3

We have a problem. We've noticed a large amount of traffic showing up on our Google Analytics. Upon further investigation we have found that we've had our content copied under a different URL.

Our site: http://www.targetis.co.uk The coppied site: http://www.target-is.com (isn't showing up with Chrome for us)

We don't own this domain. Their content is hosted with them (not via proxy). The large part of the traffic is coming from video hosting site.

What do we do?

2
  • When you put the address in as a search you find out that this is only one of many scams and websites committing scams. Its a Scam farm!
    – user12565
    Jan 10, 2012 at 20:49
  • Notify Google of the phishing site, as well as their hosting provider. File a DMCA if you can
    – Anagio
    Jun 26, 2012 at 20:51

3 Answers 3

5

Punch target-is.com into a whois search and see who controls it:

Connected to whois.enom.com
This domain has already been registered.
Displaying domain information provided by  ENOM, INC.

=-=-=-=
 Visit AboutUs.org for more information about target-is.com
 AboutUs: target-is.com

 Registration Service Provided By: Namecheap.com
 Contact: [email protected]
 Visit: http://namecheap.com

 Domain name: target-is.com

 Registrant Contact:
    WhoisGuard
    WhoisGuard Protected ()

    Fax: 
    11400 W. Olympic Blvd. Suite 200
    Los Angeles, CA 90064
    US

 Administrative Contact:
    WhoisGuard
    WhoisGuard Protected ([email protected])
    +1.6613102107
    Fax: +1.6613102107
    11400 W. Olympic Blvd. Suite 200
    Los Angeles, CA 90064
    US

 Technical Contact:
    WhoisGuard
    WhoisGuard Protected ([email protected])
    +1.6613102107
    Fax: +1.6613102107
    11400 W. Olympic Blvd. Suite 200
    Los Angeles, CA 90064
    US

 Status: Locked

 Name Servers:
    dns1.registrar-servers.com
    dns2.registrar-servers.com
    dns3.registrar-servers.com
    dns4.registrar-servers.com
    dns5.registrar-servers.com

 Creation date: 09 Aug 2011 21:51:00
 Expiration date: 09 Aug 2012 13:51:00



 Get Noticed on the Internet!  Increase visibility for this domain name by listing it at www.whoisbusinesslistings.com
 =-=-=-=
 The data in this whois database is provided to you for information
 purposes only, that is, to assist you in obtaining information about or
 related to a domain name registration record. We make this information
 available "as is," and do not guarantee its accuracy. By submitting a
 whois query, you agree that you will use this data only for lawful
 purposes and that, under no circumstances will you use this data to: (1)
 enable high volume, automated, electronic processes that stress or load
 this whois database system providing you this information; or (2) allow,
 enable, or otherwise support the transmission of mass unsolicited,
 commercial advertising or solicitations via direct mail, electronic
 mail, or by telephone. The compilation, repackaging, dissemination or
 other use of this data is expressly prohibited without prior written
 consent from us.  

 We reserve the right to modify these terms at any time. By submitting 
 this query, you agree to abide by these terms.
 Version 6.3 4/3/2002

Then contact them and/or their registrar and ask what's going on.

1
  • Thank you. We are already talking to namecheap to try and get the domain suspended. I'd love to know what they're trying to gain out of this though.
    – Shaun
    Aug 11, 2011 at 8:54
4

It looks to me like they're trying to steal your customers' login details - login attempts on the fake site are redirecting to the real site's login page.

I suggest that you should change your own login page to warn of the risk, and then see what the other party does...

BTW, you may also have some success complaining to ENOM (the registrar) rather than their reseller.

5
  • Thank you. The /login page redirects back to us. Aside from that there is only us using the backend of this site currently. At best they would get into our CMS :-S
    – Shaun
    Aug 11, 2011 at 11:00
  • 1
    @Shaun and if some of your users have used the same email address and password on some other sites?
    – Alnitak
    Aug 11, 2011 at 11:08
  • There is only three of us that use the backend of the site all of which are internal. We are strict about our password policies so that isn't a concern right now. The more pressing question is why and why us!
    – Shaun
    Aug 11, 2011 at 11:22
  • @Shaun if those login boxes are only for your CMS, don't put them on every page - indeed don't put them on any linked page.
    – Alnitak
    Aug 11, 2011 at 11:36
  • The site is quite new. It is going to be much more than that in the coming weeks but currently it is just for our CMS.
    – Shaun
    Aug 11, 2011 at 11:37
0

If you live in the USA, you can use online legal services (ie: http://www.legalzoom.com/legalforms/domain-name-cease-and-desist-letter.html) to have a "cease and desist letter" signed by a lawyer and send it to the domain registrar (NameCheap) and the phishing website email address. If you live outside the USA, you might be able to find an online legal service for your country or you would probably have to go to your local lawyers office. This way is probably the best because it tells the NameCheap that if they don't shutdown this website then they will have legal action put against them (which could cause them to be totally shutdown and have even more lawsuits).

Not the answer you're looking for? Browse other questions tagged or ask your own question.