How to protect your website from proxy mirrors?

What are proxy mirrors?

When building modern websites there’s a weakness which allows scammers to mirror the websites and make profit from their content for free.

Those proxy mirrors, namely, the copies of your websites appear on the internet, and perhaps you don’t even know about them. Such site copies junk search engine databases and create duplicates in the search results.

What is the main purpose of proxy mirrors?

Surely, making a profit is the main goal. Like leeches, those dishonest people make money on stealing your traffic until your websites are protected. To be honest, the scammers can easily clone thousands of websites in a few days using just a proxy script and make them available on the internet. If your site is ranked among the world's top 500,000, then most likely it had been already cloned.

How can proxy mirrors affect your website?

No doubt, if you do not take urgent measures the cloned websites will affect your original site's search result rankings by stealing your precious traffic and money. Once there appear pages with duplicated content from your website the search engines react to that penalizing for copies of your original website or even removing your websites entirely from a search index while the cloned website is still live and working.

How can I check if my website has been cloned?

Here are some best ways to detect proxy mirrors:

1. Let’s copy the most popular URLs of your website and paste them into browser's search box. To make your job easy you need to add a parameter like inurl: in front of the URL you want to access.

For example, for Google inurl:/category/3344/flowers

2. Multiple online plagiarism detection services that can help you find the cloned websites. Use them to check if your website has been cloned. Just take some text or a name, including a description of your website, and run them using those plagiarism checker services. Don’t use a domain name, as it is probably changed or deleted (Keep in mind, some tricky scammers not only mirror your websites but even translate the descriptions on the other languages).

The first 2 websites got in there incidentally, but the last one that has a .ru domain is the clone of the third site.

3. Google Search Console (Google Webmaster Tools) shows links to your site. If your websites are linked to each other, then it will get one additional link to the cloned website.

4. This method is perfect for people with administration skills or have somebody pretty good at it. It requires detailed analysis and an aggregation of the logs and subsystem on the abnormal activity,considering all available information, such as a requested URL, an IP address of the requester, user-agent, cookies and so on. You can do all this analysis manually. But keep in mind, the scammers never sleep, so you need to do than constantly. Besides, the analysis is a time-consuming job. And even if you are a good coder or system administrator you will still need to monitor its status and make changes to your website, so no one could clone it.

What can I do against mirror websites?

1. The easiest way is a report (abuse). Namely, we use WHOIS protocol to find information about ownership of a domain name and an internet provider. No one usually protects, scammers, so most likely they will be blocked.

And what if there are many domains, IPs are changing every 5 minutes (for example, this can be achieved by using Tor) and the hosting provider or the registrar is fail-safe?

2.In this case, you can’t deal without a skilled system administrators. Hostiserver can provide this service for you at affordable rates, including basic price packages. In addition to automatic analysis, our tech experts would check the system manually for all suspicious activities to prevent the website cloning. In other words, if the automatic system misses something, the expert will correct that error, so it would never happen again in the future. As we are already protecting many websites, the number of IPs in our blacklist continually growing ensuring your website is safe and sound from all catched by us scammers.

Let’s consider the following example:

example.com 163.**.99.** - - [06/Dec/2017:07:32:20 +0000] "GET /search/1.html HTTP/1.1" 200 6656 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

In this case, we need to look at the IP address of the requestor (a 2nd field) and user-agent (a last field). It may seem that a request comes from Googlebot, but if we carefully examine Google data https://support.google.com/webmasters/answer/80553?hl=ru and run a simple test such as:

# host 163.**.99.** **.99.**.163.in-addr.arpa domain name pointer 63-**-99-**.rev.poneytelecom.eu.

We can see that this request was not sent by Googlebot. So, we conclude the user-agent is faked. At least, it looks very suspicious. Next, we need to check the domains per this IP address, and if there are multiple clones then we block the IP and redirect all the requests from this address somewhere. Such things happen every day and the scammers invent thousands of new ways to bypass blocking of the IPs.

Summary

Every website could be entirely cloned especially, if it has great traffic flow and ranked among the world's top. The dishonest people have no moral and ethical principles; therefore, they don’t care what your website provides or sells. They would clone almost everything using a list of the most popular websites worldwide (like Alexa.com).The proxy mirrors will steal your network's traffic and money. The best way to deal with the proxy mirror websites is to hire real experts who'll constantly monitor your server and react immediately protecting websites from malicious mirrors.