Online Business Impersonation, Part II: Finding the People Behind the Fake Site

In Part I we explained how to take down a cloned website or a fake social media account. This article covers the next question clients ask: who did this? In many cases the answer can be found, and the case can be handed to law enforcement.

The scale of the problem

Sources: FBI IC3 2025 Internet Crime Report [1]; FTC Consumer Sentinel data release, June 2026 [2]. Reported figures only; most victims never file.

Business impersonation alone accounted for nearly $1 billion of the reported losses in 2025.[2] The FTC considers the problem serious enough that it adopted a dedicated rule against impersonating businesses and government agencies.[3] That rule lets the agency seek money back from the people who do it.

Who gets impersonated

Anyone whose name carries trust. In our practice that means law firms, CPA firms, financial advisers, celebrities and influencers with large followings. The fake site or account borrows that trust and uses it to collect deposits, fees or personal data.

The criminals often go after the victims’ own clients and fans. A client wires a “retainer” to a cloned law firm, or a follower sends crypto to a fake account that looks like a celebrity’s. The real business is left to explain.

Who controls what

A fake website sits on several layers, and each layer answers to a different set of rules. Knowing who to pressure, and how, is most of the work.

Layer	Who runs it	What rules apply	What it can do
Domain name	Registrar (accredited by ICANN)	ICANN’s registrar contract: a public abuse contact, prompt review of abuse reports, and action on confirmed phishing or fraud	Suspend the domain so it stops resolving
Web server	Hosting provider	Its own terms of service and the DMCA notice process for copied content [4]	Take the site offline and keep account records
IP address	Network owner or address lessor	Regional registry policies and its own acceptable-use rules	Pull the address and identify the customer
Search and social	Google, Meta, X and others	Platform policies; FTC impersonation rule [3]	Delist, label or remove the account

A common misunderstanding is that ICANN rules bind hosting providers. They do not. ICANN coordinates the domain name system and contracts with registrars, which is why a registrar can be held to abuse-handling duties while a host answers only to its own terms and to applicable law.[5]

That difference matters when the registrar and the host are in different countries. In the cases we have handled, the domain was often disabled within days while the server kept serving the clone. Both have to go.

Finding the people behind it

Takedown stops the bleeding. It does not tell you who did it, and it does not stop the same person from registering a new domain the next morning. For that you need records, and the law provides ways to get them.

1. File a John Doe action. A civil suit against unknown defendants opens the door to subpoenas under Rule 45 of the Federal Rules of Civil Procedure.[6] Trademark and cybersquatting claims under the Lanham Act are the usual vehicle.[7]
2. Subpoena the registrar and host. Federal law allows a provider to hand over subscriber records, including name, payment method and connection logs, to a private party with valid process.[8] Payment records are often the most useful piece.
3. Follow the IP addresses. Login records from the host point to an internet provider or a VPN service. Each one is a further subpoena.
4. Use the copyright shortcut where it fits. When the clone copies your text or photos, a court clerk can issue a subpoena to identify the infringer without a full lawsuit.[9]
5. Refer the case. Once a name is attached, the file goes to law enforcement with the evidence organized and preserved.

If no one can be found, the Lanham Act allows an in rem action against the domain itself. The court can order the domain transferred to you even if the registrant never appears.[7]

The VPN problem is smaller than it looks

Most impersonators work behind a VPN. Many assume that ends the inquiry. It usually does not.

VPN connections are not stable. They drop and reconnect, and in that gap the user’s real address can be logged by the host, the email service or the social platform. VPN providers also keep more than their marketing suggests, and a subpoena can reach those records.

In one federal cyberstalking prosecution, the defendant used a VPN to hide his activity. Records obtained from the VPN provider connected the account to two addresses, his home and his workplace. He was sentenced to more than 17 years.[10]

Finding one real IP address is often enough. It leads to a subscriber, and a subscriber has a name.

Why it is almost always crypto

Impersonation is a crypto crime in practice. Victims are told to pay in Bitcoin or stablecoins, and businesses are sometimes offered a “fee” to make the fake site go away. Crypto accounted for more than half of all reported cybercrime losses in 2025.[1]

Do not pay. Payment funds the next site, and sending money to an unknown party can create sanctions exposure under OFAC rules.[11] It also rarely ends the problem.

The same payment trail can work in your favor. Wallet addresses and exchange records are evidence, and tracing them is part of the identification work.

Data on wealthy individuals and firms is bought and sold on the dark web, which is often how a target is chosen in the first place. We covered that market in our article on dark web surveillance for private clients.

Expect the second site

When one domain is disabled, a replacement often appears quickly, sometimes within minutes, with a letter swapped or a hyphen added. Monitoring for spelling variants and for the original server address catches the next one early. Each new domain also adds to the record against the same person.

1. FBI Internet Crime Complaint Center, 2025 Internet Crime Report, https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
2. Federal Trade Commission, FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025 (June 2026), https://www.ftc.gov/news-events/news/press-releases/2026/06/ftc-data-show-people-reported-losing-3-point-5-billion-imposter-scams-2025
3. Federal Trade Commission, Trade Regulation Rule on Impersonation of Government and Businesses, 16 C.F.R. Part 461, https://www.ftc.gov/system/files/ftc_gov/pdf/r207000_govt_biz_impersonation_rule.pdf
4. 17 U.S.C. § 512(c) (notice and takedown), https://www.govinfo.gov/content/pkg/USCODE-2023-title17/html/USCODE-2023-title17-chap5-sec512.htm
5. National Telecommunications and Information Administration, Testimony on the Role of the U.S. Government in Securing the Nation’s Internet Architecture (2019), https://www.ntia.gov/speech/testimony/2019/testimony-acting-assistant-secretary-rinaldo-role-us-government-securing-nation-s-internet
6. Federal Rules of Civil Procedure, Rule 45 (Subpoena), https://www.uscourts.gov/rules-policies/current-rules-practice-procedure/federal-rules-civil-procedure
7. 15 U.S.C. § 1125(a), (d) (Lanham Act; Anticybersquatting Consumer Protection Act, including in rem actions), https://www.govinfo.gov/content/pkg/USCODE-2023-title15/html/USCODE-2023-title15-chap22-subchapIII-sec1125.htm
8. 18 U.S.C. § 2702(c)(6) (disclosure of subscriber records to non-governmental persons), https://www.govinfo.gov/content/pkg/USCODE-2023-title18/html/USCODE-2023-title18-partI-chap121-sec2702.htm
9. 17 U.S.C. § 512(h) (subpoena to identify infringer), https://www.govinfo.gov/content/pkg/USCODE-2023-title17/html/USCODE-2023-title17-chap5-sec512.htm
10. U.S. Department of Justice, Massachusetts Man Sentenced to More than 17 Years in Prison for Cyberstalking Former Housemate and Others (2018), https://www.justice.gov/archives/opa/pr/massachusetts-man-sentenced-more-17-years-prison-cyberstalking-former-housemate-and-others; criminal complaint affidavit, https://www.justice.gov/archives/opa/press-release/file/1001841/dl?inline=
11. U.S. Department of the Treasury, Office of Foreign Assets Control, Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments, https://ofac.treasury.gov/media/912981/download?inline

This article is for informational purposes only and does not constitute legal advice or create an attorney-client relationship. Results depend on the facts of each matter and are not guaranteed. Attorney advertising.