Five clone shops, nine domains: what each abuse desk did, hour by hour

Between 2026-09-16 and 2026-09-19 we worked one case for a US home-products retailer: five clone storefronts on .shop domains, feeding four card-collection domains. This is the record of what each party did and when, including the half day in which we told the retailer a site was offline while it was still serving US visitors.

All times are UTC. The storefront domains contain the retailer's name, so they appear as shop-A to shop-E (the real ones look like [brand]shop.shop). The attacker's collection domains carry no brand name and are given as they are. Where our case ledger says "inferred" or "cannot be determined", so does this text.

What the sites were

They were card and identity theft kits with a clone shop as the front end, not counterfeit stores. The front end was a copy: in a sample of 30 product pages on shop-A, all 30 descriptions matched the retailer's originals word for word, under the retailer's logo.

We walked shop-A through checkout with dummy data at about 09:30 UTC on 2026-09-16 and submitted no payment. The card-number field was an iframe served from legaci.shop/card-form, a domain registered on 2026-06-16. During checkout, zero requests went to any payment gateway.

The script behind that form, main-B3yf5EAN.js (SHA-256 b500daffbcc8d0f7dd057b5d82b5cc14a28aef8a276ad42d78cbfae1e0e23b4f), defines the routes /card-form, /verification, /payment-success, /lottery and /claim-prize. It asks for the bank's one-time passcode, the card PIN, and approval of the payment in the banking app. A fake prize step then uploads photos of both sides of the victim's driver's licence to /prod-api/withdrawal/submit.

None of this shows on the homepage. When the retailer first reported shop-A at 01:04 UTC on 2026-09-11, our own classifier scored it legitimate (0.93) and Google Web Risk returned no threat. The theft only appears after adding a product to the cart and reaching the payment step.

All five storefronts were registered at Dynadot between May and July 2026 and hosted on one network, AS199242. shop-E failed at add-to-cart on the first pass; its collector was identified afterwards.

Timeline

The first abuse emails went out at 09:35 UTC on 2026-09-16; by the morning of 2026-09-17 all five storefront domains were gone from DNS.

The takedown that wasn't: how a live site looked dead to us

shop-B was never down. It answered visitors from some countries and ignored others, including every network we had; we recorded "cannot connect" as "offline" and told the retailer so. Third-party scans exposed it: at 01:34 to 01:37 UTC on 09-17 the same URL served a complete storefront to exits in France, the Netherlands and the US, and nothing to six other countries.

A control experiment against the same IP address showed the mechanism:

The server was up and went silent only for the clone's own name. A host that has removed a site completes the handshake and returns an error page; it does not hang. All four storefronts not yet suspended showed this fingerprint, so our conclusion that the host had removed them had no evidence behind it. shop-D was never caught serving again; the ledger records its state as undetermined.

The "Offline" notice the retailer had received was wrong, and it went out automatically after three failed checks. The written correction — the sites are live, here are third-party scans to check it against — was still owed at the time of writing. That gap is the worst part of this case: an automated status change is cheap to send, and the correction that undoes it is not, so the system has to stop producing the claim in the first place.

Lesson one: a single vantage point cannot declare a site dead. Every probe we had sat in one country.

Lesson two: an abuse report must never reveal where the reporter observes from. Our second letter said "Observed … UTC+9", and the storefronts went silent to us within 30 minutes of it. We cannot show the letter caused that. But a report can reach the person it is about, and a timezone tells an operator which country to filter to make the report unreproducible.

Why one domain was suspended a day before the others

shop-E was the only one of the five flagged by the large antivirus vendors (BitDefender, Kaspersky, G-Data), and the only one with more than a few detections on the domain itself instead of on a URL. Our handling of all five was identical: same emails, same evidence, same automated submissions. The difference sits in a VirusTotal snapshot from 14:00 UTC on 09-16, nine hours before the clientHold.

Five domains is a small sample, and this is a correlation. It fits how a registrar works: it suspends domains, so a domain-level verdict from a known vendor is corroboration it can act on. It also explains the survivors. A site that hides from scanners is invisible when a vendor re-checks, so its detections stay near zero, so the registrar has only the reporter's word. One filtering rule defeated both our liveness check and the blocklist pipeline. Getting a URL onto those lists is covered in reporting phishing to browser blocklists.

What the registrar needed to act

The re-report at 05:17 UTC on 09-17, written in UTC throughout, added three things the first letters lacked. Two of the four domains it named were suspended within the hour.

• Permanent third-party archive links. Same-day urlscan results with screenshots, showing the storefronts returning 200. They stay readable whether or not the site answers the abuse desk.
• The SNI control experiment, in plain words, under the heading "Please do not close this report as unreproducible": the server answers an invented hostname instantly and is silent for its own.
• The registrar's own precedent. It had already suspended shop-E, and the letter described the other four as the same operation, hosting and kit.

The general structure of such a letter is in writing a registrar abuse report that gets read.

What followed: shop-C's nameservers changed at 06:11:35 UTC and shop-D's at 06:12:55 UTC, 54 and 56 minutes after the letter. Only a registrar can change a domain's delegation, and the landing page is a WHOIS-verification suspension notice, so this was registrar action. We received no confirmation. The timing fits, but it does not prove that our report was the cause. The ledger's guess at the mechanism (the report triggers a registrant WHOIS verification, the forged registrant details fail it, the domain is suspended) is an inference. Unlike the network-level filtering of the day before, a suspension at the registrar survives a change of host.

Can a lookalike domain be taken down without a registered trademark?

Yes, if the site takes passwords or card numbers: that is fraud, and a registrar can act on fraud without any trademark. In this case the brand's US trademark registration had been cancelled in 2025 because a required declaration of use was never filed, and the registrar suspended three of the five storefront domains anyway.

We did not know that at the time. The 09-17 letter cited the registration; on 09-19 we read the USPTO status record and found it cancelled. The registration certificate itself shows nothing about the cancellation.

A valid registration is a precondition for a URS complaint and for trademark complaints to platforms. UDRP can rest on unregistered rights, at more cost and difficulty. A DMCA notice rests on copyright, which the word-for-word product descriptions support. A card-theft report to a registrar, registry or host needs none of these.

What is still standing

Most of the operation is. At our last check on 2026-09-19, three of the four collectors (legaci.shop, blenia.shop, mbvnvcnmbd676767.shop) were live, and the script hash was unchanged. The fourth, broris.shop, is on serverHold by the .shop registry, a party we had never written to.

The storefronts were disposable. The collectors are shared, and a new storefront domain can be attached to them the day it is registered. None of the parties we wrote to has sent a disposition notice that we have on record. This is not a success story.

What we changed

1. A site is declared down only when several vantage points agree and a control-SNI handshake rules out selective silence; "cannot connect" alone is recorded as blocked, not offline.
2. Every abuse report states times in UTC and says nothing about where we observe from.
3. Evidence goes to a third-party archive while the site is still alive, because a registrar cannot act on a site it is unable to load.

How reports, evidence and case status fit together is on how it works.