OT: How did you detect this?
Just curious, seems like something we should all start monitoring for.
Ask HN: Why buy domains and 301 redirect them to me?
61–70 of 135 posts
Re: Ask HN: Why buy domains and 301 redirect them to me?
#62As others have mentioned this is likely one of a couple of scenarios, roughly ordered by my guess on likelihood: - Attempting to use your legitimate content and services to improve the SEO rank of other domains (even unrelated ones). This can usually be checked by looking for a sitemap.xml, there will be pages not redirected to your site that contain pages of links. - Closely following the above, the pages may not be…
I'd add canonical link elements to your html and http headers in order to reduce the chances of subversion somehow. The whole thing feels really weird to me.
Re: Ask HN: Why buy domains and 301 redirect them to me?
#63Another possibility: Does your example.com point to something with an ideological or humanitarian goal?
There was a humanitarian charity I've donated to, and I saw people erroneously linking to the wrong URLs when spreading news of it. (Say, `foobar.org` and `boofar.com` when the charity is at `boofar.org`.)
So, I just bought the URLs and had them redirect to the correct URL, before a bad actor could snap them up.
Re: Ask HN: Why buy domains and 301 redirect them to me?
#64Earlier quoted context omitted.
No, just redirect back to HTTP_REFERER. Why? The user's browser will display a redirect loop error; and most importantly, they won't see your domain. It keeps your name out of it and makes the email domain look even more fishy.
Redirecting back to the referer will not create a redirect loop. The referer is the URL of the site that linked to the redirect, not the redirect itself. The redirect does not alter the referer in any way. In many cases, there will be no referer at all. I don't know why everyone seems to think that HTTP redirects are visible in Referer (or Origin or any other header), but that's just not the case: HTTP redirects are…
> I don't know why everyone seems to think that HTTP redirects are visible in Referer
They would be if it's a same-origin redirect, no? And I was under the impression that 3xx also set it cross origin (barring a referrer-policy header), though I'm less confident now. (I can't test it ATM).
Edit: I am clearly confused. The browser preserves the original referer when performing a 3xx, as you said.
Re: Ask HN: Why buy domains and 301 redirect them to me?
#65As others have mentioned this is likely one of a couple of scenarios, roughly ordered by my guess on likelihood: - Attempting to use your legitimate content and services to improve the SEO rank of other domains (even unrelated ones). This can usually be checked by looking for a sitemap.xml, there will be pages not redirected to your site that contain pages of links. - Closely following the above, the pages may not be…
Regarding point two, OP should connect to a VPN in Japan or somewhere he very isn't, use incognito mode, and see if the same content is served. I've seen hacked sites that are set up to serve normal content to where the attacker thinks the owner of the site lives, but serve phishing content or malware or whatever to everywhere else. A 301 fits that bill because then the owners browser even when traveling will serve t…
Or, try a mobile user-agent. I've seen loads of phishing pages that will only serve their malicious payloads to phones - this is especially common with the scams that are sent via SMS.
Re: Ask HN: Why buy domains and 301 redirect them to me?
#66As others have mentioned this is likely one of a couple of scenarios, roughly ordered by my guess on likelihood: - Attempting to use your legitimate content and services to improve the SEO rank of other domains (even unrelated ones). This can usually be checked by looking for a sitemap.xml, there will be pages not redirected to your site that contain pages of links. - Closely following the above, the pages may not be…
Regarding point two, OP should connect to a VPN in Japan or somewhere he very isn't, use incognito mode, and see if the same content is served. I've seen hacked sites that are set up to serve normal content to where the attacker thinks the owner of the site lives, but serve phishing content or malware or whatever to everywhere else. A 301 fits that bill because then the owners browser even when traveling will serve t…
Our service testlocal.ly can grab screenshots for you from different countries really quickly if you want a free check.
Re: Ask HN: Why buy domains and 301 redirect them to me?
#67Earlier quoted context omitted.
Yeah this is a good call-out. If the site is being used for drive-by or targeted malware there are other checks that may be happening alongside the redirect such as user agent, country of origin (like you mentioned), plugins installed, OS, or even time of day. If they detect something that matches what they want, they may throw some intermediate 301's to pages that attempt to infect the user with something still ulti…
Just a note 301s are super sticky and browsers cache them even across incognito modes. Your best bet is to use a new browser after reconnecting to avoid false results.
