Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My website is being stolen in real time and I don't know what to do

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 111 posts

My website is being stolen in real time and I don't know what to do

#1

Post by joeyjones »

I launched the site http://altexplorer.net at the start of January as a Block Explorer and information hub for alternative cryptographic currencies. This morning I found a site http://4co.in which is ripping-off my site in real-time; every time a page is loaded on 4co.in it uses php to load the corresponding page from http://altexplorer.net, removes analytics and ad tags, replaces the site name, and replaces the link URLs.

I've put a lot of effort into building this site and keeping it running, and now someone in India is stealing it in real-time. Every page load to 4coin causes an identical page load in the nginx logs of http://altexplorer.net. What can I do besides blocking the source IP address to stop this?

Screen shots: Alt Explorer home page: https://d1eem2029tdth0.cloudfront.net/img/altexplorer-home.png

4coin home page: https://d1eem2029tdth0.cloudfront.net/img/4coin-home.png

Alt Explorer profitability page: https://d1eem2029tdth0.cloudfront.net/img/altexplorer-prof.png

4coin profitability page: https://d1eem2029tdth0.cloudfront.net/img/4coin-prof.png

Re: My website is being stolen in real time and I don't know what to do

#2

Post by joeyjones »

Sample log excerpt: 162.222.227.123 - - [14/Feb/2014:18:18:48 +0000] "GET / HTTP/1.1" 200 23271 "-" "-" "162.222.227.123"

162.222.227.123 - - [14/Feb/2014:18:37:51 +0000] "GET /chain/42 HTTP/1.1" 200 76170 "-" "-" "162.222.227.123"

162.222.227.123 - - [14/Feb/2014:17:40:58 +0000] "GET /block/0e67dcf5f6797840a98061af7581138f2347feb168d78f7138d4268c6f854748 HTTP/1.1" 200 15719 "-" "-" "162.222.227.123"

162.222.227.123 - - [14/Feb/2014:18:38:21 +0000] "GET /tx/6c636ebff9674f4168b80b415f8a9097509802992b0422a4fa98c543da9c068e HTTP/1.1" 200 15898 "-" "-" "162.222.227.123"

162.222.227.123 - - [14/Feb/2014:17:41:05 +0000] "GET /address/GRjc357hnC7THEUPVJmpMmCjSAGn54CJnx HTTP/1.1" 200 14034 "-" "-" "162.222.227.123"

162.222.227.123 - - [14/Feb/2014:18:13:21 +0000] "GET /news HTTP/1.1" 200 16675 "-" "-" "162.222.227.123"

162.222.227.123 - - [14/Feb/2014:18:19:12 +0000] "GET /profitability HTTP/1.1" 200 188354 "-" "-" "162.222.227.123"

Re: My website is being stolen in real time and I don't know what to do

#7

Post by pilom »

You found out the right first step yourself: Block the source IP address. Sure it will turn into a game of whack-a-mole with them changing their IP but eventually, their customers will get fed up with their downtime.

Second idea: Javascript redirect all of your pages to your own subdomain. Again, its just a step in an arms race, but this would be a little too hard/expensive to take to court. You can win an arms race if you try.

Re: My website is being stolen in real time and I don't know what to do

#8

Post by fragmede »

Nice bit of news you added to the top, which 4co.in is putting on their own site.

One piece of advice though: Drop the goo.gl short link and link directly to http://altexplorer.net, otherwise it looks like 4co.in was 'hacked' and goo.gl is a phishing/some other sort of scam and not legit.

You should be able to pickup the 4coi.in domain as the referrer if you want metrics for how many people were using 4co.in.

Re: My website is being stolen in real time and I don't know what to do

#9

Post by joeyjones »

benologist wrote: post #4

Report them to their web host and the ad networks they use. Don't troll them with different content just go for the kill - some accounts like AdSense carry lifetime bans.

I have reported it to the abuse contact of the web host, colocation provider, and cloudflare. I am however not expecting a response in a timely manner from any of them.

Luckily they are stripping out the ad tags before displaying by site so it shouldn't affect Ad Sense.

Re: My website is being stolen in real time and I don't know what to do

#10

Post by joeyjones »

icedchai wrote: post #3

recommendation: respond with fake data, based on source IP. the problem will take care of itself.

I am going to lok into this later today through nginx. I am planning on having every request from their scraping IP return a static page linking to the proper site.
Post reply on HN