Description

SableRaf

opened on Aug 20, 2025

Issue body actions

Which area of the website does this enhancement relate to?

Other (specify if possible)

Describe the enhancement

We’ve run into a few situations this year where scammers copy our website and put it on fake domains that impersonate other organizations. We only hear about it when trademark owners contact us with cease-and-desist emails, because the cloned sites look like processing.org and still include our contact email.

@ksen0 suggested adding a simple build check:

• Set an environment variable in GitHub secrets.
• At build time, verify it against a public key.
• If the check fails, display a small banner such as:

“This is not the official Processing website. If you ended up here by mistake or suspect misuse, you can report it below.”

I'd suggest including the following:

• A link to the Google Safe Browsing phishing report page
• A link to the WHOIS record for the domain, e.g. https://www.whois.com/whois/example.com

We can check for localhost and 127.0.0.1 to avoid showing the banner when working locally.

We could also not show our contact email on unverified builds.

Why is this enhancement important?

• Reduce confusion for trademark owners who mistakenly contact us
• Provide visitors with a quick way to report misuse
• Make cloned sites less convincing and less useful for scammers

Activity

1. SableRaf

   changed the title [-]Preventing website cloning & backlink abuse[/-] [+]Mitigating website cloning & backlink abuse[/+] on Aug 20, 2025
2. ulgens commented on Aug 19, 2026

   

   ulgens

   on Aug 19, 2026

   Contributor

   More actions

   Do we still have this issue?

   Set an environment variable in GitHub secrets.
   At build time, verify it against a public key.
   If the check fails, display a small banner such as:

   Wouldn't this be avoided if the malicious party just removes the banner or the check? Are they cloning the website by forking the git repo?
3. SableRaf commented on Aug 24, 2026

   

   SableRaf

   on Aug 24, 2026

   CollaboratorAuthor

   More actions

   Do we still have this issue?

   Occasionally (maybe once or twice a year). We typically find out when rightsholders contact us via the email listed in the footer.

   We want to make it clearer that sites deployed to other domains may be unofficial, without making legitimate forks, such as unofficial translations, harder to build or deploy. Ideally, a solution should also be easy to apply across all the websites we host.

   At the last Uptime meeting, we decided to keep the solution simpler than the build verification approach described above. Instead, we could just add canonical copy to each website stating its official/authorized URL, for example:

   “The authorized URL for our website is X. If you are seeing this website on another domain, it is not official.”

   Wouldn't this be avoided if the malicious party just removes the banner or the check? Are they cloning the website by forking the git repo?

   Yes. A mildly determined attacker could simply remove this mention if they’re modifying the source, but since this is generally a lazy attack, a lazy response may be enough. The goal isn't to make cloning impossible, just to make an untouched or minimally modified clone easier to identify.

   Reacted by kit

Issue actions