Use whois to find out which company is hosting the domain and for good measure, ping the sites and use whois on the IPs you get back to see which networks they're being served from, then contact those ISPs
Fake storefronts can be served from compromised devices (often using a residential IP address) so reporting those will get them cleaned up/secured and while most hosting companies don't have much to fear from managing a scammer's domain/DNS (nobody blacklists godaddy or namecheap and they know it) hosting scammers on your network is much worse since you risk getting your IP space blacklisted (unless you're google or cloudflare) so sometimes it's easier to get the sites removed by going after the networks involved, although that can also turn into a game of Whac-A-Mole since the scammers will often just point their domain to a new IP.
Fake storefronts can be served from compromised devices (often using a residential IP address) so reporting those will get them cleaned up/secured and while most hosting companies don't have much to fear from managing a scammer's domain/DNS (nobody blacklists godaddy or namecheap and they know it) hosting scammers on your network is much worse since you risk getting your IP space blacklisted (unless you're google or cloudflare) so sometimes it's easier to get the sites removed by going after the networks involved, although that can also turn into a game of Whac-A-Mole since the scammers will often just point their domain to a new IP.