Have your say in Community Polls: What was/is your greatest motivation to start your own business?

Re: Protecting Our Website Content & Data

How can we monitor and block high-activity IP addresses on our website?

drivenproducts
Shopify Partner
10 0 1

We've recently been the victim of massive content and data scraping on our website. We are aware that if we have this content and data published to the web, there is no way to prevent people or bots from scraping it. But we do want to monitor this activity in real time and make it difficult for them.

 

We are testing several apps to block users by ip address, ip range, and geo location. Does anyone know if there is a solution for the following:

 

1). Automatically notify us by email or sms when our website active user count rises above a specified limit

2). Automatically block an ip address or ip range when their active user count rises above a specified limit

 

Nothing is gauranteed and the use of a VPN can certainly render these solutions pointless. But we would like to explore different options and do what we can.

Replies 12 (12)

MWDesign
Shopify Partner
4 0 1

Our site has been deeply scraped too. Seems to me that Shopify needs to seriously up its security game. If one does a view source of the copy cat site, one can see that they are simply accessing all the frontend resources i.e. css, js, etc. Seems to me that it would be in Shopify's best interest to prevent others from illegally accessing their code and well as ours. 

Shopify can disrupt them. As you mentioned users can be blocked by IP addresses and content that the hackers have referenced can be made unavailable. In short, the hacker will have the weigh the effort of hacking to gain. If the effort is high enough then the hackers have much less incentive.

As I write this, we are in the middle of a Pandemic. Buying over the internet is one of the few options, people have to avoid unecessary contact. E-commerce has come a long way and recently Shopify has reaped enormous benefits. But Shopify will lose if they do not do better. I wonder what happens to a ShopifyPlus customer who is paying at least 2000/mon for the privilege and their site is scraped....

That said, I have spoken to Shopify support and we are doing as much as we can to have the copy cat site taken down. 

I would like to hear from the community. Are you a Shopify Plus customer whose site has been scraped? Have you taken the DMCA route - was that successful?

PaulNewton
Shopify Partner
7450 657 1565

Remember if they are automating content copying then you can put whatever you want in your content copy that will show on their site.

There was a thread complaining about the Honey service scraping discounts so one merchant started making discount codes like "HONEY-STEALS-YOUR-DATA"

Water mark your images, brand your videos, and product copy.
Such as making sure your website or business name is everywhere and spelled or used in so many different ways that they can't just find-and-replace a single simple word.

The thing to note here is that a business has to create value through effort of differentiating their content in such a way that someone copying it doesn't matter, viewers can still trace it back to the source company.

 

Other tactics using <noscript> tags may be an option as shady websites often get on lists that browsers and other services use to turn javascript off making <noscript> tags show to users.

If they are replicating the <head> area as well then using meta refresh tags inside noscripts with HTML5 to just send visitors to your site <meta http-equiv="refresh" content = "0 ; url =https://{{request.host}}{{request.path}}"/>

The same goes for if they are replicating the javascript as is, just put in logic to check the location and redirect , you'd want to use some other logic so the copycat's don't see the counterattack if they just test the site. If they are using shopify try and make it so when a product is getting added to a cart it it redirects and sets it to your businesses cart.

 

Seems to me that it would be in Shopify's best interest to prevent others from illegally accessing their code and well as ours. 

It's in shopifys interest that merchants store are open and accessible to customers on the internet.

By what measure would you think something is "illegally accessing"?  If your website is on the internet and public it's accessible this is very binary concept and pretty much every "solution" to try and counter that basic concept has drastic consequences on every single regular visitor(read will lose you revenue).

Would you rather potential customers can't find and access your site at all?

 

If a merchants want protected content then they need to content gate the entirety of a website such as by requiring customer accounts in advance, or using an app like locksmith.

Even then bad actors will still copycat sites.

If your a digital content business, such as writing unique articles,  for selling content to customers then seek out plagarism or DMCA services.

If your not in content creation and just sell physical products then focus on creating value to make content copycats irrelevant so it doesn't even matter if a product description or collection is copied.

As you mentioned users can be blocked by IP addresses

IP addresses change and false positives cost revenue and punish regular customers and merchants.

Shopify has abuse mechanisms in place for spam, DDOS,etc but there is very little to be done against a small site being web scraped.

 In short, the hacker will have the weigh the effort of hacking to gain

There is no "hacking" they literally just run a tool to get pages and assets ,as easy as you open a browser tab visiting any website and viewing the source(ctrl+U)

On the internet you can either have perfect security with no access , or allow access with imperfect security.

 

I wonder what happens to a ShopifyPlus customer who is paying at least 2000/mon for the privilege and their site is scraped

Healthy enterprise businesses just send it to their lawyers to handle the copyright infringement and move on to focus on more important matters of value.

