At 10pm on a weekday in late September, a home services client emailed: “Guys, our site has been cloned.”
Same name, same branding, same reviews. The domain was theirs with an “s” on the end. The phone number and booking form belonged to someone else.
It was offline the next morning. Nobody knows how long it had been live. The client found it by chance, and that is the part that kept me up.
So I built a check that runs on its own, for every client whose marketing I manage. It covers 28 websites today. If your business runs on calls and bookings, a clone of your site is a direct line to your customers. This finds one in days, before your customers do.
What a clone looks like
Reading the page source gave most of it away:
- A toll-free number on a local business. Call-routing outfits use these
- A third-party lead form collecting names, addresses and job details
- A virtual office as the address
- Invented reviews, star rating and all
- Set to noindex. It was never meant to rank. Traffic was coming from ads, a fake Google Business Profile or directory listings
- Everything uploaded that month. It was brand new
That evidence went to the hosting company’s abuse team that night, with archived copies of the page. The site was gone by morning.
What it does
It is a scheduled script on a Mac on my desk. It does three jobs and reports to a Telegram bot.
A weekly lookalike scan, every Sunday. For each client it writes out around
600 ways to fake the domain. Added, missing or swapped letters. Plurals and hyphens. rn
for m, 0 for o. The brand plus “repair” or a city. Endings like .net,
.co.uk and .site. Then it asks the internet’s address book which of those actually exist.
A memory of everything it finds. Each lookalike gets logged: where it is hosted, whether it can send email, whether a website is live. Next week it compares. Plenty of lookalikes sit parked for years. The risky week is the one someone switches it on.
A daily certificate check, every morning. Every site with a padlock needs a certificate,
and every certificate is published in public logs. Each morning it searches
those logs for each client’s name. That catches fakes on someone else’s domain,
like brandname.somehost.com, which a domain scan cannot see.
Alerts go to Telegram, and only for things that are new or have changed. Anything I trust goes on that client’s ignore list and stays quiet from then on. A quiet week gets a short “all quiet” message on Sunday, so I know it is still running.
What the first scan found
Roughly 100 registered lookalikes across 28 sites. Most were harmless: spare domains the clients already own, unrelated businesses abroad, domains parked for sale. Those went on the ignore list once.
Two were worth a closer look. One paired a client’s name with “repair” and a toll-free number, the same pattern as the original clone. The other copied a trading name and had email set up with no website. That is the usual setup for sending fake invoices.
The bit that goes wrong
The first version took 17 minutes per domain. The generator includes tens of thousands of foreign-alphabet lookalikes per name. Those matter for banks. Nobody fakes a local plumber that way. Dropping them, and adding a short list of keyboard swaps, brought each domain down to seconds.
Refused lookups look like registered domains. Public DNS servers refuse requests when you send too many. The first run reported hundreds of fake “registered” lookalikes. A refusal now counts as unknown and gets rechecked slowly.
The certificate search runs on a free volunteer service that is often overloaded. Failures are retried, and only reported after a week of misses.
What it cannot catch
- A copy on an unrelated domain with no padlock
- Fake Google Business Profiles, social pages and directory listings
- The takedown itself. Each alert carries the hosting details an abuse report needs, but someone still has to send it. Even then, one host acting fast does not stop the same people trying again elsewhere
Worth doing if
You rely on calls and online bookings, you pay for the traffic that brings them, and your name is distinctive enough to be worth copying. For an agency, one setup covers every client.
Every client whose marketing I manage is on the list.