Live data from Hacker News

Ask HN: Why buy domains and 301 redirect them to me?

news.ycombinator.com

21–30 of 135 posts

Re: Ask HN: Why buy domains and 301 redirect them to me?

#21
I don't know if it still happens, but Google used to have an issue that I would see in Verbatim mode whereby non-Wikipedia domains would rank as particular Wikipedia pages by redirecting to Wikipedia. I can't seem to replicate it now, so it might be resolved or vary from country to country.

I posted about it at the time, but no one seemed to be able to replicate it:

https://x.com/jfozonx/status/1570710776540958723

Always wondered how much traffic those domains were accumulating. Even though it was an edge case, it must've been quite a lot in aggregate.

Re: Ask HN: Why buy domains and 301 redirect them to me?

#23
post #13

Can you provide more information about what's in the headers? Additionally, are there any tracking parameters appended to the URL? I'm guessing it will look normal but it could provide some insights if something weird is there.

Just had a look - looks like pretty regular/reasonable cloudflare default stuff as far as I can tell. The headers relating to error reporting are the only thing that stand out a little, though it doesn't look unreasonable.

---

Headers

---

HTTP/2 301

date: Fri, 24 Jan 2025 13:59:51 GMT

content-type: text/html

content-length: 167

location:

cache-control: max-age=3600

expires: Fri, 24 Jan 2025 14:59:51 GMT

report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JZu4FOa%2ByynaFOXWYlxaePF9KdRQ0qGUJkfm1F1aK2m3VEx6idlvWlb5go%2B08hgSog1zm1zuMobXcVK2BkR4mQD0SEGU%2Bzp2oC6mXPgQs%2FUzvOH7LbqAG96jtf9KNqemV8Q%3D"}],"group":"cf-nel","max_age":604800}

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}

server: cloudflare

cf-ray: 90708be24810e8fe-LHR

alt-svc: h3=":443"; ma=86400

server-timing: cfL4;desc="?proto=TCP&rtt=59748&min_rtt=41108&rtt_var=43898&sent=7&recv=8&lost=0&retrans=1&sent_bytes=3535&recv_bytes=789&delivery_rate=33797&cwnd=225&unsent_bytes=0&cid=e5052200af7e27a5&ts=145&x=0"

Re: Ask HN: Why buy domains and 301 redirect them to me?

#26

Whatever their play, detect and drop the redirects. Good job on noticing it early on!

Presumably just throwing a 403 if they have this referrer is ok and won't have a weird SEO impact or something?

Couldn't the attacker evade that by sending Referrer-Policy: no-referrer with their redirect?

Re: Ask HN: Why buy domains and 301 redirect them to me?

#28
This feels like a never-ending cat and mouse activity, but depending upon your hosting infrastructure, you ought to be able to maintain a list of these domains and 403/404 incoming requests that are being referred from the list. Better to just dump them to an error / scam warning page than 301 them out to somewhere else (to avoid redirect loops)

Re: Ask HN: Why buy domains and 301 redirect them to me?

#29
I did this for a fraudulent health product. They had .org but not .com. Registered .com and redirected it. Waited for SEO to pick up on it. Created the page calling it out as fraud. Created some social media accounts and put the .com in the about info. Started commenting on their posts, anyone that looked at the fake profiles would find my page with info on why it was fraudulent.

Re: Ask HN: Why buy domains and 301 redirect them to me?

#30
post #26

Earlier quoted context omitted.

Presumably just throwing a 403 if they have this referrer is ok and won't have a weird SEO impact or something?

Couldn't the attacker evade that by sending Referrer-Policy: no-referrer with their redirect?

Good shout. Can always block based on origin header though (when under the assumption that it's a legit browser) since it's a forbidden header name.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Or...

Post reply on HN