Brand protection for online shops: catch fake stores and lookalike domains before your customers do
If you sell on Shopify, WooCommerce, or Etsy, or you run an independent DTC or craft brand, someone can register a domain that looks like yours, copy your storefront onto it, and start taking fraudulent orders in your name. VigilDNS watches for that lookalike shop domain, captures the cloned storefront as evidence, and flags the lookalikes with a working mail server, so you find the fake store before your customers and your chargebacks do.
The specific way online stores get cloned
The attack on a small shop is direct. Someone registers a near-copy of your domain, for example yourshop-store.com or yourshopofficial.com, then clones your storefront onto it: your product photos, your logo, your checkout layout. From there a few things happen, often at once.
- Fraudulent orders and payments. Shoppers who think they are on your site place orders and enter card details. They get nothing, and you get the angry email.
- Login and account harvesting. A cloned account or checkout page collects customer credentials and payment data.
- "Problem with your order" email lures. A lookalike with a working mail server sends "your payment failed, update your details" messages that look like they come from your shop.
Your customers get scammed, and you eat the chargebacks, the support load, and the reputation hit, even though the fraud never touched your actual store. For a small seller, one convincing fake storefront can do real damage before you even hear about it.
What VigilDNS watches for you
- Combosquatting and 12 more permutation techniques. We catch brand-plus-keyword shop domains like yourshop-sale.com, yourshop-official.net, or yourshop-checkout.com, exactly the names fake-store operators register. Learn how combosquatting works.
- Storefront clone detection with screenshots. When a lookalike goes live, we capture the page and show it side by side with your real shop, so a cloned storefront is unmistakable and the screenshot is ready to attach to an abuse report. A page whose first check shows a checkout naming your brand is always captured, on every plan.
- Lookalikes with a working mail server (MX). More than a third of registered lookalikes we monitor have a working mail server (September 2026). Watching only for fake websites misses them, so we flag the lookalikes set up for the email behind those "problem with your order" lures.
- Certificate history and live TLS for every lookalike. A freshly issued certificate on a lookalike shop domain raises its risk, sometimes before the fake store is fully up.
- AI threat verdicts and risk scoring. Every finding gets a score, and the higher-risk ones get an intent (phishing, malware, counterfeit, parking, redirect, or legitimate), a confidence level, and a short rationale, so you act on the genuine fake stores and ignore the harmless parked names. A live shop that names your brand, takes payment through its own checkout, and runs on infrastructure you do not control is flagged as a likely counterfeit storefront.
- Campaign clustering, dormant-threat detection, RDAP, alerts, and CSV and JSON exports. Related registrations are grouped, parked lookalikes stay on watch for when they activate, and a clone that goes live is picked up on your plan's next scan, every 24 hours on Starter or every 12 hours on Team and Business.
Honest scope: what we cover and what we do not
VigilDNS covers domains and the websites on them: lookalike shop domains, cloned storefronts, likely counterfeit storefronts selling goods under your name, and lookalikes with a working mail server. It does not cover marketplace listings on Amazon, eBay, or Etsy, or knockoffs sold through social media accounts. That is a different layer, covered by marketplace tools (Red Points and similar) focused on listing takedowns. If your problem is a fake website using your shop name, that is us. If it is counterfeit product listings, that is them. If counterfeiters are opening whole stores on their own domains to sell your goods, see counterfeit storefront monitoring for how brand keyword packs, the discovery queue, and the evidence bundle for counsel work together.
We also do not file or send takedowns. We produce the evidence package (screenshots, RDAP records, certificate data, risk score) and a takedown-ready draft for the registrar, which you send from your own mail; the same evidence supports a report to the host or Shopify. See how domain takedowns work.
Priced for a shop, not an enterprise
Enterprise brand-protection platforms are quote-only and run into five figures a year, which makes no sense for an independent shop or a small DTC brand. Free tools just list typo domains with no evidence and no scoring. VigilDNS sits in the gap: Starter is $79 a month for 5 domains, 3 seats, and 24-hour scans, self-serve, no sales call. Team ($199 a month, 20 domains, 12-hour scans) and Business ($899 a month, 100 domains) suit larger catalogs and brand portfolios. Annual billing includes two months free.
| Approach | Catches lookalike shop domain | Clone screenshot evidence | Self-serve pricing |
|---|---|---|---|
| Enterprise brand protection | Yes | Yes | No, five-figure quote |
| Free typo checkers | Lists names only | No | Yes, no evidence |
| Marketplace and social tools | Not their focus: they cover listings and social accounts | No | Varies |
| VigilDNS | Yes, 13 techniques | Yes, side by side | Yes, from $79 a month |
Frequently asked questions
Someone made a fake version of my online store. What can VigilDNS do?
If the fake store is on a lookalike domain, VigilDNS detects that domain, captures a screenshot of the cloned storefront next to your real one, and gives you a risk score and verdict. You get an evidence package and a takedown-ready draft to send, from your own mail, to the registrar, host, or your platform's abuse team.
Does it cover counterfeit products on Amazon or Etsy listings?
Not listings. VigilDNS covers domains and the websites on them: lookalike shop domains, cloned storefronts, likely counterfeit storefronts on their own domains, and lookalikes with a working mail server. Counterfeit listings on Amazon, Etsy, or eBay, and social media accounts, are a separate layer handled by tools like Red Points. If counterfeiters run their own storefront domains, see counterfeit storefront monitoring.
Why does a lookalike's mail server matter for my shop?
More than a third of registered lookalikes we monitor have a working mail server (September 2026). A lookalike set up for email can carry "problem with your order" and "your payment failed" lures aimed at your customers. If you only watch for fake websites, you miss the part of the threat that arrives as email, so we flag lookalikes with a working mail server specifically.
Do I need technical skills to use it?
No. It is self-serve. Run the free typosquat checker on your shop domain, sign up, and continuous monitoring starts with no sales call and no analyst required.
Find out if a fake store is already using your name: run the free typosquat checker on your shop domain, then check pricing and start monitoring today.