Ecommerce stores are being live-cloned via domain mirroring: a rogue domain proxies the real site and find-replaces the domain, so new products/changes sync automatically. The primary goal is takedown and brand protection, not SEO.
Shopify support often declines action if they don’t host the clone. Reports to the registrar (e.g., Namecheap), hosting (e.g., DigitalOcean), and Google DMCA are common, with mixed/slow results. Some clones sit behind Cloudflare, obscuring hosts.
Technical cause: not malware in the Shopify store; the clone modifies content server-side before delivering it to browsers.
Mitigations shared (code is central): add JavaScript in theme.liquid to redirect if window.location.hostname isn’t an allowed domain. Tips: strip dots before comparison; whitelist {{ shop.permanent_domain }}; use AND (not OR) when checking multiple allowed domains; fix missing brackets; be aware of potential redirect loops and Theme Editor lockups.
Infrastructure defenses: a Cloudflare firewall blocked mirrors for several users (some cost concerns); competitor firewall was bypassed.
Additional step: ongoing DMCA complaints and registrar/host abuse reports; outcomes vary.
Monitoring: a free alert service (didsomeoneclone.me) was shared.
Status: ongoing; no single definitive fix; combine redirects, firewall, and takedowns.
I think you’re just missing an opening bracket in the first if statement.
if (window.location.hostname.replaceAll('.','') !== "pnwjourneycom" || "pnwlifecom")
should be:
if (window.location.hostname.replaceAll('.','') !== "pnwjourneycom" || "pnwlifecom") {