Step 1: build reputation as if they are you
Step 2: offer to sell them to you for some inflated price
Step 3: make your life hell if you dont pay
Ask HN: Why buy domains and 301 redirect them to me?
81–90 of 135 posts
Re: Ask HN: Why buy domains and 301 redirect them to me?
#82As others have mentioned this is likely one of a couple of scenarios, roughly ordered by my guess on likelihood: - Attempting to use your legitimate content and services to improve the SEO rank of other domains (even unrelated ones). This can usually be checked by looking for a sitemap.xml, there will be pages not redirected to your site that contain pages of links. - Closely following the above, the pages may not be…
I think the first one is pretty likely. OP, you can search for "site:getexample.com" which will list you any pages that have been indexed for that domain. They might have just redirected the homepage. Worth a shot.
I would expect the certificate mismatch to prevent this.
Re: Ask HN: Why buy domains and 301 redirect them to me?
#83As others have mentioned this is likely one of a couple of scenarios, roughly ordered by my guess on likelihood: - Attempting to use your legitimate content and services to improve the SEO rank of other domains (even unrelated ones). This can usually be checked by looking for a sitemap.xml, there will be pages not redirected to your site that contain pages of links. - Closely following the above, the pages may not be…
Regarding point two, OP should connect to a VPN in Japan or somewhere he very isn't, use incognito mode, and see if the same content is served. I've seen hacked sites that are set up to serve normal content to where the attacker thinks the owner of the site lives, but serve phishing content or malware or whatever to everywhere else. A 301 fits that bill because then the owners browser even when traveling will serve t…
I have seen attacks where directly visiting the site doesn't show anything out of the ordinary, but visits coming from Google (referer) show different content. Have also seen ones where only User-Agent: Googlebot would see the modified version of the site.
(I doubt that is the case in OP's situation, but I have seen both of those methods of "hiding" multiple times now)
Re: Ask HN: Why buy domains and 301 redirect them to me?
#84I think you can check the HTTP_REFERER header and block the redirect using your back-end code, like PHP or Node or Python, not sure what tech stack you are using.
If I was running the sites 301 redirect from, I'd be setting a referrer policy to prevent the browser from sending the referrer header.
Re: Ask HN: Why buy domains and 301 redirect them to me?
#85Lots of answers about why, and it could be one or many of them. Scammy reasons likely.
A somewhat innocent reason could be that someone sent a newsletter email or shared a link to your site, but mistyped the URL, so to save their users from getting NXDOMAIN errors l, or even worse, someone registering it with illintentions, they registered and 301 redirected to you.
Re: Ask HN: Why buy domains and 301 redirect them to me?
#86[deleted]
Re: Ask HN: Why buy domains and 301 redirect them to me?
#87Earlier quoted context omitted.
Regarding point two, OP should connect to a VPN in Japan or somewhere he very isn't, use incognito mode, and see if the same content is served. I've seen hacked sites that are set up to serve normal content to where the attacker thinks the owner of the site lives, but serve phishing content or malware or whatever to everywhere else. A 301 fits that bill because then the owners browser even when traveling will serve t…
I have seen attacks where directly visiting the site doesn't show anything out of the ordinary, but visits coming from Google (referer) show different content. Have also seen ones where only User-Agent: Googlebot would see the modified version of the site. (I doubt that is the case in OP's situation, but I have seen both of those methods of "hiding" multiple times now)
Yes, this is how most Wordpress malware works - they inject/publish ad or keyword spam content on the site if the user agent is googlebot. Regular users don't get the ads. It's partially why most people never realise their site has been hacked.
Re: Ask HN: Why buy domains and 301 redirect them to me?
#88Are you sure it isn't the marketing team setting up domains for email marketing blasts?
Re: Ask HN: Why buy domains and 301 redirect them to me?
#89[deleted]
Re: Ask HN: Why buy domains and 301 redirect them to me?
#90Earlier quoted context omitted.
Yeah this is a good call-out. If the site is being used for drive-by or targeted malware there are other checks that may be happening alongside the redirect such as user agent, country of origin (like you mentioned), plugins installed, OS, or even time of day. If they detect something that matches what they want, they may throw some intermediate 301's to pages that attempt to infect the user with something still ulti…
Just a note 301s are super sticky and browsers cache them even across incognito modes. Your best bet is to use a new browser after reconnecting to avoid false results.
You can disable caching in Firefox's developer tools, this covers such cached redirects. Very useful combined with a persistent log of network activity to avoid clears after redirects.