Fake Website Copying Your Business? How to Get It Down

A customer asks about a website you do not recognise. You search your company name and find a second website: your logo, your product photos, your About page copied word for word, sitting on a domain you never bought. In BM people search this as "laman web palsu guna nama syarikat saya", and in Chinese as "假网站冒充我的公司".

You usually cannot delete another person's website yourself, but you can ask the companies that keep it online to act. Save the evidence, find out who hosts the site and who sold the domain, send each of them a factual report based on rights you actually hold, and ask Google to drop copied pages from its results. If the domain name itself uses your trade mark, a formal domain dispute may be the longer route.

This guide is for Malaysian businesses dealing with a copycat or look-alike site. If the clone has a login page that collects passwords or card details, our guide to reporting a phishing website that impersonates your brand fits better. This article is general information, not legal advice.

Last checked: 5 October 2026.

#How Do You Get a Fake Website Copying Your Business Taken Down?

Capture the evidence, then look up the domain with ICANN Lookup (or MYNIC's WHOIS for .my domains) and report abuse to the registrar and the hosting company. Send a copyright notice for text and images you created to the host and to Google through its legal removal requests. If the domain name copies your trade mark in bad faith, a lawyer can file a dispute under MYDRP for .my names or UDRP for names like .com. If the clone takes money, report it as fraud too. Each company decides for itself.

#Copycat, Clone or Scam: Which One Is It?

The right route depends on what the site does, not how similar it looks, and your report should match the facts.

If the copying is spreading through social media as well, with fake Pages or accounts using your name, our guide to fake pages impersonating Malaysian businesses covers that side. If the problem is a fake negative review or a scam listing rather than a cloned site, our guide to removing a scam review or listing covers that separately.

#Evidence Checklist Before You Report Anything

Clone sites move and change. Capture everything before you report, because a report can tip off the operator.

• The full URL of every copied page, not only the home page. Google's legal help page asks for the specific URLs rather than a link to the site's home page.
• Screenshots with the address bar, date and time visible, saved off your phone as well as on it.
• A side-by-side record: your original page and the copy, with the matching paragraphs or photos marked.
• Proof your version came first: the original image files with their dates, drafts, invoices from your designer or photographer, or an archived copy of your page.
• Proof of your rights: company registration documents, and your trade mark certificate if you hold one.
• The domain lookup result, saved as a screenshot or PDF, showing the registrar, creation date and name servers.
• Anything showing harm: customer messages, order confirmations from the fake shop, bank details the site asks customers to pay into.
• Every report you send, its reference number, and each reply, with dates.

#Find the Registrar and the Host

Two different companies usually stand behind a website. The registrar sold the domain name. The host stores the pages and serves them. Either one may act on a sound complaint, and you can report to both.

1. Type the domain into ICANN Lookup. WIPO's domain dispute guidance names this tool as the way to find the registrar for a domain. Owner details are often hidden for privacy, which is normal.
2. For a domain ending in .my or .com.my, use MYNIC's WHOIS instead. MYNIC's FAQ says it shows the creation, expiry and modification dates, the domain status, the registrar and the name servers, and limits personal contact details under the Personal Data Protection Act 2010.
3. Look at the name servers in the result. They often belong to the hosting or DNS company, which is where a copyright or abuse report about the pages themselves should go. Some sites sit behind a network service that hides the real host; that service usually has its own abuse form.
4. Find each company's abuse contact on its own website. ICANN's registrar abuse requirements say accredited registrars must publish an abuse email address, investigate reports and respond appropriately.

ICANN's complaints guidance says concerns about a website's content should go to the site's author or its internet service provider, and to law enforcement or a lawyer if the content may be illegal. ICANN itself takes complaints when a registrar fails to meet the abuse requirements above.

#Reporting a Clone of a .my Domain to MYNIC

MYNIC runs the .my registry, so a copycat on a .my domain has an extra Malaysian route. Its Acceptable Use and Abuse Policy treats fraudulent or deceptive use of a .my domain as abuse, and its definition of misleading advertisement covers infringing third party intellectual property rights.

• The policy invites victims to email [email protected]. MYNIC says it will investigate and refer the matter to the appropriate body.
• The same policy says MYNIC may issue a takedown notice to the registrar, or suspend, delete or lock a domain, at its own discretion. It does not promise to.
• MYNIC's FAQ describes a Domain Contact Request form that forwards your message to the domain holder without revealing their private details. MYNIC notes the holder may not reply. Keep any such message short, factual and free of threats.
• MYNIC's policies page also lists a Triple I process for complaints about .my domains registered with incomplete, incorrect or inaccurate information, which may lead to suspension or deletion.

