HN Explorer

My website is being stolen in real time and I don't know what to do

90 points by joeyjones ↗ HN
I launched the site http://altexplorer.net at the start of January as a Block Explorer and information hub for alternative cryptographic currencies. This morning I found a site http://4co.in which is ripping-off my site in real-time; every time a page is loaded on 4co.in it uses php to load the corresponding page from http://altexplorer.net, removes analytics and ad tags, replaces the site name, and replaces the link URLs.

I've put a lot of effort into building this site and keeping it running, and now someone in India is stealing it in real-time. Every page load to 4coin causes an identical page load in the nginx logs of http://altexplorer.net. What can I do besides blocking the source IP address to stop this?

Screen shots: Alt Explorer home page: https://d1eem2029tdth0.cloudfront.net/img/altexplorer-home.png

4coin home page: https://d1eem2029tdth0.cloudfront.net/img/4coin-home.png

Alt Explorer profitability page: https://d1eem2029tdth0.cloudfront.net/img/altexplorer-prof.png

4coin profitability page: https://d1eem2029tdth0.cloudfront.net/img/4coin-prof.png

110 comments

[ 0.26 ms ] story [ 158 ms ] thread
joeyjones
Sample log excerpt: 162.222.227.123 - - [14/Feb/2014:18:18:48 +0000] "GET / HTTP/1.1" 200 23271 "-" "-" "162.222.227.123"

162.222.227.123 - - [14/Feb/2014:18:37:51 +0000] "GET /chain/42 HTTP/1.1" 200 76170 "-" "-" "162.222.227.123"

162.222.227.123 - - [14/Feb/2014:17:40:58 +0000] "GET /block/0e67dcf5f6797840a98061af7581138f2347feb168d78f7138d4268c6f854748 HTTP/1.1" 200 15719 "-" "-" "162.222.227.123"

162.222.227.123 - - [14/Feb/2014:18:38:21 +0000] "GET /tx/6c636ebff9674f4168b80b415f8a9097509802992b0422a4fa98c543da9c068e HTTP/1.1" 200 15898 "-" "-" "162.222.227.123"

162.222.227.123 - - [14/Feb/2014:17:41:05 +0000] "GET /address/GRjc357hnC7THEUPVJmpMmCjSAGn54CJnx HTTP/1.1" 200 14034 "-" "-" "162.222.227.123"

162.222.227.123 - - [14/Feb/2014:18:13:21 +0000] "GET /news HTTP/1.1" 200 16675 "-" "-" "162.222.227.123"

162.222.227.123 - - [14/Feb/2014:18:19:12 +0000] "GET /profitability HTTP/1.1" 200 188354 "-" "-" "162.222.227.123"

whitehat2k9
Since the faker's requests don't have a User-Agent, you could block all requests lacking a valid User-Agent HTTP header.
icedchai
recommendation: respond with fake data, based on source IP. the problem will take care of itself.
joeyjones
I am going to lok into this later today through nginx. I am planning on having every request from their scraping IP return a static page linking to the proper site.
kevin0722
Excellent. Keep us posted. Good luck.
[deleted]
(comment deleted)
MarkPNeyer
this is probably better than banning their source ip, as it will take longer to detect and piss off their customers.

also, report them to adsense and anyone else serving their ads.

macNchz
Gigabytes of fake data.

Let them eat /dev/urandom to their heart's content.

Zancarius
> Let them eat /dev/urandom to their heart's content.

No! You can't just give them purely random data. No, sir. That would be easy enough to detect.

What you need is plausible randomness. Shift the value of every transaction by a small percent. Trending everything downward over time, but making it plausible, would be far more entertaining with random upward trends. Best buy now before it gets too expensive! Oh, I'm sorry? That wasn't the actual price? Well, you'd best use a reputable source!

If you're going to poison the well, you don't want to be caught. You want them to wonder at what point their data set diverged and for how long they've been serving incorrect data. Sinister points for interspersing legitimate data with munged data.

