7 ms·
Ask HN: How to deal with someone ripping off your design?
We recently noticed that two websites have recently ripped off the design, code and copy of our site, gocardless.com.
How did we notice? We started getting Sentry errors as they had even gone so far as to rip our JS files!
Before we get in touch with them, we wondered if anyone had any tips on getting these guys to stop.
Sites in question:
http://secure-broker-online.eu/
http://resinternationalgroup.com/
- Tzunamitom 14y agoSend them a cease and desist letter - you can find free templates online (http://www.free-legal-document.com/copyright-cease-and-desist.html http://www.free-legal-document.com/copyright-cease-and-desis... is one I just found). The more professional you can make it look the better chance you won't have to resort to a solicitor.
- AdamTReineke 14y agoIf/when that doesn't get a response (if they stole a design, who says they'll honor a C&D?), contact their web host.
- kanamekun 14y agoYou don't have to necessarily resort to a solicitor/lawyer in this scenario. If they are using your exact HTML/CSS/JavaScript and don't quickly respond and/or comply, you can always file a DMCA takedown notice: http://www.smashingmagazine.com/2009/12/18/my-website-design-was-stolen-now-what/ http://www.smashingmagazine.com/2009/12/18/my-website-design... Most hosts will quickly take down the website, giving you a cost-effective way to stop the issue. However I'd strongly encourage you to pursue a more friendly approach first, to give them a chance to do the right thing. (The site owner may not be the one who actually stole the design.)
- wheaties 14y agoI'll add that if they're a legitimate site they'll be mortified but if they're an illegitimate site, they'll quickly move to open up shop somewhere else. That said, if they're costing you money because of your sentry issues or causing you support issues that you can document, you have just cause for a lot of actions.
- Peroni 14y agoSecure Broker Online: 1-8 Kensington Gardens Square , London, W2 4BH Knock on their door and ask them directly.
- testing12341234 14y agoAdd a check to the javascript files for those domains, then have it execute a while(1);. This is semantically the same what Google does with their JSON responses [1] [1] - http://stackoverflow.com/questions/2669690/why-does-google-prepend-while1-to-their-json-responses http://stackoverflow.com/questions/2669690/why-does-google-p...
- csomar 14y agoNope, it's not the same. Google doesn't check for the domain; Google does this to prevent cross site scripting. (Accessing the JSON as a JavaScript file). The OP doesn't have a JSON, he has a JavaScript file.
- amarco 14y agohttp://resinternationalgroup.com/ http://resinternationalgroup.com/ - Looks to have a live operator that you can talk to and ask questions as well?
- ratherbefuddled 14y agoThere is something fishy here. The Secure Broker Online company is not registered with Companies House in the UK. The Kensington Gardens Square street address is that of a hotel and the CA address looks fake too from StreetView. I would guess somebody's nicked your design to create a fake portfolio for a CV, or it's being used for fraud.
- stuartmemo 14y agoI'd stop worrying about it and concentrated your energies elsewhere. By thinking about stuff like this you're focussing less on your own product, which is the important thing. If people are copying you, then you're most likely ahead of the competition anyway.
- dabeeeenster 14y agoGiven that they just did a big upgrade that has broken their API I would agree, and we're one of their biggest fans and customers!
- hellweaver666 14y agoYou can prevent hotlinking of your JS and CSS files using your server config (for instance, in .htaccess on Apache). That will make it harder but it won't stop them copying the files locally. Lots of tutorials to prevent this are a quick Google away. You could even serve up an alternate CSS file for offenders that warns them from hotlinking your resources by prepending something to the body tag that is styled like a massive warning box and hiding everything else.
- glimmung 14y agoI notice they're using eBay, AutoTrader and Gumtree logos. Don't know about the other two, but have known AutoTrader come down like a ton of bricks on muppets who abuse their brand - dob 'em in! (Although if they are as shady as they look, there may not be an entity to come down like a ton of bricks on - this looks like fraud to me)
- glimmung 14y agoMore brand abuse here: http://secure-broker-online.eu/company http://secure-broker-online.eu/company The FSA, RBS and Wells Fargo might want to be aware of this, too.
- culshaw 14y agoCEO of Auto Trader might have something to say too http://secure-broker-online.eu/escrow-process http://secure-broker-online.eu/escrow-process
- jentulman 14y agoI wonder if Ebay, Autotrader and Gumtree might also be interested in throwing some weight behind this given how prominently their brands are featured on the landing page.
