By Martin Nymann, AddonNordic ApS, the company behind CheckBiz. Updated 12 October 2026.
To take down a website that copies your shop, send a short written notice to two companies: the one that hosts the site and the one that registered its domain. Both are obliged to receive it, confirm it and look into it. Below is the exact text to send, what to attach, and what happens next. Want it sent for you? Run a free scan on CheckBiz Brand Watch: we find the copies, you confirm each domain is not yours, and we send the notices with the evidence attached, from €39 a month excluding VAT.
| What you have right now | What a complete takedown notice contains |
|---|---|
| A link to a site that uses your shop name and photos | The exact URLs: home page, one product page, the checkout |
| A feeling that it is wrong | One sentence on why it is unlawful, with your company name and company number |
| No idea who runs it | The registrar and the host, found in five minutes |
| Screenshots on your phone | Full-page screenshots with the URL and the date visible |
| Anger | Your name, your email, and a good-faith statement |
Example for illustration. The right-hand column is what Article 16 of the EU Digital Services Act asks a notice to contain.
Contents
- Who do you send a takedown notice to?
- What must a takedown notice contain?
- Template: the notice to the hosting company
- Template: the notice to the domain registrar
- What if the copy sits behind Cloudflare?
- What should you attach?
- What happens after you send it?
- What should you not write?
- FAQ
Who do you send a takedown notice to?
Send it to the host and the registrar, in that order, and to the platform only if the copy runs on one. The host can switch the site off. The registrar can suspend the domain. Shopify can only act if the copy runs on Shopify, and when we examined 12 copies of European shops in October 2026, 11 ran on WooCommerce on their own servers, where Shopify has no say.
- Find the registrar at lookup.icann.org. Note the registrar’s name, its abuse email or form, and the date the domain was registered.
- Find the host. If the name servers end in cloudflare.com, start with Cloudflare’s form (see below). Otherwise look up the IP address of the domain; the network owner is normally the host, and its website lists an abuse contact.
- Check for a platform. A copy that runs on Shopify, Wix, Squarespace or BigCommerce can also be reported to that platform. Shopify’s forms require a Shopify login, which you have as a merchant.
- Send one notice per company, one site per notice. A notice that lists ten domains or asks the reader to investigate gets parked.
Our guide Someone copied your Shopify store: what to do in the next hour walks through the lookups with screenshots. This page is about the text you send once you know who to send it to.
What must a takedown notice contain?
Four things, and the law spells them out. Article 16 of the EU Digital Services Act (Regulation 2022/2065) requires every hosting provider serving EU users to accept notices of illegal content from anyone, by electronic means, and lists what the notice must contain:
- (a) Why it is illegal. A sufficiently substantiated explanation. For a copied shop: it uses your registered company name, logo and product photos, and takes orders in your name.
- (b) Where it is. The exact URLs.
- (c) Who you are. Your name and email address.
- (d) A good-faith statement. That you believe the information in the notice is accurate and complete.
A notice with all four gives the host what the regulation calls actual knowledge of the content. From that point the host is responsible for what it leaves online, which is why a complete notice gets read and an angry email does not. You do not need a lawyer, and for this route you do not need a registered trademark.
Trap: a notice is only as strong as the facts a stranger can verify in two minutes. “They stole my brand” is a feeling. “The site uses the name [Brand], registered to [Company, number], and sells the products shown on our site at [URL], registered on 28 September 2026” is evidence.
Template: the notice to the hosting company
Copy this into the host’s abuse form or email it to the abuse address. Replace everything in square brackets. Keep it in English unless the host’s form is in another language.
Subject: Notice of illegal content under Article 16 DSA: [copy-domain.com]
I am notifying you of a website on your service that impersonates our online shop.
1. Why the content is illegal. The site at [https://copy-domain.com] uses our company name “[Brand]”, our logo and our product photographs, and takes orders and payments in our name. We are [Legal company name], company number [number], registered in [country], trading at [https://your-real-shop.com]. The site is not operated by us or with our permission. It misleads consumers about who they are buying from and infringes our rights in our company name and our photographs.
2. Exact location. [https://copy-domain.com/], [https://copy-domain.com/product/…], [https://copy-domain.com/checkout].
3. Notifier. [Your full name], [role] at [Legal company name], [email address].
4. Good-faith statement. I confirm my bona fide belief that the information and allegations in this notice are accurate and complete.
Attached: screenshots of the home page, a product page and the checkout dated [date]; the domain registration record showing the domain was registered on [date]; a screenshot of our own shop for comparison.
Please confirm receipt and inform me of your decision, as Article 16(4) and 16(5) of Regulation (EU) 2022/2065 require.
If the site asks visitors for card details or login details on pages that pretend to be yours, add one line: “The checkout collects payment card details under our name, which constitutes phishing.” That word matters at the registrar, as the next section explains.
Template: the notice to the domain registrar
Registrars are bound by ICANN’s Registrar Accreditation Agreement, not by the DSA. Section 3.18 requires every accredited registrar to publish an abuse contact, to confirm receipt of your report, and to take reasonable and prompt steps to investigate and respond. The same four facts work; the framing changes.
Subject: Abuse report: [copy-domain.com] impersonates our registered business
I am reporting the domain [copy-domain.com], registered through you on [date], for abuse. The website at this domain uses our registered company name “[Brand]”, our logo and our product photographs, and takes orders and payments in our name. We are [Legal company name], company number [number], [country], trading at [https://your-real-shop.com]. The site is not ours.
[If applicable: The checkout at [URL] collects payment card details from consumers who believe they are buying from us. This is phishing within the meaning of section 3.18.2 of the Registrar Accreditation Agreement, and I ask you to take prompt mitigation action.]
Evidence attached: screenshots dated [date], the registration record, and a screenshot of our own shop.