The trick with being evil in this case is to be subtle about it. They want to scrape all your metrics? Let them. You just can't guarantee the accuracy of the data they're scraping, right? [wink, wink]

benologist
Report them to their web host and the ad networks they use. Don't troll them with different content just go for the kill - some accounts like AdSense carry lifetime bans.
joeyjones
I have reported it to the abuse contact of the web host, colocation provider, and cloudflare. I am however not expecting a response in a timely manner from any of them.

Luckily they are stripping out the ad tags before displaying by site so it shouldn't affect Ad Sense.

toomuchtodo
Do you know who their web host is? If so, block the whole Class B from fetching your site.
devicenull
Class B? What is this, 1992?
toomuchtodo
You're right. Thanks for keeping me honest.

Don't just block the /24 ("Class C" IP block), block the /16 ("Class B" IP block) the IP resides in. You'll reduce your audience in India, but they'll have to switch webhosts to continue leaching his/her site.

http://www.oav.net/mirrors/cidr.html

[deleted]
(comment deleted)
[deleted]
(comment deleted)
pilom
You found out the right first step yourself: Block the source IP address. Sure it will turn into a game of whack-a-mole with them changing their IP but eventually, their customers will get fed up with their downtime.

Second idea: Javascript redirect all of your pages to your own subdomain. Again, its just a step in an arms race, but this would be a little too hard/expensive to take to court. You can win an arms race if you try.

joeyjones
For now I have added a news post with a link to the proper site and am debating between blocking the IP or delivering a static page with a link to the proper URL or a javascript redirect to the proper site.
fragmede
I'd do a javascript redirect so you get the ad-views and the users of the site see the new URL.

(for now)

[deleted]
(comment deleted)
jarrett
If you have a hard time determining their IP, here's a trick that might work. Visit their site with a unique but innocuous-looking path or query that would never be accessed by a normal user. For example:

http://4co.in/?q=1

If the query string is being passed through, which I suspect it is, you can use the query string to easily locate the corresponding entry in your own logs. Or, if the query string isn't being passed through, you can use a path instead:

http://4co.in/q

You probably already thought of this technique. I decided to post it anyway in case you hadn't, or in case anyone else is facing a similar challenge.

xauronx
Clever solution! I like it
intev
Building on this, you could create a script on your server that requests a random url, then greps that url in your logs to figure out the IP and then add that to the banned list. It'll be an auto banning machine!
geolqued
countermove: he works it out and blocks your magic query - query needs to be made from somewhere indistinguishable from normal requests. Changing IP would be best... maybe via tor.

A unique sequence of legitimate requests might be more difficult to for the other side to detect and it won't result in 404s. Could randomise the sequence and each can come from a different IP as long as they were synchronised properly.

jarrett
> countermove: he works it out and blocks your magic query

He very well might. But my estimation of the thief's skills is low. I could be wrong, of course.

> A unique sequence of legitimate requests might be more difficult to for the other side to detect and it won't result in 404s. Could randomise the sequence and each can come from a different IP as long as they were synchronised properly.

That's probably the best bet. A legitimate but very winding path through actual links on the site would work quite well. Given enough steps, it would almost certainly be unique. Because you'd be varying the path each time, the thief would find it hard or impossible to block you.

lmg643
interesting that they didn't change the donation addresses. so if someone uses theirs, and likes it, sends some BTC to them, it will go to you?
joeyjones
Yup, donations should still go to me.
trevelyan
Why do you jump to the assumption that they're malicious then?

Put a few more branding elements into your page design, so that visitors to their site will understand that they're redirecting your data. Then take advantage of the extra publicity that they're giving you.

joeyjones
Having a duplicate site would do a lot of damage to my Google search rankings.
dhoulb
Not sure if he's stripping it, but serving a 'canonical' meta tag would solve that if he's not,
LanceH
The more subtle response is to feed them bad data until they can't trust you.
mcv
Bad data would have my vote. It's nasty, subtle, harder to detect, and it would undermine people's trust in the culprit.
[dead] fragmede
Nice bit of news you added to the top, which 4co.in is putting on their own site.

One piece of advice though: Drop the goo.gl short link and link directly to http://altexplorer.net, otherwise it looks like 4co.in was 'hacked' and goo.gl is a phishing/some other sort of scam and not legit.

