By Martin Nymann, AddonNordic ApS, the company behind CheckBiz. Updated 3 October 2026.
Report the copy to the company that registered its domain and the company that hosts it, not only to Shopify. Here is how to find both in five minutes and what to send. If you want to see every lookalike of your store first, scan your store free with CheckBiz Brand Watch: the report lists each site and who to contact, and from €39 a month we send the takedown requests for you.
| What you have right now | What the free Brand Watch scan shows |
|---|---|
| One URL a customer sent you, e.g. yourbrand-outlet.shop | Every registered domain close to your name: typos, “outlet”, “shop”, other endings |
| Your logo, photos and product names on it | Which lookalikes show your name, take orders or were registered recently |
| A checkout that takes orders | The registrar and host behind each one |
| No idea who runs it, or who else exists | Where to send each takedown request |
Example for illustration — not a real shop.
Contents
- What should you do in the first hour?
- Why is reporting to Shopify not enough?
- How do you find who registered the domain?
- How do you find who hosts the copy?
- What should the takedown request say?
- What should you tell your customers?
- What if the copy stays online?
- FAQ
What should you do in the first hour?
Save the evidence, find the two companies that can act, send them one clear request, and warn your customers. In that order:
- Save the evidence. Take full-page screenshots of the home page, a product page and the checkout, with the URL and today’s date visible. Do not enter any card or login details, and do not place an order.
- Find the registrar of the domain (five minutes, below).
- Find the host of the site (five minutes, below).
- Send one request to each, with the screenshots and the facts.
- Tell your customers where your real shop is, so nobody else orders from the copy today.
Open the copy in a private browser window and close it again once you have your screenshots.
Why is reporting to Shopify not enough?
Shopify can only act if the copy runs on Shopify, and many copies do not. When we examined 12 copies of European shops in October 2026, 11 ran on WooCommerce on their own servers, where Shopify has no say at all.
If the copy does run on Shopify, Shopify is its host, and you should report it there too. Shopify’s report forms (fraud, trademark, copyright) all ask you to log in with a Shopify account. As a Shopify merchant you already have one, so use it: Report a merchant. Use the fraud form for a site pretending to be your shop, and the trademark form if you own a registered trademark.
Trap: WooCommerce cannot remove a store either. It is software, not a host. WooCommerce’s own guidance tells you to go to the hosting company, the registrar, or the payment provider instead.
How do you find who registered the domain?
Type the domain into ICANN’s lookup tool at lookup.icann.org. It shows the registrar, the date the domain was registered, and the registrar’s abuse contact (an email address or a web form).
Every registrar accredited by ICANN must publish an abuse contact, acknowledge reports and investigate them. That duty comes from section 3.18 of ICANN’s Registrar Accreditation Agreement. Write down:
- The registrar’s name and abuse email or form
- The registration date (a domain registered last week that copies a ten-year-old brand is strong evidence)
- The name servers (if they end in cloudflare.com, read the next section)
For some endings, the registry above the registrar acts too. Radix, which runs .store and .online, explicitly forbids storefronts selling fake or counterfeit products, and the .top registry lists the sale of counterfeit goods as a reason to suspend a domain. Verisign, which runs .com, does not judge content and expects you to go to the registrar first.
How do you find who hosts the copy?
The host is the company whose servers deliver the site. If the lookup shows Cloudflare name servers, Cloudflare is not the host: report the site at abuse.cloudflare.com, and Cloudflare forwards your report to the real hosting company and to the site operator.
Without Cloudflare in front, look up the IP address of the domain. The network owner shown for that IP address is normally the hosting company, and its website lists an abuse contact.
Hosts that serve EU users must offer a way to report illegal content. Article 16 of the Digital Services Act requires every hosting provider to let anyone, not only the brand owner, submit a notice electronically, to confirm receipt, and to tell you what they decided.
What should the takedown request say?
