Wait what? How have you concluded that?
So they have some active job copying over your data continuously?!
Or are they simply pointing their domain to your IP? Are you running with HTTPS forced? Please enable Let’s Encrypt, which should put an end to such tomfoolery!:
https://meta.discourse.org/t/my-forum-is-opened-with-another-link/70572/5?u=merefield