I've been in the Shopify ecosystem for over a decade. From 2014 to 2020 I was a Shopify Expert, building stores for over 100 brands around the world. Since 2020 I've built and run 4 Shopify apps, used daily by thousands of stores.
In those 12 years, I've seen every kind of scam aimed at my clients' stores: phishing, fake emails, cloned websites.
Again and again, clients emailed me, upset and confused. How could someone copy their whole store so easily? Those emails are growing every week.
So I started tracking it. Today I watch over 790,000 real Shopify stores for copies of themselves, and so far I've found:
153,502 cloned Shopify stores.
And it's not just the big names. Any store that gets a little bit popular ends up on a scammer's radar.
One store, eight copies
One of the stores I watch is an independent spice brand: a small company with a loyal following, amazing products, and a really nice custom Shopify store.
I found 8 clones of it, and 7 are still online right now. Call the brand Emberspice (not its real name). The clones sit on domains like emberspiceofficial.shop, emberspicepremium.shop and getemberspice.shop. Each one is an exact copy of the real store: same design, same products, all the photos the brand took themselves. But everything is heavily discounted. And the Checkout button goes somewhere else.
A customer searches for the brand, sees an ad for emberspiceofficial.shop (who's going to doubt "official"?), and buys. The order never shows up, because there is no order. So they email the real brand asking where their package is, and the brand has no idea what they're talking about.
Clones vs. lookalikes
A clone is a copy of your store. A lookalike is a domain made to look like yours: my-brand.com instead of mybrand.com, or mybrands.co instead of .com. They often come together (like a clone sitting on a .shop lookalike), but not always.
The spice brand did one smart thing and bought up 4 lookalikes of its own. But that's rare: across the 746,083 lookalike domains I've found, 92% are registered by someone other than the brand.
Who solves this today?
If you're a big enterprise brand like Nike, you've solved this by hiring an in-house team to scour the internet for clones, or by paying enterprise software like BrandShield or Red Points $20,000+ a year to do it for you.
And it does need solving: fewer than 3% of the clones I've found have gone offline on their own.
For Shopify stores without those resources, there hasn't been an affordable option... until now.
Recon Brand Protection for Shopify
Late last year I launched my 4th Shopify app, Recon Brand Protection. It's where all of the numbers above come from.
Once installed, it lives in the background and watches over 70 million domain names for clones of your store and lookalikes of your brand. When it finds something suspicious, it takes screenshots, compares the product images and files to your store, and lets you know if it's a clone. The goal is simple: you find out before your customers do.
Getting clones taken down
Finding a clone is only half the job. The other half is getting it offline, and that's where most merchants get stuck. Who do you even email?
Recon answers that for every clone it finds, and writes the reports for you, with the screenshots and evidence already in them:
- Google and Microsoft: visitors get a big red warning page instead of a checkout, often within hours
- The registrar: the company that sold the scammer the domain, with their abuse contact
- The host: a ready-to-send DMCA notice (including Cloudflare, who pass it along to the real host)
You give each one a once-over and hit send. Recon then tells you when a clone goes offline, and if it pops back up on a new domain (which happens a lot). The host or registrar always makes the final call, but you go in with the right contact and the evidence to back it up.
And we want to take even that off your plate. We're piloting a Pro service where our team sends the reports and follows up for you.
Check your store
For 12 years, I never had a great answer for clients when their store got copied. Now I do.
Two ways to start:
- Free check: go to recon.bot/audit. No account needed, just your domain.
- Ongoing watch: install Recon from the Shopify App Store. The free plan checks every week. The paid plan ($50/month) checks daily and alerts you the moment a clone shows up.
You shouldn't need a $20,000 security contract to protect your store. Now you don't.
Numbers from Recon's database as of October 13, 2026.