My entire website was duplicated by someone, and I mean, duplicated. They did not just rip the content and re-publish it. The site looks as if I used my backup files and put them on a new server with a new domain.

My question is - is that possible without having the actual files? This site uses Wordpress, so their is a database that would need to be uploaded as well.

The duplication part is not really bothersome to me. I run into in from time to time. A couple DMCA notices to host providers usually squares it away, and I have an attorney on standby in case it need to go further.

My concern would be that my backup files or server have been compromised.

  • 1
    I don't mean to be rude here, but are you absolutely sure it's not a domain just showing your actual site with another name in the address bar? – TessellatingHeckler Mar 13 '14 at 22:52
  • Different logo. They stripped things like copyright notice and a few other stuff here and there. – Eric Mar 13 '14 at 23:44
  • They could be doing this stripping via a proxy or something. – neutrinus Mar 14 '14 at 9:23
  • It sounds like they crawled all the pages and got all the HTML, then posted it. From the sounds of it, it's only the html that was "hijacked". This is unfortunately all too common. – Nathan C Mar 14 '14 at 12:12

It is possible your server was compromised, no way to tell without inspecting your server. Is it possible that the copy of the site be static? One could crawl a WordPress site, download the content and put it up, without needing your database? Possibly your WordPress site has a backdoor to the database, maybe your database port is open to the internet. There are so many ways.

So the answer is yes, it is possible really. How that was done, no way to tell.

  • Wordpress core is generally pretty tight, but there are so many very poorly written plugins that open the whole thing up to SQL injection requests unfortunately. – Mark Henderson Mar 13 '14 at 22:50
  • 5
    Try site/wp-login.php. If it doesn't exist, they probably crawled it using wget (assuming you don't have a link to that page, which you shouldn't). If it does exist, it would be amusing to see if your login worked. – saltface Mar 13 '14 at 22:54
  • @saltface - site/wp-login.php returns a 404. No page on server. – Eric Mar 13 '14 at 23:44
  • +1 I would guess wget mirror as it's a one liner to clone an entire site's content if it's well linked. – jscott Mar 14 '14 at 1:10
  • Thanks for the info on this. For now, I am operating under the assumption that it was cloned. I will keep an eye on it, and re-examine my backup and storage protocols. – Eric Mar 14 '14 at 15:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.