My website is being stolen in real time and I don't know what to do

You can use javascript frame busting techniques to redirect back to the main page. You can also use mod_rewrite or some proxy setups to make it so a completely different set of pages shows up for people coming from that site. This is better than just blocking it because it's a bit more subtle and lets you tell that site's users what's happening.

A perfect troll setup.

So many fun options.

1) Use javascript to replace their ad referrers with yours.

2) Display porn only for them

3) Random infinite page refreshes on their servers.

4) Javascript fake-click the ads so they get banned by their ad network

worst advice ever.

Use imagemagick to watermark all image requests on the fly so you can keep changing the position of a url watermark on all images.

edit - actually, don't do this as it is trivially easy to get around by doing 2 or 3 requests and keeping anything that hasn't changed.

Or if you do do this, add a low level noise filter on top so that the attacker can't just directly equate pixel values.

> Let them eat /dev/urandom to their heart's content.

No! You can't just give them purely random data. No, sir. That would be easy enough to detect.

What you need is plausible randomness. Shift the value of every transaction by a small percent. Trending everything downward over time, but making it plausible, would be far more entertaining with random upward trends. Best buy now before it gets too expensive! Oh, I'm sorry? That wasn't the actual price? Well, you'd best use a reputable source!

If you're going to poison the well, you don't want to be caught. You want them to wonder at what point their data set diverged and for how long they've been serving incorrect data. Sinister points for interspersing legitimate data with munged data.

The trick with being evil in this case is to be subtle about it. They want to scrape all your metrics? Let them. You just can't guarantee the accuracy of the data they're scraping, right? [wink, wink]