Someone Copied Your Store? How to Take the Copycat Down

You find a site using your product photos, your product copy, sometimes your whole layout and logo. Then you notice it’s running Meta and TikTok ads under your brand name.

Most people start with a Google removal request. Google can drop the pages from its search results, but it can’t delete the site from the server it runs on. If the copycat gets its traffic from paid social, a Google removal barely touches it. What works is figuring out which companies keep the site online and reporting it to each of them: the store platform or host, the CDN, the domain registrar, the ad platforms and the marketplaces.

Key points

• Only two kinds of provider can actually delete a site: a hosted store platform such as Shopify, and the origin web host. Search engines, ad platforms and CDNs can only cut its reach and traffic.
• Save the evidence before you contact anyone. Once you send a warning, the other side can edit pages or move domains, and your proof goes with them.
• Name the right of action. Copied photos and text are copyright, your brand name and logo are trademark, a cloned checkout taking payments is fraud, and an Amazon reseller is only actionable if the goods are materially different or fake.
• Cloudflare rarely removes anything. It forwards your complaint to the site operator and the host.
• A DMCA takedown can be reversed. After a valid counter-notice, platforms usually restore the content in 10 to 14 business days unless you file suit.

This is a process guide, not legal advice. If you’re heading toward litigation or a damages claim, talk to an IP attorney.

Map the providers behind the copycat site

A copycat site depends on several companies. A registrar holds the domain, a store platform or web host serves the files, a CDN may sit in front, and the traffic comes from search, ads or marketplaces. Each one has different powers, so work out which ones the site uses before you file anything.

Layer	Typical providers	What they can do	What they can’t do
Hosted store platform	Shopify, BigCommerce, Wix	Remove products and images, close the store	Touch sites on independent servers
Origin web host	AWS, DigitalOcean, Hetzner, OVHcloud	Delete files, shut down the server	Cancel or transfer the domain
CDN / reverse proxy	Cloudflare, Fastly, CloudFront	Forward complaints; show warning pages for confirmed phishing	Delete files on the origin server
Domain registrar	GoDaddy, Namecheap, Squarespace Domains	Suspend domains used for phishing or malware	Decide ordinary copyright or trademark disputes
Search and ad platforms	Google, Bing, Meta, TikTok	Remove search results, pull ads, ban ad accounts	Block people who visit the URL directly
Marketplaces	Amazon, eBay, Etsy, TikTok Shop	Remove listings, suspend sellers	Act on the seller’s own website

Only the store platform and the origin host can take the site down. Reports to the other layers cut off exposure and traffic, and you can file them in parallel.

Three quick checks tell you what the site runs on:

• Look up the domain in ICANN Lookup to find the registrar and its abuse contact. Since January 2025, RDAP has replaced WHOIS as the authoritative source for gTLD registration data.
• View the page source. If you see cdn.shopify.com or Shopify.theme, it’s a Shopify store and Shopify is the only provider you need for the takedown itself.
• Check who owns the IP address the domain resolves to. A Cloudflare IP means the real host is hidden behind the CDN (see section 2).

Let an AI do the lookups

If these lookups are new to you, copy the prompt below into an AI assistant with web access, such as ChatGPT, Claude, Gemini or Perplexity, and fill in the [brackets] before sending. AI tools can get facts wrong and can invent email addresses or forms, so check the registrar, host and reporting links it gives you against ICANN Lookup and the official pages.

Prompt: map a copycat site's providers and draft the reports

You are an assistant who knows e-commerce IP enforcement and web infrastructure. Help me deal with a website that is infringing my rights.

- My website: [your site URL]
- Infringing URLs: [one or more URLs]
- What was copied: [e.g. product photos, product descriptions, logo, the whole site design]
- Rights I hold: [e.g. original photo files and photographer contract, US trademark registration number, trademark not yet registered]

Search the web and work through these steps in order:

1. Identify the services the infringing site uses: store platform (for example, whether the page source contains cdn.shopify.com), CDN, origin host and domain registrar (use the RDAP result from lookup.icann.org). For each one, state the evidence and give the abuse email address or official reporting form.
2. Classify the infringement as copyright, trademark, fraud/phishing or an Amazon reseller issue, and explain why. If it's a reseller, assess whether the goods may be materially different.
3. List the reports I should file, starting with the providers that can actually take the site down, with the official link for each.
4. List the evidence I still need to save before filing.
5. Draft the first report (a DMCA notice or a trademark complaint) with every statement the platform requires. Use square brackets for anything I haven't provided.

