4 ms·

I like how you think. These are all great ideas! Reminds me of a time some real estate website hotlinked a ton of images from my website. After I asked them t

I like how you think. These are all great ideas! Reminds me of a time some real estate website hotlinked a ton of images from my website. After I asked them to stop and they ignored me I added an nginx rewrite rule to send them a bunch of pictures of houses that were on fire. For some reason they stopped using my website as their image host after that.

egberts1 4y ago
What a sure-fire way to toast them! Kudos!
davidrupp 4y ago
Bummed that I can upvote this only once. Excellent work.
smaudet 4y ago
Is the primary motivator to do this? I'm curious if they are stealing anything else, e.g. are they selling ads/tracking, do they replace order forms with their own...
- mkoryak 4y ago
  because I asked them to stop doing it, and they didn't. Technically they were stealing my bandwidth. Also to teach them an important lesson about the internet.
  - Firmwarrior 4y ago
    haha, they're just lucky you didn't introduce them to Goatse
    - mkoryak 4y ago
      well actually... there was another time a site hotlinked to a js file. After asking them to stop, i found that they had a contact form with a homebrew captcha which created the letters image like http://evilsite.com/cgi-bin/captcha.jpg?q=ansr http://evilsite.com/cgi-bin/captcha.jpg?q=ansr A little while later, their captcha form had a hidden input appended with the correct answer value, and the word to solve was changed to a new 4 letter word from a dictionary of interesting 4 letter words. The form still worked because of the hidden input. I might have changed the name on the "real" input also.
graderjs 4y ago
LOL! Thank you for the laugh. This is great.
pwdisswordfish9 4y ago
#5 and #6 are key. Don't try to block them directly, just get them delisted. When you've worked out a way to identify which requests belong to the scammer, feed them content that the search engines and their ad partners will penalize them for.
spmurrayzzz 4y ago
Signal boosting suggestion #1 here. Great idea. Additionally if they decide to blackhole the fake/honeypot url, since you mentioned they pass along the user agent, you could mixin some token in a randomized user agent string that your scraper uses so that you could duck-type the request on your end to signal when to capture the egress ip.

egberts1 4y ago

What a sure-fire way to toast them! Kudos!

davidrupp 4y ago

Bummed that I can upvote this only once. Excellent work.

smaudet 4y ago

Is the primary motivator to do this? I'm curious if they are stealing anything else, e.g. are they selling ads/tracking, do they replace order forms with their own...

mkoryak 4y ago
because I asked them to stop doing it, and they didn't. Technically they were stealing my bandwidth. Also to teach them an important lesson about the internet.
- Firmwarrior 4y ago
  haha, they're just lucky you didn't introduce them to Goatse
  - mkoryak 4y ago
    well actually... there was another time a site hotlinked to a js file. After asking them to stop, i found that they had a contact form with a homebrew captcha which created the letters image like http://evilsite.com/cgi-bin/captcha.jpg?q=ansr http://evilsite.com/cgi-bin/captcha.jpg?q=ansr A little while later, their captcha form had a hidden input appended with the correct answer value, and the word to solve was changed to a new 4 letter word from a dictionary of interesting 4 letter words. The form still worked because of the hidden input. I might have changed the name on the "real" input also.

graderjs 4y ago

LOL! Thank you for the laugh. This is great.

pwdisswordfish9 4y ago

#5 and #6 are key. Don't try to block them directly, just get them delisted. When you've worked out a way to identify which requests belong to the scammer, feed them content that the search engines and their ad partners will penalize them for.

spmurrayzzz 4y ago

Signal boosting suggestion #1 here. Great idea. Additionally if they decide to blackhole the fake/honeypot url, since you mentioned they pass along the user agent, you could mixin some token in a randomized user agent string that your scraper uses so that you could duck-type the request on your end to signal when to capture the egress ip.