How to take down a fake website impersonating your brand

A customer sees an ad for the fake website promoting 70% discounts, orders from there and, two weeks later, asks YOU where their order is. But your store has no record of the purchase because the order went to a copy of your website.

That is usually how brands find out they're being impersonated, and it becomes a customer-service problem before anyone else on your team even finds the fake. With the help of AI, copying your website with thousands of product listings featuring the exact same descriptions, titles, and images is easier than ever.

You are not the only target. In the last three months of 2025, security researchers logged more than 850,000 phishing attacks. Online stores and retail brands made up about 9% of them.

Getting a fake store taken down doesn't require technical skills. Here's how to do it without spending a week sending the same complaint to the wrong inbox.

1. Confirm the impersonation and save evidence

First, check that the website is not an authorized reseller, an old campaign site or another legitimate business with permission to use your material. A similar name or a negative review alone does not establish impersonation.

Does the site claim to be your official store? Does it reproduce your login page and ask for credentials? Is it accepting orders under your business name? These observations help distinguish a phishing or fraud report from a complaint about copied content.

Before reporting, collect:

• Exact URLs: the homepage and individual product, login or checkout pages showing the abuse. Include the final destination if a link redirects.
• An independent capture: submit the URL to urlscan.io (set visibility to Unlisted) or save it on the Wayback Machine. A timestamped 3rd party copy is harder to dispute than your own screenshot, and urlscan.io also shows the site's IP address and hosting company, which you'll need in step 2.
• Dated screenshots: just in case, prepare the screenshots as well. Show the address bar, copied branding and the relevant offer or form. Capture any ad or search result that brought you there.
• Original material: corresponding pages on your real website, original photographs or other records supporting your ownership.
• Business identification: your official domain, company details and relevant trademark records if available. An agency reporting for you should also have your authorization.
• Customer evidence: messages describing purchases, order confirmations or payment receipts, with unnecessary personal and financial information removed.
• Infrastructure details: a saved registration lookup and any hosting information you can establish.

Keep the files together under the fake domain’s name. You will reuse them across reports, and they remain useful if the operator changes the page. Don't enter credentials or card details, and don't place a test order. Screenshots of the visible checkout are enough.

2. Find the host and registrar, then choose the right reporting route

To get a fake site taken down, you need to find out who is keeping it online. The registrar is the company the domain name was bought from. It can suspend the domain so the address stops working. The hosting provider runs the server the site lives on. It can delete the content or close the account. These are often two different companies, and it's worth reporting to both.

Start with ICANN Lookup to identify the registrar. Then use its published abuse contact or reporting form. You can still report abuse when the registrant’s personal details are private. Identifying the person behind the website is not a requirement and is usually difficult.

To find the host, check which company owns the IP address the domain points to. The urlscan.io report from step 1 shows this, and so does any IP lookup tool. Sometimes the name you find is only a middleman (Cloudflare is a common one). Submit a report through its abuse form when relevant and pursue the actual hosting provider as well.

Use this map to decide what to request:

Several reports can be appropriate for one site. A fake checkout using stolen product photographs may justify both an abuse complaint and a copyright notice. Ideally, report to as many relevant parties as you can, because some take longer to respond and each action can help disrupt the scam.

3. Send an abuse report that explains the harm

An abuse team needs enough information to reproduce the problem and decide whether its policies apply. Explain what a visitor sees, what the site asks them to do and why the claimed affiliation is false.

For a phishing page, say exactly what it asks visitors for: login details, card numbers or ID documents. For a fake store, document the claim that it represents your business and any customer reports of fraudulent transactions. Distinguish what you observed from what you suspect.

Domain companies must look into phishing reports. They do not have to review a report within 24 hours just because a business complained. Law-enforcement reports move faster, but yours may take longer, so send it with clear screenshots.

Send the host and registrar their relevant reports on the same day once your evidence is ready. Use each provider’s form when available and retain the confirmation or case number.