Rules:
- Separate what you verified from what you're inferring. If you can't find something, say so and tell me where to look it up myself. Don't invent email addresses, forms or legal citations.
- Don't suggest scanning or attacking the other party's servers.
- Finish by telling me which situations call for an IP attorney.

1. Save the evidence before you make contact

The natural reaction is to email the address on the copycat’s contact page. That warns them early: they swap a few images, move to a new domain, and when you file with a platform later, the pages you’re describing no longer exist. Save everything first.

Evidence of the infringement

For each infringing page, save:

• The full page URL, plus direct URLs of the copied images or videos.
• A full-page screenshot that shows the address bar and the date.
• The page source. Use your browser’s “Save Page As, complete” or an extension such as SingleFile.
• Prices, phone numbers, support emails, company names and payment methods shown on the page.
• A third-party archive. Submit the page to the Wayback Machine or archive.today. An independent timestamp is much harder to dispute than your own screenshot.

Evidence that you own the work

You need to show you had it, and published it, first:

• Original photos, RAW files, video project files, PSD or vector source files.
• Upload records with timestamps from your Shopify or WordPress admin, and Git history for code.
• Contracts, invoices and copyright assignment clauses from photographers, designers or agencies you hired.
• Trademark registration certificates and copyright registrations.

Paying a freelancer doesn’t automatically make you the copyright owner. In the US, commissioned photos and designs usually belong to the creator unless there’s a written assignment or the work qualifies as work made for hire. Check your contracts before you sign a sworn takedown notice.

Number your files, for example 01_original_photo.jpg, 02_infringing_page.png, 03_dns_lookup.pdf, so you can reuse the same set with every platform.

For practitioners: making evidence hold up

• Hash your screenshots, saved pages and original files with SHA-256, and record each hash and timestamp in a single log.
• Save the full response headers with curl -iL -A "Mozilla/5.0" https://example.com/target-page. Server, Date, ETag and CDN headers such as Cloudflare’s CF-RAY show what the server returned at a specific time.
• Record the current DNS records (A, CNAME, MX), the IP’s ASN, and the TLS certificate serial number and issuer. You’ll need them when you look for the host.

2. When the copycat is behind Cloudflare

Many copycat sites sit behind Cloudflare. A DNS lookup then returns Cloudflare’s IP addresses, and the actual host stays hidden.

What a Cloudflare report actually does

You file at Cloudflare’s abuse form. For sites that only use its CDN and security services, Cloudflare doesn’t store the site’s files, so it generally won’t remove anything. Its abuse policy says it forwards the complaint to the website operator and the hosting provider, and gives the host the origin IP. Cloudflare does act on content it hosts itself, through products such as Pages, Workers, Workers KV, Stream and Images.

For confirmed phishing, Cloudflare shows visitors a warning page and tells the site owner to clean up the files.

The name and contact details you enter may be passed on to the site operator. Use a company legal or compliance address, such as legal@yourbrand.com, rather than your personal phone or email.

Finding the real host yourself

If Cloudflare’s forwarding goes nowhere, or you’d rather go straight to the host, you can try to find the origin IP. The usual sources are Certificate Transparency logs, historical DNS records and the headers of emails the site sends. Once you have the IP, an RDAP lookup gives you the host’s abuse contact, and you can send your notice directly.

If the site is a Shopify store, skip this step. All Shopify stores run on Shopify’s own infrastructure, so you report them to Shopify.

For practitioners: four ways to find the origin IP

These rely on public data and normal requests only. Don’t scan or probe the other party’s servers.

1. Certificate Transparency: search the domain on crt.sh. CT logs list hostnames, not IPs, but they often reveal subdomains like origin., direct. or dev. that aren’t proxied. Resolving those can expose the origin.
2. Historical DNS: many sites pointed their A record straight at the server before turning on the Cloudflare proxy. SecurityTrails and ViewDNS keep those old records.
3. Email headers and SPF: if the site sends sign-up or order emails, check the Received: from lines in the raw message and any ip4: entries in the domain’s SPF record. If they send through SendGrid, Mailgun or Shopify, you’ll only see the email provider’s IPs, which tells you nothing about the host.
4. Confirm it: request curl -H "Host: infringing-domain.com" http://<candidate-IP>/. If the response matches the copycat site, you’ve found the origin.

3. Name the right you’re asserting

A complaint that says “they copied my website” usually gets rejected, because it doesn’t say what right was infringed. Sort what happened into one of these four buckets first.

