Store info is being cloned on imposter site

Our url: www.justwalkers.com

clone wordpress site: justwalkers.shop

I added script given in other threads:

This is directing our real site to the gov redirect site. I want the .shop site to be redirected. Can someone help?

I have reported the clone, but hosting is in Bulgaria, so I don’t expect much to be done. I do see they are using The Open Graph Protocol and a wordpress site. not sure if that helps.

Thank you!

1 Like

I also tried this script:

Hi @JHS1

Sorry to hear about your issues. We were in a similar situation before.

First, that script would not work if you have it on your site. And I do not think they would copy it to clone site.

That clone looks like a clear scam, with those unrealistic prices but there are always some people who would still buy from them.

I suggest you try to report to as many places as you can. First, try the domain registrar https://abuse.sav.com/sav. I had some difficulties to

search more details on a domain but one online tool returned sav.com so try that. Also check this list and take some time to write reports with more details and exact product links.

▼ Sites to Report Malicious URLs: ▼

• Google SafeBrowsing: https://safebrowsing.google.com/safebrowsing/report_phish/

• Microsoft: https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site

• Fortiguard: https://www.fortiguard.com/webfilter

• BrightCloud: https://www.brightcloud.com/tools/url-ip-lookup.php

• CRDF: https://threatcenter.crdf.fr/submit_url.html

• Netcraft: https://report.netcraft.com/report

• Palo Alto Networks: https://urlfiltering.paloaltonetworks.com/

• ESET: https://phishing.eset.com/en-us/report

• Trend Micro: https://global.sitesafety.trendmicro.com/index.php

• BitDefender: https://www.bitdefender.com/consumer/support/answer/29358/

• Forcepoint: https://csi.forcepoint.com/

• Symantec: https://sitereview.symantec.com/#/

• Kaspersky: https://opentip.kaspersky.com/

Good luck

2 Likes

Hey there, @JHS1 ! Thanks for taking the time to reach out to the Shopify Community today regarding this situation with your online store being cloned. My name is Imogen. It’s good to meet you!

First, I recommend taking the time to report the page to whatever platform you suspect the page to be hosted on. This will make the platform aware of the situation at hand. You could also take the time to report the site to Google Safe Browsing for their awareness. You can also attempt to get some information regarding the entity by doing a WHOIS lookup and using the information found to get in touch with the platform hosting the content.

Our Teams have worked on some suggestions regarding coding that you can use to assist with stopping these duplications, as well as help get folks redirected to the proper store. I have the following code for you to consider. Before making any changes to your code, please make a back-up of your theme PRIOR to adding any new code to your theme files.

I want to note that this code is not something that we can guarantee will prevent duplications or resolve this issue. Different themes may require this code to be put in different spots of their coding. As Shopify Support Staff like myself are not trained on code, we cannot advise on specifically where you should put this code - someone else with more code experiencing may happen by this thread and make a suggestion, or you can hire a Shopify Partner to assist.

Shopify Support Staff like myself are not able to advise on legal advice or information, so we do recommend that if you want some guidance on other ways to go about addressing this situation regarding this imposter, to please consult a local expert on the topic so they can help you address the situation beyond how these reporting links and code suggestions may assist.

I have reached out to cloudflarenet, as they came up as IP. They gave me this as a response: :

Cloudflare received your DMCA copyright infringement complaint regarding: justwalkers.shop
Cloudflare offers network service solutions including pass-through security services, a content distribution network (CDN) and registrar services. Due to the pass-through nature of our services, our IP addresses appear in WHOIS and DNS records for websites using Cloudflare. Cloudflare cannot remove material from the Internet that is hosted by others.
Accepted URL(s) on justwalkers.shop:
https://justwalkers.shop
Hosting Provider:

CloudWall Ltd.

Abuse Contact:

abuse@cloudwall.bg
We have notified our customer of your report."

I also looked up cloudwall, and they are a basic webpage that has set up shop. I am not expecting help from them.

@Imogen_1 - would my code be written as you did, or would it be :

Hey again, @JHS1 . Thank you for tagging me. The code snippet I provided is provided from one of our Internal Teams here at Shopify as part of a suggestion to assist with preventing cloning/redirecting stores during situations like these. As I mentioned in my previous post I’m not trained on coding (nor are any of our other frontline support staff) so I wouldn’t be able to advise on how that code is meant to be written or what changes should be made to it. I recommend revisiting the expectations I set around that snippet for context around using it and what it may accomplish.