All the flawed prevention in the world will not stop Copycats and especially wont stop those seeking to replicate success.

So what if they ctrl+c&ctrl+v ,or have a bot do it?  Is the business so surface thin that a highschooler with an afternoon can replicate the business model and infrastructure itself?

Do they have the vendor relationships? Customer support infrastructure? Volume inventory? Shipping Logistics? Unique marketing materials(email,video,instagram,etc)? Aggressive pricing? etc etc etc

 

Everytime I've seen these types of conversations they are always just distractions that focus on imitators instead of focusing on building out actual value in the business.

Either send to your lawyer handle it, hire a DMCA service, or Ignore them and create actual value that cannot be gotten with every person on the planet with ctrl+c.

Contact paull.newton+shopifyforum@gmail.com for the solutions you need


Save time & money ,Ask Questions The Smart Way


Problem Solved? ✔Accept and Like solutions to help future merchants

Answers powered by coffee Thank Paul with a Coffee for more answers or donate to eff.org


HMTRAD
Tourist
3 0 3

Chiming in to say that our site has been scraped twice this year - two different .shop domains. The first one we were successfully able to file a takedown request and it came down after a couple days. The one that just happened, we're having trouble determining the domain provider, but appears to be associated with Cloudflare so we've put in a report with them. The fake sites are poorly done and any intelligent person should be able to figure out it's not our actual store - but what a pain. Shopify's chat bot just pointed me to their own DCMA takedown request form, which isn't relevant in this case since the fake site isn't a Shopify one. 

Tina_Bologna
Visitor
2 0 0

We are in the same situation.  It is a .shop domain and is also associated with Cloudflare.  However the domain is hosted by a group called Cloudwall.bg. Cloudflare is just a pass through.  How long did it take for the site to be removed?

HMTRAD
Tourist
3 0 3

We were eventually able to track down the domain provider (Cloudflare said they couldn't do anything) and after we filed a takedown request with them, it took about 2 weeks for the site to come down. I followed up a couple of times by email as they kept giving us ETA's that would pass. Hopefully you can get through to Cloudwall!

Mitch7
Visitor
1 0 0

Hi Tina,

 

I had the same thing happen to me. I filed a complaint with cloudflare and they referred me to cloudwall.bg. Did you have any luck getting it taken down? If so, how did you do it? I have a feeling this cloudwall company looks like a scam as well.

Chrisjigsaw
Shopify Partner
50 1 46

This has actually happened to me TWICE this year (first in January and then again today), both with a similar .shop domain and hosted on Cloudwall (going through Cloudflare). At least it was caught quicker this time...

 

Chris

shop owner / web developer / Shopify supporter (and critic) since 2015

Madison09
Excursionist
22 0 5

Hi!

We heard you! We understand how much hard work, money, and time is allotted in growing a brand to convert into sales. While you are investing in building your page's image, other brands take advantage of your original content.

That is why we created the UNIQUE APP. It is a powerful app that used high-tech AI that protects your private content. We have outlined why you must have UNIQUE:

- It detects personal content copyright violations all over the internet.
- Creates full report related to the detection of the violation including the violator's information
- Performs automatic DCMA report to the platforms used and removes the stolen content
- Sends automated email warnings and requests to remove these contents

We have a lot to offer that will save you time and money. With us, you can just focus on growing your business!

Check our reviews: https://apps.shopify.com/unique-anti-theft#reviews

Driven_Products
New Member
7 0 0

Hi Madison09-

Thanks for chiming in to promote your app. Unfortunately, looking at your app details, your solution does not the solve the issue brought about by this post. We need a proactive solution to prevent content scraping and this solution is reactive. There are already many FREE solutions that do what your app does and more.

Good luck and have a great day.

Madison09
Excursionist
22 0 5

Hello!

This really sounds stressful! Been through this a lot and I have invested money but ended up other stores are benefitting from it. I came across this UNIQUE app, and it is very cool. It detects other stores that use my brand's images and contents... It automatically sends a notification to me through email and it automatically deletes those photos.

Try it. they have a free trial.

https://apps.shopify.com/unique-anti-theft#reviews

Hope this helps.

apps-developer
Shopify Partner
50 0 3

try using the free shopify app Kedra Shield app. it has country blocking, IP blocking, and vpn/proxy/bot blocking features, and it even shows the blocked ips. you can find it on the shopify app store here: https://apps.shopify.com/kedra-shield-website-security 

apps-developer
Shopify Partner
50 0 3

try one of those anti bot shopify apps. there are plenty that have bot block or vpn block so it would filter our bots. for example: https://apps.shopify.com/kedra-shield-website-security   it also has country blocker and ip blocker features. and other security measures