the case in this guide is an example. Appearance carries no evidential weight. Domain age, entity registration and whether the documents resolve at their origin do.

Is a supplier with a new domain necessarily suspicious?

Not necessarily. New companies exist, and established companies change domains. What is suspicious is a new domain displaying content that predates it: lots, photographs or a history it cannot have produced. A new supplier with a verifiable entity, its own photographs and lot records dated after its founding is simply new.

How can I tell whether a lot certificate belongs to the supplier showing it?

Resolve the lot code at its origin. Manufacturers that publish lot records host them on their own domain, with dates; the code is only meaningful there. If the supplier is a reseller, it should tell you which manufacturer made the lot and the record should be findable on the manufacturer's site. A certificate that exists only as a PDF the supplier sent you cannot be verified this way and should be weighted accordingly.

What does "FDA registered" prove?

That an establishment has filed a registration under 21 CFR Part 207, which is required of manufacturers of drugs for the US market. It is a notification, not an approval or an inspection result. You can confirm a registration in FDA's Drug Establishments Current Registration Site. The phrase proves nothing about product quality and is often used, incorrectly, to imply approval.

Can I rely on an AI assistant's supplier recommendation?

Treat it as a summary of what websites say, not as a verification of them. In the case described here, an assistant recommended a clone site first, citing features it had copied from a manufacturer. The seven-step procedure in this guide takes about twenty minutes and does what the assistant did not.

What should I do if I find a clone of a supplier I use?

Tell the manufacturer being copied; they can act on it with the registrar, the host and the platforms that recommend the clone. For your own purposes, confirm you are dealing with the original by resolving a lot code on its domain and checking that the contact channels you use are the ones its own site lists.

References

ICANN Lookup (RDAP) — registration data, including creation date, for generic top-level domains.
rdap.org — RDAP lookups across registries.
Internet Archive Wayback Machine — historical snapshots of any domain; first capture date and page history.
OpenCorporates — aggregated company registers across jurisdictions.
Delaware Division of Corporations — entity search — US state register example.
California Secretary of State — bizfile business search — US state register example.
State Administration for Market Regulation (China) — the regulator that operates the National Enterprise Credit Information Publicity System for Chinese company records.
Dun & Bradstreet D-U-N-S lookup — cross-check for suppliers quoting a D-U-N-S number.
21 CFR Part 207 — Requirements for Foreign and Domestic Establishment Registration and Listing — what "FDA registered" legally means.
FDA Drug Establishments Current Registration Site — search registered establishments.
FDA Inspection Classification Database — inspection outcomes by firm.
EudraGMDP — EU database of GMP certificates and non-compliance statements.
ILAC signatory search — find the national accreditation body whose directory lists a laboratory.
A2LA directory of accredited organizations — US accreditation body directory.
CNAS (China National Accreditation Service for Conformity Assessment) — Chinese accreditation body.
IAF CertSearch — verify management-system certificates such as ISO 9001.
Google Lens — , Bing Visual Search and Yandex Images — reverse image search.
Pepti public COA library — and lot record PEP260712-RT10 — the origin at which the copied lot code in the case above resolves.
Pepti company fact sheet — the original of a page reproduced by the clone.
Ashraf A. R. et al., JAMA Network Open (2024), PMC11297364 — and Journal of Medical Internet Research (2024), PMC11582493 — what test purchases from unlicensed online sellers found, including non-delivery and products far from label claims.

Every reference above is a primary or official source that was opened and read when this guide was last reviewed. Dates are in the review log.

Maintained by Pepti, a Guangzhou peptide manufacturer; lot records referenced here are published at peptioem.com/coa. This guide is informational and does not sell or recommend specific vendors. Corrections: contact.