-1

So i think someone is mirroring my site with a proxy and hides behind cloudflare (cloudflare already notified and google also) so i cant find out the real ip of the server to block it.

Is there anyway to detect if your website is opening in a other domain and block it or redirect it?

maybe some javascript hostname lookup and then redirect? or is there a better solution?

Im using Cyberpanel with Openlitespeed, Configsever Firewall, Modesecurity and as CMS Wordpress latest version and Cloudflare for DNS

Edit: Solution for people who are in the same situation

Go to the "attacker" website and add some characters at the end of the url like domain.com/?upuuukgkhlgkhlgkh and then check your access log for these characters and make sure if you are on cloudflare that you configured your server to show the real ips in the access log copy the ip from the logs double check on utrace.com that the ip is not from cloudflare or any other cdn and block it on cloudflare and/or your server

in my case they used different ips so make sure to check the other domain again and refresh it a couple times if your site still shows up do the same procedure again till all ips are blocked.

note: this doesnt prevent them from doing it on another vps again but for now i have no permanent solution for that. if i find one i will update it

19
  • Is your site being displayed in a frame/iframe? If so, you can use javascript to break out.
    – pcalkins
    Jan 7 at 21:31
  • Are you saying that there is a rogue proxy server that is mirroring your site by somehow making requests through cloudflare to your web server? If so, how do you know this?
    – mti2935
    Jan 7 at 21:34
  • unfortunetly it's not. i tried to block iframe via javascript just to make sure..wasnt working
    – Marzel
    Jan 7 at 21:35
  • @mti they did it on 2 different domains one was showing real server ip other sits behind cloudflare. i blocked the ip of the real one but its still showing my site. then i uploaded a php fiel to my server to resolve the remote ip of the server..then i visited the file on the other domain and it shows just cloudflare ips. they host images, css and js o their own domain but replaced affiliate links and other external links with their own links and even placed ads on it.
    – Marzel
    Jan 7 at 21:36
  • 1
    I'm not sure how a server that is not on cloudflare's network can make an HTTP(S) request to another server that is not on cloudflare's network, through cloudflare. That is not how cloudflare works. The more likely scenario is that someone is abusing cloudflare's service, by using it the way it is intended to be used (as a WAF) but for your site. What does a DNS lookup of the FQDN show?
    – mti2935
    Jan 7 at 21:50
1

Your question is a bit confusing

A mirror is usually a copy of the entire site, so I'm guessing you mean forwarding/proxying and not mirroring.

Forwarding

You could save the HTTP request header data for each incoming connection.

There are several fields there which could give you useful information.

  • Examine the value of the field named Forwarded.

  • The fields named X-Forwarded-... are also worth a peek.

Wikipedia article with more info:
HTTP header fields

HTTPS & Certificates

Make sure you use HTTPS instead of plain old HTTP.

Proxy servers can't forward HTTPS traffic transparently without installing a certificate on each client.

If you make sure each page redirects to itself with an absolute FQDN path the first time a NEW client connects, you will make unwanted redirection a real headache...

Checking link referrals etc. will let you inspect traffic too.

2
  • 1
    wrt 'Proxy servers can't forward HTTPS traffic transparently without installing a certificate on each client' - I think the OP is saying that the proxy sites are using a different domain than his site's domain. So, the proxy sites don't need to install OP's certificate (and private key).
    – mti2935
    Jan 8 at 13:41
  • That's why he should have pages forward the request to themselves with an absolute path including FQDN the fist time a new unique client connects.
    – svin83
    Jan 9 at 19:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.