6 ms·

Instead of blocking by IP, just check SERVER_NAME/HTTP_SERVER variables in your backend/web server (or even in JavaScript of the page check window.location.host

by nuccy 4y ago

Instead of blocking by IP, just check SERVER_NAME/HTTP_SERVER variables in your backend/web server (or even in JavaScript of the page check window.location.hostname) and in case those include anything but original hostname, redirect to the original website (or serve different content with a warning to the visitor). If you have apache2/nginx this can be easily achieved by creating a default virtualhost (which is not your website), and additionally creating explicitly your website virtualhost. Then the default virtualhost can have a proper redirect while serving any other hostname. Those variables are populated by the browser, unless proxying server is rewring them, your web-server will be able to detect imposter and serve him/her with a redirect. If rewrites are indeed in place, then check in the frontend. Blocking by IP is the last option if nothing else works.

michaelmior 4y ago
As the OP mentioned, JS is stripped and URLs are being written, so I doubt either of those approaches will work.
- nuccy 4y ago
  Making js essential is not that hard, right? Just "display: none" on the root element, which is removed by js :) More sophisticated options can been found in other comments.
  - nuccy 4y ago
    The other kind of problem is if the website is not really proxied but rather dumped, patched and re-served. In such case the only option (if JavaScript frontend redirect doesn't work) is blocking by IP the dumping server. To identify IPs, as pointed in the root comment of this thread, you can create a one-pixel link to a dummy page, which dumping software would visit, but a human wouldn't. So you will see who visited that specific page and block those IPs for good.
    - michaelmior 4y ago
      I would think you'd want to be careful about search engines with that approach. Assuming the OP wants their site indexed, you could end up unintentionally blocking crawlers.
  - michaelmior 4y ago
    Forcing all users of your website to use JavaScript to get around a scammer is pretty heavy-handed.
    - kelnos 4y ago
      Presumably OP would only have to do this for a limited time, until the scammer gives up and moves on to an easier target. It's not the best, but I don't think it's as bad as you say.
    - krater23 4y ago
      Show me one website that today really works without javascript.
      - jethro_tell 4y ago
        https://news.ycombinator.com https://news.ycombinator.com
      - c22 4y ago
        I've been surfing without javascript since 2015. Most websites continue to work fine without it (though some aesthetic breakage is pretty standard). About 25% of sites become unusable, usually due to some poorly implemented cookie consent popup. I don't feel like I'm missing out on anything by simply refusing to patronize these sites. I will selectively turn JS on in some specific cases where dynamic content is required to deliver the value prop.
        michaelmior 4y ago
        > Most websites continue to work fine without it > About 25% of sites become unusable These two statements seem pretty contradictory. 75% feels like a low threshold for "most."
        c22 4y ago
        Most is more than half.
  - tofuahdude 4y ago
    Tail wagging the dog is never a good answer.
  - klyrs 4y ago
    It's trivial to strip that "display: none" out, too.
    - brazzledazzle 4y ago
      Yea if they're already rewriting content to serve ads (likely since they're probably not doing this for altruistic reasons) you're just putting off the inevitable. While blocking or captcha'ing source IPs is also a cat and mouse game it's much more effective for a longer period of time.
- mnutt 4y ago
  Maybe an html <meta> redirect tag that bounces through a tertiary domain before redirecting to your real one? If they noticed you were doing it they could mitigate it, but they might deem it too much effort and just go away. You might also start with the hypothesis that they're using regex for JS removal and try various script injection tricks...
  - michaelmior 4y ago
    If they're already stripping JS, I can't imagine it would be a lot of work to also remove the <meta> redirect.

by nuccy 4y ago

michaelmior 4y ago

As the OP mentioned, JS is stripped and URLs are being written, so I doubt either of those approaches will work.

nuccy 4y ago
Making js essential is not that hard, right? Just "display: none" on the root element, which is removed by js :) More sophisticated options can been found in other comments.
- nuccy 4y ago
  The other kind of problem is if the website is not really proxied but rather dumped, patched and re-served. In such case the only option (if JavaScript frontend redirect doesn't work) is blocking by IP the dumping server. To identify IPs, as pointed in the root comment of this thread, you can create a one-pixel link to a dummy page, which dumping software would visit, but a human wouldn't. So you will see who visited that specific page and block those IPs for good.
  - michaelmior 4y ago
    I would think you'd want to be careful about search engines with that approach. Assuming the OP wants their site indexed, you could end up unintentionally blocking crawlers.
- michaelmior 4y ago
  Forcing all users of your website to use JavaScript to get around a scammer is pretty heavy-handed.
  - kelnos 4y ago
    Presumably OP would only have to do this for a limited time, until the scammer gives up and moves on to an easier target. It's not the best, but I don't think it's as bad as you say.
  - krater23 4y ago
    Show me one website that today really works without javascript.
    - jethro_tell 4y ago
      https://news.ycombinator.com https://news.ycombinator.com
    - c22 4y ago
      I've been surfing without javascript since 2015. Most websites continue to work fine without it (though some aesthetic breakage is pretty standard). About 25% of sites become unusable, usually due to some poorly implemented cookie consent popup. I don't feel like I'm missing out on anything by simply refusing to patronize these sites. I will selectively turn JS on in some specific cases where dynamic content is required to deliver the value prop.
      - michaelmior 4y ago
        > Most websites continue to work fine without it > About 25% of sites become unusable These two statements seem pretty contradictory. 75% feels like a low threshold for "most."
        c22 4y ago
        Most is more than half.
- tofuahdude 4y ago
  Tail wagging the dog is never a good answer.
- klyrs 4y ago
  It's trivial to strip that "display: none" out, too.
  - brazzledazzle 4y ago
    Yea if they're already rewriting content to serve ads (likely since they're probably not doing this for altruistic reasons) you're just putting off the inevitable. While blocking or captcha'ing source IPs is also a cat and mouse game it's much more effective for a longer period of time.
mnutt 4y ago
Maybe an html <meta> redirect tag that bounces through a tertiary domain before redirecting to your real one? If they noticed you were doing it they could mitigate it, but they might deem it too much effort and just go away. You might also start with the hypothesis that they're using regex for JS removal and try various script injection tricks...
- michaelmior 4y ago
  If they're already stripping JS, I can't imagine it would be a lot of work to also remove the <meta> redirect.