Im pretty sure now, that they just made real-time mirror of my site.
When user visits any page of their site, their server gets code of my page with same adress. Then it replaces all my domain in html code by their domen and shows it, adding advertisement code.
The problem is, they use cloudflare. And after i ban their ip, they change it after few hours…
