171–180 of 310 posts
Earlier quoted context omitted.
They literally proxy your website? I thought they'd cache it... that makes more sense now in your statement that you hit their website with a specially formatted url. Since they pass that through to you you can filter on that. Also: since you say 4k-5k IPs... any of them from cloud providers? And specific location?
No cloud providers as far as I'm aware. They were all from the same 4-5 ASN networks, all based in Russia.
What striked me, though, is that a copycat website is waaaay faster than your original. If I were in your shoes, I would invest my time and effort into speeding up the site. Unlike hunting some script kiddies, that will bring palpable benefits.
Same thing happened to me and my service ( https://next-episode.net ) almost 2 years ago. I wrote a HN post about it as well: https://news.ycombinator.com/item?id=26105890 , but to spare you all the irrelevant details and digging in the comments for updates - here is what worked for me - you can block all their IPs, even though they may have A LOT and can change them on each call: 1) I prepared a fake URL that no leg…
Might I suggest a spin on this: instead of blocking the IPs, consider serving up different content to those IPs. You could make a page that shames their domain name for stealing content. You could make a redirect page that redirects people to your website. Or you could make a page with absolutely disgusting content. I think it would discourage them from playing the cat and mouse game with you and fixing it by getting…
Not if you value the people who might move to the real domain.
Earlier quoted context omitted.
I tried but couldn't redirect back to my website as they stripped / rewrote all JS.
You could have a "stolen content" pure HTML/CSS banner that gets removed by Javascript. Only proxy site visitors will see the banner because the proxy deleted the Javascript.
1. Create fake url endpoint. And go to that endpoint in the adversary's website, when your server gets request, flag the ip. Do this nonstop with a script. 2. Create fake html elements and put unique strings inside. And you can search that string in search engines for finding similar fake sites on different domains. 3. Create fake html element and put all request details in encrypted format. Visit adversary's website…
Doesn't that also cost you an equal amount? You'll be serving them an equal amount that they proxy to the end user.
It's not even necessarily a cost for them; you're assuming that the host is owned and paid for by the abuser. If it's simply been hijacked (quite possible), you're just racking up costs for another victim.
Earlier quoted context omitted.
As the OP mentioned, JS is stripped and URLs are being written, so I doubt either of those approaches will work.
Making js essential is not that hard, right? Just "display: none" on the root element, which is removed by js :) More sophisticated options can been found in other comments.
Earlier quoted context omitted.
Shadow nefarious techniques are the best. Don't give them clear indications that there is a problem. For example, I had an app developer start stealing API content, so once I determined points to key from them, instead of blocking them I simply randomized the API content details returned to their user's apps. Hey, API calls look good, the app looks like it is working, no problem right? Well, the users of the app were…
Serious question — is there a way to defend from this "stealing the API" thing? E.g. building an authentication of some sort and then including a key with your app?
1. Create fake url endpoint. And go to that endpoint in the adversary's website, when your server gets request, flag the ip. Do this nonstop with a script. 2. Create fake html elements and put unique strings inside. And you can search that string in search engines for finding similar fake sites on different domains. 3. Create fake html element and put all request details in encrypted format. Visit adversary's website…
These are the best ideas, especially SEO poisoning and alternate images. If their point is to steal content and rankings then poisoning the well should discourage this in the future. I suspect their actual goal is to have a low-effort high SEO site to abuse as a watering hole for phishing attacks. As a side note, their domain is linked in this thread so they are seeing HN in their access logs and probably reading thi…
The first line of defense is contacting the relevant authorities. This means search engines, the hosting provider, and the owner of the domain (who may not be the abuser). Be polite and provide relevant evidence. Make it easy for them to act on it. There'll be some turnaround time and it's not always successful, but it's the best way to get a meaningful resolution to the issue.
What about in the meantime? If all the source IPs are from one ASN, just temporarily block all IPs originating from that ASN. There'll be some collateral damage, but most of your users won't be affected.
HN probably won't like this but if they are blocking all JS you can make all content invisible with CSS and use JS to unhide it before page load finishes. Temporarily of course until these guys go away. The nice thing about this is it can be made arbitrarily complex. For example you can make the page actually blank and fetch all the normal, real content with JS after validating the user's browser as much as you like…