Case Study / Impersonation An imposter site, dead in days, not months.
A pixel-for-pixel clone of a pre-IPO mining company's website appeared online, carrying the company's real street address and a working contact form collecting enquiries meant for the real business. It had been live for months before anyone noticed. Once we saw it, it did not get quietly de-indexed. The host pulled the whole site down and banned the operator.
Hard removal
The site taken down at the host, not de-indexed from search
Banned
The operator's account terminated, more than the one clone
Days
From engagement start to offline, after months undetected
- MonthsThe clone was live and collecting enquiries through a working contact form, using the company's real street address. Nobody knew it existed.
- Day oneWe built the evidence package: the copied assets, the false address use, and the harvesting form, filed against the host's and registrar's own abuse policies.
- Days laterThe host removed the entire site and terminated the operator's account. Not a de-indexing, not a demotion, not a takedown of one page.
- SinceIt has never come back, and the operator lost the account they would have rebuilt it on. The company is monitored now, so the next one surfaces in hours.
Dates and the removal outcome are from the engagement record; registrar and host correspondence and the evidence package are on file. Client specifics under NDA.
How to read this
There is a real difference between hiding a fake site and deleting one. De-indexing leaves it live for anyone with the link, and the operator simply spins up another. A hard removal at the host takes the site off the internet, and banning the account takes away the place they would have rebuilt it.
The part worth fixing is the first row. The takedown was fast. The months nobody noticed were not, and that gap is the entire argument for monitoring.
The problem
A clone of the company's site, matched pixel for pixel, using its real street address and a working contact form that was harvesting enquiries intended for the real business. It had been live for months, in front of investors and customers, during a pre-IPO window.
What we did
We documented the copied assets, the false use of the address, and the harvesting form, then took it to the host and registrar under their own abuse policies rather than sending a letter and hoping. Documentation is the whole difference between a takedown that takes days and one that takes months.
Where it landed
The host removed the entire site and banned the operator's account. Not a de-indexing, which would have left the clone live for anyone holding the link. It has never reappeared, and the company is now monitored so the next attempt surfaces in hours rather than months.
The takedown took days. Nobody noticing took months. We fix the second part.
How we measured it. Removal outcome, dates, and account termination from the engagement record; registrar and host correspondence and the evidence package on file. Client specifics under NDA.
Every case study we publish is anonymized, and every figure on this page came out of the client's own account or a dated live check. We do not publish a number we cannot show you the source of.
Monitoring
This is the service behind the work on this page. It explains what we actually do, what you get, and what it costs.
See the service