Live data from Hacker News

Ask HN: Someone is proxy-mirroring my website, can I do anything?

news.ycombinator.com

71–80 of 310 posts

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#71
Same thing happened to me and my service (https://next-episode.net) almost 2 years ago.

I wrote a HN post about it as well: https://news.ycombinator.com/item?id=26105890, but to spare you all the irrelevant details and digging in the comments for updates - here is what worked for me - you can block all their IPs, even though they may have A LOT and can change them on each call:

1) I prepared a fake URL that no legitimate user will ever visit (like website_proxying_mine.com/search?search=proxy_mirroring_hacker_tag)

2) I loaded that URL like 30 thousand times

3) from my logs, I extracted all IPs that searched for "proxy_mirroring_hacker_tag" (which, from memory, was something like 4 or 5k unique IPs)

4) I blocked all of them

After doing the above, the offending domains were showing errors for 2-3 days and then they switched to something else and left me alone.

I still go back and check them every few months or so ...

P.S. My advice is to remove their URL from your post here. This will not help with search engines picking up their domain and ranking it with your content ...

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#72

Warning: Don't visit the proxy mirror at work, I was redirected to xcams/adult content.

The mirror is injecting their own ads. My guess is it was just a malicious ad forcing the redirect. It could still happen, but it doesn’t appear to be the main intention of the mirror site.

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#75
post #71

Same thing happened to me and my service ( https://next-episode.net ) almost 2 years ago. I wrote a HN post about it as well: https://news.ycombinator.com/item?id=26105890 , but to spare you all the irrelevant details and digging in the comments for updates - here is what worked for me - you can block all their IPs, even though they may have A LOT and can change them on each call: 1) I prepared a fake URL that no leg…

[deleted]

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#76
post #8

If the host (DediPath) is not respecting DMCA notices, one other thing you can do is adding the requester's IP address to every page, eg as a div class. If the responses are live proxied, this will surface the cloner's front-facing IP address, and you can block that (and their ASN) specifically.

I'm not sure I can understand your advice.

That's clever, and I just understand after a while.

Now let's say that your website will show the ip of whoever visit it, in one of textbox. When you access it it shows your ip. When the proxy sever access it it shows the proxy sever's ip. When you access the proxy site, the proxy site will access your site, having their ip on one of the text box, then return the page with their ip to you.

The more advanced method is to encrypt the ip and put it hidden somewhere, on later for you to decrypt it, get the ip and black list them.

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#77
post #71

Same thing happened to me and my service ( https://next-episode.net ) almost 2 years ago. I wrote a HN post about it as well: https://news.ycombinator.com/item?id=26105890 , but to spare you all the irrelevant details and digging in the comments for updates - here is what worked for me - you can block all their IPs, even though they may have A LOT and can change them on each call: 1) I prepared a fake URL that no leg…

For 2) you mean you loaded it from the adversary's proxy site, just to clarify?

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#78
post #27

1. Create fake url endpoint. And go to that endpoint in the adversary's website, when your server gets request, flag the ip. Do this nonstop with a script. 2. Create fake html elements and put unique strings inside. And you can search that string in search engines for finding similar fake sites on different domains. 3. Create fake html element and put all request details in encrypted format. Visit adversary's website…

Why return big files when you can return small files at excruciatingly slow speeds? modems are hot again!

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#80
Sending a mail to the hosting provider is helpful. Also, if you are looking at blocking IP you can try blocking an entire ASN temporarily to see how that works. It’s one thing for someone to destroy a server and reimage it on the same service. It’s another thing to destroy it and bring it up on a fresh provider. Currently the attacker is using dedipath for example. Block the ASN while waiting for their abuse team to respond.
Post reply on HN