How Is This Guy Bypassing Stripe/Shopify With a Two-Site Setup?

How Their Setup Works:​

1. You add a product to the cart on onlyshoes.fr (blackhat site).
2. Clicking "checkout" triggers a series of redirects:
   • onlyshoes.fr/pages/processorder
   • Redirects to onlyshoees.com/?type=processorder&nbv529:6
   • Final checkout: onlyshoees.com/checkouts/... (Stripe-powered)
3. The whitehat site (onlyshoees.com) looks clean—no copyrighted images or brand names—just generic versions of the same products.

What I’m Trying to Figure Out:​

• How is this guy handling referral URLs to prevent Stripe from seeing the original blackhat source?
• What kind of redirection method is he using to avoid detection?
• Could this be JavaScript redirects, meta refresh, or server-side cloaking?
• Is Stripe actually blind to the original traffic source, or is this method just buying time before a ban?

ichbineinberliner said:

I've been researching different ways people run the two-site method to bypass Stripe bans, and I came across something interesting.


The site in question: https://onlyshoes.fr/ (blackhat) → redirects to https://onlyshoees.com/ (whitehat).

How Their Setup Works:​

1. You add a product to the cart on onlyshoes.fr (blackhat site).
2. Clicking "checkout" triggers a series of redirects:
   • onlyshoes.fr/pages/processorder
   • Redirects to onlyshoees.com/?type=processorder&nbv529:6
   • Final checkout: onlyshoees.com/checkouts/... (Stripe-powered)
3. The whitehat site (onlyshoees.com) looks clean—no copyrighted images or brand names—just generic versions of the same products.

What I’m Trying to Figure Out:​

• How is this guy handling referral URLs to prevent Stripe from seeing the original blackhat source?
• What kind of redirection method is he using to avoid detection?
• Could this be JavaScript redirects, meta refresh, or server-side cloaking?
• Is Stripe actually blind to the original traffic source, or is this method just buying time before a ban?

Has anyone here seen or implemented something similar? Would love to hear insights from those who’ve tested this type of setup!

Click to expand...

bartosimpsonio said:

Don't out your competitors, mate. I have a strict policy against helping anyone who outs the specific sites. You're just trying to get them banned.

Click to expand...

bartosimpsonio said:

Don't out your competitors, mate. I have a strict policy against helping anyone who outs the specific sites. You're just trying to get them banned.

Click to expand...

ichbineinberliner said:

thank you Bart, but it is absolutely not my competitor, moreover I couldn’t explain clearly the mechanism with giving any source (=website)

Click to expand...

bartosimpsonio said:

Sure but you provided the exact domain name. It's someone's site, even if not your competitor

Click to expand...

ichbineinberliner said:

I've been researching different ways people run the two-site method to bypass Stripe bans, and I came across something interesting.


The site in question: https://onlyshoes.fr/ (blackhat) → redirects to https://onlyshoees.com (whitehat).

How Their Setup Works:​

1. You add a product to the cart on onlyshoes.fr (blackhat site).
2. Clicking "checkout" triggers a series of redirects:
   • onlyshoes.fr/pages/processorder
   • Redirects to onlyshoees.com/?type=processorder&nbv529:6
   • Final checkout: onlyshoees.com/checkouts/... (Stripe-powered)
3. The whitehat site (onlyshoees.com) looks clean—no copyrighted images or brand names—just generic versions of the same products.

What I’m Trying to Figure Out:​

• How is this guy handling referral URLs to prevent Stripe from seeing the original blackhat source?
• What kind of redirection method is he using to avoid detection?
• Could this be JavaScript redirects, meta refresh, or server-side cloaking?
• Is Stripe actually blind to the original traffic source, or is this method just buying time before a ban?

Has anyone here seen or implemented something similar? Would love to hear insights from those who’ve tested this type of setup!

Click to expand...