Josh and Amy Vandevender have run St. Louis Roofing & Siding out of Kirkwood for 20 years, building a business that advertises drone inspections, Owens Corning preferred contractor status, and an A+ rating with the Better Business Bureau. Then a neighbor found what looked like their site under a different name, using their customer testimonials to sell roofing inspections nobody at their company ever agreed to.
The Vandevenders discovered a site called exteriorstl.com that had copied testimonials from customers identified as Robert, Janet and Jim, according to First Alert 4. The station reports the Vandevenders first stumbled onto the site after asking ChatGPT for website ideas, only to have it surface exteriorstl.com. A neighbor then set up a roof inspection with the site to see what would happen.
What happened was a man who identified himself as Claudio showed up and performed a roof inspection, according to the station's reporting. Josh Vandevender confronted Claudio about the website, and cell phone video the Vandevenders provided to First Alert 4 captured Claudio saying he was not a roofer and that he would ask for incorrect information on the site to be changed.
A Storefront That Existed Only Online
The fake site listed a business address of 123 Main Street in St. Louis, which does not exist, per the station's report. Exteriorstl.com is not listed with the Better Business Bureau, nor is it registered with the Missouri Secretary of State's Office, First Alert 4 found. The site went live in July, and it claimed drone roof inspections, full licensing and Owens Corning preferred status — the same credentials St. Louis Roofing & Siding actually holds.
Michael Sweeney, director of cyber defense at Silent Push, reviewed both the St. Louis Roofing & Siding and Exterior STL websites for First Alert 4 and said AI cloning sites pull information and reproduce it to build convincing fakes. The exterior STL website appears to have been set up to collect leads from people needing roofing work, feeding that information into a local database, the station reports.
The Man Behind the Clone Responds
Gabe Waterhouse told First Alert 4 that Claudio created the site using AI and said they did not intend to take anything away from another business. Waterhouse, who declined to be recorded, said the operation had not had any paying customers and that he planned to shut the business down.
Amy Vandevender and Heather Sullivan, the reporter who broke the story for First Alert 4, contacted AWS directly, and the hosting provider subsequently took down the exteriorstl.com site. That sequence highlights a gap security researchers have flagged repeatedly: automated scam sites can go live in days, while takedowns often depend on victims or journalists escalating directly to hosting companies rather than any automatic filter catching the fraud first.
A Pattern Cybersecurity Researchers Have Been Tracking
Silent Push warned in its 2026 threat outlook that threat actors are increasingly deploying AI website builders to rapidly create lookalike sites and age newly registered domains for malicious lead generation and advertising campaigns, according to the firm's own threat research. Cybersecurity firm Netcraft reported identifying 100,000 AI-generated websites impersonating nearly 200 distinct commercial brands in 2025, as detailed by Marketplace, illustrating how generative tools have made replicating a legitimate business site cheap and fast.
The scale of the broader problem is significant. The FBI's Internet Crime Complaint Center logged 22,364 complaints referencing artificial intelligence in 2025, resulting in roughly $893 million in reported losses, Hoodline previously reported. Phishing and domain spoofing were the single largest complaint category the FBI received that year, with 191,561 complaints totaling about $215.8 million in losses. A 2025 Better Business Bureau study found that nearly 80% of North American businesses encountered attempted fraud in 2024, with brand impersonation and fake service offerings among the costliest schemes.
What Legal Options Exist for Cloned Businesses
Website content, graphics and written testimonials automatically receive copyright protection under 17 U.S.C. § 102(a) of the U.S. Copyright Act as soon as they are published, according to attorneys, though federal registration is generally required before filing a formal copyright lawsuit. In Missouri, Section 407.020 of the Missouri Merchandising Practices Act makes deception, misrepresentation or false pretense in advertising or selling services unlawful, with penalties that can include civil enforcement, restitution orders and, for willful violations, Class D felony charges.
The Federal Trade Commission has also made unlawful online lead generation an enforcement priority, securing more than $145 million in settlements against networks that collect consumer inquiries through deceptive websites and resell the data to third parties. The Missouri Attorney General's Consumer Protection Section maintains a hotline at 800-392-8222 and a mediation process that has recovered more than $15.5 million in restitution in a single recent year for residents who report scams like this one.
Consumers should check a business with the Better Business Bureau before booking work through its website, and companies concerned about being cloned can hire cybersecurity experts to alert them when their branding or content is reused elsewhere online. The Vandevenders' case adds to a run of contractor-fraud stories in the St. Louis region this year, including a contractor accused of taking cash and vanishing after tornado damage left homeowners desperate for roofing help.
-4.webp?w=160&h=400&fit=crop&crop=edges)