Tech help: Spam/Mirror site of Smart Football

I need a little help from my tech-savvy readers: Someone (apparently in Russia, no joke) has created a spam/mirror site of Smart Football by adding “.net” to my hostname and copying over the site. Right now it is more of an annoyance than a problem, though I am getting streams of hits through via domain from various IP addresses around the country (at least a few per second, though the traffic is not overwhelming). Yahoo is the DNS provider and I have reported the site, and I have made complaints to Google as well. The actual web host seems impenetrable, so I’ve had little success reporting anything.

My concern is that the site would convert itself at some point to some kind of attack site or one that fishes for information. If you have any advice or ideas please leave them in the comments. You may also email me at chris [at] smartfootball.com but I’ve prefer to keep the discussion here, if possible. Any help is appreciated.

  • Anonymous

    You can send it to the FBI (
    http://www.ic3.gov/default.aspx ), but they seem to focus more on child porn and merchandise fraud than this kind of thing.  They also probably can’t do much since the site is hosted in Russia. 

    You could also get a lawyer to send a C&D letter, but the odds of that actually being respected are approximately 0%, so that would probably be a waste of money.

  • anon

    Domain Name………. smartfootball.net
      Creation Date…….. 2012-01-07
      Registration Date…. 2012-01-07
      Expiry Date………. 2013-01-07
      Organisation Name…. Anil Jayanna
      Organisation Address. PO Box 61359
      Organisation Address.
      Organisation Address. Sunnyvale
      Organisation Address. 94088
      Organisation Address. CA
      Organisation Address. US

    Admin Name……….. Admin PrivateRegContact
      Admin Address…….. PO Box 61359
      Admin Address…….. registered post accepted only
      Admin Address…….. Sunnyvale
      Admin Address…….. 94088
      Admin Address…….. CA
      Admin Address…….. US
      Admin Email………. contact@myprivateregistration.com
      Admin Phone………. +1.5105952002
      Admin Fax…………

    Tech Name………… TECH PrivateRegContact
      Tech Address……… PO Box 61359
      Tech Address……… registered post accepted only
      Tech Address……… Sunnyvale
      Tech Address……… 94088
      Tech Address……… CA
      Tech Address……… US
      Tech Email……….. contact@myprivateregistration.com
      Tech Phone……….. +1.5105952002
      Tech Fax………….
      Name Server………. yns1.yahoo.com
      Name Server………. yns2.yahoo.com

  • hampuspersson

    Chris, it seems like the .net-site has just copied your front page source code, image links and all. A first step could be to stop them from loading images from your server, ie hotlinking. It won’t solve the problem, but it will force the perpetrators to download and relink all images to make the site look like the original.

    Google “prevent hotlinking” or similar and you’ll get plenty of good hits, I think that there is even a WP-plugin that does all the dirty work for you. Be aware that it might stop people from displaying images in your posts in their RSS-feeds though.

  • anon

    This might help with the hotlinking: http://www.sitepoint.com/forums/showthread.php?139836-Block-specific-sites-hotlinking-in-.htaccess&s=6f56792d60b87efadca6acc324459d72&p=1014910&viewfull=1#post1014910

  • guest

    This page has a number of great htaccess tricks including preventing hotlinking of images.

    In his solution he also forces a new image to be sent instead.  For instance a png that says “This content stolen from smartfootball.com”

    http://corz.org/serv/tricks/htaccess2.php 

    If this content is causing your site problems with google page rank you can file a complaint.  However, they can only handle search etc., not removing the offender.  
    http://support.google.com/bin/static.py?hl=en&ts=1114905&page=ts.cs

  • Pingback: Tech help: Spam/Mirror site of Smart Football | Smart Football | Tech Unleashed

  • Jon

    You need to file a DMCA complaint with Google (and Yahoo & Bing while you are at it) and have them remove the site from search results.   They’re reasonably fast with removing these types of sites.

    http://www.labnol.org/internet/google-dmca/19256/ 

  • Anonymous

    I’ve filed the DMCA complaint. I also fiddled with .htaccess and blocked incoming links along with the external use of images (if it’s an issue with RSS feeds I’ll figure that out). The images on the mirror site appear to be saved locally, so not much I can do there. The whole thing is irritating and exhausting but I’ve beefed up some other security measures with all of this as well. 

  • guest

    You might have done this already, but figure out the ip address of the computer used to scrape the content from your site (not the .net ip address of the clone site). It should be listed all over your server access logs.  Then block access from this ip address too make it more difficult to scrape any of your new content.

