Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My website is being stolen in real time and I don't know what to do

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 111 posts

Re: My website is being stolen in real time and I don't know what to do

#71

Post by joshstrange »

asmosoinio wrote: post #62

I think mentioning the short URL provider auto-killed fragmede's comment, and my copy&paste of it. Here goes again: fragmede's comment below is [dead], but has very good advice. --- Nice bit of news you added to the top, which 4co.in is putting on their own site. One piece of advice though: Drop the short link and link directly to altexplorer.net, otherwise it looks like 4co.in was 'hacked' and the short link is a ph…

I think they have to use a short-url or it gets re-written. He might be able to ajax in a page on from site (using the short-url to get it so it's not re-written) that contains the real URL as I doubt they are injecting something to re-write what is added vis JS.

[0] > This won't work as it seems they're replacing any mention of "altexplorer" with "4coin"

[0] https://news.ycombinator.com/item?id=7240554

Re: My website is being stolen in real time and I don't know what to do

#72

Post by msantos »

The javascript solution has already been suggested, but take a step back and think about it: the same way the leech worked out your links, domain name, logo and all the stuff that brands your website, he can easily figure out the simple JS code suggested here.

http://4co.in')document.location='//xxxxxx.xxxx';">

So I say, go a step further:

- do not send his users to a black hole, instead show a banner warning them about the leech and then after a few seconds redirect the user to your website.

- The JS code for the above should go in the same JS file that provides core functionality to your website.

After done that, run your JS past http://closure-compiler.appspot.com/home or if you better still install the yuicompressor cli (http://yui.github.io/yuicompressor/) in your machine.

The resulting code will be minified/compressed and seriously obfuscated. So trying to defeat it will that the leech hours if not days depending on his experience.

- encode/obfuscate the warning string (1st topic) to make it harder to find within the JS code.

- and finally do a daily spot check on website following @jarrett comment below

Re: My website is being stolen in real time and I don't know what to do

#73

Post by wlesieutre »

asmosoinio wrote: post #62

I think mentioning the short URL provider auto-killed fragmede's comment, and my copy&paste of it. Here goes again: fragmede's comment below is [dead], but has very good advice. --- Nice bit of news you added to the top, which 4co.in is putting on their own site. One piece of advice though: Drop the short link and link directly to altexplorer.net, otherwise it looks like 4co.in was 'hacked' and the short link is a ph…

I think the text of "altexplorer" is being replaced automatically, hence the need for a shortener.

Re: My website is being stolen in real time and I don't know what to do

#74

Post by fallinghawks »

Navarr wrote: post #51
al2o3cr wrote: post #17

Detect their IP and 301 their requests to goatse. Or something worse, if you're bent like that. :)

Why do that to people who probably don't know 4coin is being a thief?

The point is to make them stop going to 4co.in at all. No credibility = no traffic = dead site. And hopefully the thief learns a lesson.

Re: My website is being stolen in real time and I don't know what to do

#75

Post by GrahamsNumber »

codegeek wrote: post #49

Lot of good suggestions already. I am not sure if you are interested in contacting the perpetrator directly and asking them to stop this but I did a little research for you. looking up the whois info, it says that the registrant's email was bgrf@ymail.com When I put this email in google, I came across another spammy site called baklinks.blogspot.com. This site asks you to swap back links. At the bottom of the blog po…

You seem to have a particular set of skills

Re: My website is being stolen in real time and I don't know what to do

#76

Post by matt_heimer »

The JavaScript frame busting methods are not the right approach, you have no control over what his users see. There is no reason he can't filter out any JavaScript or other HTML. In fact he might not even display your live HTML. He might have copied it to make his page templates and it scraping just the data from your site, you just don't know. If he isn't doing this now, he will if he gets in an arms race with you.

You need to return bad data to his site by IP address and possibly user-agent. Don't make the data bad to mess with the users, just make it return unusable data, for example all numbers are zeros. Then what you do it make a scheduled task that scraps his website (using his domain name). If you start getting HTTP requests in your logs that correspond to the schedule job you created then you add the new requesting IP to the blacklist of funny data, then make a second request to his website validate the IP you blacklisted. You could setup your scrapping tool to use random tor exit nodes and cycle the user-agent info.

He could do the same (random ips) but might not... Really you need some type of accountability which you can never have on a public website but requiring registration/authentication would help some if it becomes that important to you.

Re: My website is being stolen in real time and I don't know what to do

#77

Post by segmondy »

If you have time, go to war.

Have a page that spits the IP/hostname of referrer in a hidden section. Using that you can identify the IP/hostnames, so if he changes, you can always detect it.

Now that you can detect him, when he crawls your site, feed him garbage info for every single page, then constantly check his page for the hidden ip/hash in case he changes his IP/host. Hide that in a minified js. You can also feed his page bogus links that violates google's SEO so he can get blacklisted.

Re: My website is being stolen in real time and I don't know what to do

#79

Post by raverbashing »

BlakePetersen wrote: post #61
raverbashing wrote: post #30

Ok, time for a reality check If you can't imagine what to do in this situation you shouldn't be running a website of this nature This type of thing can (and does) happen and it's up to you to know how to defend yourself. The others have given plenty of ideas, but I guess there are more specific things that can be done depending on their page structure/ads etc

So, you're suggesting him just giving up on his site and moving on? One issue that wasn't even his fault and he should walk away? I guess trying to ask for advice and acting on that advice, all the while learning more and more about the potential attack vectors one should be aware of when dealing with these relatively new cryptocurrency services, is a shit idea. BTW, love your intolerant handle. I guess you'd be bash…

No, I expect him to sit, analyze the situation and learn things instead of a hopeless "I don't know what to do"

The issue is not "Please advice me what to do", it is saying it in the spirit of someone who doesn't know how he got in the situation in the first place. For someone who builds a site like that, he should've know better.

Re: My website is being stolen in real time and I don't know what to do

#80

Post by raverbashing »

jnevill wrote: post #58
raverbashing wrote: post #30

Ok, time for a reality check If you can't imagine what to do in this situation you shouldn't be running a website of this nature This type of thing can (and does) happen and it's up to you to know how to defend yourself. The others have given plenty of ideas, but I guess there are more specific things that can be done depending on their page structure/ads etc

This is just terrible advice. "You shouldn't run a website unless you know how to deal with this"... and yet the only way you would learn to deal with this is if you were running a website... You are an idiot.

You don't accelerate your car to 100mph and then ask "how do I brake"

If he launched the site, some technical knowledge he must have, however, to then not know (as in, to not have any idea) what to do seems strange.

Thanks for the offence, but it's not me who's hopeless about their website.

Post reply on HN