Someone cloned my website: what to do now, and how to find the next copy first

If you are reading this, you're probably already aware that your site is being impersonated. Maybe a customer wants to know where their order is, and you have no record of it. Someone in your finance team takes a call from a supplier asking why your bank details have changed. Or somebody raises a support request with a link, and there is your website: your logo, your product photos, your wording, on a web address (domain) you have never owned.

A cloned website can be taken down, and you can do every step below yourself. Expect a separate report to each provider, each with its own queue, then days of chasing and checking, and the same again for every new copy. That is the work DefendDomain can take off your hands. After the steps comes the part that matters most for next time: how to find a copy before your customers do.

First, check it is a clone

Websites borrow from each other all the time, and a rival reusing your product descriptions is irritating but a different problem. The test is whether the site pretends to be you to people who trust you. If it uses your name and branding, and it takes orders, collects logins, lists contact details or sends email as you, treat it as an attack on your business. It will be used against your customers, your staff or both.

Clones turn up in three kinds of place: a web address close to yours (a misspelling, or your exact name with a different ending), an unrelated address with your pages on it, or a subdomain on a free hosting platform with your brand as the project name. That last kind has no domain registration behind it, which matters later.

If the fake products are listed on a marketplace or promoted from a social media account, rather than sold from a copy of your own site, report them through that platform's own brand reporting process. That is where the power to remove them sits. This guide is about copies of your website.

Step 1: Capture the evidence before the copy changes

Once the people running a clone realise they've been spotted, they can change the pages, take the site down, or rebuild it on a different address. The evidence you collect in the first hour may be the only evidence you get.

Capture:

• A screenshot of every page, with the full web address and the date and time visible.
• The full address of each page, copied as text.
• Your own genuine pages alongside, so anyone reviewing a report can compare the two at a glance.
• Whatever sent people there: emails, text messages, adverts, social posts, and the reports from customers or staff, with their dates.
• What the site asks visitors for: its forms, and what its checkout or login pages collect.

Do not type real details into the clone's forms, and do not contact whoever runs it. Both tell them they have been found.

Step 2: Work out what the copy is built to do

A clone is built for a purpose, and the purpose tells you who is about to be hurt and how.

• Taking orders or payments. Your customers pay for goods that never arrive, and then they contact you. Our page on fake online stores covers this case.
• Collecting logins. If your site has a customer portal or a staff sign-in page, the copy is there to collect passwords.
• Collecting enquiries. The clone's contact forms and email addresses put your prospects and suppliers in touch with the attacker instead of you.
• Making invoice fraud look legitimate. A fake invoice, or an email saying your bank details have changed, is more convincing when a customer can check and find a working copy of your website behind it. The payment goes to the attacker, and your finance team is left chasing an invoice the customer believes is paid.
• Advertising jobs. A copied careers page can front an employment scam aimed at people who want to work for you. There is a section on this below.

If the clone sits on a lookalike of your domain, check one more thing: whether that domain is set up to send email. A lookalike with email set up can write to your customers, staff and suppliers as you, whether or not anyone ever visits the site. Our free scan shows which lookalikes of your domain are registered and which of them can send email. If a lookalike is already emailing people as you, our guide to email impersonation covers what to do about that side.

Step 3: Warn your staff and your customers

By the time you find a clone, the cost is already impacting you: the refunds and complaints, the passwords to reset, the payment that went to the wrong account. Warning people quickly limits how much more of it there is.

Tell your staff first, and finance before anyone else. If a supplier or customer has already asked about new bank details, do not wait for step 1 to finish. Anyone who pays suppliers or updates bank details should confirm every change by phone, on a number they already hold, until this is closed. Support and sales teams need two or three sentences they can give a customer who asks.

Then tell customers what they can check for themselves: your one genuine web address, how you do and do not ask for payment, and where to report anything suspicious. Keep it factual, and do not publish the clone's address. Naming it sends it visitors.

Step 4: Get it in front of the people who can take it offline

A clone comes down when someone with control over it acts, and warnings can protect people while that happens. For a single clone, the report needs to reach:

• The browser warning services (Google Safe Browsing and Microsoft SmartScreen), which put a red warning screen in front of visitors while removal is under way.
• Blocklists that spam filters and security tools use. A listing protects people who have never heard of your company.
• The companies that run the copy: the host (the company whose servers run the site), the registrar (the company that sold the domain) and any email provider it uses. They are the ones who can take it offline. A free lookup at lookup.icann.org shows a domain's registrar and its abuse contact. For a copy on a free hosting platform, use the platform's own abuse or phishing report form. In one case we have written up, a single evidence-backed report had a copy on a free hosting platform offline about a day after it was confirmed.
• Search engines, which can drop the pages from their results.

What decides the speed is the report. The person reading it has never heard of your company, so it has to make the impersonation obvious within a minute: the copy and the original side by side, dated, with what the site is being used for. Vague complaints wait in a queue.

