Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Someone is proxy-mirroring my website, can I do anything?

news.ycombinator.com

Post reply on HN
Print view View original

181–190 of 310 posts

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#181

Post by LinuxBender »

IMSAI8080 wrote: post #178
LinuxBender wrote: post #132

Earlier quoted context omitted.

These are the best ideas, especially SEO poisoning and alternate images. If their point is to steal content and rankings then poisoning the well should discourage this in the future. I suspect their actual goal is to have a low-effort high SEO site to abuse as a watering hole for phishing attacks. As a side note, their domain is linked in this thread so they are seeing HN in their access logs and probably reading thi…

They said the attacker was passing through the client's user agent. If they get a user agent that is GoogleBot, they could check if the requesting IP is actually a valid Google data centre (there is a published list of IPs). If the IP is not Google directly, they could return a blank page therefore causing Google to index nothing through the mirrored site.

This is a good idea, though it may be short lived since the attackers are likely reading this due to the referrers in the logs. They may add an ACL to counter this but it might be interesting to see how long that works.

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#182

Post by supriyo-biswas »

halifaxbeard wrote: post #38

Setup Cloudflare on the domain and turn on “bot fight mode”. If the TLS ciphers the client proposes for negotiation doesn’t align with the client’s User-Agent they get a CAPTCHA. I would suspect that whoever is doing this proxy-mirroring isn’t smart enough to ensure the TLS ciphers align with the User-Agent they’re passing through.

On the free tier, does bot fight mode do anything other than simply detect bots based on JavaScript detections?

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#183

Post by Mikealcl »

nomel wrote: post #173
bvinc wrote: post #142

Earlier quoted context omitted.

Might I suggest a spin on this: instead of blocking the IPs, consider serving up different content to those IPs. You could make a page that shames their domain name for stealing content. You could make a redirect page that redirects people to your website. Or you could make a page with absolutely disgusting content. I think it would discourage them from playing the cat and mouse game with you and fixing it by getting…

> Or you could make a page with absolutely disgusting content. Not if you value the people who might move to the real domain.

You could do this without effecting normal traffic depending on uniqueness of ip doing the scraping.

Love the idea.

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#184

Post by swsieber »

Mikealcl wrote: post #183
nomel wrote: post #173

Earlier quoted context omitted.

> Or you could make a page with absolutely disgusting content. Not if you value the people who might move to the real domain.

You could do this without effecting normal traffic depending on uniqueness of ip doing the scraping. Love the idea.

I think you missed the point - if people show up at $PROXY expect nice stuff but see junk, then they won't move over to $REAL and instead blame $REAL.

E.g. you'd like some way to redirect people from $PROXY site to $REAL site, and disgusting content on $PROXY won't do that - it'll reflect poorly on $REAL

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#185

Post by jFriedensreich »

highwaylights wrote: post #94
jFriedensreich wrote: post #88

there are infinite mitigations and it will always boil down to how much they want to do this vs how much you want to prevent them. in the end they could render in a remote controlled browser and use cdn or aws ip adresses en mass, i would consider highjacking their users in subtle ways like replacing pictures or text with obscenities or legal disclaimers. unfortunately their motivation is ad selling to other dodgy co…

Maybe op only needs to do enough to undermine their website, rather than drive them away. it’s possible the combination of blocked image hotlinks, watermarking the domain inside the images, and CSS trickery that messes up the page on the proxy (along with whatever other steps that can be thought of to make it look wrong or erroneous on the proxied site) could get op bumped to #1 on search on enough links that it no l…

I would try googles phishing report (as others here have reported and allready done)https://safebrowsing.google.com/safebrowsing/report_phish/ even the example here is not targeted at stealing user dat per se

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#186

Post by michaelmior »

nuccy wrote: post #167
nuccy wrote: post #166

Earlier quoted context omitted.

Making js essential is not that hard, right? Just "display: none" on the root element, which is removed by js :) More sophisticated options can been found in other comments.

The other kind of problem is if the website is not really proxied but rather dumped, patched and re-served. In such case the only option (if JavaScript frontend redirect doesn't work) is blocking by IP the dumping server. To identify IPs, as pointed in the root comment of this thread, you can create a one-pixel link to a dummy page, which dumping software would visit, but a human wouldn't. So you will see who visited…

I would think you'd want to be careful about search engines with that approach. Assuming the OP wants their site indexed, you could end up unintentionally blocking crawlers.

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#187

Post by strictnein »

halifaxbeard wrote: post #38

Setup Cloudflare on the domain and turn on “bot fight mode”. If the TLS ciphers the client proposes for negotiation doesn’t align with the client’s User-Agent they get a CAPTCHA. I would suspect that whoever is doing this proxy-mirroring isn’t smart enough to ensure the TLS ciphers align with the User-Agent they’re passing through.

This is the correct first step.

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#188

Post by mnutt »

michaelmior wrote: post #164
nuccy wrote: post #156

Earlier quoted context omitted.

Instead of blocking by IP, just check SERVER_NAME/HTTP_SERVER variables in your backend/web server (or even in JavaScript of the page check window.location.hostname) and in case those include anything but original hostname, redirect to the original website (or serve different content with a warning to the visitor). If you have apache2/nginx this can be easily achieved by creating a default virtualhost (which is not y…

As the OP mentioned, JS is stripped and URLs are being written, so I doubt either of those approaches will work.

Maybe an html redirect tag that bounces through a tertiary domain before redirecting to your real one? If they noticed you were doing it they could mitigate it, but they might deem it too much effort and just go away.

You might also start with the hypothesis that they're using regex for JS removal and try various script injection tricks...

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#189

Post by hedora »

bvinc wrote: post #142
santah wrote: post #71

Same thing happened to me and my service ( https://next-episode.net ) almost 2 years ago. I wrote a HN post about it as well: https://news.ycombinator.com/item?id=26105890 , but to spare you all the irrelevant details and digging in the comments for updates - here is what worked for me - you can block all their IPs, even though they may have A LOT and can change them on each call: 1) I prepared a fake URL that no leg…

Might I suggest a spin on this: instead of blocking the IPs, consider serving up different content to those IPs. You could make a page that shames their domain name for stealing content. You could make a redirect page that redirects people to your website. Or you could make a page with absolutely disgusting content. I think it would discourage them from playing the cat and mouse game with you and fixing it by getting…

One possibility: Serve different content, but only if the user agent is a search engine scraper. Wait a bit to poison their search rankings, then block them.

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#190

Post by someweirdperson »

If they are serving all files, that should work for systems that check if you are the owner by asking to serve a file as a response to a challenge.

The copy is using ZeroSSL. This seems to use a similar mechanism like letsencrypt to verify certs. Maybe, you could get their certificate by serving the response to their challenge from your server. Not idea how to proceed from there.

Or activating the google webmaster tools. Maybe there's some setting "remove from index" or "upload sitemap" that could reduce its visibility on google.

Post reply on HN