#Copyright Notices for Copied Text and Photos

If you wrote the text, took the photos or paid someone who assigned the rights to you, copyright is usually your strongest tool. The Intellectual Property Corporation of Malaysia's FAQ says Malaysia has no copyright registration system and that a work is protected automatically when it is created.

1. Send a copyright notice to the hosting company through its abuse or copyright form. List each copied URL, the original it copies, and a statement that you own the work.
2. Report the copied pages to Google. Google's copyright policy page says it responds to clear notices of alleged infringement and may remove or disable access to the material. You file through its legal troubleshooter by choosing the product, such as Search.
3. Expect transparency and a possible reply. Google says it may forward notices to the Lumen project, which publishes them with some personal information removed, and the site operator can file a counter notice that may lead to reinstatement.

Removing a result from Google does not remove the website. Google's own legal help page notes that content it restricts may still exist elsewhere on the web, which is why the host report matters as well. Our explainer on how copyright takedowns work across platforms covers the same notice on social media.

#When the Domain Name Itself Uses Your Brand

Copyright covers the pages. A domain dispute covers the name. If someone registered a domain that matches or closely imitates your trade mark, in bad faith, a formal dispute can end with the domain transferred to you or cancelled. These cases are written legal submissions, and a lawyer usually handles them.

• WIPO's guidance says a UDRP complainant must prove three things: rights in a trade mark, that the registrant has no rights in the domain, and that the domain was registered and is being used in bad faith.
• AIAC describes MYDRP as the Malaysian model of the UDRP. Its elements are similar but not identical, so read the policy itself or let a lawyer advise.
• MYNIC's Registrant Policy encourages both sides to try negotiation or mediation first, and says a .my dispute ends with the domain kept, transferred or deleted, and that AIAC cannot award damages. Either side can still go to court.

A dispute is about the domain, not the copied pages, and it needs registered or otherwise provable trade mark rights. If your brand is unregistered, our guide to trade mark reports against fake brand accounts explains why registration matters for this kind of claim.

#If the Clone Takes Money From Your Customers

A copycat that only copies your words is a rights problem. A clone that sells fake orders or collects deposits is fraud, and customers come first.

• Post a calm warning on your real website and social accounts: name the fake domain, say you do not operate it, and list your only official web address and payment details.
• Tell anyone who paid to act on the money straight away. The government's NSRC 997 page says to call 997 within 24 hours of discovering a scam, contact the bank, and lodge a police report.
• Lodge your own police report describing the impersonation, so there is a record that your business is a victim, not the source.
• Report the incident to CyberSecurity Malaysia through its Cyber999 reporting channel, which accepts reports by online form, email, phone and mobile app.
• Add the police report number to your registrar, host and MYNIC reports.

#Mistakes That Weaken Your Report

• Claiming copyright over material you licensed or do not own. A false claim can expose you to liability and undermines your genuine complaints.
• Organising staff or friends to flood the host or Google with reports. One accurate report from the rights holder carries more weight than a pile of duplicates.
• Trying to break into, disrupt or trace the site's owner yourself. Leave identification to the police and the courts.
• Paying a "takedown" seller who promises removal or asks for the login to your own domain or hosting account. Nobody outside the host, registrar, Google or a dispute panel controls the outcome, and handing over logins puts your real site at risk.

#What If the Site Stays Up?

Sometimes nothing happens. The host may decide the copying is too slight, the registrar may say it does not judge content, or the site may sit with a provider that ignores complaints. That is frustrating, but it is not the end of your options.

• Send one follow-up to each company with any new evidence, such as more copied pages, customer losses or a police report number.
• Pursue the Google route separately. Removing copied pages from search results cuts the traffic a clone gets from people searching your name.
• For a domain that copies your trade mark, or for serious financial harm, ask a Malaysian lawyer about a domain dispute or court action. This article is general information, not legal advice.

#When a Case Review Makes Sense

Many businesses can file these reports themselves with the steps above. A review helps when the clone spans a website and fake social accounts at once, when copies keep coming back on new domains, or when you are unsure which rights you can rely on. SocialSafe by AwareXone looks at the case first, prepares rights-based reports through official platform, registrar and legal channels only, never files false claims, and never asks for the logins to your domain, hosting or social accounts. It is best effort: the host, registrar, Google or a dispute panel makes the decision, and some sites stay up. The impersonation removal service explains how it works, and our Trust Center sets out what we will and will not do.

#Frequently Asked Questions