How to report a fake .shop domain to the .shop registry

Most clones of Shopify stores that we see use a .shop domain. Every .shop domain sits under one registry: GMO Registry, in Tokyo. The registry sits above the registrar that sold the domain. It can put a domain on hold no matter which registrar holds it.

That makes the registry a useful second report. Send it alongside your report to the registrar, not instead of it.

Checked against get.shop and GMO Registry’s public pages on October 14, 2026. This is not legal advice. The registry can change its process, so check the linked pages before you report.

When should you report a fake store to the .shop registry?

Report to the registry when the fake store uses a domain that ends in .shop and it does one of the things the .shop policy bans. The policy bans:

“Phishing or any other attempt to fraudulently acquire sensitive information including but not limited to credit card details or login passwords;”

Registrants also promise not to register a domain “for the purpose of distributing malware, abusively operating botnets, phishing, piracy, trademark or copyright infringement, fraudulent or deceptive practices, counterfeiting”.

A fake store that pretends to be you and takes card details at checkout fits the phishing rule. Report it as phishing.

How do you report a fake .shop domain?

1. Save the evidence first. Take dated, full-page screenshots of the clone. Do not enter real card details.
2. Go to get.shop/abuse and click the report link. It opens the registry’s report form, run by its abuse partner CleanDNS.
3. Use the form, not email. The registry warns: “Reports not submitted via this form may face significant delays in response.”
4. Choose phishing and name the brand being imitated: yours.
5. Paste the report below into the description.
6. Upload screenshots as evidence.
7. Log the report with the date and any reference number.

If several .shop clones of your store exist, list each one. They may sit at different registrars. The registry covers them all.

What evidence does the .shop registry ask for?

The form loads with JavaScript and its fields can change. On October 14, 2026, its code showed fields like these. Check the live form.

• Your full name, email and phone number
• The offending URL: the complete address of the clone page
• The date you saw the abuse
• A description of the abusive activity
• Evidence: screenshots. The form says “You must provide evidence”.
• For phishing: the brand or company being imitated
• Your name as a signature, confirming the information is true and accurate

Copy-paste report for the .shop registry

Only include statements that are true for your case.

Brand being imitated: [Your Brand] (https://[your-store.com])

Offending URL(s):
- https://[clone-one.shop]/
- https://[clone-two.shop]/checkout

Description:
These .shop domains run fake stores that pretend to be our store. They
use our name, logo, product photos and descriptions. They ask visitors
for payment card details at checkout. They are not connected to us and
we have not authorised them.

This is phishing under the .shop anti-abuse policy: an "attempt to
fraudulently acquire sensitive information including but not limited
to credit card details".

Registrar of each domain: [Registrar name]. We have reported the
domains to the registrar on [date].

Screenshots taken [date, time, time zone] are attached.

[Your name], [Title], [Your Brand]
[Email] / [Phone]

What happens after you report to the .shop registry?

The registry decides what to do. Its policy says it “reserves the right to deny, cancel or transfer any registration or transaction, or place any domain name(s) on registry lock, hold or similar status, that it deems necessary, in its discretion”.

A domain on hold stops resolving, so the clone goes offline at that address. The registry also runs a separate form for owners who ask to lift a hold, which shows that it uses holds.

• Timing: not stated by GMO Registry.
• Registrar first: not stated by GMO Registry. Report to both.

What if the .shop clone stays up?

• ICANN: the 2024 ICANN contract changes also cover registries. After a fair wait, you can file a complaint through ICANN Compliance. Show that you reported first.
• URS: if you hold a registered word mark, the Uniform Rapid Suspension process can suspend .shop domains that copy your mark. It costs money and takes weeks. See UDRP complaints for how domain disputes work.

Other reports to send

• The registrar. The most common for .shop clones are Dynadot and Cosmotown.
• The host, with a copyright notice. Use the DMCA takedown generator.
• Google Safe Browsing and Microsoft.
• See how to report a fake Shopify store for every channel, and download all the templates.

Let Recon prepare the reports

Recon is a Shopify app that watches for clones of your store. On every plan, it finds who to report each clone to, including the registry, and writes the notices for you to review and send. Early access on Pro: one click, and Recon files the reports for you. The registry, registrar or host still decides what happens to a domain. Recon never removes sites itself.

Add Recon to Shopify, or run a free website check first.

Sources

• .shop abuse page: get.shop/abuse
• .shop report form: abuse.cleandns.space/gmoregistry
• GMO Registry anti-abuse policy: gmoregistry.com/en/abuse
• .shop anti-abuse policy (PDF): get.shop
• ICANN compliance complaints: icann.org/compliance/complaint