Someone copied your website or store? What you can do

If someone copied your website or store, report the copy to every party that controls a piece of it: the registrar can suspend the domain, the hosting provider can remove the server, Google can drop copied pages from search results on a copyright notice, and the browser blocklists can put a warning in front of visitors. An abuse team can easily close a report it can't verify for itself. If the copy takes card numbers or passwords, it's fraud, and you don't need a trademark to report it.

OpenBait is a takedown service for fake websites and phishing sites that copy a company's website. We file these reports for you. If the copy steals passwords or card numbers, we report it with evidence to the companies that can take it offline and stay on it until it's down; if it only copies your pages, we have it removed from Google search results. Pro is $299 a month for up to 3 takedowns, Business is $499 a month for up to 10, and a single takedown is $199, paid once. To get started, paste the copy's link into "Check a link" on our homepage or pick a plan. If it is your Shopify store that was copied, here is how we get the copy taken down.

The rest of this page shows how it played out in practice: in September 2026 we reported five copies of one US retailer's online store. Some of the copies came down within a day, but the machinery behind them didn't, and we made one mistake, described below. The full hour-by-hour record is in a store cloned five times.

First: is the copy just a copy, or a trap?

Find out what the copy does before you decide who to report it to. A copied site that only steals your text and photos is a copyright problem. A copied store that collects card details is phishing, and registrars are contractually required to act on phishing (more on that below).

You usually can't tell from the homepage. In our case, the retailer found the first copy and reported it to us on September 11. Our own classifier scored its homepage as legitimate (0.93), and Google's Web Risk returned no threat. Of 30 product pages we sampled, all 30 descriptions matched the retailer's own word for word, under the retailer's logo. The theft only showed at checkout. The card field was an iframe served from a separate domain, and during checkout no request went to any payment provider. Nothing a shopper typed there would buy anything.

Kits like this one go on to ask for the one-time code your bank sends and for photos of an ID, which is why a copy that takes payments is treated as fraud, not as a copyright problem.

Who can take down which part

Each party can remove one layer, and none of them removes all of it.

Registrars have a contractual duty here. Under section 3.18 of ICANN's Registrar Accreditation Agreement, every accredited registrar must publish an abuse contact and "take reasonable and prompt steps to investigate and respond appropriately to any reports of abuse". Amendments that took effect in April 2024 require registrars to act on well-evidenced phishing. ICANN's enforcement report for the first six months counts 154 resolved cases, more than 2,700 suspended domain names and more than 350 disabled phishing websites. Google states that it complies with copyright notices under the DMCA (Google Legal Help).

One detail matters for store owners: none of the five copies ran on the real store's own e-commerce platform. They were on .shop domains bought through one registrar and hosted on one network that had nothing to do with that platform, so a report filed with the platform would not have removed anything. Where a copy actually lives matters, and it isn't always where you'd expect. Reporting a phishing domain to its registrar covers how a registrar report works.

Why this is slow

A copy can vanish for you and stay up for everyone else, and an abuse team acts only on what it can verify itself. Copies also come in batches: the retailer's first report named one domain, and five days later it sent us four more. Each team works on its own schedule, so the layers come down at different times.

Do you need a registered trademark?

Not to report fraud. A store that collects card numbers is an abuse case for the registrar and the host, whether or not the brand holds a trademark. A trademark matters for the slower routes that decide who owns a domain name: UDRP and URS, and platforms' trademark complaint forms. Copied product text and photos are covered by copyright, which you have without registering anything.

What if the fake site only uses your business name?

A copy that takes no payments and asks for no passwords is a slower problem. Nobody is being defrauded today, so the fast fraud channels don't apply. The route that fits depends on details a quick look usually can't settle: what the copy actually reproduces, and whether a trademark is registered and live. Those routes run in weeks or months. If this is your situation, start free and tell us the domain, and we'll say which path fits. If the copy does take payments or passwords, skip this and see the first section. It's fraud however it's dressed up, and it moves on a different clock.

What happened when we reported five copies

We sent the first reports on September 16 at 09:35 UTC. By the next morning, all five storefront domains had disappeared from DNS:

The storefronts were disposable. The domains that collected the card numbers were shared between them, and a new storefront can be attached to one the day it is registered. Taking down the copies is one round, not the end of the case.

Here's our mistake: within three hours of the first reports, the first copy stopped answering our checks, and we told the retailer it was offline. It was still serving visitors in other countries and had only stopped answering us. Third-party scans from other countries showed it, and we sent the retailer a written correction. The case record explains how that happened and what we changed so it can't repeat.

Warn your customers while you report

Reports take hours to days to act on. In the meantime, your customers are on the copy. Post a short notice where they will see it: which address is really yours, what the copy looks like (with its domain written so it can't be clicked, like example[.]shop), and what to do if they already paid. The whole first-response sequence is in the first 48 hours of a phishing incident.

Copying is not only a US problem. In its August 2026 monthly report, the Council of Anti-Phishing Japan says reports are increasing from companies whose website photos, brand names and operator details were copied and used for fake sites and fraudulent online stores.

If you want someone to do this for you

This is the work OpenBait does. On the Pro plan ($299 a month), we take on up to three cloned stores a month: the reports to the registrar and host, DMCA notices for copied product pages, and a case page that records what was sent to whom and what came back. Each fake-site domain counts as one takedown, and you can add one for $199 on any plan. If none of the sites we take on has had any effect 30 days after our first report, your first payment is refunded.

If you only want a place for customers to report copies of your site, the report page is free for one brand. How it works explains what happens after a report comes in.