Photos, video, copy and code: copyright

Photos, videos, articles, product descriptions, illustrations and original code are all protected by copyright. Most platforms handle these under the US DMCA notice-and-takedown process. A valid DMCA notice includes:

• Your physical or electronic signature.
• Identification of the copyrighted work, for example the URL of your original image.
• The exact location of the infringing material: specific page or image URLs, not just the homepage.
• Your name, company, address, phone number and email.
• A statement that you have a good-faith belief the use isn’t authorized by the owner, its agent or the law.
• A statement that the notice is accurate and, under penalty of perjury, that you’re the owner or authorized to act for the owner.

Brand name, logo and trade dress: trademark

Even if they didn’t copy a single photo, using your registered mark or logo on similar goods, or presenting themselves as an official or authorized store, can be trademark infringement.

The test is likelihood of confusion. Prepare:

• Your registration certificate, the jurisdiction, the registration number and the classes of goods (Nice classification).
• Screenshots and URLs of where they use the mark.
• What makes buyers think it’s you, for example “official store” wording on their pages.

One case you can’t report: if they’re selling your genuine products and use your brand name only to say what the product is or what it fits, that’s usually nominative fair use.

Cloned checkout and phishing: fraud

A cloned site with your support details, a fake checkout harvesting card numbers, or orders that never ship is phishing and fraud, not just an IP dispute. Report it on several fronts:

1. Browser blocklists: report the URL to Google Safe Browsing. Once confirmed, Chrome, Firefox and Safari show a full-page warning. Edge relies on Microsoft SmartScreen, which has its own report form.
2. Payment providers: see which processor their checkout uses, whether Stripe, PayPal, Shopify Payments or another acquirer, and send that processor your evidence of brand impersonation and fraudulent transactions.
3. Registrar: registrars generally stay out of copyright disputes, but they do act on phishing and fraud. With solid evidence, most will put the domain on clientHold, which stops it from resolving.
4. Law enforcement: in the US, file with the FBI’s IC3 and the FTC. Customers who were charged should dispute the charge with their card issuer.

Amazon resellers: check for a material difference first

When another seller joins your ASIN, the reflex is to report trademark infringement, and that report can backfire.

Under the first sale doctrine, once you sell a genuine branded product, the buyer can resell it without your permission. If the reseller is selling genuine goods obtained legitimately, “unauthorized” alone isn’t trademark infringement. Amazon is likely to reject that report, and repeated invalid reports can count as abuse of its tools and put your Brand Registry access at risk.

You have a valid basis in three situations:

• Material difference: the goods differ from yours in packaging, accessories, instructions, warranty or specifications.
• Copied images: the reseller built its own listing with product photos you own.
• Counterfeits: a test buy shows the item is fake, refurbished or relabeled.

For practitioners: counter-notices, registration and the material-difference test

Counter-notices: under 17 U.S.C. § 512(g), after a takedown the user can send a counter-notice. The provider then restores the material no less than 10 and no more than 14 business days after receiving it, unless the complainant reports that it has filed a court action. That’s a condition of the provider’s safe harbor, so platforms follow it. A bad-faith competitor can use this to get content back up, so decide in advance whether you’re prepared to sue.

Registration: under § 411(a), a “United States work” must be registered with the Copyright Office before you can sue. Under § 412, statutory damages and attorney’s fees are only available if the work was registered before the infringement began, or within three months of publication. If your US sales rely on your product photography, group registration of photographs is cheap insurance.

Material difference: in Société des Produits Nestlé v. Casa Helvetia (982 F.2d 633, 1st Cir. 1992), the First Circuit held that even subtle differences are material if consumers are likely to consider them relevant when buying, and the first sale defense then doesn’t apply. Lost manufacturer warranty coverage is a common basis for this argument in reseller cases.

4. Where to file on each platform

Shopify

If the copycat runs on Shopify, takedowns tend to move quickly.

• Copyright: Shopify Copyright Policy
• Trademark: Shopify Trademark and Trade Dress Policy
• Report a merchant: Shopify Report a Merchant

Don’t just send Shopify the store’s homepage. List each original URL alongside the matching product page or image URL on their store.

Search engines

A search engine report only removes the pages from search results.

• Google: copyright, trademark, counterfeit and other legal requests go through Google Legal Help. Spam links and sneaky redirects go to Search Quality Issues, but copied images, copied text and trademark misuse belong in Legal Help.
• Bing: the Bing copyright removal form handles copyright only.

Marketplaces

• Amazon: brand owners use Report a Violation in Brand Registry. Without Brand Registry, use Amazon’s infringement report form.
• eBay: join the VeRO program and report through it.
• Etsy: rights owners report listings through the Etsy Reporting Portal; Etsy’s help article explains how to get access.
• TikTok and TikTok Shop: copyright reports and trademark reports are separate forms.
• AliExpress, Alibaba.com, Taobao and 1688: use Alibaba’s IP Protection Platform.

