111–120 of 135 posts
Not a lawyer. Your claim to copyright the term used by your SaaS depends on the website you registered, unless you officially copyrighted the term. Someone having all those websites can also claim the copyright, or claim you didn't enforce it by asking the other websites to be removed.
Earlier quoted context omitted.
I have seen attacks where directly visiting the site doesn't show anything out of the ordinary, but visits coming from Google (referer) show different content. Have also seen ones where only User-Agent: Googlebot would see the modified version of the site. (I doubt that is the case in OP's situation, but I have seen both of those methods of "hiding" multiple times now)
Yes, this is how most Wordpress malware works - they inject/publish ad or keyword spam content on the site if the user agent is googlebot. Regular users don't get the ads. It's partially why most people never realise their site has been hacked.
That is a really good problem to have. If you know that is happening with HTTP you can redirect those requests, based upon origin, to a honeypot of your choosing. It’s free traffic you didn’t have to work for to use as you wish without disruption to your business requirements. You can use that traffic to experiment with new features under experimental branding, AB testing, and more.
The malicious website can stop the Referer header from being sent by setting the Referrer-Policy header to "no-referrer". Also, redirects apparently wouldn't include a Referer header any way, according to kbolino's comment.
Redirected traffic is coming from one or more dedicated locations performing the redirection. The source of redirection is still identifiable by IP address. So, if you know the traffic is coming from the a given IP and is a 301 you have all you need. Even after that the identified traffic, if not bots, can then be further tracked via a variety of client-side things like cookies and localStorage.
As others have mentioned this is likely one of a couple of scenarios, roughly ordered by my guess on likelihood: - Attempting to use your legitimate content and services to improve the SEO rank of other domains (even unrelated ones). This can usually be checked by looking for a sitemap.xml, there will be pages not redirected to your site that contain pages of links. - Closely following the above, the pages may not be…
Regarding point two, OP should connect to a VPN in Japan or somewhere he very isn't, use incognito mode, and see if the same content is served. I've seen hacked sites that are set up to serve normal content to where the attacker thinks the owner of the site lives, but serve phishing content or malware or whatever to everywhere else. A 301 fits that bill because then the owners browser even when traveling will serve t…
There's a related site compromise where a hacked webserver behaves normally except, when the referrer is google.com, it adds a JavaScript redirect to the end of any page.
You go to example.com, everything looks normal. You click a link to example.com, you end up on a page selling herbal dick pills. Site owner yells at Google thinking it's their fault. Googlebot never gets served the redirect.
You should be able to do the same thing with 301 redirects.
Their play is to send emails with those domains but in the emails claiming to be you and when people reading the email go to the domain, they see your page (they got redirected).
Wow. Yeah that's genius. It would definitely catch me as I just visit the domain to see if it's legit and don't think about redirects. e.g. gogle.com -> google.com
As others have mentioned this is likely one of a couple of scenarios, roughly ordered by my guess on likelihood: - Attempting to use your legitimate content and services to improve the SEO rank of other domains (even unrelated ones). This can usually be checked by looking for a sitemap.xml, there will be pages not redirected to your site that contain pages of links. - Closely following the above, the pages may not be…
- Reaching out in good-faith with an offer to sell the domain to you. I've had that happen in the past and before receiving the email the person directed the domain to my official website to show good will. I purchased the domain and now own it.
Not saying this is the case here, but just wanted to throw a legitimate scenario into the mix. They should have reached out by now if this was the case.
Earlier quoted context omitted.
Regarding point two, OP should connect to a VPN in Japan or somewhere he very isn't, use incognito mode, and see if the same content is served. I've seen hacked sites that are set up to serve normal content to where the attacker thinks the owner of the site lives, but serve phishing content or malware or whatever to everywhere else. A 301 fits that bill because then the owners browser even when traveling will serve t…
I have seen attacks where directly visiting the site doesn't show anything out of the ordinary, but visits coming from Google (referer) show different content. Have also seen ones where only User-Agent: Googlebot would see the modified version of the site. (I doubt that is the case in OP's situation, but I have seen both of those methods of "hiding" multiple times now)
Earlier quoted context omitted.
I'm not GP but a decade ago when I started out as a web developer I made the mistake of using 301s in production and at the time we never figured out how to get the browser to re-learn the responses for those pages without drastic measures. I still never use 301s for that reason. Things may have changed, but I dare not try!
> I still never use 301s for that reason. Things may have changed, but I dare not try! I use 301 for http:->https: redirects because (a) I doubt we're going back, (b) it prevents some cleartext leaks (like the Host header), and (c) it is slightly cheaper. > we never figured out how to get the browser to re-learn the responses for those pages without drastic measures. If you control the target URL it is easy, just red…
IMHO you should take action ASAP - at the cost of sacrificing all traffic coming from them. Regardless of their endgame, I'd just detect the HTTP referer and redirect back to them: crawlers and browsers will detect the redirect loop and happily complain about their domain. This will render their redirects ineffective, eg. any phishing attempt will have broken links. This is preferable rather than returning 404, 403,…
So what's left is 1) filing a DMCA request with their registrar and 2) hosting provider, 3) checking offending inbound links and using Google’s Disavow Links tool. And if they're plagiarizing some contents, also 4) asking Google to remove infringing pages from their index. I had to do the latter a few years ago.