Copied website removed in about a day

What was copied, and where

In mid-2026, a full copy of the company's public website was found online. It loaded with a valid padlock, showed no browser warning, and used the company's own pages and wording.

The attacker had not registered a domain. They opened a free account on a well-known hosting platform that developers use to publish websites, named the project after the company, and uploaded the copied site. That gave them an address such as brandname.free-host.example, with a security certificate issued automatically, at no cost.

Why it was hard to spot

• There was no registration. With no registrar and no public record of who owns the address, checks that look for new domain registrations had nothing to find.
• Free typo-checking tools could not see it. They list possible misspellings of your domain and check which ones exist. This copy sat under the hosting company's own domain, so it was on no such list.
• The padlock and the hosting company's good name made it look safe. The usual advice, look for the padlock or hover over the link, would not have helped anyone spot it.
• Only one company could remove it. With no registrar involved, the hosting platform was the only route to a takedown, so it mattered to know how to reach its abuse team quickly.
• The project was named after a lookalike domain that had already been taken down for this company once. A copy removed from one address can come back on another.

A consultancy's website is where clients and prospects send enquiries, ask for documents and find contact details. A convincing copy could collect all of that, and staff or job applicants sent a link to it would have no easy way to tell it apart.

How it was found

Our lookalike domain monitoring did not catch this, and could not have, because no domain was registered. Three other checks did:

• Public certificate logs: every security certificate (the padlock) is recorded in a public log when it is issued. We watch 100+ of those logs as entries appear and check every name in them against the company's brand, including names under other companies' domains.
• A search for the company's wording: because the copy used the company's own text, our regular web searches for that wording found it on an address the company did not own.
• The website marker: an optional small script or 1×1 image on the company's own pages. When the copied page loaded on another address, the marker reported where.

The evidence was put together automatically: screenshots of the copy beside the real site, DNS and hosting details, and an AI comparison confirming the pages matched.

What we did, and what happened

With no registrar, the hosting platform both hosted the copy and controlled the address. One report, with the evidence attached, went to the platform on the day the copy was confirmed.

The site was offline the next day, about 24 hours after confirmation. No client, prospect or employee was known to have reached it.

We kept watching afterwards, including a check of the other free hosting platforms for the same brand, because a copy that is free to host is also free to put up again elsewhere. See how we protect a brand from copies of its website.

If you have just found a copy of your own site, our guide to what to do when someone clones your website covers the first 24 hours and the takedown route.