You should be able to pickup the 4coi.in domain as the referrer if you want metrics for how many people were using 4co.in.

[deleted]
(comment deleted)
beauzero
Instead of blocking source IP. Detect and send "unwanted information".
BlakePetersen
I agree, this may be a more effective approach than trying to block the IP and the whole whack-a-mole issue.

Essentially, they trust the data you're providing and are trying to make a buck off that info. But if they lose that trust because they don't know whether the data is legit or not, you win!

I would also try to mask the fact that the data is not accurate, if they immediately see everything as simply zeroed out, it would be a huge red flag you're on to them. If you provide them ALMOST correct data, it would be harder for them to determine what's going on and their users will see realize the disparity and (hopefully) get burned and never come back.

Essentially, the trick is to destroy the site's credibility so there's no financial benefit to continue to steal from you.

Good Luck!

dhoulb
This is a great approach.

I'd also recommend only borking SOME of the data - an intermittent bug is harder to fix than a consistent one!

[dead] TempleOSV2
C:\TAD\Text\WALDEN.TXT

ay, to my astonishment, making the holes with a hoe for the seventieth time at least, and not for himself to lie down in! But why should not the New Englander try new adventures, and not lay so much stress on his grain, his potato and grass crop, and his orchards -- raise other crops than these? Why concern ourselves so much about our beans for seed, and not be concerned at all about a new generation of men? We should really be fed and cheered if when we met a man we were sure to see that some of

al2o3cr
Detect their IP and 301 their requests to goatse. Or something worse, if you're bent like that. :)
jaredsohn
goatse as it was is no more. They had planned to offer vanity email addresses, but I am not sure if it took off. It looks like they're doing something with dogecoin now.

But an image search should help you find the image.

Navarr
Why do that to people who probably don't know 4coin is being a thief?
fallinghawks
The point is to make them stop going to 4co.in at all. No credibility = no traffic = dead site. And hopefully the thief learns a lesson.
[deleted]
(comment deleted)
TrainedMonkey
I would contact the other site first and find out WTF. It is unlikely, but they might have a good reason for it. If they are just trying to rip you off, solution might be as simple as just asking them to stop.
joeyjones
The thing is that the coin information isn't unique and the block, tx, address, etc info is all on the block chain. The unique content is the profitability and historic information, but the charting is broken in what they scrape.
dhoulb
Problem is contacting him first tips him off. If you build a technological solution, you can reuse it if this ever happens again.
raverbashing
Ok, time for a reality check

If you can't imagine what to do in this situation you shouldn't be running a website of this nature

This type of thing can (and does) happen and it's up to you to know how to defend yourself.

The others have given plenty of ideas, but I guess there are more specific things that can be done depending on their page structure/ads etc

jnevill
This is just terrible advice. "You shouldn't run a website unless you know how to deal with this"... and yet the only way you would learn to deal with this is if you were running a website...

You are an idiot.

raverbashing
You don't accelerate your car to 100mph and then ask "how do I brake"

If he launched the site, some technical knowledge he must have, however, to then not know (as in, to not have any idea) what to do seems strange.

Thanks for the offence, but it's not me who's hopeless about their website.

BlakePetersen
So, you're suggesting him just giving up on his site and moving on? One issue that wasn't even his fault and he should walk away?

I guess trying to ask for advice and acting on that advice, all the while learning more and more about the potential attack vectors one should be aware of when dealing with these relatively new cryptocurrency services, is a shit idea.

BTW, love your intolerant handle. I guess you'd be bashing me then. Sorry my taste in music differs from yours, please don't "bash" me.

cowers in fear as the old, bitter hippie grabs his cane

maxerickson
You shouldn't bother with all the personal attacks.
raverbashing
No, I expect him to sit, analyze the situation and learn things instead of a hopeless "I don't know what to do"

The issue is not "Please advice me what to do", it is saying it in the spirit of someone who doesn't know how he got in the situation in the first place. For someone who builds a site like that, he should've know better.

Gigablah
Read his post again. He knows what is happening. He even mentions that he could block the IP address. He simply wants to know if there are better solutions.

