Find a vendor
DEEN

How to Spot a Legitimate Peptide Vendor in Five Minutes

Legal notice, age gate, RUO labeling, payment methods, CoA library: eight signals that let you tell a legitimate vendor from a questionable one in five minutes, each backed by a real example from our own research.

Five Minutes That Pay Off

RUO peptides aren't approved medicines. There's no regulatory approval process like the one a drug goes through, no manufacturing license an authority has reviewed. Judging a vendor is entirely on you. For this guide we looked closely at more than 20 vendors: legal notice, payment methods, batch verification, review platforms, WHOIS data. Some shops disclose everything cleanly. Others have gaps you can spot in five minutes once you know where to look. This checklist covers the eight signals that made the biggest difference in our research, each with a real example from the vendors we checked.

Legal Notice: Legal Entity and Address

German law requires a legal notice (Impressum) for every commercial online shop. It names the legal entity with its full name and legal form, GmbH, UG, or Ltd, plus a physical address you could actually send a letter to. A city name alone isn't enough. In our research, several shops were missing exactly that. Peptide Labz's legal notice page returns a 404 error, and nowhere on the domain is there an address, only the marketing line “Berlin, Germany” without a street or number. DN Lab Research names no company address anywhere, not on the homepage, contact page, about page, or terms. Hydro Research Peptides' terms name only the brand “Hydro Research” and a support email, no company name, no address, no registration number. Without these details, you often don't know who you're actually dealing with. Not every gap is the same size: Smart Peptides' legal notice does list a company name, address, phone number, and email, it's just missing a business registration number and a VAT ID. That's a smaller gap than no address at all, but it still falls short of the legal standard.

Age Gate and RUO Labeling

Because RUO substances aren't approved for use in humans, a legitimate shop places an 18+ age gate before you can enter, plus a visible RUO note on every single product page, not just buried in the fine print. Neither is decorative, both show a vendor at least acknowledges the legal framework it operates in. A missing age gate, which we couldn't find at all on one of the checked shops, is an early warning sign on its own, even if it doesn't prove anything by itself. For the difference between a peptide, a protein, and what RUO means, see our Peptide 1x1.

Withdrawal, Terms, and Payment Methods

Complete terms and conditions and a right-of-withdrawal notice are the legal baseline, and so are payment methods that leave you a way back if something goes wrong. Card payment through a payment processor usually comes with a chargeback option. Pure bank prepayment or cryptocurrency doesn't, once the money is sent, it's gone. Smart Peptides no longer offered card payment as of our last check, only bank prepayment and cryptocurrencies like Bitcoin, USDT, and USDC. On top of that, the bank account listed for prepayment is in the name of a private individual, not the company named in the legal notice. A private account instead of a business account doesn't prove anything on its own, but combined with other gaps it's worth taking seriously. A missing withdrawal page, or one that only points to a dead link, is its own warning sign regardless of payment method.

Domain Age and WHOIS Privacy

A WHOIS lookup shows how long a domain has been registered and, if no privacy service is blocking it, who's behind it. A long domain history looks trustworthy, but on its own it proves nothing. DN Lab Research, for instance, has been registered since November 2021, an unusually long run for this market. At the same time, its own RUO policy names a different legal entity than the shop's brand name, “Bioniq Lab” instead of “Dnlab Research”, without the site resolving that contradiction anywhere. Domain age only answers one question, not all of them. At PPX, the WHOIS registrant record names a different company and a different city than the vendor's own legal notice, which lists only “Vienna” with no further details. Cross-checking WHOIS data against the legal notice is worth doing, especially when the latter is already thin. An active WHOIS privacy service isn't a red flag by itself, plenty of legitimate shops use one for straightforward privacy reasons. It only becomes notable once the data that is available contradicts the legal notice, as with PPX.

Reading ScamAdviser and Trustpilot Correctly

ScamAdviser calculates a trust score between 0 and 100 from signals like domain age, SSL certificate, and hosting location. That's an algorithmic value, not a verdict, and it can shift the moment a single signal changes. ScamAdviser gives Peptide Labz a trust score of 0 out of 100, based on data the tool itself flags as five months old. On its own, that's one data point. Combined with the missing legal notice and the untraceable address, though, it fits the pattern. A stronger signal is a removed Trustpilot profile. Trustpilot actively takes profiles down when a business violates its guidelines and then shows the message “This profile has been removed.” We found exactly that for Hydro Research Peptides and for Smart Peptides. Notably, Hydro Research's own Facebook page still advertises “4.7 on Trustpilot” and links straight to the now-removed profile, a gap between marketing and reality that shows up on a quick check. For you as a buyer, that means reading ScamAdviser, Trustpilot, and your own legal-notice check together, not any single value in isolation.

