HACKER Q&A
📣 francescochi

How can a website copy mine in real time?


Hey everyone,

I am literally going insane since yesterday night as my website is being cloned in real time and I cannot explain how that is possible.

I use NextJS and host it on Vercel.

As soon as I deploy a change it gets copied instantly, even the API routes.

I just added a check to see if the referrer is allowed and, since they copy everything, their requests return a 401.

Mine is a .com and theirs is a .xyz

Does anyone have any idea?

Thank you


  👤 ActorNightly Accepted Answer ✓
Just add obfuscated java script code that checks the host and errors out if its not your domain. Can still be bypassed, just will take some reverse engineering.

Ive added JSFuck code for this specifically on a few occasions


👤 petercooper
Might they just be reverse proxying it? Make a request for an unusual URL and see if it appears in your logs.

👤 RecycledEle
My guess is that your web hosting provider sold you out.

DirectNIC did it to me.

You can test this by adding a file like inxed.htm (note the deliberate misspelling) in your web root folder without any links to it anywhere and seeing if you can hit it in their web server.


👤 curtisblaine
Insert some heavily obfuscated javascript code that checks the domain at runtime and, if it's the wrong one, redirects to distasteful images. If the site is in China, redirecting to prohibited content is another fun thing to do.

👤 sim7c00
not sure about nextjs / vercel, but don't you have access logs for your webserver which you can check to see who's doing the cloning? Perhaps you can find some user-agent or certain ip-range or something is responsible, and block that.

there are tons of automated systems copying everything everywhere unfortunately. a lot are fairly ok to block.

There's also services you can hire or hosting providers who do some filtering for you, but those are generally more expensive than basic ones. (added security tooling around their platform)


👤 beardyw
Check the domain and if it's not yours redirect it. If they copy that you are done.

👤 maremmano
Realtime? DNS?

👤 cranberryturkey
its easy. is your site accessible on the internet? it can be copied in realtime.