how can this happen?

[Weedy Lady]

I use a card sending service that gives me excellent stats. It lists every single card page by name and how many people it was sent to. Now, here is the problem:
Lately I've been finding web sites on my stats that are not mine. In other words, the form number that is mine is being used, but the people are being sent to another web site when they click on the link in the e mail message they receive.

Yes, I wrote to the service about it but never got an answer.

this month there was a whole series of these listings, all from various sub pages of www.svmatch.com/ When I looked that up in whois it gave the name of some guy in Moscow but no IP. I was going to ban that IP, but can't.

Question is: Could it be possible that these sites are copying my code completely and putting it on their site, and then when people send what looks like my card, the person who received the notification e mail is taken to their site instead? I just changed the graphics locations on all my pages (I do that regularly because hotlinking proteftion will NOT work on my site)and reloaded the entire site. But I do not want these sleeseballs to be able to do that.

Anyone have anything that will help me with this problem????

I know it is not something that most of you ever face, so you may not understand what I'm talking about. But this is getting very irritating. Not to mention that the site doing this may well be a porn site or a malicious one, and I certainly don't want to look like I'm connected to something like that!

[Faglork]

this month there was a whole series of these listings, all from various sub pages of www.svmatch.com/

Can you give us one of those subpages? Or the corresponding line of your stats?

When I looked that up in whois it gave the name of some guy in Moscow but no IP.

http://www.dnsstuff.com/

--> 64.111.196.206

I was going to ban that IP, but can't.

Why can't you? Can you explain that a bit?

Could it be possible that these sites are copying my code completely and putting it on their site, and then when people send what looks like my card, the person who received the notification e mail is taken to their site instead?

Looks like that - but your card sending program should have an option to block IPs. If not, get a programmer to add this, it is not very complicated. Although it won't help with spoofed IPs, it fends off most attacks.

hth,
Alex

[Weedy Lady]

Thanks for getting the IP for me. It is located in the US, whereas the scumbag that is highjacking my form number is in Moscow.

Also, when I enter the IP for reverse DNS lookup there is no reverse DNS for that IP.

Now that I have the IP I can ban it from my site completely, but the card sending service does not provide this capability. I can't get a programmer to add it because I don't own the service. I use the service because it pays me money. If I had my own referral service I would not make any money from it, and the only way I have of making income is from the card sending service and the Google ads.

You asked for the full subpages of their site. Here are some:
www.svmatch.com/allusers/6/
www.svmatch.com/lastusers/3/
www.svmatch.com/profileusers/12/
www.svmatch.com/onlineusers/11/

If you visit these addresses you get only a text page with one or two lines on it. This is what is so confusing to me.

I'm not sure that changing the location of the graphics will work, because if these people are really persistent they can just revisit my pages and get the new location from my code without too much problem. Usually when I change graphics locations people out there get the message and hotlink to someone else after a while.

And here is another one, and this is definitely a porn site: www.allinfonow.com/3113/

This is really upsetting to me.

[nottheusual1]

OK - svmatch.com is hooked up with an Estonian hosting company (who can't be easily contacted), who gets their space from:


OrgName: ISPrime, Inc.
OrgID: IPRM
Address: 25 Broadway
Address: 6th Floor, Suite #2
City: New York
StateProv: NY
PostalCode: 10004-1086
Country: US

an american company, who is very reachable:

http://www.isprime.com

Contact them and "discuss" that you are getting a lawyer and using the DMCA (Digital Millenium Copyright Act) to "pursue any monetary damages" you may be entitled to, reminding them that the penalties are for each infraction, and you have logs to show 1000's of them.

Demand that they force the Estonian hosting company to make their customer cease and desist or that you will have no option but to seek redress from the American hosting company (them) who is facilitating the DMCA infractions. Give them a time period to comply (like 7 business days) and see if they act.

If they don't, then it is lawyer time. They should respond, though, as the DMCA is pretty ugly (all the plaintiff has to prove is intent) and few hosts will get tied up in court with a high chance of being fined for months of transgressions for some schmuck overseas.

May or may not work - DMCA is usually focused on theft of content - you'll just have to bolster your side, showing how the lifted code is "essential to your business".

[Weedy Lady]

Thank you so much for the detailed advice. I will watch very closely and if there is one more incident on my stats I will most certainly follow all your suggestions!

If changing the graphics locations solved the problem then I think it will be OK. I have to do this regularly to combat all the people who hotlink to my images from bulletin board and forum postings anyway, so it is a way of life for me.

It is the highjacking of the forms that really got to me!

I wish I could use hotlinking protection, but I have tried it 3 different times and it absolutely will not work for my web site for a lot of reasons -- none of which has to do with my hosting company.

Thanks again for your help!