- timdorr 14y agoIt's actually quite easy: Find their host and, if they're in the US, issue a DMCA notification: $ dig resinternationalgroup.com ;; ANSWER SECTION: resinternationalgroup.com. 18788 IN A 66.206.15.100 $ dig -x 66.206.15.100 ;; ANSWER SECTION: 100.15.206.66.in-addr.arpa. 3600 IN PTR cpanel.siteplot.com. Send the email over to support@siteplot.com. If that doesn't work, go up to their datacenter: $ whois 66.206.15.100 ... OrgAbuseHandle: NETWO5887-ARIN OrgAbuseName: Network Admin OrgAbusePhone: +1-509-209-8000 OrgAbuseEmail: network@cyber-world.com OrgAbuseRef: http://whois.arin.net/rest/poc/NETWO5887-ARIN ... Email it over to network@cyber-world.com or support@cyber-world.com. Here's a good template from Scribd: http://support.scribd.com/entries/22980-DMCA-copyright-infringement-takedown-notification-template http://support.scribd.com/entries/22980-DMCA-copyright-infri...
- escaped_hn 14y agoThat would be an abuse of the DMCA since its just a design (see Flat-Ui).
- rorrr 14y agoWhy? They are stealing OP's copyrighted works and posting them on their website.
- okamiueru 14y agoNot sure if you read the description provided. They ripped the source code as well, not just the design. That goes under copyright, as would copying someones graphic assets. If it were using similar graphics or design, then yes, it isn't a copyright issue.
- DanBC 14y agoNo. This is directly using (even hotlinking some assets) the OPs copyrighted materials. FlatUI had 3 icons that were "similar"[1] to icons in LayerVault. There wasn't any clear copying of assets. [1] for some values of similar, including "not similar".
- 14y ago
- lucb1e 14y agoThe other comments already indicate it's a fake, so I wouldn't worry about it too much. I myself would have some fun with the Javascript files that they're hotlinking; have it break the website or do something funny (cornify). They have no reason to complain. And I'd ask them if they could stop copying my website (perhaps propose a reasonable time, like a month, but do nothing afterwards). Then I'd let it be.
- charliepark 14y agoJust add this to your JavaScript onload (and replace "yourdomain", of course): if(window.location.origin.indexOf("yourdomain.com")<0){ window.location.href = "http://yourdomain.com"; };
- Mahn 14y ago...unless they copied the JS files instead of linking to them directly, of course. Note to self: add remote self-destruct function within any JS I ship.
- benmanns 14y agoSecond note: Make it time delayed (set statically to something like 2 weeks from compile time). Then, when they use the script in development it works, but in 1-2 weeks it breaks in their production site. Otherwise, they will just find out why it isn't working and remove the self-destruct function.
- kls 14y agoThe question would be if they just grabbed a static snapshot of the site and are using that or if they are actually still pointing back to some of the stolen sites files. If they are pointing back to the stolen sites JavaScript files then yes it would be very easy to redirect the traffic back to their site. Given that the code resides on their server they are completely within their rights to do so as well. I would also minify the JavaScript file as well, so the change is not immediately apparent to them. Make them work to figure out why the code they have stolen is not working.
- jacobr 14y agoYou just linked to a domain registrar, please use example.com in examples.
- Mahn 14y agoI'm having a hard time trying to picture people on HN reading the comment and thinking "cool! yourdomain.com! I wonder what's in there!"
- markdown 14y agoOT, but I'd like to suggest an improvement in your FAQ: > Who is GoCardless for? > Anyone can use GoCardless... As far as I can tell from the rest of the website, you are a UK startup, and your service is useless to Taifusi in Samoa or Raj in Bangladesh.
- kmfrk 14y agohttp://www.plagiarismtoday.com/ http://www.plagiarismtoday.com/ has all the information you need in notifying affiliates and filing a DMCA.
- deleted 14y ago[deleted]
- huhtenberg 14y agoI'm going to bet that this is a setup for the phishing scam. Random addresses and phone numbers, fake endorsements, blatant design rip-off - it all points rather unambiguously at a quick-and-dirty attempt at creating a believable online presence. It could've been just a designer's "sketch" or a proof of concept for a client if it weren't for two clones. This indicates that this is a redundant setup, with possibly more clones floating around, but with the JS files fixed. Your best bet would be to contact the hosting providers and say just that. If this is indeed a part of the scam operation, you should also prepare yourselves for a website redesign, because if the scam gets on its way, then your visuals may end up being associated with the scammy websites rather than with your genuine business.
- seferphier 14y agophishing scam websites spend a lot of effort to fake their website.. amazed.
- pc86 14y agoThe secure broker website has already been flagged by my work firewall as a phishing site.
- cwisecarver 14y agoUse the "is this my domain" javascript trick and then remove all elements from the DOM. Better yet, location.href them somewhere else.
