You haven't posted the real domain so I can't check but try pinging the clone's domain and make sure it isn't pointing to your server's IP. It may just be a domain that belonged to the previous owner of your server's IP.
It deflects a lot of blind security attacks..all of which would fail of course, but I don't need that noise in real log files.
This would solve your problem too. If you're feeling vindictive, redirect requests for the offending domain somewhere that will be bad for their SEO.
EDIT: I should add that a null default vhost will exclude HTTP/1.0 clients. But that's a non-issue unless you're serving to very old embedded systems.