My website is being stolen in real time and I don't know what to do • Hacker News Board

Re: My website is being stolen in real time and I don't know what to do

#91

Post by asmosoinio » Sat, Feb 15, 2014, 12:01 AM UTC

joshstrange wrote: post #71

asmosoinio wrote: post #62

I think mentioning the short URL provider auto-killed fragmede's comment, and my copy&paste of it. Here goes again: fragmede's comment below is [dead], but has very good advice. --- Nice bit of news you added to the top, which 4co.in is putting on their own site. One piece of advice though: Drop the short link and link directly to altexplorer.net, otherwise it looks like 4co.in was 'hacked' and the short link is a ph…

I think they have to use a short-url or it gets re-written. He might be able to ajax in a page on from site (using the short-url to get it so it's not re-written) that contains the real URL as I doubt they are injecting something to re-write what is added vis JS. [0] > This won't work as it seems they're replacing any mention of "altexplorer" with "4coin" [0] https://news.ycombinator.com/item?id=7240554

True, I didn't think it through before commenting.

Re: My website is being stolen in real time and I don't know what to do

#92

Post by Faint » Sat, Feb 15, 2014, 1:02 AM UTC

Could we make him pay a few bucks?

Specifically, can we make him traffic multiply? I wonder what exactly is he doing with request headers... maybe this could work:

1) set up page /fluffy with wildly compressing contents, say 50MB of $£€$£€$£€$£€$£€.. always force gzip encoding 2) set up a few bots (amazon?) to download that page from his site, but do not accept any compression

Start the attack on some time the guy is probably sleeping, it might go on for a few hours before he notices, costing him a couple of hundred bucks in bandwidth.

Or maybe just some cpu waste in same vein: the guy has to open the gzip before forwarding to do string replace and re-zip it afterwards, so you can make sure that the content REALLY balloons..

Re: My website is being stolen in real time and I don't know what to do

#93

Post by Gigablah » Sat, Feb 15, 2014, 2:19 AM UTC

raverbashing wrote: post #79

BlakePetersen wrote: post #61

Earlier quoted context omitted.

So, you're suggesting him just giving up on his site and moving on? One issue that wasn't even his fault and he should walk away? I guess trying to ask for advice and acting on that advice, all the while learning more and more about the potential attack vectors one should be aware of when dealing with these relatively new cryptocurrency services, is a shit idea. BTW, love your intolerant handle. I guess you'd be bash…

No, I expect him to sit, analyze the situation and learn things instead of a hopeless "I don't know what to do" The issue is not "Please advice me what to do", it is saying it in the spirit of someone who doesn't know how he got in the situation in the first place. For someone who builds a site like that, he should've know better.

Read his post again. He knows what is happening. He even mentions that he could block the IP address. He simply wants to know if there are better solutions.

So the problem is the way he titles the post. Sure, okay. So make that your argument. You'll sound even pettier but at least you're not fighting a strawman.

Re: My website is being stolen in real time and I don't know what to do

#94

Post by jagannv » Sat, Feb 15, 2014, 3:01 AM UTC

codegeek wrote: post #49

Lot of good suggestions already. I am not sure if you are interested in contacting the perpetrator directly and asking them to stop this but I did a little research for you. looking up the whois info, it says that the registrant's email was bgrf@ymail.com When I put this email in google, I came across another spammy site called baklinks.blogspot.com. This site asks you to swap back links. At the bottom of the blog po…

Extending that investigation, This Google Plus profile shares the same name and similar face. https://plus.google.com/108991124177710449415/about

Re: My website is being stolen in real time and I don't know what to do

#95

Post by trevelyan » Sat, Feb 15, 2014, 3:18 AM UTC

joeyjones wrote: post #67

lmg643 wrote: post #40

Earlier quoted context omitted.

interesting that they didn't change the donation addresses. so if someone uses theirs, and likes it, sends some BTC to them, it will go to you?

Yup, donations should still go to me.

Why do you jump to the assumption that they're malicious then?

