Copying a website is trivial — automated tools mirror an entire site in minutes. What the attacker adds is a lookalike domain and a payment path that goes to them. Customers arrive through search advertisements, messages, or mistyped addresses, and have little reason to doubt what they see.
How clones are distributed
- Paid search advertisements above your genuine result, a persistent and effective route.
- Messages and emails linking directly to the clone.
- Social advertisements using your branding.
- Typosquatted domains catching mistyped addresses.
What to do, in parallel
Do not work sequentially — pursue all of these at once. Report to the domain registrar for abuse and trademark infringement. Report to the hosting provider. Submit the URL to browser safe-browsing services, which produces the fastest visible result for users. If it is running advertisements, report those to the advertising platform, which can act quickly. And warn your customers immediately rather than waiting for any of it to complete.
Preserve evidence first
Screenshot the clone, record the URL and WHOIS details, and note the payment details it presents. This is needed for takedown requests, for police reports, and for helping customers who paid. Once takedown succeeds, the evidence is gone.
Fake applications
Search the app stores for your business name periodically. Fraudulent applications collect credentials and payment details under your brand, and stores act on reports from the genuine owner, particularly where a trademark exists. Publish which official apps you actually have — for many small businesses the answer is none, and saying so plainly is useful.
Reduce the recurrence
Register the obvious lookalike domains, monitor certificate transparency for new ones, keep trademark registrations current since they materially speed takedowns, and tell customers to reach you by typing your address rather than following advertisements. None of it is perfect, and together it shortens the life of each attempt.