So the problem is the way he titles the post. Sure, okay. So make that your argument. You'll sound even pettier but at least you're not fighting a strawman.

dhoulb
He's not really asking what to do - I'm sure he can think of 10 things. He's really asking 'what would you do'. And he's getting some awesome feedback from the community. What made you so bitter!
mynameismiek
Do I need more karma to down vote people? Because, I would totally down vote this guy if I could.
jbeja
I think you need 500 to downvote.
tedivm
You can use javascript frame busting techniques to redirect back to the main page. You can also use mod_rewrite or some proxy setups to make it so a completely different set of pages shows up for people coming from that site. This is better than just blocking it because it's a bit more subtle and lets you tell that site's users what's happening.
[deleted]
(comment deleted)
fceruti
Serve a different website for that ip with fake data.
[dead] ye
A perfect troll setup.

So many fun options.

1) Use javascript to replace their ad referrers with yours.

2) Display porn only for them

3) Random infinite page refreshes on their servers.

4) Javascript fake-click the ads so they get banned by their ad network

RobPomeroy
You should be able to apply behavioural detection here even if the IP address changes - they'd have to be polling your site regularly. Is there a discernible pattern in the logs?
lotsofmangos
Use imagemagick to watermark all image requests on the fly so you can keep changing the position of a url watermark on all images.

edit - actually, don't do this as it is trivially easy to get around by doing 2 or 3 requests and keeping anything that hasn't changed.

Or if you do do this, add a low level noise filter on top so that the attacker can't just directly equate pixel values.

michaelmcmillan
<img src="x" onerror= "if(document.location.href!='http://altexplorer.net')document.location='//goatse.cx';">
kposehn
You, sir, win.
jw2013
but 4coin can add some simple code (e.g. use regex) just to remove that line from scrapped content before sending it to the user though.
iamdanfox
You could defeat regex by sending a different base64 string each time by including a call to void(server side random number).
jw2013
yes, you can, but since the core of above line is unchanged because the you need the functionality of that line, they can still regex the core part (but not the whole line since there are some random chars or random numbers you put)
cbaleanu
Question answered. Topic closed.
Navarr
This won't work as it seems they're replacing any mention of "altexplorer" with "4coin"
[deleted]
(comment deleted)
cheald
<img src="x" onerror="eval(atob('aWYoZG9jdW1lbnQubG9jYXRpb24uaHJlZiE9J2h0dHA6Ly9hbHRleHBsb3Jlci5uZXQnKWRvY3VtZW50LmxvY2F0aW9uPScvL2dvYXRzZS5jeCc7'))" />
[dead] jw2013
putting following on your website and thus "notifying" 4coin users is such a clover move!!! I am just wondering what 4coin's next move may be.

"2014-02-14 A site has been found that is stealing the content in real-time: 4co.in. If you are viewing this from 4co.in please go to http://goo.gl/w1f6Sq to view the correct site. I am not responsible for any malicious content or malware on 4co.in."

codegeek
Lot of good suggestions already. I am not sure if you are interested in contacting the perpetrator directly and asking them to stop this but I did a little research for you.

looking up the whois info, it says that the registrant's email was bgrf@ymail.com

When I put this email in google, I came across another spammy site called baklinks.blogspot.com. This site asks you to swap back links. At the bottom of the blog post, I found the name of the person "Naveen K R"

I then looked up google with "Naveen K R + bgrf". I was able to find a site he (probably) runs called www.zokali.com

More googling combos, I finally found his linkedin profile and his name "Naveen K Ramanand"

https://www.linkedin.com/in/krnaveen.

May be you can contact this guy directly. Seems like he is the one doing this or at least he knows who.

chaz
People usually use the same username, too, so using the LinkedIn username on Twitter: https://twitter.com/krnaveen. There's this tweet from November:

  I started to earn money on 4co.in short links. It’s easy -
  make the short links and earn the biggest money. http://4co.in
scraper90210
there are companies offering services to deal with this, just depends on how much your time is worth. Here is one option. www.distilnetworks.com ... in case you tire of whack-a-mole