A Reverse Proxy Clone of a Shopify Store: One Merchant's Takedown

In July 2026, the UK brand Charley Chau found its whole store running on another address. It was a live mirror. It updated itself every time a shopper loaded a page.

Charley Chau wrote up what happened on the Shopify Community forum, step by step. This post walks through their account. Charley Chau is not a Recon customer. We use their public post because it is one of the clearest records of a clone takedown we have read.

This is general information, not legal advice.

What is a reverse proxy clone?

Most clones are copies. Someone saves a store’s pages and product photos, then puts them on a new address. The copy is frozen on the day it was made.

A reverse proxy clone keeps no copy. When a shopper opens the fake address, the fake server asks the real store for the same page. It changes a few details, then shows the result to the shopper. Every page is fetched fresh.

So the clone always looks current. New products, sale prices, blog posts and stock levels all appear on it at once. Charley Chau put it in one line: “we think they used a reverse proxy to create a live mirror of our website.”

Reverse proxy clones explains the difference in more detail.

How this clone worked

Charley Chau has traded on charleychau.com since 2010. The clone ran at pawio[.]us. Their post describes what the operator changed:

The name and logo. The logo became “Pawio”.
Contact details. Every mention of their email address and domain was swapped for Pawio’s.
Prices. The clone was “showing effectively our price minus UK sales tax.” That made it a little cheaper than the real store.
Checkout. The checkout was not Shopify’s. A message on it told shoppers to email Pawio “before making a payment.”

Everything else came straight from the real store: design, menus, products, pages and blog posts.

How they found it

By luck. A Google Alert fired on their brand name. The clone had replaced most mentions of “Charley Chau”, but not all, and Google picked one up.

A brand name alert is a good free habit. It only works when the clone keeps your name somewhere and Google indexes the page. A clone that swaps every mention never triggers it. Google Alerts vs clone monitoring covers what each one can and cannot see.

Warning signs

For shoppers:

The address is not the brand’s own domain.
Prices are a little lower than the brand’s site. Here, the gap was UK sales tax.
The checkout looks different from the rest of the store.
The checkout asks you to email or message someone before you pay.

For merchants:

A brand alert, search result or ad points to a domain you do not own.
The other site has your exact page structure. Charley Chau compared a full list of their own page addresses with the clone’s, and every one matched.
Your new products or announcements show up on the other site within minutes.

Every report they filed, and why each one matters

The clone came down within 36 hours. To get there, Charley Chau filed nine reports. Each one went to a company that controls a different part of the clone.

1. The domain admin, by email

.us domains show registration details in a public WHOIS lookup. Charley Chau emailed the listed admin contact and asked them to “take everything down within 48 hours, and confirm by email once done.”

Why it matters: it puts the operator on notice and creates a dated record. Do it only after you have saved your evidence.

2. Shopify

They sent Shopify a DMCA copyright notice. Shopify replied that the clone was not hosted on Shopify, so it could not act.

Why it matters: Shopify can only remove stores that run on Shopify. This clone used its own checkout. How to report a fake Shopify store shows how to check before you file.

3. The registrar (Porkbun)

The WHOIS lookup showed the domain was registered with Porkbun.

Why it matters: the registrar controls the domain name itself. It can suspend the domain, which takes the clone offline wherever it is hosted.

4. The CDN (Cloudflare)

The domain used Cloudflare nameservers.

Why it matters: Cloudflare often sits in front of a site without hosting it. It passes reports to the real host and can act on its own service. Report a fake store to Cloudflare explains when this report helps.

5. The host (Rashost)

The site’s server was with Rashost, a Chinese hosting company. Charley Chau used Perplexity “to write an appropriate infringement notice in Chinese and English.”

Why it matters: the host runs the server that fetches and changes your pages. It can switch that server off. A notice in the host’s own language is easier for its team to act on.

6 and 7. Google, for copyright infringement (twice)

Why it matters: if Google accepts a copyright removal request, it can drop the clone’s pages from its search results. Fewer shoppers then find the clone when they search for your products.

8. Google, for phishing

Why it matters: a page that asks for payment or personal details under a false name is phishing. If Google agrees, Chrome and other browsers can show a warning before anyone opens the page. Report a fake store to Google Safe Browsing covers this form.

9. The police (UK Report Fraud)

Why it matters: a police report creates an official record. Shoppers who lost money, and their banks, can refer to it.

The result

The clone was down within 36 hours. Charley Chau wrote: “We have no idea who took action – whether it was the fraudsters themselves, Shopify, Cloudflare, Porkbun or Rashost.”

That is common. Companies rarely tell you which report worked. Sending the right report to each layer at once gives every one of them a reason to act.

The evidence they kept

Before they reported anything, they collected:

A full list of their own page addresses, matched against the clone’s
Screenshots of the clone’s pages
A screen recording while browsing the clone
A short summary of what was copied and what was changed

The recording is worth copying. A live mirror changes when your store changes, so a dated video shows exactly what shoppers saw.

A free tip: a notice that appears on the clone

Charley Chau added an announcement bar to their real store. Because the clone fetched their pages live, the bar “was published immediately on the mirror site.” Shoppers on the fake address saw the real brand’s notice.

This only works on a live mirror. A saved copy will not pick up changes to your store. Check the clone after you post the bar to see if it shows up.

Word it carefully. Your own customers see it too. A loud scam warning on your store can make your store look unsafe. Keep it calm and short, for example: “Our only official website is yourstore.com.” Point to a page with more detail. Remove the bar once the clone is down.

If you use Recon, it can show a warning like this on a clone that mirrors your store, and only there, never on your own domains. You turn it on from the clone’s case. See how to warn shoppers on a clone.

Charley Chau also warned customers on their blog and social media, and planned an email to their customer list.

Where Recon fits

You can’t stop someone copying your store. Anything a shopper can load, a mirror can load too. Copy blockers and right-click blocks do not stop it. What you can do is find out fast and report it properly.

Recon is a Shopify app for that. On every plan, for each clone Recon finds, it works out who to report it to: the registrar, the host, the registry, Google Safe Browsing and Microsoft. It writes the notices for you. You review them and send them. The host or registrar decides whether and when to remove a site. Recon does not remove sites.

If you add Recon’s optional theme block, Recon alerts you when a clone loads your store’s pages. On the Pro plan, the alert arrives by email straight away. On the Free plan, it arrives in your weekly summary. Recon cannot promise to find every clone, and we cannot say it would have found this one.

The free website check looks for clones on addresses built from your brand name. It would not have found pawio[.]us, because that name has nothing to do with Charley Chau. Only the installed app catches clones on unrelated addresses.

Add Recon to Shopify