My Entire Store Has Been Cloned (Mirror Proxy) +25 Times Including Checkout

[RebelPetal]

My store has been cloned / mirror proxied +25 times. Every page, product, blog, the cart, checkout, you name it. 

Spoke with shopify, unfortunately they could not help. Have started reporting the sites but there are so many of them that I can't keep up. I also have tried the code everyone links to from Dave - it did not help in my case.

Every update I make to my site shows up immediately on the cloned/mirrored sites.

They are showing up in google searches for my store and sending soooooo much traffic to my site (upwards of 5500 a day & even visiting my site from theirs) All of this is really messing with my analytics / conversion rates, SEO, etc. Some days it looks like the traffic is coming from Canada, others it is from the US, and most shows it is coming from Facebook which does not even make sense. 

Their checkout cart page does not seem to actually work - once I input a (fake) address and (fake (info) it opened to a 520 error page. 

I attached screen grabs of my analytics to show some context of what is happening on my site.

Can anyone help? 

TIA

my store: rebelpetal.com

the cloned/mirrored sites:

https://hexinaccount.com/

https://www.qiheyibai.com/

https://www.elwadifa24.com

https://dameijixie.com

https://includeme2.com

https://www.cfkeyun.com

https://dengdengbrain.com

https://nh-trust.com

https://mihowe.shop

https://tupi.fun

https://otorir.sbs/pages/rebel-petal-weddings

https://elol.cc/pages/christmas

https://tuce.shop/pages/rebel-petal-rentals

https://ciwote.sbs/pages/rebel-petal-commercial

https://gedase.sbs/pages/rebel-petal-pretty

https://www.aixunlab.com/collections/rebel-pretty

https://donale.sbs/blogs/rebel-petal/rockcliffe-pavillion-wedding

https://www.vesa.shop/products/wall-mount?variant=30995420184639

https://ucih.shop/products/drake-dragon?variant=33366876520511

https://direti.sbs/products/3-variety-beeswax-food-wrap-abeego?variant=37218290701

https://vate.fit/collections/celebrate-galentines-or-valentines-day/products/hand-stamped-bracelets-...

https://enetiw.sbs/products/himalayan-salt-bar?variant=32591311962175

https://nosiyo.shop/products/samoa-accent-pillow?variant=32752421961791

https://otorir.sbs/collections/rebel-weddings

https://aledew.sbs/products/ice-stones?variant=32597254963263

https://tesu.shop/pages/rebel-petal-charlie-roxie

[InfiniteCom]

Hi @RebelPetal, I looked at a few links examples and assuming they use a reverse proxy, here are some ideas to help mitigate the issue.

• The examples I saw are hosted at CloudFlare ISP, complain to the ISP themselves and ask for investigation on all proxies to your shop. (reason: this constitutes misleading customers)
• Add an announcement bar at the top of your shop to tell your clients that they need to be on your real domain name. (test it to make sure they are not changing your text)
• If you know how to code/or have a developer, add javascript code in your theme to check the host in the url, if the host is not correct, then redirect automatically to your real domain. (You will actually get their traffic 😁 ) . Make sure that this code executes at the end of the page so it would run after their code, and possibly inline so they do not override the url.

[RebelPetal]

Thank you for your reply @InfiniteCom 

I have been slowly making my way through the fake sites and reporting them and have also reported them to google for phishing.

So far it looks like they aren't changing our text and everything seems to be a direct mirror of our site. 

I can input code but I can not write code. Do you have any recommendations for a developer that could write the code for us to input into our site? We tried the code that has been suggested on other peoples post (with similar issues) and it did not work.

Thank you again.

[InfiniteCom]

@RebelPetal 

Regarding the links above, they are hosted at Cloudflare. I recommend that you send the entire list to them using this page:

https://www.cloudflare.com/trust-hub/abuse-approach/

These are the IP addresses for all of them and I checked them, they are owned by Cloudflare

104.21.11.102, 104.21.11.87, 172.67.222.179, 172.67.158.130, 104.21.18.211, 104.21.19.78, 104.21.86.183, 172.67.203.65, 104.21.37.146, 104.21.37.146, 104.21.75.252, 172.67.187.61, 172.67.199.206, 172.67.150.219, 172.67.211.222, 104.21.0.227

The code you have on your home page has an extra '}' at the end causing it to fail. Remove that one character and it should work. 

If it does not or they add further changes, I can help you out.

[p1Commerce]

Looking at that code, I believe when that last bracket is removed (and the semicolon should be removed also) it's going to redirect in all circumstances as the || "rebelpetal.com" is going to return true, and the result is going to be an infinite loop.

You need to be very careful when implementing code for this purpose.

The following I believe will do the trick but highly recommend testing it thoroughly.

<script type="text/javascript">
if (typeof window != 'undefined' && window.location && window.location.hostname.replace('www.', '') !== "rebelpetal.com") {
  window.location.replace("https://www.rebelpetal.com/");
}
</script>

Also, file a DMCA claim on Google.

[RebelPetal]

Hi @p1Commerce - thank you for your reply. I make a copy of our theme and try the code on it first. I had left the copy of our theme as the published one but have since put it back to our original.

I did try testing the code you kindly provided and published it to give it a test and it unfortunately did not work. Maybe I did it incorrectly - I input it just before the </head> script at the bottom.. Should it have been at the top? This is outside of my wheelhouse.

Doing the DMCA claim on Google now, thank you!

[p1Commerce]

Anywhere on the page will work but the redirect will only take place if the code is used on a domain other than yours. 

To test it you would need to add the code, view source of the page, save that source as an HTML file and upload it to a different website.

[RebelPetal]

I have reported all 26 of them to cloudflare, their registrars and google phishing. 

I was thinking of waiting another 72 hours (business hours during the week) to hopefully get the sites removed and then I would try the code again to "break" any of the mirror sites that haven't yet been removed.  I have removed the code for now. 

Is it possible to have code created that would stop our site from being duplicated / mirrored again? Worried this will keep happening. Yesterday we had 6,694 online store sessions (99.9 were BS)...they are messing with our analytics (and google ratings) so badly.

Thank you

[InfiniteCom]

@RebelPetal 

The only technical way to stop these copiers is by making the website render incorrectly if served from their domains or redirecting automatically to your correct domain which is what you are doing now.

I have tested the code from @p1Commerce and it works perfectly (if it runs on your domain as well as the other domains), in both cases, it will redirect to your domain only if needed.

Just copy & paste what @p1Commerce provided mostly anywhere on the page (maybe at the end of the head). (Use the button 'copy' top-right of the code to make sure you are copying the right thing).

Note, I noticed that when you had your original code, the other sites made changes to it. So after you try it and it does not work, let us know while the code is there so we help adjust it.

[RebelPetal]

@InfiniteCom that is great to know - is it okay if I tag you in a reply in a day or two (giving time for the companies to remove the websites)  once I update the code? I will ping you when I am online and if you are too, then I will add the code and we can go from there. I am super grateful! Thank you!

@p1Commerce I submitted the DMCA claims on Google - thank you again! 

re: your comment "To test it you would need to add the code, view source of the page, save that source as an HTML file and upload it to a different website." I don't think I have the ability/skills/brain to do that. Or maybe I do and my brain is too fried to process what you are saying and things are all starting to sound like the teacher in Charlie Brown. Going on 3 days with very little sleep trying to get this all sorted. Super appreciate your help.

[InfiniteCom]

Of course... will be happy to help

[RebelPetal]

Thank you again. I am beyond grateful.