Help: My site is mirrored by another domain

T

TassieNZ

Premium Uploader and Sometimes Hacker!

Jan 17, 2019

9,017

19,814

120

New Zealand

• May 9, 2020

• #21

1. Have you filed a DMCA complaint?
2. Have you considered adding canonical URLs to your pages?

Just a start.

 

• 

Reactions: jackdas

ssau

Member

Banned User

Jan 23, 2020

44

20

8

India

• May 9, 2020

• #22

nickfoxx said:

I sent emails to both emails, but there was no response. There is no action to stop this. The domain continues to function.

Click to expand...

You can't get exact registrar details from freenom.

 

ssau

Member

Banned User

Jan 23, 2020

44

20

8

India

• May 9, 2020

• #23

nickfoxx said:

Yes, it uses cloudflare. I tried everything, but it doesn't help.
I'm not very up to date with these things.

Click to expand...

If your problem ,is not fixed you can inbox me. I will try to fix that!

 

nickfoxx

New member

Feb 26, 2020

24

3

3

• May 9, 2020

• #24

Unfortunately, I tried what you pointed out to me here, I tried everything else, but to no avail. The site continues to mirror itself in real time. I don't know what they use and how to stop it.

 

ssau

Member

Banned User

Jan 23, 2020

44

20

8

India

• May 9, 2020

• #25

nickfoxx said:

Unfortunately, I tried what you pointed out to me here, I tried everything else, but to no avail. The site continues to mirror itself in real time. I don't know what they use and how to stop it.

Click to expand...

I have gone through your site, and it seems you are either using theme/plugin which is having backdoor(malware). I can stop that if you want

 

ckeeper

Well-known member

Nov 8, 2019

623

376

63

• May 9, 2020

• #26

nickfoxx said:

My site is mirrored on the following domain http://vickmotesta.ml
The domain on which the mirror copy is used Cloudflare and I can't reach the original IP address.
I have no idea what they use to do this.
I tried everything to deal with the problem, but to no avail.
My site is on WordPress.
How to stop this.

Click to expand...

Looks like someone has a full access to your website, I suspect your account has been hacked, first thing is to change all your passwords. Second there is a good chance they have left some backdoor somewhere as well, do a system scan both for wp and also for your hosting system, and your PC against Trojans as well. Use some plugins to trace any suspicious connections to any of the plugins you use.

GitHub - pluginkollektiv/snitch: Network monitor for WordPress. Connection overview for monitoring and controlling outgoing data traffic.

Network monitor for WordPress. Connection overview for monitoring and controlling outgoing data traffic. - pluginkollektiv/snitch

github.com

Click to expand...

Good luck.

 

Last edited by a moderator: May 9, 2020

nickfoxx

New member

Feb 26, 2020

24

3

3

• May 9, 2020

• #27

ssau said:

I have gone through your site, and it seems you are either using theme/plugin which is having backdoor(malware). I can stop that if you want

Click to expand...

OK.

 

biscuit

Well-known member

May 30, 2018

417

240

63

• May 9, 2020

• #28

You can easily deal with this. IF Its a proxy site. When you post a new article go to cloudflare firewall and create a new firewall rule - Field: URI Operator: Contains Value: you type your article url or just part of it . The choose an action, Go for Js challenge or Allow. Now Deploy. IMPORTANT! Make sure you publish the article AFTER 1-2 minutes from creating the firewall rule. Then just follow the rule. Probably the firs logged IP is the sucker. He is hitting your site every few seconds.
Now this only works if the guy proxied your site. If he has access to your database this will not work

 

• 

Reactions: TassieNZ

nickfoxx

New member

Feb 26, 2020

24

3

3

• May 9, 2020

• #29

gopo said:

You can easily deal with this. IF Its a proxy site. When you post a new article go to cloudflare firewall and create a new firewall rule - Field: URI Operator: Contains Value: you type your article url or just part of it . The choose an action, Go for Js challenge or Allow. Now Deploy. IMPORTANT! Make sure you publish the article AFTER 1-2 minutes from creating the firewall rule. Then just follow the rule. Probably the firs logged IP is the sucker. He is hitting your site every few seconds.
Now this only works if the guy proxied your site. If he has access to your database this will not work

Click to expand...

Not work

 

biscuit

Well-known member

May 30, 2018

417

240

63

• May 9, 2020

• #30

nickfoxx said:

Not work

Click to expand...

Try one more thing. In cloudflare activate Under Attack Mode . Then post an article. This will bassically JS Challenge everyone. If the new article still shows on his site he has access to your database. You can disable the under attack mode after that.

 

nickfoxx

New member

Feb 26, 2020

24

3

3

• May 9, 2020

• #31

nickfoxx said:

Not work

Click to expand...

This is the result of the test. I just don't understand how it is through my Contabo hosting

 

nickfoxx

New member

Feb 26, 2020

24

3

3

• May 9, 2020

• #32

gopo said:

Try one more thing. In cloudflare activate Under Attack Mode . Then post an article. This will bassically JS Challenge everyone. If the new article still shows on his site he has access to your database. You can disable the under attack mode after that.

Click to expand...

I tried this. I activated the mode, published an article and it went directly to the mirror site without even showing that it was a "Under attack" mode. It is loaded directly and the new article is published.

 

ssau

Member

Banned User

Jan 23, 2020

44

20

8

India

• May 9, 2020

• #33

I see, any further installation of plugins and files will effect old files(nature of the backdoor) so have to remove it manually

 

nickfoxx

New member

Feb 26, 2020

24

3

3

• May 9, 2020

• #34

Scan my site, and view that is XSS atack

 

ssau

Member

Banned User

Jan 23, 2020

44

20

8

India

• May 9, 2020

• #35

nickfoxx said:

Scan my site, and view that is XSS atack

Click to expand...

so, have you fixed that?