Effect Claims on the Shop Page

RUO products are explicitly not approved medicines. A vendor that still promises concrete physical effects on its shop page blurs exactly that line, no matter how clean its purity data or shipping times otherwise look. Peptide Labz's homepage carries a customer testimonial describing concrete physical effects and labeling the author a “patient,” wording that suggests medical use even though the product is an RUO research peptide. At PPX, a product page for retatrutide carries the page title “… weight-loss injection alternative,” putting an unapproved research compound right next to an approved medicine category. Neither is language you should find on a legitimate RUO vendor's page. The same line blurs with category labels like “weight loss” or “muscle building” for an RUO product, even when the individual product text itself is more restrained than the category it sits under.

Public CoA Library

A certificate of analysis, or CoA, is only worth something if you can check it yourself before buying: batch number, lab, date. PPX advertises that “every product” ships with a CoA, with a download button on every product page. On every product we checked, that button links to the same generic sample file with the placeholder batch “PP-COA-000000,” not an actual certificate. DN Lab Research states right on the product page that the CoA is available “upon request” only, despite a “3rd Party Tested” badge on the same page. In both cases, the purity claim stays a claim you can't verify before you buy. When in doubt, ask specifically for the batch number of the batch currently being sold, rather than accepting a generic sample PDF from the product page. For how to read a real CoA and check a specific batch, see Verify a Batch.

The Five-Minute Checklist

The table below summarizes all eight signals, with an example from our own research. No single signal proves anything by itself, but together they add up to a clear picture. For the full comparison of every vendor we checked, scored by our methodology, see the vendor overview.

SignalWhat It MeansExample From Our Research
Legal notice with entity and addressMissing it means no traceable address if a dispute comes upPeptide Labz: legal notice page returns a 404, no address found on the domain
18+ age gateShows whether a vendor takes the RUO legal framework seriouslySmart Peptides: no age gate found on the website
RUO note on every product pageNecessary, but doesn't replace checking the other pointsDN Lab Research: RUO note present throughout, legal notice still missing
Payment methods: card vs. crypto/prepayment onlyCard usually offers a chargeback option, pure prepayment or crypto doesn'tSmart Peptides: only prepayment and crypto now, account listed in a private individual's name
Domain age and WHOIS cross-checkAge alone proves nothing, what matters is matching it against the legal noticePPX: WHOIS registrant names a different company and city than the legal notice
Reading the ScamAdviser trust score in contextAlgorithmic value, not a verdict, matters together with other signalsPeptide Labz: trust score 0 out of 100 alongside a missing legal notice
Removed Trustpilot profileTrustpilot removes profiles for guideline violations, a stronger signal than a low star ratingHydro Research Peptides: profile removed according to Trustpilot
Effect claims on the shop pageA warning sign for RUO products, regardless of purity or pricePPX: product title positions retatrutide as a “weight-loss injection alternative”
Publicly viewable CoA libraryWithout open verification, the purity claim stays just that, a claimPPX: CoA download button links to the same sample PDF on every product

Sources

Frequently asked questions

Is it illegal to buy RUO peptides in Germany?
RUO peptides aren't approved medicines and aren't cleared for use in humans. That doesn't automatically make buying them for research purposes illegal, but you're operating outside pharmaceutical law and without regulatory quality checks. This isn't legal advice, when in doubt, check our [Peptide 1x1](../peptid-1x1.html) or get your own legal assessment.

Is a low ScamAdviser score proof that a vendor isn't legitimate?
No. The score is an algorithmically calculated value based on signals like domain age or SSL certificate, not a verdict on the vendor. It becomes meaningful together with other points on this checklist, like a missing legal notice or a removed Trustpilot profile.

Is prepayment-only or crypto-only automatically a dealbreaker?
Not automatically, some vendors work that way for practical reasons. It gets more concerning when the prepayment account is also in a private individual's name instead of the company named in the legal notice, as we found with one vendor. Then you lose the direct link between the payment and the legal entity if something goes wrong.

Explore the documentation