You can adapt this template to the facts of your incident and the recipient’s reporting requirements:

Subject: Phishing report: [domain] impersonating [brand]

I am [name, role] at [company], the operator of [official website], and I am authorized to report this incident.

These URLs impersonate our business: [list exact URLs]. The website is not operated by us or authorized to represent our brand.

On [date and time, including time zone], we observed [specific behavior, such as a copied login form requesting account credentials or a checkout claiming to accept orders on our behalf].

Evidence attached: [dated screenshots, matching original pages, relevant customer reports and supporting business records]. [Describe any confirmed harm separately from suspected harm.]

Please investigate under your abuse policies and take appropriate action to disable the abusive content or disrupt its operation. Please confirm receipt and provide a case reference.

Contact: [business email and other details required by the provider].

This template is for an abuse complaint. A formal DMCA notice has additional statutory requirements, covered below.

4. Report the fake to Google, Microsoft and the platforms sending it traffic

While the hosting provider and registrar investigate, report the fake site to services that can warn people or limit how they find it.

For a page designed to steal personal information, use Google’s phishing-report form. Google routes these reports to its Safe Browsing team. You can also use Microsoft’s unsafe-site reporting form.

A browser warning reduces exposure while the website may remain online, as it shows users a huge red warning screen that the website is deceptive, and most people take such warnings seriously.

If copied material appears in Google Search, use Google’s legal-removal process and select the relevant product and legal ground. Give Google the exact links to the offending pages. Keep in mind that even if Google removes them from search results, the website may still be online.

Report fraudulent ads separately on the platform that ran them (Google Ads, Meta or TikTok). Include the ad's ID or link and the URL of the fake site it promotes. To find a fake's ads on Facebook and Instagram easily, search your brand name in the Meta Ad Library.

Where you can establish which payment provider is involved, report the suspected fraudulent account through that provider’s official channel. Note that customer receipts or a hosted payment page can be useful evidence.

5. Use copyright, trademark or EU notices for content you own

If someone copied your website’s original photographs, substantial original text or other copyright-protected material, a copyright complaint can support removal even when you have no registered trademark.

For providers operating under the US DMCA process, send the notice to their designated agent or use their official copyright form. The US Copyright Office’s designated-agent directory helps locate the appropriate recipient.

If the host offers its services in the EU, you don't need the DMCA. The EU Digital Services Act requires every hosting provider to run a notice-and-action process for illegal content (Article 16), and a store that deceives consumers by posing as your brand qualifies. Use the host's "DSA notice" or "report illegal content" form, and include the exact URLs, why the content is illegal, your contact details and a statement that the notice is accurate and made in good faith.

A copyright takedown notice must identify what was copied and give the exact links where it appears. Include your contact details and signature, state that you believe the use is unauthorized, and confirm that your information is accurate and that you have the right to file the notice. The US Copyright Office provides a sample notice you can follow.

Only claim rights you hold. A brand name isn't protected by copyright (that's what trademarks are for), and a similar layout isn't infringement on its own. If you have a registered trademark, use it: hosts, Shopify, Meta and Google Ads all accept trademark complaints, and they're often the stronger route when a fake uses your name and logo but not your original photos.

If the fake runs on Shopify, use Shopify's copyright form. Shopify requires a link to each individual page containing the copied content and won't accept a general shop link. For fraud rather than copying, use Shopify's report-an-issue page.

If the other party challenges your copyright complaint (which is unusual, but can happen), Shopify may restore the content after 10–14 business days unless you tell Shopify you’ve filed a court case. Review the challenge and seek legal advice if needed. If you also have evidence of phishing or fraud, continue reporting that through the provider’s abuse process.

6. Follow up and verify what changed

Keep a simple incident log recording the provider, submission date, case number, response and next action. When a provider asks for missing evidence, reply within the existing case so the history stays together.

For an active scam, check the status again the following day and follow the provider’s escalation procedure if there is no useful response.

