ScrappyLabs · Field Notes · Security

Somebody cloned the store.

The first sign wasn't a security alert. It was the phone. How a fake copy of a real shop gets built, how we followed one back to the crew running it, and what to do the morning you find yours.

Brian · ScrappyLabs·Asheville, NC·~7 min read

The call

Orders nobody took

A consumer brand we work with started getting calls about orders it had no record of. The customers had paid. Nothing had arrived. When they dug out their receipts, the store on them wasn't the brand's store. It was a copy: the same logo, the same product photos, the same sales copy, on a new domain with a different ending. It was running ads on the brand's name.

And at the bottom of the fake site was the brand's real phone number. So the people the fake store robbed called the real company to complain.

The clone lists your real phone number. Your staff take the angry calls for orders they never took.

What it is

Not a hack. A copy.

Nobody broke into anything. A clone is a hosted storefront account on one of the big store platforms, a domain bought that week, photos and text lifted from the real site, and a checkout through the usual wallet buttons. One product, priced under the real one, with a "first-time buyer" discount banner. The product images were AI-generated, and it showed: the lettering on the label melted into nonsense.

Because nothing was breached, none of the brand's security tools saw anything. No alarm goes off when someone copies your public website. The first alert is a customer.

The second store

The backup was already waiting

While we collected evidence on the first store, we checked the obvious look-alike names. One had been registered the day before: same registrar, same store platform, and a password page with the brand's logo on it. Staged. When the first store gets reported and shut, the second one opens.

That changed how we think about the job. A takedown has to cover the next store too, because the next store already exists.

Following the thread

One kit, many victims

The fake store's contact page gave a support address on a throwaway domain. That domain's webmail sat on a rented server overseas, and the same mail server handled more than two dozen other "support" domains, all with generic shop names, many of them registered in batches on the same two days. Each one looks like the back office for another store.

Then we found the pattern. In a free sample of newly registered domains, we turned up a second fake store for a completely different brand in a completely different category. Its contact page matched the first one word for word: the same odd date stamp, the same banner text, the same city name written in Chinese characters, paired with a US state that didn't match. Same kit. New victim.

These crews reuse everything. So one clone, followed carefully, leads you to the rest.

That matters for the takedown too. A report about one shop gets one shop removed. A report that shows a platform three stores run by the same people asks for the whole account to come down.

Knock first

We told the second brand for free

We'd never worked with them. We emailed their support team the evidence, the screenshots and the report links, with no pitch attached. Within the hour it was with their legal and brand-protection people.

That's the right order. If you see smoke coming out of a stranger's house, you knock on the door. You don't hand them a business card first.

Spot one

The tells

No single sign proves a store is fake. Plenty of real businesses register new domains and sell one product. It takes several of these together, and then a person looking at it:

• The domain is weeks old, while the real brand's site is years old.
• An odd ending or a hyphen: brand.one, brand.us, brand-official.com, us-brand.com, brand.vip.
• One or two products, cheaper than the real store.
• Product photos with garbled text on the label.
• A contact address on free webmail or a domain you've never heard of.
• A store address that doesn't add up: a city in one country, a state in another.
• "Official site" claims, giant review counts, "as seen on" logos, countdown timers.

Name matching alone is noise. When we swept two days of new store domains for names close to real brands, almost every match was a real business. The fakes stood out only when several tells lined up.

The checklist

The morning you find yours

1. Save the evidence before you report anything. Screenshots of every page, including checkout and contact, with the full address and the time. Reported stores disappear, and the evidence goes with them.
2. Tell your customers. A short notice on your real site and your social accounts: "We only sell at yourbrand.com." Give your support staff a two-line script.
3. Log every caller. Order number, date, amount, payment method, the transaction ID, and who sent the receipt email. Tell them to dispute the charge with their card or payment provider.
4. Report to the store platform. Most have both a trademark form and a fraud form. The trademark owner signs the trademark one.
5. Report to the payment processor the checkout uses, and to the ad network if it is running ads on your name.
6. Report to the domain registrar and the host. Their abuse contacts are in the domain's public registration record.
7. Report the address to the browser warning lists (Google Safe Browsing and Microsoft's equivalent) so visitors see a warning.
8. If one crew runs several stores, say so. List them together in every report.
9. Check again tomorrow. And the day after. Re-file when the next one appears.

Customers who lost money can also report it to the FTC at reportfraud.ftc.gov (opens in a new tab).

What we built

A daily watch

After the first case we wrote a sweep that runs every morning. It checks newly registered domains and newly issued security certificates for the brand names we watch and their look-alikes, fingerprints any store it finds, and sends an alert the same day. A new certificate can show up while the fake store is still behind its password page.

On its first afternoon it found a second, different scam against the same brand: a fake "official site" sales page with invented reviews and a buy button that bounced through a hidden redirect. It had been up for months. Nobody had noticed, because nothing had told anybody to look.