- sageikosa 14y agoThe classic counter-punch to resource linking is to make some of the resource grabs dynamic based on the referrer. I remember one site host who realized someone was using his images for avatars on various forums, and changed the contents to p0rn.
- bradleyland 14y agoYou've got to be really careful when doing something like this. Basing the decision to display porn to users based on the value of the referrer (or any technical factor for that matter) is asking for trouble. Valid visitors' browsers should send your site as the referrer, but what if your check fails and a legitimate users is shown porn instead? What if you introduce a bug that causes many, or all, of your users to see porn instead of the intended content? Serving porn from a business oriented domain is never an option, IMO. It sucks when someone rips off your content, but you have to carefully evaluate the real impact it has on your business, not just the emotional impact that it has on your sense of ownership.
- sageikosa 14y agoI agree, doesn't have to be p0rn; just the example I remember.
- Cthulhu_ 14y agoThe less offensive form of this kind of hotlinking prevention is to provide a small-sized image with the URL of the website it was taken from, or a hotlinking notification, not pr0n unless you want to offend unsuspecting visitors. The person that hotlinks an image for usage as a forum avatar won't even realize it most of the times because his browser cache kicks in.
- sageikosa 14y agoIIRC, other users on the forum started complaining that the offending user was using pr0n, he (or the forum owner) then complained to the person from whom content was being leeched who promptly told them to suck it.
- the1 14y agosubmit a DMCA takedown notice. and blog about how mean people are when they complain about it.
- petenixey 14y agoI'm guessing that the traffic from this will alert them pretty soon so either way you'll want to take action quickly Hiroki. Might be fun to hellban them, alter your JS to show visitors nothing when they visit their sites. Won't last for long but if you only do that for visitors with fewer than 3 visits then it'll take them a little while to figure it out.
- solistice 14y agoI'm not sure about the legality of this option, nor the alternative I'd suggest. Instead of hellbanning their site, try redirecting their traffic to your own site.
- dquigley 14y agoWell they do have a live chat on those two pages. Might as well make use of it! Or you could contact their live chat provider and mention the copying. They might care.
- andyhmltn 14y agoI would take comfort in knowing that the sign up form at http://resinternationalgroup.com/ http://resinternationalgroup.com/ is impossible to finish :-)
- xhedley 14y agoThe business problem isn't the ripoff, it's the fraud in your business space of easy online direct debit set ups. If lots of fraudsters set up in this area with convincing sites, your customers' customers will worry about providing their bank details. Suggest talking to your sponsoring direct debit bank about shutting the fraudulent sites down. Or you could report to actionfraud.police.uk but I suspect your bank has better connections.
- apeace 14y agoIt's simple. Make money off your idea before they do. Good luck!
- csomar 14y agoHere is my suggestion: 1. Send a DMCA notice [https://news.ycombinator.com/item?id=5367936 https://news.ycombinator.com/item?id=5367936]. 2. Blank their page with JavaScript. While it's legal to redirect the traffic to your site (it's YOUR JavaScript and there are no Terms for its use), you'll probably mislead people and make them think that you are the phishing site. Not worth it, in my opinion.
- jcutrell 14y agoI actually set up a quick Heroku deploy to help identify when people are downloading our code and running it on a different domain than ours (just sends us an email). Most of the reckless folks stealing our stuff don't identify the little bit of JavaScript I've thrown in there, and we get a lot of these alerts. It also sends us the domain the code is running on. Of course, we aren't worried as much about localhost. The JS also replaces the content on the page, and shows a "you shouldn't be doing this" kind of alert; we've had a TON of hits on this. It happens literally daily. We have yet to file for DMCA takedown - good plan for those who are legit stealing. However: I have a strong opinion on these things. Specifically, if people are stealing your stuff, see what you can do to innovate past them. Ideas will always be stolen; edge and innovation can't be stolen. Sometimes it's legit to call people out. Sometimes DMCA takedowns are needed. Sometimes, it's time to man up and beat the system. One step ahead, and all that jazz.
- ameen 14y agoAny particular reason why you've been repeatedly targeted by such individuals? Some of them could be related and if targeted might cease abusing your code.
- jcutrell 14y agoWell - it probably has to do with the fact that the site was featured on awwwards.com and a few other CSS-gallery type sites. Not 100% sure, though; the attention comes from all over the place.
- ep103 14y agoAs a side note, where are those gray icons at the bottom coming from? I needed a light bulb like that on my last project, and ended up having to slap together something on photoshop
- zeeg 14y agoFirst time I've seen this use-case for Sentry :) (I didn't actually see Sentry within the source code, was I missing something?)