Counterfeit website takedown relies on IP notices, ad and payment reports and clustering store networks. See which levers work and what results to expect.
Quick answer: A counterfeit website takedown removes or disables an online store that sells fake versions of your products. Unlike phishing, counterfeiting is mainly an intellectual property problem, so the strongest levers are trademark and copyright notices to hosts, complaints to ad platforms and search engines, and reports that cut the store off from card payments. Suspending the domain is harder than for phishing, and because counterfeit stores usually come in networks, they work best when handled as one operation rather than site by site.
This guide is for brand protection, legal and e-commerce teams. It covers why counterfeit stores need a different approach from phishing sites, which levers work, how to treat a network of stores, and what to expect from a takedown service. The general workflow for fraudulent sites is described in the phishing site takedown process, step by step, and if you have just found a single fake shop and need a first-response checklist, start with fake online store using my brand.
Why counterfeit stores need a different approach
Three things set counterfeit stores apart from phishing pages.
- They are not DNS abuse under ICANN's definition. Since April 2024, gTLD registrars must act on well-evidenced malware, botnets, phishing, pharming and related spam (ICANN). Selling counterfeits is not on that list, and ICANN says trademark complaints about website content are outside its scope (ICANN). Some registrars still act under their own terms of service, but you cannot count on it.
- They look like real businesses. Some ship goods, so the evidence has to show that the products are fake, which takes product knowledge and trademark registrations rather than a screenshot of a login form.
- Some also steal card data. When a store is really a front for collecting payment details, it becomes a phishing case and the faster abuse route applies.
Before reporting, capture the signs that each route relies on: the brand in the domain name, prices far below retail, your own product photos and the merchant name shown at checkout.
The levers that work
Hosting provider
Most hosts' acceptable use policies prohibit intellectual property infringement. A trademark notice with your registration numbers, the infringing URLs and a clear explanation of why the goods are not genuine is the starting point. Where the store uses your product photos or descriptions, a copyright notice is often quicker, because hosts that follow the DMCA process act on a valid notice; our guide to DMCA notices against cloned websites explains what to include. If the store is behind a CDN, you first need to find the real host, as described in our Cloudflare guide.
Registrar and domain disputes
When the domain name itself contains your trademark, a UDRP complaint can have it transferred to you or cancelled. This is slower and costs more than an abuse report, but it removes the name from the operator for good. Our guide to the domain takedown service compares suspension, UDRP and URS in detail.
Ads and search
Counterfeit stores depend on traffic. Google's advertising policies prohibit ads for counterfeit goods and provide a complaint form for brand owners (Google). Social platforms run similar intellectual property reporting channels for ads, posts and profiles. Copied images and text can also be reported to search engines under copyright law, which removes the pages from results even when the host does not respond.
Payments
Cutting off payments hurts every store that shares a merchant account. The International AntiCounterfeiting Coalition's RogueBlock program lets member and non-member rights holders submit sites selling counterfeit goods, which it then forwards to participating payment companies such as Mastercard, Visa and PayPal (IACC). A test purchase, made with care and ideally with your counsel's advice, can show which merchant account a store actually uses.
Treat it as a network, not a list of URLs
Counterfeit operators rarely run one store. They launch dozens of near-identical sites, rotate domains as each one is taken down and buy ads for whichever is live. Removing them one at a time is slow and never ends. Clustering helps you find the shared infrastructure behind them:
- Hosting: stores on the same IP address or hosting account can often be removed with one well-documented report.
- Templates and code: identical page structure, file names, scripts and tracking identifiers reveal new copies as soon as they appear.
- Payments: the same merchant name or payment gateway across stores points to the account that funds the whole network.
- Registration patterns: the same registrar, naming style and registration dates help you spot domains before they go live.
Prioritize the shared points first, such as hosting accounts and merchant accounts, then the domains receiving paid traffic. Finally, set up monitoring so that new stores built on the same template are caught early. The brand impersonation glossary entry explains how these stores relate to other forms of impersonation.
Evidence and authority
Counterfeit takedowns are judged on paperwork. Before you or a provider send anything, gather:
- trademark registrations covering the relevant countries and product classes, and proof that you own the photos and text being copied;
- dated screenshots of product pages, prices and the checkout, with full URLs;
- notes explaining why the goods are not genuine, such as products you never made, impossible prices or missing security features;
- a signed authorization if a provider will file on your behalf, since hosts, platforms and payment programs may ask who is acting for the brand.
Choosing a service and what to expect
Many anti-phishing providers concentrate on fraud and abuse reports, while counterfeit work also needs intellectual property notices and product knowledge. Ask any provider which of the levers above it uses, whether it clusters stores into networks, and how it reports results. Phishvoid's focus is impersonation: where a counterfeit store copies your site or collects card data, a human team reports it to blocklists, hosts, registrars, search engines and platforms, including DMCA notices for copied content.
Realistic expectations help when you report results internally:
- counterfeit cases usually take longer than phishing, because notices are more formal and some hosts ask for more proof;
- some offshore hosts ignore intellectual property complaints, so removing ads and payments may cut a store's traffic and income before it goes offline;
- stores return on new domains, so success means fewer working stores and less paid traffic over time, not a single clean sweep.
FAQ
Is selling counterfeits considered DNS abuse?
Not under ICANN's current definition, which covers malware, botnets, phishing, pharming and spam used to deliver them. Some registrars still act on counterfeit complaints under their own terms, but the main levers are hosts, platforms and payments.
Can we get a counterfeit store's domain transferred to us?
Yes, if the domain is identical or confusingly similar to your trademark and you win a UDRP case showing the holder has no legitimate interest and acted in bad faith. A UDRP decision covers the domain name only, not the content on other sites.
Should we make a test purchase?
It can provide strong evidence, including the merchant account behind a store. Agree the approach with your counsel first, use a dedicated payment card and keep what arrives as evidence.
What if the counterfeit store is behind Cloudflare or another CDN?
Report it to the CDN, which forwards complaints and may identify the host, and send your notice to the host itself once you know it. Blocking ads and payments works regardless of where the store is hosted.
Is someone impersonating your brand?
We find lookalike domains and cloned pages and take them down. Start with a free exposure scan.