What to do in the first hour after finding a fake copy of your store.
Fake stores are built to take your customers' money before anyone notices. The faster the reports go in, the fewer people they reach. This page sets out what to do, in order.
Fake stores are produced at scale, in four steps.
- 1
Your catalogue is copied wholesale
Scrapers pull product names, descriptions, prices and photos straight from your storefront. Many copies still load images from your own servers or CDN, which leaves a trail.
- 2
A lookalike domain goes live
Your name plus a word like “outlet” or “sale”, a letter swapped, or a cheap ending like .shop or .store. A certificate is issued so the padlock shows.
- 3
A fake checkout collects payments and card details
The goal is card details or a payment for goods that never ship. Prices are slashed to make people act before they think.
- 4
Ads point your customers at it
Paid social and search ads using your name and photos bring traffic fast. Once reported, the same people often return on a new domain.
Your catalogue on a domain you do not own
Four things to do in the first sixty minutes.
0–10 min
Check the fake site free
Paste the fake site's address into the free check. You get the registrar, the host or Cloudflare, and who to report it to. Note the time and the full URL.
10–20 min
Capture the evidence
Screenshot the home page and checkout yourself, or start a Takedown Pack, which captures a full-page screenshot, an archived copy and hotlinked-asset proof for you.
20–40 min
Report the site
Send the registrar and host reports first, because they can take the whole site down. Then report it to the browser blocklists (Google and Microsoft), which warn visitors even before removal.
40–60 min
Protect your customers
Post a short notice on your site and social channels with your real address. Tell your support team what to say, and report any ads you have seen to the ad platform.
Avoid
- — Do not contact the people behind the fake site. It warns them, and they move faster.
- — Do not buy from it to “test” it with your own card.
- — Do not make public threats before the reports are in. Report first, announce second.
- — Do not assume one report is enough. Chase the ones that go quiet.
Notes for Shopify, WooCommerce and Magento stores.
Shopify
- Storefront data is easy to scrape, so fake sites often match your catalogue exactly.
- If the fake site itself runs on Shopify, Shopify's own intellectual-property reporting process applies as well as the registrar.
- Images hotlinked from your store's CDN are strong evidence that the content was taken from you.
WooCommerce
- Fake sites are often full-site scrapes, including theme files and sometimes your scripts.
- The clone beacon is a footer snippet you can add through your theme or a header-and-footer plugin.
- Check your server logs for unusual referrers loading your images.
Magento / Adobe Commerce
- Larger catalogues mean fake sites are often partial copies: your best sellers, re-priced.
- Media served from your own domain makes hotlink proof straightforward.
- The beacon can go in your theme's footer like any other script.
There is no Takedown Pack app to install. Everything works from your browser, whatever platform your store runs on. Read the Shopify guide
Check the fake copy of your store free.
Paste the address of the fake site. We identify the registrar, the hosting provider, whether it is hiding behind Cloudflare, and who to report it to.
- — Nothing is sent to anyone
- — Looked up from our servers, not your browser
- — Your result is saved at a private link
Start a takedown
Check the fake site free, then get it taken down.
Paste the address of the fake site. In about 20 seconds you will know who registered it, who hosts it and who can take it down. No account and no card are needed.