Skip to main content
Clone detectionLayers 2 and 3

Website clone and content theft detection

A copied website and copied wording leave different traces, so two layers look for them: embedded markers, an optional website marker on pages you choose, and content fingerprinting, a search of the web for your site's wording.

The report includes copies of your website. We email a secure payment link within one working day.

New threat
Example
yourcompany.com

Sign in to yourcompany

Continue
Your login page
yourcompany-login.com

Sign in to yourcompany

Continue
The copy
Alerted: copy of your site
  • Your website marker reported it as it loaded
  • Your sign-in page, on an address that is not yours
  • Screenshot and registration details saved as evidence
  • 2 independent layers: embedded markers and content fingerprinting
  • 400k+ visits to customer websites checked for copies every month
  • <100 ms for the marker to answer, so it never slows your pages down

Why there are two layers

An attacker who copies your site whole takes your code with it, including the marker, and is caught when the copy loads. One who rebuilds it by hand, or a competitor lifting your product descriptions, leaves none of your code behind but keeps your wording.

In one case, a full copy of a client's website on a free hosting platform was found through certificate logs, a search for its wording and the website marker. It was offline about 24 hours after the client confirmed it. Read the case study

Layer 2 Embedded markers

The website marker

The marker is optional: a small script or a 1×1 image on the pages you choose. If one of those pages is copied and loads on a domain you have not allowed, the marker tells us the address it loaded on. We do not have to wait for a search engine to find the copy.

Because it is triggered by a real person opening the copy, the alert can arrive with the first visitor. If your privacy team needs to know what the marker records, ask us before you add it.

How it works
  • A single line of script, or a 1×1 image if you prefer. The script is the one we recommend: the image works without JavaScript but tells us less, so its sightings go on a watch list instead of raising an alert.
  • You list the domains allowed to show your pages, exactly or by pattern
  • Previews, staging sites and content-system sandboxes are filtered out
  • Evidence is collected automatically when a copy is reported

What only the marker catches

  • A copy that has just gone live and nobody has seen yet
  • A copy behind a login, or on a page no search engine can reach
  • A fake checkout or login page built from your real one
  • A copy on a free hosting platform, up for a weekend

It only reports a copy of your own pages. A fake login page copied from someone else's, such as Microsoft's sign-in page with your logo added, carries no marker.

Layer 3 Content fingerprinting

A search for your wording

There is nothing to install. We pick out the phrases on your site that belong to you, the wording that would not appear anywhere else by chance, and search the web for them.

When your wording turns up on a domain that is not yours, we compare the two pages and send you the result with the evidence.

How it works
  • Phrases picked and scored automatically for how unusual they are
  • Partial copies found as well as full ones
  • Each phrase searched for again, up to once an hour
  • Screenshots captured as evidence when a match is confirmed
Example
yourcompany.com/about

About us

We have supplied trade customers across the UK since 2009.

Your page
shop.example.net/about

About us

We have supplied trade customers across the UK since 2009.

Another site
Your wording found on another site3 of 5 phrases match

What only the wording search catches

  • A copy rebuilt by hand that kept your wording
  • A handful of your pages lifted into somebody else's site
  • A copy that took your words but not your code
  • Your text copied by a competitor rather than a criminal

It only finds pages a search engine can reach. A copy behind a login is the marker's job.

What neither layer can see

A fake site that copies neither your code nor your wording, such as a generic login page on an unrelated address, is not caught by these two layers. If it sits on a lookalike of your domain or has your name in its certificate, lookalike monitoring (Layer 1) or certificate monitoring (Layer 4) can catch it.

See how takedown works

Free scan. No account, no card details.

See which lookalikes of your domain already exist

The free scan checks 150+ lookalikes of your domain and shows which are registered and which can send email as you. It does not look for copies of your website; monitoring does that.

  • Typos, other endings and added words, such as yourcompany-invoices.com
  • Which ones are registered, and which are set up to send email as you
  • The report in your inbox, usually in a couple of minutes. No account, no card details, no sales call.

When the scan is done we ask for a work email to send the report to. Gmail, Outlook.com and other free addresses are not accepted.

Want copies of your website checked too? Order the Threat Report, $249. Or book a demo.