Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I accidentally made my link shortener into a malware honeypot

app.y.gy

Post reply on HN
Print view View original

111–118 of 118 posts

Re: I accidentally made my link shortener into a malware honeypot

#111

Post by 63stack »

infotainment wrote: post #94
63stack wrote: post #89

Earlier quoted context omitted.

I don't understand why shadowbanning would be so effective. It's trivial for any competent spammer to check their submissions from different ip addresses, they will very quickly discover if they are shadowbanned. The risk of misidentifying legit users and shadowbanning them outweighs the potential gain.

It may be trivial, but I think the answer is: they don’t double check. Possibly that’s too much effort to do so?

I might be wrong on how these spam bots operate, but I assume someone (human) has to write at least a few lines of scripts tailored to the form on the website, to actually submit the spam. Adding a few more lines to also check that the submission went through doesn't seem like much effort.

Re: I accidentally made my link shortener into a malware honeypot

#112

Post by sebazzz »

xyst wrote: post #44
JoshTriplett wrote: post #18

What's the benefit of a link shortener, these days? It made sense back before Twitter had one of their own. And I know that some people use it to get link analytics. I've also occasionally seen it used for printed materials, to get pretty URLs that are easy to hand-type. People also use it for malicious purposes, such as hiding malware, or disguising referral links, or otherwise trying to obfuscate where a link is go…

More for vanity and possibly increases engagement. Like you said, if I want a group of people to visit a link. Would you type in “q.ly/abc” or “website.com/20240229/my-blog-title-here/1” But as some have mentioned, QR codes have easily replaced URL shorteners for this purpose anyways. Also I guess for the very small number of people without a device that can’t read QR codes, a shortened url would help them engage

URL shorteners still benefit QR codes, if you can’t control the length of the URL or want to abuse the QR code by putting some logo in the middle.

Re: I accidentally made my link shortener into a malware honeypot

#113

Post by nullc »

63stack wrote: post #89
david422 wrote: post #25

I've dealt with some spammers to various degrees. I think one of the most effective ways of dealing with spammers is to - "shadowban" them. Allow them to use your service, but don't indicate to them that you've identified them as malicious. For instance, when dealing with chat spammers - allow them to chat, but do not show their chats to other users. Another level would be to allow them to chat, but only show their c…

I don't understand why shadowbanning would be so effective. It's trivial for any competent spammer to check their submissions from different ip addresses, they will very quickly discover if they are shadowbanned. The risk of misidentifying legit users and shadowbanning them outweighs the potential gain.

Some of the "spammers" are just mentally ill people. The unethical practice of shadowbanning is highly effective against them.

Re: I accidentally made my link shortener into a malware honeypot

#114

Post by nullc »

63stack wrote: post #110
15457345234 wrote: post #100

Earlier quoted context omitted.

> The risk of misidentifying legit users and shadowbanning them What's the risk?

A legit user getting told they are banned can contact the site to try and resolve the issue on why they have been misidentified, getting shadowbanned will possibly never get resolved.

Not just never resolved but potentially waste large amount of their time making posts that will never be seen by anyone else.

Re: I accidentally made my link shortener into a malware honeypot

#115

Post by codeonline »

15457345234 wrote: post #101
codeonline wrote: post #78

Earlier quoted context omitted.

They are useful for links that need to outlive the infrastructure they are hosted on. Think about them as a layer of abstraction. Ie. Links in paper published to a journal like nature. It might be valid for 10 years but the links embedded in it will rot quickly as organisations change cms's, domains names change. Organisations merge and disappear. Also places where the cost to change the url is expensive, bus shelter…

> links embedded in it will rot quickly as organisations change cms's, domains names change. Organisations merge and disappear. A link shortener doesn't solve any of those problems

They do when you control the link shortener

Re: I accidentally made my link shortener into a malware honeypot

#116

Post by david422 »

63stack wrote: post #89
david422 wrote: post #25

I've dealt with some spammers to various degrees. I think one of the most effective ways of dealing with spammers is to - "shadowban" them. Allow them to use your service, but don't indicate to them that you've identified them as malicious. For instance, when dealing with chat spammers - allow them to chat, but do not show their chats to other users. Another level would be to allow them to chat, but only show their c…

I don't understand why shadowbanning would be so effective. It's trivial for any competent spammer to check their submissions from different ip addresses, they will very quickly discover if they are shadowbanned. The risk of misidentifying legit users and shadowbanning them outweighs the potential gain.

> I don't understand why shadowbanning would be so effective

Because if done correctly the user never knows they are shadow-banned. It sounds trivial when you know _how_ the shadowban is done. But for instance, instead of an IP check, perhaps it's a time check - after 3 days it comes into play. Or a combination of different checks. So imagine that you are accessing a service that appears to be working correctly .... you would basically need to a) determine that that service even does shadowbanning, and b) think of infinite ways that you might be shadowbanned and try to determine if that's the case.

Re: I accidentally made my link shortener into a malware honeypot

#117

Post by heleninboodler »

mik3y wrote: post #95
heleninboodler wrote: post #93

Earlier quoted context omitted.

How current is this? It doesn't actually have *.blogger.com in it, nor the other two examples I checked.

I just made up `blogger.com` as an example. I probably could have picked a better one. `blogspot.com` & its many TLD variations are on the list. It looks like the repo where the list is maintained [1] is pretty active. YMMV, I'm not a maintainer or anything.. [1] https://github.com/publicsuffix/list

The other two I checked were *.wordpress.com and *.bandcamp.com, both well known TLDs with user-generated subdomains. Neither is there.

Re: I accidentally made my link shortener into a malware honeypot

#118

Post by 99catmaster »

xyst wrote: post #40
david422 wrote: post #25

I've dealt with some spammers to various degrees. I think one of the most effective ways of dealing with spammers is to - "shadowban" them. Allow them to use your service, but don't indicate to them that you've identified them as malicious. For instance, when dealing with chat spammers - allow them to chat, but do not show their chats to other users. Another level would be to allow them to chat, but only show their c…

> if the ip address that created the link shortener accesses the link, they get the real redirect, and if a different ip address accesses it If there’s anything I have learned about IP based blocking, it’s very unreliable. Especially in a NAT’d world. Great you “shadowbanned” an IP, but you also impacted many other people and devices behind that public IP including the bad actor. IPv6 is supposed to make NAT irreleva…

Sorry for noob question but what does NAT and NAT’d mean in this context?
Post reply on HN