How to report a cloned website, from a real clone-store case

To report a cloned website, send the evidence to every party that controls a piece of it: the registrar can suspend the domain, the hosting provider can remove the server, Google can drop copied pages from search results on a copyright notice, and the browser blocklists can put a warning in front of visitors. Save the evidence with a third party while the copy is still live, because a report nobody can verify is easy to close. If the copy takes card numbers or passwords, it is fraud, and you do not need a trademark to report it.

That is the short answer. The rest of this page is what it looked like in practice: in September 2026 we reported five copies of one US retailer's online store. Some of the copies came down within a day and the machinery behind them did not, and we made one mistake we describe below. The full hour-by-hour record is in a store cloned five times.

First: is the copy just a copy, or a trap?

Find out what the copy does before you decide who to report it to. A copied site that only steals your text and photos is a copyright problem. A copied store that collects card details is phishing, and registrars are contractually required to act on phishing (more on that below).

You usually cannot tell from the homepage. In our case, the retailer found the first copy and reported it to us on 11 September. Our own classifier scored its homepage as legitimate (0.93), and Google's Web Risk returned no threat. Of 30 product pages we sampled, all 30 descriptions matched the retailer's own word for word, under the retailer's logo. The theft only showed at checkout. The card field was an iframe served from a separate domain, and during checkout no request went to any payment provider. Nothing a shopper typed there would buy anything.

If you walk through a copy's checkout yourself, use made-up details and stop before paying.

Who can take down which part

Each party can remove one layer, and none of them removes all of it.

Registrars have a contractual duty here. Under section 3.18 of ICANN's Registrar Accreditation Agreement, every accredited registrar must publish an abuse contact and "take reasonable and prompt steps to investigate and respond appropriately to any reports of abuse". Amendments that took effect in April 2024 require registrars to act on well-evidenced phishing. ICANN's enforcement report for the first six months counts 154 resolved cases, more than 2,700 suspended domain names and more than 350 disabled phishing websites. Google states that it complies with copyright notices under the DMCA (Google Legal Help).

One detail matters for store owners: none of the five copies ran on the real store's platform. The real store was on Shopify. The copies were on .shop domains bought through one registrar and hosted on one network, so reporting them to Shopify would not have removed anything. Find out where a copy actually lives before you report it; how to look up the registrar and the host is in how to report a phishing domain to its registrar.

What to save before you report

A copy can vanish for you and stay up for everyone else, so save proof that someone else can check.

• A third-party archive of the live page, such as urlscan.io or the Wayback Machine. An abuse desk can open it after the site stops answering them.
• Screenshots of the parts that matter: your logo on their page, the copied product text next to yours, and the checkout form if there is one.
• Every domain involved. Copies often come in batches. Our retailer's first report named one; five days later it sent us four more.

Do you need a registered trademark?

Not to report fraud. A store that collects card numbers is an abuse case for the registrar and the host, whether or not the brand holds a trademark. A trademark matters for the slower routes that decide who owns a domain name: UDRP and URS, and platforms' trademark complaint forms. Copied product text and photos are covered by copyright, which you have without registering anything.

What if the fake site only uses your business name?

If it takes no payments and asks for no passwords, it is usually not an abuse case, and registrars treat it as a dispute over the name. That points to the trademark routes above, or to a copyright notice if it also copies your content. These take weeks or months, not hours. If it does take payments, see the first section: it is fraud, however it is dressed.

What happened when we reported five copies

We sent the first reports on 16 September at 09:35 UTC. By the next morning, all five storefront domains had disappeared from DNS:

The storefronts were disposable. The domains that collected the card numbers were shared between them, and a new storefront can be attached to one the day it is registered. Taking down the copies is one round, not the end of the case.

Our mistake: within three hours of the first reports, the first copy stopped answering our checks, and we told the retailer it was offline. It was still serving visitors in other countries and had only stopped answering us. Third-party scans from other countries showed it, and we sent the retailer a written correction. How that happened, and what we changed so it cannot repeat, is in the case record.

Warn your customers while you report

Reports take hours to days to act on, and your customers are on the copy in the meantime. Post a short notice where they will see it: which address is really yours, what the copy looks like (with its domain written so it cannot be clicked, like example[.]shop), and what to do if they already paid. The whole first-response sequence is in the first 48 hours of a phishing incident.

Copying is not only a US problem. In its August 2026 monthly report, Japan's Council of Anti-Phishing Japan says reports are increasing from companies whose website photos, brand names and operator details were copied and used for fake sites and fraudulent online stores.

If you want someone to do this for you

This is the work OpenBait does. On the Business plan ($299 a month), a person works one hard case a month, such as a copied store, through to the end: the registrar and host reports, DMCA notices for copied product pages, and a case page that records what was sent to whom and what came back. Five cloned stores and the card-collection domains behind them count as one incident, not nine. If none of the sites we take on in your first month is removed, that month is refunded.

If you only want a place for customers to report copies of your site, the report page is free for one brand. How it works explains what happens after a report comes in.