If an ICANN-accredited registrar ignores a well-evidenced phishing report, file a complaint with ICANN Contractual Compliance. Report to the registrar first, then include your original report and case number with the ICANN complaint, giving the registrar a few business days to respond before you escalate. This applies to generic domains such as .com and .shop. Country-code domains such as .uk or .lt follow their own registry's procedures.

ICANN checks whether registrars follow its rules, but cannot directly take a website offline. If a provider says it has taken action, check what changed. Is the fake page gone? Does the domain redirect to another checkout? A browser warning may appear while the site is still running. Record what you find and when you checked.

A timeout on your connection is weak evidence of a completed takedown. Recheck through a separate connection or trusted assessment tool, and watch for redirects or a replacement domain.

Help customers find your real store while reports are pending

Publish your official domain clearly wherever customers already interact with your business. If the incident is generating support requests, add a concise notice explaining which website you operate and how customers can verify an order.

Make the advice specific: type the known official address directly, use an existing bookmark and contact support through the legitimate site when a supposed order cannot be found. Avoid sending customers to the fraudulent website to compare the two.

If customers report paying the fake, direct them to their bank or payment provider promptly. Keep relevant complaints for your incident record without collecting full card numbers or account credentials.

When recovering the domain is worth considering

A brand may want control of the domain itself, especially if it is likely to be reused. That can call for a domain dispute alongside the immediate abuse reports.

You can sometimes force the fake domain to be transferred to you through a formal dispute process called UDRP. It costs about $1,500 before lawyer fees and only works if you already own a trademark and can prove the other side registered the name in bad faith.

That makes domain recovery a separate budget decision, particularly if the operator keeps moving between disposable addresses. Have IP counsel assess whether the domain and evidence justify it.

How long does a fake website takedown take?

Anywhere from a few hours to several weeks, depending on how clear your evidence is and which providers are involved.

A 2025 study of 690,502 phishing domains, examined over 39 months, found that phishing domains remained accessible for an average of 11.5 days after detection. That is almost two weeks of lost revenue and customer trust while infrastructure providers review your evidence.

Meanwhile, Redditors share different real-life experiences: sometimes hosts remove fraudulent sites within hours, in some cases, even with copyright and abuse complaints, it takes a few days. Those self-reported experiences show what can happen in individual cases, without establishing a typical turnaround time.

Your incident’s timeline depends on the infrastructure provider’s review of your evidence and the action it can take. When comparing a domain takedown service, ask when it will submit reports, how it follows up, how it confirms removal and what happens if the first provider declines to act.

When a phishing takedown service is useful

For one clearly documented fake, you may be able to handle the reports yourself. Outsourcing becomes useful when several domains appear, providers need repeated follow-up, or the work is taking time away from running the business.

BehindLink is built for ecommerce brands in that position. Its service combines monitoring for impersonating websites with human verification before takedown work, helping brands handle confirmed incidents and identify further copies as they appear. That means the fake websites are found and taken down before they can do any harm to your customers and your reputation.

Removal still depends on the providers that control the offending infrastructure. A useful service should make the work reviewable: which URLs were confirmed, where reports were filed, what responses arrived and whether removal has been checked.

If a website is impersonating your brand, contact BehindLink with the suspicious URLs and your official domain. Explain whether customers are already affected, so the incident can be assessed with the evidence that matters.

FAQ

Can I take down a fake website myself?
Yes. You don't need a lawyer or technical skills. Send evidence to the registrar and hosting provider, report the URL to Google Safe Browsing and Microsoft, and report any ads or payment accounts.

Will reporting a fake site to Google remove it?
No. A Safe Browsing report makes browsers show a warning, and a legal removal request can drop pages from Google Search, but the site stays online until its host or registrar acts. However, you should still report to Google, because it may reduce the harm caused significantly.

What if the fake site is hosted outside the EU or US?
Report it anyway. ICANN's rules bind accredited registrars in every country, and most hosts have abuse policies covering phishing. Warnings from Google and Microsoft, and reports to ad and payment platforms, cut off visitors and money while you escalate.