Confirm it is not you
Open the URL in a clean browser. Check the hostname. If it is not your official domain and it has a cart, treat it as hostile even if the theme looks identical.
Note whether checkout asks for cards or a login. That changes the abuse angle (trademark vs phishing).
Collect evidence before it rotates
Screenshot the homepage and the cart. Copy the full URL. Do not log in or pay.
Run your official domain through obscuryn.com/free-scan so you see sibling hosts. Kits rarely stand up only one shop.
File, then re-check
Send the packet to the domain registrar and to Shopify’s impersonation / IP path. File it. A tweet does not count.
Re-scan in 48 hours. The first domain often drops and two new .shop hosts appear the same week.
Questions
Related