I run two companies. Unclone, whose blog you're reading, hunts brand impersonators for a living. The other one is CryptoAssetRecovery.com, a wallet recovery business my dad and I have run since 2017, helping people locked out of their crypto get back in. CryptoAssetRecovery was Unclone's first customer, because I won't sell brand protection I haven't put on my own brand.
This story is about the second company. On July 28th, at 5:41 in the evening UTC, someone spent about ten dollars on a domain called cryptoassetrecover.com. They dropped the "y."
They deployed a complete, working copy of our site. Our homepage. Our wallet guides. Our blog posts, our testimonials, our privacy policy, our FAQ. The photos of my dad and me from the "father-and-son team" section. Fourteen pages that our crawler checked, every one a match. Behind it all ran a real web application on a server whose owner hides behind a WHOIS privacy proxy and rented IP space registered to "Private Customer."
Drag the handle. Left is the real site, right is the clone. Same cloudy hero, same press logos, same "helping people back in since 2017" line. The only reliable way to tell them apart is the address bar.
Out of that entire site, they changed two things.
The two edits
The top of the real CryptoAssetRecovery site carries a thin banner:
Beware of impersonators - only trust emails from @cryptoassetrecovery.com. [Report impersonator]
That last link goes to Unclone, and anyone who clicks it can flag a fake to us in about thirty seconds.
The clone kept the banner. Edit one: the trusted email domain now read @cryptoassetrecover.com. Theirs. Edit two: the report link was gone.
Drag across the banner. Left, the real one: trust @cryptoassetrecovery.com, with a blue "Report impersonator" link. Right, the clone: one letter gone from the domain, and the report link gone with it.
So the fake site warned its visitors about impersonators, and aimed the warning at the real company. They even set up mail service on the typo domain, which means a worried visitor who emailed "the company" to double-check would land in the impersonators' inbox.
The person who lands on that page is locked out of a wallet, maybe with their savings inside, searching for help, one letter away from the real company. The clone existed to catch that person and walk them through handing over the one thing you should never give anyone.
The clone's contact page. It asks for your wallet type, your phone number, and how much the wallet is worth, so they can rank their victims. They even kept the real site's promise: "We will never DM you first."
What detection looked like
The machine's side of the timeline, straight from the Unclone case record:
- August 2, 00:10:11 UTC. The clone surfaces in search results and hits our monitoring as a signal.
- August 2, 00:11:29 UTC. Seventy-eight seconds later, Unclone has fetched the site, scored it against our baseline, and opened a case: critical severity, 0.999 confidence. The evidence bundle is already attached: DNS records, registration data, TLS certificate, full-page screenshots, complete HTML, all timestamped.
The classifier's verdict, word for word: "a highly deceptive one-edit lookalike of the official brand domain... a material clone of the official brand's website, with an overall clone score of 1.0, matching favicons, and identical text blocks."
What the takedown looked like
Then the case sat, waiting for me.
My tenant runs in confirm-each mode: a person reads what the machine found and approves every report before it goes out. Unclone also has an auto mode that sends the report as soon as the case is ready. I keep my own company on manual because I want to read what goes out under our name, and for eight days I was heads-down on something else. The case was ready to send 78 seconds after the signal landed. It waited eight days for me to click approve.
That wait is a setting, not a limit. On auto, the report files within the first minute. On confirm-each, the clock belongs to whoever reads the queue. Mine ran eight days. A brand team on rotation would clear it in an hour. Same product, different setting.
Once I did approve it, on August 10th at 19:57 UTC, the report went to NameSilo, the registrar, through their phishing form with the full evidence bundle.
At 20:29 UTC, NameSilo put the domain on clientHold. Delegation pulled, site unreachable. Thirty-one minutes from report to dead clone.
One wrinkle worth knowing if you ever do this yourself: a takedown is a process, and it doesn't finish the moment the registrar acts. DNS resolvers around the world cache the old records for up to two days, so the corpse kept twitching. Our monitor kept reporting the site reachable from warm caches for hours after the hold. If you check a "taken down" site and it still loads, that's usually why.
What it cost them, and us
Their spend: about ten dollars, plus a few hours standing up a copied site.
Our spend: nothing beyond the monitoring we already run. The case study you're reading is the most expensive part, because writing it made me admit a $10 defensive registration would have stopped this exact domain. We own the .com everyone types. We didn't own the version with the "y" missing, and I can't give you a good reason why.
But before you conclude the fix is "buy your typos," count them. Unclone generated 22,087 plausible permutations of our name. Registering the ten most obvious costs you a hundred dollars a year and blocks the ten laziest attackers. Since March, our brand alone has drawn lookalikes on cryptoassetrecovery.uk, .org, .com.au, a "recoverys" plural, and an "ai" suffix. You cannot buy your way out of this. You can only watch for it.
The bugs this case turned up
While writing this up I audited the pipeline behind it. The audit found two real bugs.
The first: our permutation watchlist capped each brand at 2,000 domains and filled the whole cap with homoglyphs (look-alike characters, like swapping an "o" for a zero). For a name as long as ours, homoglyphs alone blew past the cap, so simpler typos, including the exact dropped-letter that hit us, never made the watchlist. The second: a substring-matching bug misrouted this very case's hosting complaint to Amazon Web Services, who rejected it, because the token "s3" matched the "ns3" in the attacker's nameserver.
Both fixes shipped to production the same afternoon, with regression tests locked to this case's real evidence. Our watchlist now covers every typo class. Being customer zero means every case sharpens the product, and this one sharpened it twice.
The part I keep coming back to
Out of fourteen pages and everything on them, the impersonators changed one sentence and deleted one link. The warning, and the way to report them.
They read our site closely enough to find the two things that threatened them. That's the clearest product validation I've ever received, and it came from the adversary.
The banner on the real site still reads the same today. The link still works. If you run a brand that people trust with their money, their credentials, or their name, someone will eventually rent your reputation for ten dollars. When they do, the questions that matter are: how fast do you find out, and how fast can you make it stop. Our answers, this time: 78 seconds of machine time, 31 minutes of registrar time, and eight days of a founder on confirm-each mode not reading his queue. Auto mode deletes that number.
If you want those answers for your own brand, that's what we built Unclone for: unclone.io.
Charlie Brooks Founder, Unclone and CryptoAssetRecovery