Entire Shopify Store Stolen and Duplicated - Please Help!

Shopify Discussion

Topic summary

A Shopify store owner discovered their entire product catalog (6000+ products, images, descriptions) was scraped and duplicated on a fraudulent domain they don’t control. The scam site appears designed to harvest customer credit card data by offering deep discounts and requesting payment authorization.

Resolution Process:

  • Running a WHOIS lookup to identify the domain registrar
  • Contacting the registrar’s abuse email (PublicDomainRegistry.com or Web Commerce Communication Ltd. were common)
  • Filing reports with Cloudflare, ICANN, and Google
  • Most successful approach: emailing the registrar’s abuse contact resulted in takedown within 24-48 hours

Key Findings:

  • This is a widespread, recurring problem affecting multiple merchants
  • The same scammers (often registered in Malaysia/Wilayah Persekutuan) repeatedly create new domains
  • Shopify cannot help if the fraudulent site isn’t hosted on their platform
  • Right-click prevention code offers minimal protection as scraping tools bypass it easily
  • Legal action is typically impractical due to international jurisdictions

Ongoing Challenges:

  • Sites reappear under different domains after takedown
  • Merchants express frustration that Shopify doesn’t implement stronger native protections
  • Buying up similar domains is expensive and ultimately futile
  • The .shop domain registry shows limited responsiveness to abuse reports

Participants recommend monitoring Google searches for duplicate sites and immediately reporting new instances to registrars.

Summarized with AI on November 4. AI used: claude-sonnet-4-5-20250929.
24

Morning all, I have had a result.

After searching the fraudulent domain name on WHOIS, I got this:

WHOIS search results

Domain Name: LEPETITTAMBOURCHEAP.SHOP
Registry Domain ID: DO11940794-GMO
Registrar WHOIS Server: iwhois.webnic.cc
Registrar URL: https://www.webnic.cc/
Updated Date: 2024-09-30T09:27:56.0Z
Creation Date: 2024-09-27T18:27:35.0Z
Registry Expiry Date: 2025-09-27T23:59:59.0Z
Registrar: Web Commerce Communication Ltd.
Registrar IANA ID: 460
Registrar Abuse Contact Email: [email removed]
Registrar Abuse Contact Phone: +603.89966788
Domain Status: ok https://icann.org/epp#ok
Registrant State/Province: Wilayah Persekutuan
Registrant Country: MY
Registrant Email:
Admin Email:
Tech Email:
Name Server: NORAH.NS.CLOUDFLARE.COM
Name Server: LELAND.NS.CLOUDFLARE.COM

So I emailed 'compliance_abuse@webnic.cc’ with the following plea:

"Hi, I hope you can help.
My websites whole inventory has been copied by an unauthorised website.
I wish to serve a host request for DCMA, and have found that you are the registrar for their domain.
Their domain is https://lepetittambourcheap.shop
And they have copied the entire product list from my website https://a2restrictors.com/

Can you please help?"

Less than 12 hours later I woke up to find this in my inbox:

"Dear Team,
Greetings.
Kindly be informed that domain(s) were no longer in use.
Please check after 24-48 hours.
If the reported content still exist, kindly provide us the relevant screen capture with latest date & time with domain name shown in the screen capture for our further checking.
Should you need further assistance, please feel free to contact us.

Thank you.
Warm Regards,
Support
WebNIC"

I’m a very happy chap this morning, will be very vigilant in the future.