Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Someone is proxy-mirroring my website, can I do anything?

news.ycombinator.com

Post reply on HN
Print view View original

161–170 of 310 posts

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#161

Post by nezirus »

halifaxbeard wrote: post #38

Setup Cloudflare on the domain and turn on “bot fight mode”. If the TLS ciphers the client proposes for negotiation doesn’t align with the client’s User-Agent they get a CAPTCHA. I would suspect that whoever is doing this proxy-mirroring isn’t smart enough to ensure the TLS ciphers align with the User-Agent they’re passing through.

I would agree with the above, as an easier version of TLS fingerprinting. One could also ise nginx/haproxy to extract enough TLS info, and detect requests xoming through proxy Magic string: JA3 fingerprint

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#162

Post by graderjs »

mkoryak wrote: post #41
musabg wrote: post #27

1. Create fake url endpoint. And go to that endpoint in the adversary's website, when your server gets request, flag the ip. Do this nonstop with a script. 2. Create fake html elements and put unique strings inside. And you can search that string in search engines for finding similar fake sites on different domains. 3. Create fake html element and put all request details in encrypted format. Visit adversary's website…

I like how you think. These are all great ideas! Reminds me of a time some real estate website hotlinked a ton of images from my website. After I asked them to stop and they ignored me I added an nginx rewrite rule to send them a bunch of pictures of houses that were on fire. For some reason they stopped using my website as their image host after that.

LOL! Thank you for the laugh. This is great.

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#163

Post by wpietri »

DamnInteresting wrote: post #131
wpietri wrote: post #108

One strategy tip: don't play cat and mouse. As you've demonstrated, if you change one thing, they will figure it out and change one thing. Not only does that not work, but you are training them that it's worth trying to beat your latest change. Instead, plot a few different changes and throw them in all at once. Preferably in a way where they will have to solve all of the changes at the same time to figure out what h…

> pure IP blocks are easier to detect than tarpitting and returning fake/corrupted content I recently had to employ such a strategy against some extremely aggressive card testers (criminals with lists of stolen credit cards who automate stuffing card info into a donation form to test which cards are still working). Instead of blocking their IPs, I started feeding them randomly generated false responses with a statist…

This warms my heart and it's a great example of lengthening the feedback loop.

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#164

Post by michaelmior »

nuccy wrote: post #156
santah wrote: post #71

Same thing happened to me and my service ( https://next-episode.net ) almost 2 years ago. I wrote a HN post about it as well: https://news.ycombinator.com/item?id=26105890 , but to spare you all the irrelevant details and digging in the comments for updates - here is what worked for me - you can block all their IPs, even though they may have A LOT and can change them on each call: 1) I prepared a fake URL that no leg…

Instead of blocking by IP, just check SERVER_NAME/HTTP_SERVER variables in your backend/web server (or even in JavaScript of the page check window.location.hostname) and in case those include anything but original hostname, redirect to the original website (or serve different content with a warning to the visitor). If you have apache2/nginx this can be easily achieved by creating a default virtualhost (which is not y…

As the OP mentioned, JS is stripped and URLs are being written, so I doubt either of those approaches will work.

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#166

Post by nuccy »

michaelmior wrote: post #164
nuccy wrote: post #156

Earlier quoted context omitted.

Instead of blocking by IP, just check SERVER_NAME/HTTP_SERVER variables in your backend/web server (or even in JavaScript of the page check window.location.hostname) and in case those include anything but original hostname, redirect to the original website (or serve different content with a warning to the visitor). If you have apache2/nginx this can be easily achieved by creating a default virtualhost (which is not y…

As the OP mentioned, JS is stripped and URLs are being written, so I doubt either of those approaches will work.

Making js essential is not that hard, right? Just "display: none" on the root element, which is removed by js :)

More sophisticated options can been found in other comments.

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#167

Post by nuccy »

nuccy wrote: post #166
michaelmior wrote: post #164

Earlier quoted context omitted.

As the OP mentioned, JS is stripped and URLs are being written, so I doubt either of those approaches will work.

Making js essential is not that hard, right? Just "display: none" on the root element, which is removed by js :) More sophisticated options can been found in other comments.

The other kind of problem is if the website is not really proxied but rather dumped, patched and re-served. In such case the only option (if JavaScript frontend redirect doesn't work) is blocking by IP the dumping server.

To identify IPs, as pointed in the root comment of this thread, you can create a one-pixel link to a dummy page, which dumping software would visit, but a human wouldn't. So you will see who visited that specific page and block those IPs for good.

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#168

Post by ChrisMarshallNY »

hbn wrote: post #141
ChrisMarshallNY wrote: post #87

Earlier quoted context omitted.

How about something like... body[href*= " "] { background-image: url("http://goatse..."); } Ala: http://ascii.textfiles.com/archives/1011

We're trying to punish the people running the proxy mirror, not the users who stumble upon them just trying to use the site

In that case, write some JS, that wanders around the Hubble site, randomly downloading full-res TIFF images for the background, or that randomly displays Disney images.

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#169

Post by geocrasher »

musabg wrote: post #27

1. Create fake url endpoint. And go to that endpoint in the adversary's website, when your server gets request, flag the ip. Do this nonstop with a script. 2. Create fake html elements and put unique strings inside. And you can search that string in search engines for finding similar fake sites on different domains. 3. Create fake html element and put all request details in encrypted format. Visit adversary's website…

Passive Aggressive FTW. These are all fantastic ideas.

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#170

Post by sublinear »

DoctorOW wrote: post #45
musabg wrote: post #27

1. Create fake url endpoint. And go to that endpoint in the adversary's website, when your server gets request, flag the ip. Do this nonstop with a script. 2. Create fake html elements and put unique strings inside. And you can search that string in search engines for finding similar fake sites on different domains. 3. Create fake html element and put all request details in encrypted format. Visit adversary's website…

In my search for this I found @document isn't super supported [0] I suggested something like: a[href*= "sukuns.us.to"] { display:none; } Then use SRI to enforce that CSS. [0]: https://caniuse.com/mdn-css_at-rules_document

I know this is just a game that never ends, but if they're already rewriting the HTTP requests what's stopping them from rewriting the page contents in the response?

SRI is for the situation where a CDN has been poisoned, not this.

Post reply on HN