By hand, you write that report several times over, because each of them has its own process, its own evidence requirements and its own queue. If a host does not answer its abuse address, use its abuse or phishing report form instead, and report the copy to the browser warning services at the same time so visitors are warned while you wait.

Report it to the authorities as well. In the UK, report the site to the National Cyber Security Centre, and if anyone has lost money, to Report Fraud in England, Wales and Northern Ireland or to Police Scotland on 101. In the US, report fraud losses to the FBI's Internet Crime Complaint Center and the Federal Trade Commission. Elsewhere, report it to the police or national cyber security agency in your country. A report gives you a record and adds to what the authorities can act on. It does not replace a direct request to the people who control the site.

Step 5: Chase it until it is actually offline

Sending the reports starts the takedown. Getting the copy offline often takes days, sometimes longer, while each one sits in a queue and the clone keeps taking your customers' payments and your staff's passwords.

So someone has to follow up: phoning each provider's help desk, replying to tickets that were closed or passed to another provider, re-sending the same evidence, and pushing for an escalation when nothing moves. It also means checking every day whether the address still works and the pages still load, because a closed ticket can still mean a live site, and a copy that comes down can reappear on the same host.

That work often lands on the head of IT or an operations lead: phone queues and ticket threads spread across days, while the work they would otherwise be doing waits.

If you have a live copy of your site right now, we can do this part for you. Report a live attack and one of our team calls you back, usually the same working day. If you go ahead, we send the reports, chase them on a set schedule and check every hour whether the copy is still online.

If the copy is used for fake job offers

Fake recruiters usually find people on LinkedIn, job boards, text messages or WhatsApp, send them to the copied site, then ask for a fee for training or equipment. The site can be taken down like any other copy (steps 4 and 5). The posts and messages need reports of their own:

• Report the fake job posts and recruiter profiles to the platform they are on. Only the platform can remove them.
• Put a short notice on your careers page: you never charge candidates a fee, and you only contact them from your own domain.
• Reply to candidates who contact you with the same two facts, and ask them to keep the messages they received.
• Candidates who paid should call their bank straight away. In the US they can report it to the Federal Trade Commission and the FBI's Internet Crime Complaint Center; in the UK, to Report Fraud; elsewhere, to the police.

We can go after the copied site and the lookalike domains behind it. We do not remove the posts, text messages or WhatsApp messages themselves.

Step 6: Assume there will be another one

Copying a website takes minutes. A takedown costs whoever made it that one copy, and nothing stops them making another. In the free hosting case above, the project name on the platform had been built from a lookalike domain that was already taken down once before for the same brand. By hand, every new copy sends you back to step 1.

So the useful question after the first takedown is how you will hear about the second. This time, the clock ran from the day the copy went live to the day someone told you. That gap is where the refunds, the reset passwords and the misdirected payments came from, and it is the part you can change.

How to find the next copy before your customers do

To fool anyone, a clone has to carry your brand: your name, your words and your images. All of those are things you can watch for. How much watching is worth doing depends on what a copy would cost you.

To start, for free: run our free scan once a week. It shows which lookalikes of your domain have been registered and which of them can send email, so a misspelling or your name on a different ending gets noticed while it is still empty. Then set up Google Alerts for your brand name and two or three distinctive phrases from your site, so you hear when your words are published somewhere new. Neither catches everything. A clone that is only ever sent to people as a direct link may never be indexed, and a copy on a free hosting subdomain has no registration to spot. Together they will catch some copies before a customer tells you, for the cost of a weekly reminder.

When a copy would cost you customers, payments or logins, the watching has to be wider than a weekly check, and the takedown needs someone whose job it is. DefendDomain re-checks around 500 lookalikes of your domain every hour, watches public certificate logs for names like yours, and looks for copies of your site's wording on the web, including on addresses that look nothing like yours. When a copy goes live, the evidence is captured with the alert. When you confirm it, one click sends it to every place that can act, we follow up automatically, and we tell you when it is offline. After that we keep watching and alert you if it comes back. In the second case we have written up, a lookalike of a private-equity-backed software group's domain was flagged when it was registered, confirmed as a clone when the copied site went live, and taken offline before any customer, prospect or employee was known to have used it. In a third case, fake stores posing as an upmarket e-commerce brand ran on Shopify and WooCommerce, and 14 fake stores were taken down in the brand's first two weeks with DefendDomain.

Why this cannot wait

The takedown is the step everyone searches for, and it matters. But the size of the bill is set by how long the copy stays live. Every day it is up is another day of orders paid to someone else, passwords handed over, invoices settled to the wrong account, and customers who now connect your name with being defrauded.

So act today, not after the next customer call. Capture the evidence, warn your people, get the reports out and chase them, or report a live attack and one of our team will call you back, usually the same working day. Then decide how you will hear about the next one: run a free scan to see what is already registered around your brand, or book a demo to see the full platform.

Frequently asked questions