  • Jd

    ^this guy scares me.

  • Icambron

    It does seem to break images in RSS feeds. I see broken images on all your old posts in Google Reader.

  • http://stereochro.me/ Keith Gaughan

    I work for a registrar, so I might be able to help. The correct action to take such circumstances is to initiate a UDRP action against them. In your case, smartfootball.net is an abusive registration. Here are the details: http://www.icann.org/en/udrp/udrp.htm

  • http://twitter.com/robweir Rob Weir

    Pretty easy to do this for any URL. Just use a whois tool. One’s built into most operating systems, or they’re available online. For example: 

    http://www.networksolutions.com/whois/index.jsp

  • Russian Mob

    It’s not “apparently in Russia”, it’s registered to

    Domain Name………. smartfootball.net
    Creation Date…….. 2012-01-07
    Registration Date…. 2012-01-07
    Expiry Date………. 2013-01-07
    Organisation Name…. Anil Jayanna
    Organisation Address. PO Box 61359
    Organisation Address.
    Organisation Address. Sunnyvale
    Organisation Address. 94088
    Organisation Address. CA
    Organisation Address. US

    CA, US, again.

  • Samizdat

    it is indeed hosted on an IP in Russia.

    I notice that yahoo provides the DNS; you can probably file a complaint with them and at least get the DNS yanked, if not find out who the registrar is and try to get control of it as an abusive domain.

    ;; AUTHORITY SECTION:
    smartfootball.net.      86272   IN      NS      yns2.yahoo.com.
    smartfootball.net.      86272   IN      NS      yns1.yahoo.com.
    smartfootball.net.      86272   IN      NS      ns8.san.yahoo.com.
    smartfootball.net.      86272   IN      NS      ns9.san.yahoo.com.

    smartfootball.net.      533     IN      A       193.39.78.26

    inetnum:         193.39.78.0 – 193.39.78.255
    netname:         RuLanService
    descr:           PE Spiridonova Vera Anatolyevna
    country:         RU
    org:             ORG-PSVA2-RIPE
    admin-c:         VK2109-RIPE
    tech-c:          CR5012-RIPE
    status:          ASSIGNED PI
    mnt-by:          RIPE-NCC-END-MNT
    mnt-lower:       RIPE-NCC-END-MNT
    mnt-by:          COMCORNET-MNT
    mnt-routes:      MERCUR-MNT
    mnt-domains:     COMCORNET-MNT
    source:          RIPE # Filtered

    organisation:    ORG-PSVA2-RIPE
    org-name:        PE Spiridonova Vera Anatolyevna
    org-type:        other
    address:         RU, Chuvashskaya respublika, Shumerlya city
    mnt-ref:         COMCORNET-MNT
    mnt-by:          COMCORNET-MNT
    source:          RIPE # Filtered

    role:            COMCORNET REGIONS
    address:         Russia, Moscow, Mira, 126
    remarks:         ———————————————————-
    remarks:         Points of contact for COMCORNET REGIONS Network Operations
    remarks:         SPAM and Network security issues: noc@comcor-net.ru
    remarks:         Customer support: noc@comcor-net.ru
    remarks:         ———————————————————-
    abuse-mailbox:   noc@comcor-net.ru
    admin-c:         VK2109-RIPE
    tech-c:          VK2109-RIPE
    nic-hdl:         CR5012-RIPE
    mnt-by:          COMCORNET-MNT
    source:          RIPE # Filtered

    person:         Vasiliy Kambalov
    address:        Russia, Moscow, Mira str., 7
    mnt-by:         COMCORNET-MNT
    phone:          +7 495 6502020
    nic-hdl:        VK2109-RIPE
    source:         RIPE # Filtered

    % Information related to ‘193.39.78.0/24AS48172′

    route:           193.39.78.0/24
    descr:           PE Spiridonova Vera Anatolyevna
    origin:          AS48172
    mnt-by:          MERCUR-MNT
    source:          RIPE # Filtered

  • anon

    Yep, nothing scarier than one command line and a quick copy-paste

  • http://twitter.com/eatmorefrogs diesel

    Seems to be resolved

  • http://www.coloradoprepfootball.com Michael

    It seems you went and registered all the other TLDs which was smart. But for anyone else that may have this problem and stumble here, registering all the other TLDs (.org, .net, .me and so on) may be expensive, but it will prevent this kind of hassle. They can’t clone if they don’t own.