Social and ads

A lot of copycat traffic comes from Meta and TikTok ads, so report the ads at the same time as the site.

• Meta (Facebook, Instagram): report infringing ads, pages and accounts through the Meta Intellectual Property help center.
• Google Ads: in Google Legal Help, choose Google Ads to report ads that use your trademark or images.

If you sell in the EU

Under the Digital Services Act, hosting services and online platforms operating in the EU must offer a notice-and-action mechanism for illegal content, including IP infringement, act on notices in a timely way, and give a statement of reasons when they remove or restrict content. If an EU-facing marketplace or host has no obvious IP form, ask for its DSA notice channel.

5. Dealing with lookalike domains

If someone registers yourbrand-official.com or buy-yourbrand.shop and puts a fake store on it, taking down the content isn’t enough. They can move the domain to a new host the next day.

What a registrar will and won’t do

A registrar isn’t a court, and it won’t usually rule on trademark or copyright disputes. A domain that merely hosts your photos won’t get suspended. Registrars step in when the domain is used for malware or phishing, or when the registration details are verifiably false.

UDRP and URS

To take over or cancel a bad-faith registration, use ICANN’s Uniform Domain-Name Dispute-Resolution Policy (UDRP), filed with a provider such as WIPO. You have to prove all three:

1. The domain is identical or confusingly similar to a mark you have rights in.
2. The registrant has no rights or legitimate interests in it.
3. It was registered and is being used in bad faith.

A UDRP panel can order the domain transferred to you or cancelled. WIPO’s fee starts at US$1,500 for one to five domains decided by a single panelist.

The Uniform Rapid Suspension system (URS) is cheaper and faster, but it only suspends the domain for the rest of its registration and can’t transfer it. It covers the new gTLDs such as .shop, .store and .online, plus a few others that adopted it. It doesn’t apply to .com or .net, so for those, UDRP is the route. Country-code domains such as .co.uk or .de follow their own registry’s dispute policy, for example Nominet’s DRS for .uk.

6. The takedown sequence, step by step

1. First hour: collect evidence and map the providers. Don’t contact them yet. Save screenshots, source and third-party archives, and identify the registrar, host and CDN.
2. Day 1: report to whoever can delete the site. A Shopify store goes to Shopify; a self-hosted site goes to the origin host. Report their ads at the same time.
3. Day 3: clean up search results. Submit the specific URLs through Google Legal Help. If the pages are gone but Google still shows the old version, use Google’s Refresh Outdated Content tool and Bing’s Content Removal Tool. The Removals report in Search Console only works for sites you’ve verified, not someone else’s.
4. Day 7: watch for counter-notices and relaunches. If you receive a valid counter-notice, decide whether to send a cease-and-desist letter through a lawyer or file suit.
5. Ongoing: prevention. Register your trademark in your main markets, keep source files and contracts for every shoot and design, and route all IP issues through one legal inbox.

What this means for you

• When you find a copycat, spend the first hour on evidence and on mapping the providers. Only then decide where to file, because doing it the other way round can cost you your evidence.
• Put most of your effort into the store platform and the origin host, since they can delete the site. File with Google, Meta and Cloudflare in parallel to cut traffic and exposure.
• Every report should state five things: the right you own, the exact infringing URL, the provider the site uses, the policy or law you rely on, and the specific removal you’re asking for.
• Register your brand as a trademark in your main markets, and register your key product photos with the US Copyright Office. Without these, many platform reports and domain disputes stall.

Appendix: where to file

Links checked on October 31, 2026.

Search and browser safety

• Google legal removals (copyright, trademark, ads)
• Google search quality issues
• Google Refresh Outdated Content
• Google Safe Browsing phishing report
• Microsoft SmartScreen unsafe site report
• Bing copyright removal
• Microsoft IP infringement notices

Infrastructure and domains

• Cloudflare abuse report
• Cloudflare abuse policy
• ICANN Lookup (RDAP)
• US Copyright Office DMCA designated agent directory
• WIPO domain name disputes
• GoDaddy IP claims
• Namecheap abuse reporting

Marketplaces and social

• Shopify report a merchant
• Shopify copyright policy
• Shopify trademark policy
• Amazon Brand Registry
• Amazon infringement report
• eBay VeRO
• Etsy IP reporting guide
• TikTok copyright report
• TikTok trademark report
• Meta Intellectual Property help center
• Alibaba IP Protection Platform

Fraud reporting (US)

• FBI Internet Crime Complaint Center (IC3)
• FTC fraud report