Put a few more branding elements into your page design, so that visitors to their site will understand that they're redirecting your data. Then take advantage of the extra publicity that they're giving you.

Re: My website is being stolen in real time and I don't know what to do

#96

Post by geolqued » Sat, Feb 15, 2014, 4:06 AM UTC

jarrett wrote: post #27

pilom wrote: post #7

You found out the right first step yourself: Block the source IP address. Sure it will turn into a game of whack-a-mole with them changing their IP but eventually, their customers will get fed up with their downtime. Second idea: Javascript redirect all of your pages to your own subdomain. Again, its just a step in an arms race, but this would be a little too hard/expensive to take to court. You can win an arms race…

If you have a hard time determining their IP, here's a trick that might work. Visit their site with a unique but innocuous-looking path or query that would never be accessed by a normal user. For example: http://4co.in/?q=1 If the query string is being passed through, which I suspect it is, you can use the query string to easily locate the corresponding entry in your own logs. Or, if the query string isn't being pass…

countermove: he works it out and blocks your magic query - query needs to be made from somewhere indistinguishable from normal requests. Changing IP would be best... maybe via tor.

A unique sequence of legitimate requests might be more difficult to for the other side to detect and it won't result in 404s. Could randomise the sequence and each can come from a different IP as long as they were synchronised properly.

Re: My website is being stolen in real time and I don't know what to do

#97

Post by joeyjones » Sat, Feb 15, 2014, 4:55 AM UTC

trevelyan wrote: post #95

joeyjones wrote: post #67

Earlier quoted context omitted.

Yup, donations should still go to me.

Why do you jump to the assumption that they're malicious then? Put a few more branding elements into your page design, so that visitors to their site will understand that they're redirecting your data. Then take advantage of the extra publicity that they're giving you.

Having a duplicate site would do a lot of damage to my Google search rankings.

Re: My website is being stolen in real time and I don't know what to do

#98

Post by mcv » Sat, Feb 15, 2014, 10:10 AM UTC

LanceH wrote: post #42

pilom wrote: post #7

You found out the right first step yourself: Block the source IP address. Sure it will turn into a game of whack-a-mole with them changing their IP but eventually, their customers will get fed up with their downtime. Second idea: Javascript redirect all of your pages to your own subdomain. Again, its just a step in an arms race, but this would be a little too hard/expensive to take to court. You can win an arms race…

The more subtle response is to feed them bad data until they can't trust you.

Bad data would have my vote. It's nasty, subtle, harder to detect, and it would undermine people's trust in the culprit.

Re: My website is being stolen in real time and I don't know what to do

#99

Post by danoprey » Sat, Feb 15, 2014, 11:02 AM UTC

IgorPartola wrote: post #81

If you end up trying to block his IP, don't just DROP or REJECT his packets. TARPIT [1] them! This way not only would you be denying him access, but you would also be draining his resources. Another thing to try is to see just how much data his server will take. See if you can send him a GB-sized response. [1] http://www.netfilter.org/projects/patch-o-matic/pom-external...

Please try contacting them directly and simply asking to stop before doing this!

Re: My website is being stolen in real time and I don't know what to do

#100

Post by vdance » Sat, Feb 15, 2014, 12:57 PM UTC

First post here at HN... but I would try a shame tactic (per codegeek's helpful name research). In a nice bright box just above your normal content, send the following text back to his IP address ...

"Hello, my name is and I've stolen the content that you are viewing right now -- someone's hard work. I stole it in a very intentional and fairly disrespecful way. Sometimes we get life lessons and this may well be one of mine. Instead of using my skills to do good with the precious time that I have in this beautiful world, I've chosen to write a fairly nefarious script to copy every single page of someone else's website and suck it back into my website, so that I can profit from someone else's work. The message you are reading right now may go away for a day or two, if I change my IP address. But rest assured, it will be back once my IP address is rediscovered. This event will also follow me forever on search engines when people search my name -- future employers, friends, family. I have been doing this for days and have been asked to stop. I haven't yet, but time will tell.... ()

In the meantime, if you would like to visit the real website go ..."