Please confirm receipt and tell me what action you take.
[Your full name], [role], [Legal company name], [email address].
Trap: a plain copy, without phishing, is not “DNS abuse” under the ICANN rules, so the registrar must investigate and reply but is not forced to suspend. Only say phishing if the site actually collects card or login details under your name. A false claim costs you the credibility the next notice depends on.
For some domain endings the registry above the registrar acts too. Radix, which runs .store and .online, forbids storefronts selling counterfeit products, and the .top registry lists the sale of counterfeit goods as a reason to suspend. Verisign, which runs .com, is content-neutral and sends you back to the registrar.
Rather not chase abuse desks yourself? Start with a free scan. From €39 a month excluding VAT, Brand Watch sends these notices for you with the evidence attached, with you in copy, and follows up on day 3 and day 7.
What if the copy sits behind Cloudflare?
Use Cloudflare’s abuse form at abuse.cloudflare.com; Cloudflare is not the host, but it forwards your report. For a copied shop choose “Trademark Infringement” if you hold a registered trademark, otherwise “General”. Choose “Phishing & Malware” only if the site collects card or login details. One report can list up to 250 URLs.
Cloudflare forwards the complaint to the website operator and to the actual hosting company, and gives the host the site’s real IP address. Cloudflare only removes content it hosts itself. So the Cloudflare form is the first step for a site behind Cloudflare, not the last: when the forwarded report reaches the real host, your DSA notice applies there.
What should you attach?
Five things, in one message, so the reader never has to ask:
- Full-page screenshots of the copy’s home page, one product page and the checkout, with the URL bar and today’s date visible. Do not enter card details and do not place an order.
- The registration record from lookup.icann.org, showing the registrar and the registration date. A domain created last week that copies a brand with years of history is your strongest single fact.
- A screenshot of your own shop showing the same products and the same name, so the comparison needs no explanation.
- Your company registration: company number and, if you have one, the trademark registration number. Anyone can check your company in the official register, which is exactly what the abuse desk will do.
- Your contact details: full name, role, company and email, so the host can send the confirmation and decision the DSA requires.
What happens after you send it?
Two things the host must do, and one thing you should do. Under Article 16(4) the host must send a confirmation of receipt without undue delay if you gave an email address. Under Article 16(5) it must tell you its decision and how to challenge it. Under 16(6) it must handle the notice in a timely, diligent, non-arbitrary and objective manner, and say so if a machine made the decision. The regulation sets no number of days, so “timely” is what you hold them to.
Your part is the follow-up:
- Day 3: nothing happened? Reply to your own notice at the host and the registrar: “On [date] I sent the attached notice. Please confirm receipt and your decision.” Quote the original subject line.
- Day 7: still online? Add the parties that let the copy earn money. Report the ads to Google under its Misrepresentation policy, which forbids impersonating other brands in ads or on the website. If you hold a registered trademark, send Stripe or PayPal an IP notice; Stripe says it can stop processing payments, not remove the site.
- Keep every reply. Visa and Mastercard only accept brand-abuse reports from the rights owner or a lawyer, and Mastercard wants evidence of at least three earlier notices. Your day 0, 3 and 7 messages are that evidence.
No one can promise that a copy comes down; the host or the registrar decides. What you control is that a complete notice reaches the right desk today, and that the next copy does not sit online for weeks before you hear about it.
What should you not write?
Do not call the site a scam or a fraud, do not threaten, and do not guess. The abuse desk decides what the site is; your job is to make the facts obvious.
- Not “scam”, “fake” or “fraud”. Write what you saw: “uses our name”, “takes payments in our name”, “registered on 28 September 2026”.
- Not ten domains in one notice. One site per notice, so each one can be actioned on its own.
- Not “please investigate”. Give the facts that end the investigation before it starts.
- Not a test order. Stripe suggests a test purchase as proof that a site uses Stripe, but a card payment to a copy is your money gone and your card number in the wrong hands.
- Not a claim you cannot back. “Phishing” only when the site collects card or login details. “Trademark” only when you hold a registration.
FAQ
Can I send a takedown notice without a lawyer?
Yes. Article 16 of the Digital Services Act lets any individual or entity notify a hosting provider of illegal content, and ICANN’s rules let anyone report abuse to a registrar. Neither route requires legal representation or a registered trademark.
Do I need a registered trademark to report a copycat website?
No for the host and registrar routes above. Yes for the trademark-specific forms at Shopify, Cloudflare, Stripe and PayPal, which only accept notices from the rights holder or an authorised representative. Without a registration, use the “general” or “fraud” paths and lean on your company registration and your photographs.
How long does a host have to respond to a DSA notice?
The regulation says “without undue delay” for the receipt and “timely” for the decision, with no fixed number of days. In practice, send your day 3 follow-up if you have heard nothing, and move to the day 7 steps if the site is still online.
Should I write that the site is a scam?
No. Describe what the site does: it uses your name, your photos and takes payments in your name. The host or registrar decides what to call it. A factual notice is read; an accusation is parked.
What does it cost to have the takedown notices sent for me?
The scan is free. From €39 a month excluding VAT, Brand Watch checks daily for new copies of your shop, sends the notices to the host, the registrar and the other channels with the evidence attached, and follows up on day 3 and day 7. You confirm each domain before anything is sent, and replies go to you.
This article is general guidance, not legal advice. Whether a site comes down is decided by its host, its registrar or a court.
Summary
Send the host a notice with the four Article 16 elements, send the registrar an abuse report with the same facts, attach the screenshots and the registration date, and follow up on day 3 and day 7. Write facts, not accusations. Run a free scan on CheckBiz Brand Watch to see which sites use your name today, and let us send the notices for you.
This content was generated with artificial intelligence.