Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why buy domains and 301 redirect them to me?

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 135 posts

Re: Ask HN: Why buy domains and 301 redirect them to me?

#91

Post by avoutic »

SlightlyLeftPad wrote: post #54
TrueDuality wrote: post #51

Earlier quoted context omitted.

Yeah this is a good call-out. If the site is being used for drive-by or targeted malware there are other checks that may be happening alongside the redirect such as user agent, country of origin (like you mentioned), plugins installed, OS, or even time of day. If they detect something that matches what they want, they may throw some intermediate 301's to pages that attempt to infect the user with something still ulti…

Just a note 301s are super sticky and browsers cache them even across incognito modes. Your best bet is to use a new browser after reconnecting to avoid false results.

On Chromium-based browsers, if you open the Developer Tools (F12 or Inspect in right click) and you go to the Network tab, you can click 'Disable Cache'.

In my experience, this solves the sticky 301 issue and you should have no issues with cached 301s anymore.

Works perfect for these kind of investigations or if you made a mistake during site development.

Re: Ask HN: Why buy domains and 301 redirect them to me?

#92

Post by geocar »

kqr wrote: post #71
nneonneo wrote: post #67

Earlier quoted context omitted.

Really? That seems like a fantastic way to fingerprint people. I would be a bit surprised if that was the case... (Fingerprint usage: have https://myfingerprint.example.com 301 to https://myfingerprint.example.com/unique_id_3b136c1cb , then embed https://myfingerprint.example.com in an iframe and see which request is made.)

I'm not GP but a decade ago when I started out as a web developer I made the mistake of using 301s in production and at the time we never figured out how to get the browser to re-learn the responses for those pages without drastic measures. I still never use 301s for that reason. Things may have changed, but I dare not try!

> I still never use 301s for that reason. Things may have changed, but I dare not try!

I use 301 for http:->https: redirects because (a) I doubt we're going back, (b) it prevents some cleartext leaks (like the Host header), and (c) it is slightly cheaper.

> we never figured out how to get the browser to re-learn the responses for those pages without drastic measures.

If you control the target URL it is easy, just redirect back. Seriously: The browser won't loop, it'll just fetch the content again and now not seeing a 301 will forget that nonsense ever happened. This is why 301 is usually a fine default for same-site redirects, or if the redirect target is encoded in the URL (such as in tracking URLs).

The big no-no is don't 301 to a URL you can't control unless you have the appropriate Cache-Control headers on the redirect.

Re: Ask HN: Why buy domains and 301 redirect them to me?

#93

Post by Scoundreller »

preinheimer wrote: post #66
IncreasePosts wrote: post #48

Earlier quoted context omitted.

Regarding point two, OP should connect to a VPN in Japan or somewhere he very isn't, use incognito mode, and see if the same content is served. I've seen hacked sites that are set up to serve normal content to where the attacker thinks the owner of the site lives, but serve phishing content or malware or whatever to everywhere else. A 301 fits that bill because then the owners browser even when traveling will serve t…

Our service testlocal.ly can grab screenshots for you from different countries really quickly if you want a free check.

Can you get Google Safe Search to do that? I feel like my reports fall on deaf ears because SMS spammer's URLs would only serve 'bad' pages to $MyCountry (and nowadays do it behind a captcha, fuck you hcaptcha).

Re: Ask HN: Why buy domains and 301 redirect them to me?

#94

Post by ag_hn »

Just had a look - it appears you’ve got nine .com domains registered with your brand name in the same second on GoDaddy: explore/get/join/meet/my/team/the/tryEXAMPLE.com and EXAMPLEconnect.com.

The Cloudflare redirect likely has GoDaddy underneath, based on what’s visible at myEXAMPLE.com/lander and others.

Half of the domains are set for Outlook Mail, the other for Google Mail which points to a potential email game.

It doesn’t make things safer that your brand name is a top-400 frequency word in one of the European languages. Not owning your .com and having a dozen businesses with similar names just compounds the risk.

What to do really depends on the specifics of your case, including trademark and competition factors. If you’re stuck, feel free to ping me at aghackernews [at] gmail.

Re: Ask HN: Why buy domains and 301 redirect them to me?

#95

Post by motoxpro »

maurimtl wrote: post #24

Their play is to send emails with those domains but in the emails claiming to be you and when people reading the email go to the domain, they see your page (they got redirected).

Wow. Yeah that's genius. It would definitely catch me as I just visit the domain to see if it's legit and don't think about redirects. e.g. gogle.com -> google.com

Re: Ask HN: Why buy domains and 301 redirect them to me?

#97

Post by RajBhai »

jsheard wrote: post #26
HughParry wrote: post #11

Earlier quoted context omitted.

Presumably just throwing a 403 if they have this referrer is ok and won't have a weird SEO impact or something?

Couldn't the attacker evade that by sending Referrer-Policy: no-referrer with their redirect?

Sounds like a security flaw that browsers honor this.

Re: Ask HN: Why buy domains and 301 redirect them to me?

#98

Post by austin-cheney »

That is a really good problem to have.

If you know that is happening with HTTP you can redirect those requests, based upon origin, to a honeypot of your choosing. It’s free traffic you didn’t have to work for to use as you wish without disruption to your business requirements. You can use that traffic to experiment with new features under experimental branding, AB testing, and more.

Re: Ask HN: Why buy domains and 301 redirect them to me?

#99

Post by shahzaibmushtaq »

It's not that easy to find their play.

First and foremost, guide visitors with a popup alert or a banner that you only conduct legitimate business through example.com.

Did you buy used/old/expired domain? Any patterns you can see or a random increase in traffic out of nowhere? What about your competitors?

A 301 redirect isn't a bad thing unless someone has the knowledge to turn it into something bad.

Post reply on HN