I just remembered that my case, cause OP also could face with the same fake clone web address while generating his paper wallet - fake clone in global WWW (with the similar spelling) or fake clone provided through DNS spoofing (OP saw bitaddress.org in his web browser, but actually visited completely different IP address).
Somebody should do a write up on how DNS spoofing works and how to protect ourselves from it.
This is going to hit s lot of inexperienced people who don't know how to avoid that kind of thing.
The typosquatting is easier to spot though.