Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why buy domains and 301 redirect them to me?

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 135 posts

Re: Ask HN: Why buy domains and 301 redirect them to me?

#71

Post by kqr »

nneonneo wrote: post #67
SlightlyLeftPad wrote: post #54

Earlier quoted context omitted.

Just a note 301s are super sticky and browsers cache them even across incognito modes. Your best bet is to use a new browser after reconnecting to avoid false results.

Really? That seems like a fantastic way to fingerprint people. I would be a bit surprised if that was the case... (Fingerprint usage: have https://myfingerprint.example.com 301 to https://myfingerprint.example.com/unique_id_3b136c1cb , then embed https://myfingerprint.example.com in an iframe and see which request is made.)

I'm not GP but a decade ago when I started out as a web developer I made the mistake of using 301s in production and at the time we never figured out how to get the browser to re-learn the responses for those pages without drastic measures.

I still never use 301s for that reason. Things may have changed, but I dare not try!

Re: Ask HN: Why buy domains and 301 redirect them to me?

#72

Post by eastbound »

phoe-krk wrote: post #3

They'll weaponize them at some point. How exactly is to be seen, but if people associate your product with domains you do not control (e.g. via SEO searches and hyperlinks left in public places), then everyone is on the hook the moment these domains stop redirecting to your service.

Yes, they can send legit-looking email with getexample.com, then people will accept those emails as trusted, such as lifecycle emails.

Then they send an invoice…

Re: Ask HN: Why buy domains and 301 redirect them to me?

#73

Post by HenryBemis »

TrueDuality wrote: post #31

As others have mentioned this is likely one of a couple of scenarios, roughly ordered by my guess on likelihood: - Attempting to use your legitimate content and services to improve the SEO rank of other domains (even unrelated ones). This can usually be checked by looking for a sitemap.xml, there will be pages not redirected to your site that contain pages of links. - Closely following the above, the pages may not be…

Bait and switch? Get users t bookmark the joinexample.com, and the others, and once they notice that people keep going to your side via their domain names, they will switch, make a fake "change password" and will be ripped off.

Re: Ask HN: Why buy domains and 301 redirect them to me?

#76

Post by d4mi3n »

Beijinger wrote: post #52
bhouston wrote: post #15

I haven't seen this before but back in the early 2010s I had some India-based group that iframed our SaaS website under a new domain. I caught it early and implemented this fix: https://stackoverflow.com/questions/2896623/how-to-prevent-m... I think this was a common attack vector around then, but is no longer common.

Stupid question: Can you not detect and prevent this based on the HTTP referrer? Maybe reroute to goatse or something....

Pretty sure content-securty-policy headers can prevent this type of attack these days for browsers that support them. Check out the frame-ancestors CSP directive: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...

Re: Ask HN: Why buy domains and 301 redirect them to me?

#77

Post by SlightlyLeftPad »

nneonneo wrote: post #67
SlightlyLeftPad wrote: post #54

Earlier quoted context omitted.

Just a note 301s are super sticky and browsers cache them even across incognito modes. Your best bet is to use a new browser after reconnecting to avoid false results.

Really? That seems like a fantastic way to fingerprint people. I would be a bit surprised if that was the case... (Fingerprint usage: have https://myfingerprint.example.com 301 to https://myfingerprint.example.com/unique_id_3b136c1cb , then embed https://myfingerprint.example.com in an iframe and see which request is made.)

Interesting use case actually. I had never thought of this. I wonder if it’s used in the wild

Re: Ask HN: Why buy domains and 301 redirect them to me?

#78

Post by kbolino »

eastbound wrote: post #74
kbolino wrote: post #46

Earlier quoted context omitted.

You cannot detect a 301 redirect when you're only in control of the destination.

Not through the referrer?

If you navigate straight to bad-domain.com which redirects to good-domain.com, there will be no referer at all.

If you click a link on red-herring.com which points to bad-domain.com, which then redirects to good-domain.com, the referer will be red-herring.com (if not disabled entirely).

HTTP redirects have no effect on the referer.

Re: Ask HN: Why buy domains and 301 redirect them to me?

#80

Post by naveensky »

TrueDuality wrote: post #31

As others have mentioned this is likely one of a couple of scenarios, roughly ordered by my guess on likelihood: - Attempting to use your legitimate content and services to improve the SEO rank of other domains (even unrelated ones). This can usually be checked by looking for a sitemap.xml, there will be pages not redirected to your site that contain pages of links. - Closely following the above, the pages may not be…

one another scenario is that if you open the domain from browser, they will do 301 redirect, but for traffic coming from Google/search engine, they will show their actual content.
Post reply on HN