Anyone have any idea what this does? It's embedded in the copycat site's source: earlierindians.com/39faf03aa687eeefffbe787537b56e15/invoke.js
Ask HN: Someone is proxy-mirroring my website, can I do anything?
31–40 of 310 posts
Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?
#32Warning: Don't visit the proxy mirror at work, I was redirected to xcams/adult content.
Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?
#33Earlier quoted context omitted.
I have Cloudflare at the front already. The issue is that they are not actively scraping the content but rather mirroring it on demand.
Just an idea but maybe you could cause big loads on their servers by requesting in parallel a large amount of urls where you actively serve a gzipped massive html file that is full of links to your website. EDIT: or building up on what user zhouyisu says above you can generate your perfect match IP blacklist by calling urls via the abusing site that automatically puts any caller into the blacklist.
I'm not sure how easy would be to serve a "zip bomb" without getting into trouble, but it would be neat
Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?
#34Add a link rel="canonical" to your pages as well, it should give engines a hint that your domain is the legit one. https://webmasters.stackexchange.com/questions/56326/canonic... I noticed that the other domain is hotlinking your images. So you can disable image hotlinking, by only allowing certain domains as the referers. If you block hotlinked images then the other domain will not look as good. Remember to do it fo…
I think they are replacing all mentions of saashub.com with their domain. Also, I'm not using statically.io, that's something they are prepending in front of all images. Automatically.
It's adding the CDN for some of the images but not all of them, so you'd have to cover both
Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?
#35Quick and easy first:
1) Add a watermark to your images when they proxy to you.
Stolen image from {url}
2) Add a js script when the url differs from yours and display a message + redirect
Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?
#36Another option would be to use a service like Cloudflare, which offers protections against scraping and other malicious behavior. This can help prevent the proxy-mirror site from being able to access your site's content. https://blog.cloudflare.com/introducing-scrapeshield-discove...
I have Cloudflare at the front already. The issue is that they are not actively scraping the content but rather mirroring it on demand.
Enable bot protection in Cloudflare as per your plan https://developers.cloudflare.com/bots/get-started/
Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?
#37What about a slightly alternative approach, where instead of trying to block the abuser, you try to make it clear to end users what the real website is? E.g. in your logo image, include the real domain name "saashub.com". Have some introduction text on your home page "Here at saashub.com, we compare SaaS products ...." When your images are hotlinked, replace them with text like "This is a fraudulent website, find us at saashub.com". Anything that can make it obvious to end users that they're on the wrong website when they visit the abuser's URL.
By the way, I've also reported the abuser as a phishing/fraud website through https://safebrowsing.google.com/safebrowsing/report_phish/?u...
Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?
#38Setup Cloudflare on the domain and turn on “bot fight mode”.
If the TLS ciphers the client proposes for negotiation doesn’t align with the client’s User-Agent they get a CAPTCHA.
I would suspect that whoever is doing this proxy-mirroring isn’t smart enough to ensure the TLS ciphers align with the User-Agent they’re passing through.
Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?
#39Look at your traffic logs and see if you can't fingerprint the scraper. Should be relatively easy since they're mirroring your entire site. Then instead of blocking the fingerprint, poison the data. Introduce errors that are hard to detect. Maybe corrupt the URLs, or use the incorrect description or category. Be creative, but make it kind of shit. It's easy to work around blocks. Working around poisoned data is much…
This... there are definitely aspects of the proxy that they aren't configuring or are unaware of.
i.e. ssl_cipher, http_x_requested_with, http_accept... and the order of all headers supplied... the casing of all headers supplied... TLS client HELO.
It is relatively easy, if you have enough signals, to essentially create a fingerprint that they won't understand how it works. Yet it will be effective at blocking it regardless of the IP.
Once you add enough of these together it will be hard for them to get around it without being obvious as they do so.
Super aggressive... those same fingerprints will reveal legit browser traffic and the fingerprints for things like Google-bot... so you could go towards a whitelist rather than blocklist. But this is a place you'd have to actively manage as new variations arise constantly.
Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?
#40Generate your pages from Javascript.