Really? That seems like a fantastic way to fingerprint people. I would be a bit surprised if that was the case...
(Fingerprint usage: have https://myfingerprint.example.com 301 to https://myfingerprint.example.com/unique_id_3b136c1cb, then embed https://myfingerprint.example.com in an iframe and see which request is made.)
Re: Ask HN: Why buy domains and 301 redirect them to me?
#68I can answer this one because it was one of my dirtier SEO tricks.
Expired domains and Domains on the marketplace, with hundreds or thousands of “backlinks” to them, are valuable. In the listing you may see something like “20000 back links.” And those links are usually worthless , spam, and will vanish as soon as you buy. But you can find domains that have real backlinks. TEN backlinks from reputable websites are more valuable than a thousand spam BLs.
You used to be able to buy and run software , “backlinks explorer” to investigate everyone who links to a domain you’re thinking about buying. And you can also research a “20000 backlinks” claim to see if this is just someone spamming that domain all over blogger and forums.
A good domain to buy will have legit backlinks from real websites that the website linked on purpose. If it’s been spammed thousands of times for a “5000 backlinks claim” , expect google to punish it!
Because if you 301 them to your site, google et al assume you’re the legitimate successor to that website and people mean to link to you.
So you come up higher in search.
I’ve used this to be the first or second result on google. And certainly on the first page of results.
It overcomes downranking for being a new domain nobody links to.
Google has its own criteria for evaluating whether your page is spam or a scam, and whether you’re abusing this to promote spam or a scam.
I have a trio of ancient highly ranked domains that I forward to a new page for about a year.
They’ll hit page one on google within a week or two or three.
After I remove the 301s or recycle those domains, the pages usually still come up within the first page of results afterwards.
Before you get too horrified here, I did this to bury a “competitor” who had registered a similar domain name, stolen my entire repo and website from a disgruntled employee, copied all my software and copied my webpage word for word trying to drum up business on my IP. The whole time they mocked me in email about stealing my customers and putting me out of business.
It worked. (Sort of. If you hire them they don’t actually have any idea how to do what I do.)
I did not do this to scam or phish or what have you. I just did this to bump them from #1 on google. Which they got by incorporating with a similar business name and registering with a similar URL.
They did ultimately manage to shut that business down and disrupt it after years of this and I moved on because I have other talents and this venture wasn’t profitable enough to deal with this entity kneecapping me for years and years.
But on my way out, I forwarded all of those domains to a reasonable and legitimate website that’s in the same line of work, resulting in them now dominating the other site in search. So I walked away and used this trick one last time to at least ensure someone searching for this subject would end up in some safe and reasonable hands.
What’s my point in sharing this?
It’s that the other website has no idea I did this, and has no control over it. You might see this and assume the worst about the other website.
someone could be doing this to manipulate SEO or search results over sites they don’t even own. For reasons that might (?) make sense or be well intended.
and for reasons that don’t, or might even be malicious.
* MULTIPLE edits for clarification
Re: Ask HN: Why buy domains and 301 redirect them to me?
#69I haven't seen this before but back in the early 2010s I had some India-based group that iframed our SaaS website under a new domain. I caught it early and implemented this fix: https://stackoverflow.com/questions/2896623/how-to-prevent-m... I think this was a common attack vector around then, but is no longer common.
Stupid question: Can you not detect and prevent this based on the HTTP referrer? Maybe reroute to goatse or something....
Consider rerouting to a picture of an egg in an soft-boiled egg cup with an uncanny resemblance to male anatomy.
Re: Ask HN: Why buy domains and 301 redirect them to me?
#70I haven't seen this before but back in the early 2010s I had some India-based group that iframed our SaaS website under a new domain. I caught it early and implemented this fix: https://stackoverflow.com/questions/2896623/how-to-prevent-m... I think this was a common attack vector around then, but is no longer common.
Stupid question: Can you not detect and prevent this based on the HTTP referrer? Maybe reroute to goatse or something....
I'm sure I don't really have to point this out, but...
The last thing you would ever want to do is associate your domain name with gross, offensive content like this. The web is crawled all the time for snapshot data.
Additionally, you're more likely to cause your own (potential) users to stumble on this than anything else.
IMO, the best policy is almost always transparency. If you were to redirect users (and referrer-based redirects are a fragile thing), send them to a phishing/spam awareness page and explain that they most likely arrived from such a source.