Someone Cloned My Website. The Interesting Part Was the Checkout.

No affiliate links in this one and nothing to sell you. If you want to know how the money side of this site normally works, that is all in my editorial policy. I have deliberately not named the shop involved, not printed any of the domains, and not included the IP addresses. The card capture endpoint described below is still live and still serving other people’s cloned shops, and I would rather not help anyone find it.

There are 3am rabbit holes I choose and 3am rabbit holes that choose me. This one arrived in the afternoon, disguised as a marketing email, and I did not properly understand what I was looking at until I had the page source open in the small hours with the house asleep. Someone cloned my website, copied it down to the product slugs, and the theft turned out to be the least interesting part of it.

The email was the kind you skim and delete.

Congratulations! You’ve acquired 2 new backlink(s) with your website.

Two new links. One from an automated site-report generator, worthless but harmless. The other from a domain I did not recognise, which was almost exactly the domain of a business I run.

Almost. The .co had quietly migrated out of the end of the domain and into the middle of the name. Same letters. Same order. Different address entirely. If you saw it in a search result at a glance you would not notice, and that is the whole point of it.

The SEO tool valued both links at roughly eighty dollars and congratulated me on my momentum.

The detail that proved someone cloned my website

The link was not to their homepage. It was to a specific product page, and the slug on the end of it was mine.

Not a generic phrase. A handle. The bit of the URL I chose myself, typed out, and could have written a hundred other ways. Two unrelated businesses do not independently arrive at the same product slug.

That was the moment this stopped being odd and started being deliberate.

Following the infrastructure

The WHOIS came back fast. The domain had been registered a few weeks earlier, on a one year term. Disposable. The registrar was American, ICANN accredited. The nameservers were Cloudflare.

Cloudflare usually means a dead end. If they are proxying the traffic then the real host sits behind them, and you are reduced to filing an abuse report and waiting.

So I filed one, and it bounced back with an error I had not seen before.

"A URL contains a domain that is not active on Cloudflare"
err_code: "url_not_orange"

Cloudflare were doing DNS only. Not proxying. The origin was not hidden at all. I could simply resolve it, and when I did, it landed nowhere near my own host. Different provider, different network, different country. So whatever this was, it was not a shop on my platform that I could report through my platform.

The registry record for that address range was more useful than I expected. It belonged to a hosting company registered in China, operating European address space through a broker. And the address block itself had been created days before the domain was registered.

That ordering matters. Nobody was repurposing an old server. The infrastructure was stood up for the job.

One detail buried in that record turned out to be the most useful thing I found all week. The hosting company had voluntarily registered a DMCA agent with the US Copyright Office. That is an opt-in to safe harbour, and safe harbour only holds if you act on properly formed notices. It gave me a formal process to point at instead of an inbox to plead with.

The checkout

This is where it stopped being an intellectual property problem.

I put an item in the basket and went through to the checkout. I filled it with obvious rubbish. Two letters in the name field, a made-up postcode, and a card number that was just the digits one to eight twice over. Never a real card, obviously. Then I opened the page source.

I was expecting Stripe. Or PayPal. Or something. Every real shop has a payment processor, and a payment processor is a company with compliance obligations and an abuse team you can write to.

There was no payment processor.

"provider_id": "pp_payment-iframe_payment-iframe",
"data": {
  "iframeUrl":  "https://[random-string].shop",
  "backendUrl": "wss://[random-string].shop"
}

The card form was an iframe served from a random-string domain, and the card details went out over a websocket. A persistent connection, streaming the numbers as you type them.

That is not a payment being processed. It is a payment being collected.

A few lines further down, on a physical product that plainly needs putting in a box and posting to somebody:

"requires_shipping": false

They were never going to ship anything. There is no fulfilment failure here. No dropshipper hoping to source stock and quietly failing. The goods are set decoration. The card form is the product.

The tells, once I knew what I was looking at

They kept my SKUs. Their variant code was my own SKU convention with my domain bolted onto the front of it. The product handles were the same, my slug with my domain as a prefix. Whatever scraped the site tagged everything with its source, and nobody bothered to clean it up afterwards.

They kept my writing. Word for word. Product copy, the specifications block, the how-to-order steps, the dispatch note. My photographs. My logo. My navigation.

The contact address did not exist. The site displayed a support email on a lookalike domain, close to mine but not mine. I checked whether it resolved. No DNS, no mail server, nothing at all. Any customer chasing a missing order would be typing into the void, which I assume is the intention rather than an oversight.

The prices did not reconcile either. A struck-through “was” figure against a sale figure, with no relationship between the two. The discount is bait and the number is meaningless. And it claimed free worldwide shipping on all orders, which I have never offered anywhere.

Then I found the second one

The product images were not being served from their own domain. The paths pointed at a different domain again, one I had not seen yet.

I resolved it. Two addresses along from the first, in the same allocation. A second identical clone of the shop, and judging by the fact that the file paths still pointed at it, the original build of the two.

But the card harvester sat somewhere else entirely. Different provider, different network, separate infrastructure altogether.

That is the part that actually matters, and it took me a while to see it.

The storefronts are disposable. A domain costs a few pounds and an hour of setup, and if one gets taken down you register another. The harvester is shared. One card capture endpoint, serving an unknown number of cloned shops belonging to an unknown number of businesses who have no idea any of it is happening.

I am one of them. I only know because a marketing email told me I had won a backlink.

What I actually did about it

In rough order of how fast each one bites.

Google Safe Browsing. Three separate reports. Both storefronts, and most importantly the harvester. This is the fastest acting thing available to a normal person. It puts a full page red warning in Chrome, Safari and Firefox, it does not need anyone’s cooperation, and it strangles the traffic while everything else grinds along.