Short facts, one site per request, and nothing the host has to investigate to understand. The Digital Services Act lists what a notice to a host should contain, and the same structure works for registrars:
- Why it is unlawful: “This site uses our shop name, logo and product photos and takes orders in our name. We are [company name, company number].”
- The exact URLs: home page, product pages and checkout.
- Your name and email address.
- A good-faith statement: “I believe the information in this notice is accurate and complete.”
Attach the screenshots, the registration date from the lookup, and a link to your real shop. Describe what you saw: “uses our name”, “takes payments in our name”, “registered on 28 September 2026”. Do not write that the site is a scam or a fraud. The registrar or host decides, and a calm, factual request gets read.
If the copy asks visitors for card details or login details on a page that pretends to be yours, say so explicitly and call it phishing. Under the ICANN agreement, registrars must act promptly on clear evidence of phishing.
Want this done for you? With CheckBiz Brand Watch you confirm the site is not yours, and we send the requests to the registrar and the host with the evidence attached, then follow up after 3 and 7 days. Their replies go straight to you.
What should you tell your customers?
Tell them the address of your real shop and that you never sell under any other domain. Put one line on your home page and in your order confirmation email, and pin a short post on your social channels.
When a customer writes “where is my order?” and you cannot find the order, ask for the website address they bought from. That is often how shops find their first copy. Point the customer to their card issuer or bank to dispute the payment, and add the URL to your evidence.
Check the “company” the copy names, too. Copies often show an imprint or a company name and number in the footer. You can search that company free on CheckBiz to see whether it exists in the official register and is active. A company number that does not exist, or belongs to an unrelated business, is a useful fact for your request. Our guide to supplier red flags you can check in the company register shows what to look for.
What if the copy stays online?
Follow up, and widen the circle. If nothing has happened after three days, write again to the registrar and the host, quoting your first request. After a week, add the parties that let the copy make money:
- Ads: Google’s Misrepresentation policy forbids impersonating other brands or businesses in ads or on the website. Report the ad through Google’s ad report form.
- Payment providers: Stripe and PayPal accept notices from the owner of intellectual property, such as a registered trademark. Stripe says it can stop processing payments, not remove the site.
The card networks are a later step: Visa only accepts brand abuse reports from the rights owner or an authorised lawyer, and Mastercard asks for evidence of earlier enforcement attempts, so start with the registrar and the host.
No one can promise that a copy comes down. The registrar or host decides. What you can control is that a complete request reaches the right abuse desk quickly, and that a new copy does not go unnoticed for weeks. That is what Brand Watch does: a free scan today, and from €39 a month (see pricing) a daily check for new copies, an email the same day, and the takedown requests sent for you.
FAQ
Can I report a copied store if I don’t have a registered trademark?
Yes. Registrars must investigate abuse reports, and under the Digital Services Act anyone can notify an EU hosting provider of illegal content. A registered trademark opens extra routes, such as Shopify’s trademark form and payment-provider notices, but you do not need one to start.
How do I find out who registered a copycat domain?
Enter the domain at lookup.icann.org. It shows the registrar, the registration date and the registrar’s abuse contact. The owner’s own details are usually hidden for privacy, so send your request to the registrar.
Will the copy definitely be taken down?
No one can guarantee it. The registrar or the hosting company decides. A complete, factual request with screenshots and the exact URLs gives them what they need to act quickly.
Does Shopify remove copies of my store?
Only if the copy runs on Shopify. Then you can report it with Shopify’s fraud or trademark form while logged in to your Shopify account. Copies on WooCommerce or other software must be reported to their registrar and host.
How much does it cost to find copies of my store?
The Brand Watch scan is free and lists every lookalike site with who to contact. If you want us to send the takedown requests, follow up and check every day for new copies, Brand Watch costs €39 a month for one brand, excluding VAT for businesses, and you can cancel anytime.
Start with a free scan
The free scan lists every lookalike of your store and who to contact, and the report arrives by email in a few minutes.
Scan your store free with CheckBiz Brand Watch
This content was generated with artificial intelligence.