Hi,

We are currently dealing with the same thing. A .shop clone with the same reply from cloudfare. Any suggestions you can give us for having the clone taken down? Anything you can suggest for ensuring it doesnt happen again? Thanks in advance for the guidance.

Hi there @ziggys . We have not had any success in taking it down. In digging more, they are hosted by a site located in a different country and they not give any way to contact anyone. We reported the site to google, since that is the search that they most come up in, but it is still up. Who knows how many of these google is trying to remove from searches… All we do now is hope that people realize it has weird prices with a comma instead of a period, “about us” section sounds foreign and has incorrect use of the english language, and check out has wrong kinds of shipping. If any customer contacts us about it, we let them know it is a scam site phishing for info. Fortunately, we have only had a couple customers stumble across this site and reach out.

It’s terrible that the internet is really the wild west with no supervision.

Thanks for taking the time to reply @JHS1 . Glad to hear it hasn’t negatively impacted you too much.

It really is too bad that more can’t be done both to prevent it from happening again, AND to remove it once it does happen.

Hopefully it’s a non issue in the future for you.

Hi there,

we have the same problem with our shop.

May I ask if you are successful to take the fake-shop down meanwhile?

Thank you very much for a reply, if you have and tips.

Kind regards

Tim

Hi.

We have the same problem here. Same hosting abuse@cloudwall.bg.

Did you manage to do something about it?

Thanks

The site has come down for us. Not sure if it was something we did or not.

However, we did report the hosting sites, untill we hit a wall there.

We reported to as many of the sites as we could listed by Laza_Binaery above, in this thread…we reported on google more than once.

We are in Canada and so we also reported to the RCMP online as this is clearly fraud.

Good luck. Hope this helps.

It happened to our business too:

Our real URL: www.tradgardsdags.nu

Infringers url: tradgardsdags.shop

This seems to be a widespread scam by judging of the comments in this thread - utilizing crappy AI to read your original site to then create a ugly, unstructured and badly translated version of it. For us it was the same host cloudflare, which gave us the exact same info about the “real” host as earlier comments stated, leading to Cloudwall - a simple site with abuse@cloudwall.bg as email. After searching WHOIS we found the domain registrar for our case is:

Name: Web Commerce Communication Ltd.

Registrar WHOIS Server: iwhois.webnic.cc

Registrar URL: https://www.webnic.cc/
IANA ID: 460
Abuse Contact Email: compliance_abuse@webnic.cc
Abuse Contact Phone: +603.89966788

I have reported the infringement formally to both CloudFlare, Cloudwall and Web Commerce Communication Ltd. to let them know they are serving illegal content. Look up how to write a formal compliance according to the requirements in DMCA for your complaint to be eligible. If you write this formal infringement complaint to the host, they are forced by law to take down content proven illegal on their servers in a prompt manner. If too long time passes without any action from your formal complaint they are to be found guilty of the infringement themselves. Therefore this will pressure them. If you do not understand who the real host is, send it to all of the actors serving the infringers website.

You can look up how to structure your DMCA complaint by using ChatGPT, it’s makes it go faster - yes, fight them with their own medicine.

I have simultaneously reported the case to both the police and the authority responsible for trademark and copyright violations in my country.

I was happy to find the list of links to report malicious websites that Laza_Binaery shared here, thanks for that. I am making more friends and family report the url in all of these sites.

Another interesting thing is that they seem to copy the images from your website by using the file directory at the original shopify server. If you could in any way put a limit on where your image database could be used, you could potentially make them loose all images on their website - making it look even worse and very likely not fooling even the most naive of people. I will take this conversation with Shopify tomorrow.

With executing these steps I think all of us can get rid of this vermin. Do not worry, the ones who aim for the easy way never persists - let’s squish these softies together.

1 Like

Update! SITE IS TAKEN DOWN

Only 6 hours after I had emailed the domain registrar owner Web Commerce Communication Ltd. at compliance_abuse@webnic.cc with a formal complaint (according to the requirements in the DMCA) they answered saying that the infringer site had been taken down. And indeed it is.

(Please note that the domain registrar owner will be different for different cases, you need to check up who is the domain registrar in your case at for example: ie.godaddy.com/whois)

Even if the domain registrar owner seems to have taken the final action of the takedown I still think it is a good idea to perform all the steps that I mentioned in my previous comment. So that all actors are contacted and all measures are taken by you so that you can get rid of them fast and definitely.

Hope you can just follow this guide if the same thing happens to you.

Best of luck

1 Like