The registrar. American and ICANN accredited, which made them the only party in the whole chain operating somewhere with genuine accountability. I led with my registered trade mark and mentioned URS, the Uniform Rapid Suspension procedure, which exists specifically for clear-cut trade mark abuse.

A DMCA notice to the host, citing their own designated agent registration number. Low expectations. But it builds the record, and “we were told in writing and did nothing” is a considerably worse position for a host than “we never knew.”

NCSC, who feed the commercial takedown services. Useful when the host is unlikely to answer a letter.

Action Fraud, as the impersonated business. Their online triage genuinely is not built for this. Every branch assumes you are the person who lost the money, and I hit two dead ends before finding a category that worked. It produces a crime reference number though, and that number changes the tone of every follow-up email you send afterwards.

A notice to my own customers, which in hindsight should have been first.

What I did not do was contact them. It achieves nothing and it tips them off. They would move hosts, register a near identical domain, and I would start again with a broken evidence trail.

What happened next

Both storefronts stopped resolving inside a day.

Not erroring. Not showing a holding page. Returning nothing at all, which is a different thing entirely, and worth understanding if this ever happens to you.

There are two ways a domain goes dark like that, and they look identical if you only ask your own broadband router. Either the people running it deleted their own DNS records to go quiet, or somebody further up the chain removed the domains altogether. Those are very different outcomes. You can separate them by asking the registry that runs the top level domain for the delegation directly, instead of asking a normal resolver for an address.

If they had simply switched off their own DNS, the domains would still be delegated. The registry would still hand back the nameservers they were pointed at, and the failure would happen one step later, at those nameservers. You would get a server failure, not a flat denial that the name exists at all.

That is not what came back. The registry returns NXDOMAIN for both. They are not in the zone file. The delegation has been withdrawn at a level nobody operating those sites could reach, which rules out the explanation I was most worried about, the one where they saw the reports coming and went quiet deliberately to protect the wider operation.

I still cannot see the status field on the registrations themselves, so I cannot tell you whether that is a formal suspension or something further along than that. But somebody with authority over both took them away, together, within about a day of a trade mark complaint landing at the registrar who sold them. I had braced for weeks.

And the harvester is still up.

That is the part worth sitting with. The two storefronts, the ones carrying my name and my photographs and my product descriptions, were gone within a day. The card capture endpoint they were both feeding, sitting on separate infrastructure with no registrar anywhere in the chain to complain to, has not moved an inch. It is still there. Still collecting. Still serving whatever other cloned shops are pointing at it right now.

I wrote the section above about disposable storefronts and shared infrastructure before any of this happened. I did not expect to have it demonstrated quite so promptly.

Things I learnt

One properly evidenced complaint beat everything else. I filed six reports. The number is not what did it. One of them contained a registered trade mark with a number and a date, a domain registered more than a year after it, and product URL slugs that were verifiably mine, sent to the only party in the chain with real accountability. Registrars sit on vague “someone copied my content” claims for weeks, because those claims require judgement. They move quickly on a file that leaves them nothing to weigh up.

The trade mark cost about £170. I registered it a year and a half before any of this happened, for reasons that had nothing to do with fraud. The fee has gone up since, and it is a little over two hundred pounds for a single class now, so check the current figure before you budget. It is still the best money I have spent on the business and I did not know that until the week it earned its keep. If you are trading seriously under a name and have not registered it, the cost is small and the leverage is out of all proportion to it.

Screenshot everything before you report anything. This turned out to matter more than I expected, because the sites really did vanish, and they vanished faster than I thought possible. Capture the pages, the checkout, the source, the WHOIS. Archive it somewhere with a timestamp on it. Every report you file is worth roughly as much as the evidence attached to it, and once the site is gone you cannot go back for more.

Read the page source. The screenshots told me it was a clone. The source told me it was a card harvester, found the second domain, and exposed the shared infrastructure. None of that is visible from the front end. It took ten minutes.

Automated tools have no judgement. An SEO platform found this, counted it as a win, valued it at eighty dollars and congratulated me on my momentum. It was working exactly as designed. It simply had no concept of what the link was.

The uncomfortable bit

I do not know if anyone lost money. I never will.

If somebody searched my brand, landed on that site, liked the look of a cheap product and entered their card, there is no mechanism by which I would find out. No order in my system. No email, because the address they would write to does not exist. Maybe eventually a confused message asking where a parcel is, or a bad review for a shop that is not mine.

That is the thing about brand impersonation I had not properly understood until that week. The damage does not land on you. It lands on people who trusted you, and it lands somewhere you cannot see it.

The two minute check

Someone cloned my website and it sat there for weeks before I found out, by accident, from an email I nearly binned. If your business has any kind of catalogue online, do this now rather than at 3am in a fortnight.

Resolve your own domain so you know what your real infrastructure looks like. Then search your brand name with a few different endings stuck on it. .shop, .store, .online, .co, and your own name with the dot moved a character or two. Then search a couple of your own product descriptions in quotes, word for word, and see whether anyone else is running them.

It takes two minutes. If it turns out someone cloned my website and yours from the same scrape, the reporting routes above are the ones that actually moved.

---

I’m Pete Harrison. I’m 55, I run a business, and I have a mild case of insomnia that means I spend a lot of time at 3am reading about gadgets, gear and ways to make life work better. Things I Learnt at 3am is where I write honestly about the things I’ve actually bought, tested and lived with. No fluff, no rehashing the spec sheet. Just the real verdict from someone who uses this stuff every day.