Fake site takedown
Someone copied your Shopify store? Get the fake site taken down.
OpenBait is a takedown service for fake websites that copy a business's site. When a copy of your site takes your customers' card numbers, we report it with evidence to the companies that can take it offline and follow it until it stops loading. When it only copies your pages, we have it removed from Google search. Takedowns come with Pro: $299 a month for up to 3 fake sites.
Paste the link to the copy.
A copy of a real store usually looks normal on its own, so the check will most likely answer "Not confirmed". That's expected. Under the answer, choose Sign up and get it taken down: signing up is free, you confirm the site copies yours, pick a plan, and we take it from there. If no button appears, email us the link.
Not sure it's a copy, or found several? Email us the link. A person compares it with your site and writes back with what we can do.
What is a cloned store actually doing?
In one case from September 2026, a US online store found five copies of its site on .shop domains. The copies we followed through to checkout weren't selling anything. Each one was built to take card numbers.
- They looked like the real thing. All 30 product descriptions we sampled matched the real store's word for word, under its logo.
- Nothing looked wrong on the homepage; the theft only showed at checkout. The card box loaded from a separate website, and no real payment company was involved at any point.
- The card number was only the start. The copy went on to ask for the one-time code from the bank, the card PIN and photos of both sides of a driver's license.
That's why your customers come to you: they paid what they took to be your store, nothing arrived, and the charge isn't yours to refund. Fraud of all kinds adds up: in 2025, the FTC received 3 million fraud reports from consumers, who reported $15.9 billion in losses (FTC, March 2026).
Can Shopify take the copy down?
Only if the copy runs on Shopify. Shopify can close stores on its own platform. It has no say over a website hosted somewhere else.
In that case, none of the five copies ran on the real store's platform. They were on .shop domains bought through one registrar and served from one hosting network that had nothing to do with it, so a complaint to the platform would not have removed anything.
Each company in the chain can take down one layer, and none of them takes down all of it:
| Who | What they can take down |
|---|---|
| The domain registrar | The domain. Once it's suspended, the copy stops loading at that address. |
| The hosting provider | The server serving the pages. The operator can move to another host. |
| Google Search | The copied pages in its results. The site still opens for anyone with the link. |
| Browser warning lists | Nothing. They put a red warning page in front of visitors. |
| The payment provider, if the copy takes real payments | The merchant account. |
You don't need to work out which of these applies: once you confirm the copy, we do.
Why does the copy keep coming back?
- Copies come in batches. In September, the store found one copy. Five days later, it found four more.
- The storefronts are disposable. The sites that collect the card numbers are shared between storefronts, and a new storefront can be plugged into one the day its domain is registered.
- Out of Google isn't offline. A plain copy removed from search results still opens for anyone who has the link.
- A site can look gone from one place and still be serving shoppers elsewhere. We learned this in that case: we told the store one copy was offline while it was still serving visitors in other countries, and sent a correction. We no longer call a site offline until we've confirmed it.
What OpenBait does once you confirm the copy
You confirm, with one click, that the site copies yours. From there:
- A copy that takes card numbers or passwords: we report it with evidence to the companies that can take it offline, and follow it until it stops loading. You don't need a trademark or any documents for this.
- A copy of your pages that takes no payments: we have its pages removed from Google search under copyright. You sign a letter of authorization in your dashboard once, and it's valid for a year. The site itself can still be opened by anyone with the link.
- Reports go out under OpenBait's name, never from your email address, and say only what the evidence shows.
- One case page shows every fake domain: what was done, and when each site went offline.
- After a site goes offline, we keep checking it every day. If it comes back at the same address, we report it again at no extra charge once you confirm.
- New copies: every day we check newly registered domains with names like yours, and paid plans also check Google search results for your brand name. Your customers get a report page where they can send us copies they find.
How long does it take?
There's no fixed timeline: the hosting provider, the registrar and Google each decide on their own schedule. Our fastest so far was under an hour, from a follow-up report with fresh evidence to the registrar suspending the fake site. Reported sites are checked every hour, and the time a site went offline is recorded on your case page.
In that case, all five copies had stopped loading by the day after our first reports. The full record, including what didn't go well, is in Five clones of one store: what each abuse team did.
How much does it cost?
| Plan | Price | Fake sites we take on each month | Brands |
|---|---|---|---|
| Pro | $299 a month | Up to 3 | 1 |
| Business | $499 a month | Up to 10 | 2 |
| Enterprise | $899 a month | Up to 20 | 3 |
- Each fake-site domain counts as one, so five copies count as five. On any plan, you can add one more for $199.
- Monthly, no minimum term. Cancel anytime.
- Signing up is free, and so are the daily check of newly registered domains with names like yours and your customer report page. On the Free plan, sites you confirm are reported only to browser warning lists, not to the hosting provider or the domain registrar.
- If it doesn't work: if none of the sites we take on has had any effect 30 days after our first report (offline, suspended or flagged by browsers), we refund your first payment. It applies once and must be requested within 30 days after that; the Subscription & Refund Policy has the details.
Established brand-protection companies list paid plans that include fake-site takedowns from $15,000 a year (listed prices, October 2026). OpenBait is billed monthly, and you sign up online without a sales call. See all plans or how it works.
What should I tell my customers while the copy is up?
Post a short notice where your customers will see it: your real web address, the copy's domain written so it can't be clicked (like example[.]shop), and that orders placed there never reached you. Customers who paid on the copy should contact their card issuer. Then add your OpenBait report page to your FAQ and order emails, so the next copy your customers find comes straight to us.
Questions
Do I need a registered trademark?
Not for a copy that takes card numbers or passwords: that's fraud, and it can be taken down without one. For a copy of your pages, your own product text and photos are covered by copyright, which you have without registering anything.
Is OpenBait part of Shopify?
No. OpenBait is an independent takedown service and isn't affiliated with Shopify. It works on copies of any website, whatever platform the real site runs on.
Can you guarantee the copy will be taken down?
No one can promise that, because the hosting provider and the registrar make the final call. On a monthly plan, if none of the sites we took on has gone offline, been suspended or received a browser warning within 30 days of our first report, we refund your first payment. It applies once and must be requested within 30 days; see the Subscription & Refund Policy.
What if the copy moves to a new domain?
A copy on a new domain counts as a new takedown. If it comes back on the same domain, we report it again at no extra charge once you confirm.
Will the copy disappear from Google?
For a copy of your pages, yes, once Google approves the request: we ask Google to remove the copy's pages from its search results, using the letter of authorization you sign in your dashboard. For a copy that steals card numbers or passwords, we work to get the site itself taken offline instead.
I haven't found a copy yet, but I'm worried. What can I do?
Check which look-alike versions of your domain are already registered with the free look-alike domain checker. If you're weighing other services, this comparison of brand-protection tools lays out what each one covers.
Found a copy of your store?
Paste the link at the top of this page, or email it to us. A person compares it with your site and writes back with what we can do.
Case details come from our case records. Where a cause can't be proven, such as which report led to which suspension, we haven't claimed it. OpenBait is not affiliated with Shopify.