Ask HN: Someone is proxy-mirroring my website, can I do anything?

Post by DamnInteresting » Mon, Dec 12, 2022, 3:58 PM UTC

wpietri wrote: post #108

One strategy tip: don't play cat and mouse. As you've demonstrated, if you change one thing, they will figure it out and change one thing. Not only does that not work, but you are training them that it's worth trying to beat your latest change. Instead, plot a few different changes and throw them in all at once. Preferably in a way where they will have to solve all of the changes at the same time to figure out what h…

Post by chris_wot » Mon, Dec 12, 2022, 4:00 PM UTC

Benanov wrote: post #97

reaktivo wrote: post #86

Redirect via meta tag

won't survive a grep

Post by mhlakhani » Mon, Dec 12, 2022, 4:07 PM UTC

blinding-streak wrote: post #120

santah wrote: post #71

Same thing happened to me and my service ( https://next-episode.net ) almost 2 years ago. I wrote a HN post about it as well: https://news.ycombinator.com/item?id=26105890 , but to spare you all the irrelevant details and digging in the comments for updates - here is what worked for me - you can block all their IPs, even though they may have A LOT and can change them on each call: 1) I prepared a fake URL that no leg…

Side note: great idea for a website. This could be really helpful. You got a new user here.

Post by petepete » Mon, Dec 12, 2022, 4:08 PM UTC

ChrisMarshallNY wrote: post #87

DoctorOW wrote: post #45

Earlier quoted context omitted.

In my search for this I found @document isn't super supported [0] I suggested something like: a[href*= "sukuns.us.to"] { display:none; } Then use SRI to enforce that CSS. [0]: https://caniuse.com/mdn-css_at-rules_document

How about something like... body[href*= " "] { background-image: url("http://goatse..."); } Ala: http://ascii.textfiles.com/archives/1011

    body[href*= ""] {
      animation: rotation 20s infinite linear;
    }

    @keyframes rotation {
      from {
        transform: rotate(0deg);
      }
      to {
        transform: rotate(359deg);
      }
    }

Post by smaudet » Mon, Dec 12, 2022, 4:11 PM UTC

mkoryak wrote: post #41

musabg wrote: post #27

1. Create fake url endpoint. And go to that endpoint in the adversary's website, when your server gets request, flag the ip. Do this nonstop with a script. 2. Create fake html elements and put unique strings inside. And you can search that string in search engines for finding similar fake sites on different domains. 3. Create fake html element and put all request details in encrypted format. Visit adversary's website…

I like how you think. These are all great ideas! Reminds me of a time some real estate website hotlinked a ton of images from my website. After I asked them to stop and they ignored me I added an nginx rewrite rule to send them a bunch of pictures of houses that were on fire. For some reason they stopped using my website as their image host after that.