Clone / Pishing my site

[gnrx]

Hello.
In the last 2 days I view that, 2 other domains/sites are indentical to my vbulletin forum.
This sites, are identical and the users can try to log in this websites and the owners can give the details accounts for login, for this, are pishing.

But if in my forum I post a new post or thread, appears automatically in this pishing websites.

I contact with my server and are search for malware, but don't have any malware (I have a VPH / dedicated server).

Thanks and sorry for my english.

[Dave]

I've seen this before, they simply proxify all requests to your server and imitate the request as a GoogleBot so it's hard to block it.

Add the following to your headinclude template and make sure to modify the second line.
For example if your domain is vbulletin.org, split it in half and change it to "vbull" + "etin.org". This must be done so it's harder for them to replace all instances of your domain with their own.

<script>
   if(window.location.hostname.indexOf("your" + "site.com") === -1){
      window.location = 'https://www.go' + 'ogle.com';
   }
</script>

What this script does is it checks if the current URL contains the domain you supplied, if not, it will redirect the user to Google.
Essentially this will work against their intentions (injecting ads on the cloned forum) since all users that visit the cloned site of your forum are redirected to Google.

[gnrx]

In the first time, thank you Dave for your explanation of the issue and how solve this.

I made the changes in my headinclude template, and now, perfect, the 2 websites that prosify all requests to my server, now, are redirect to google.

I think...if in the third line, change google for my url, redirect to my site but...I don't know if its good iddea...

Again, thank you very much.