https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corru...
Even when I've been able to track down hosts, registrars, etc for scraped duplicates of sites, and report to all and Google, Microsoft Safety Scanner, etc -- nobody acts (or certainly not in any reasonable enough time to be useful).
In one case the scammer was using our own logo served directly from a source we could replace with Cloudflare rewrites. So the hijacked logo became "THIS IS A SCAM SITE" while we replaced the one on production.
I act. I receive about 5 takedown notices every day--the curse of running an open source DNS service (nip.io/sslip.io).
I've received over 1,000 takedown requests, but none came from Cloudflare or Google. Most of them come from Netcraft, Phishlabs, and doppel.com.
Are you getting takedown requests from people who don’t understand how DNS works, or… are they actually suggesting that your particular DNS server filter particular results?
They seem to invite it
This is literally false. They are one of the few hosts I have dealt with that actually does NOT do this. Their abuse reporting form even has check boxes that are optional to forward it to the underlying host and the owner. If you leave them unchecked they don't forward anything.
I don't know where you got your information from but it's quite literally the opposite of reality.
Now, whether or not they actually act on it depends on whether they are proxying the site or merely providing authoritative DNS. If they are just providing DNS they will continue to provide it and deny your report and I think that's stupid and frustrating. If they are proxying it they will put up a block page in front of it which is meh.
I'd have trouble believing that U.S. Attorney General Todd Blanche would care very much, but I guess it wouldn't hurt to try.
Upload a scam ad? No problemo.
The scale is mind-boggling. The number 404 is poetic. Any possible (mis) spelling of the brand will open the "intended" site - you will never see a 404 :D. Auto-correct on steroids indeed.
And I imagine this sort of thing must be happening across hundreds of markets not just US. And possibly not just food delivery but other types of ecommerce as well.
I also block every single domain whose name contains non-ASCII character (no Unicode domain names for me / no punnycode: just get lost).
So maybe, maybe, maybe that after all I'll be moving to whitelisting domains. I know some do it and I know it's hard to do right. But some do just that.
It may be time for companies to give the list of all the domains we need to whitelist for their site to function.
Better yet: it may be time for companies to use as few domains as possible.
I don't care about your ads partners. I don't care about your surveillance (pardon, telemetry) partners.
It's too early to tell but a mindset shift may be coming.
Why are they allowed to direct you to literal scams? Why are they allowed to profit off of literal scams?
This affects the company I work for, who gets called every single day with customer complaints from people who clicked the scam link from a search ad when looking for our site.
Our site has existed for over a decade. There's no justifiable reason that a company who's brand is known by every single grocer or merchant to somehow show up under a literal fly by night scam company pretending to have the same name. It's unacceptable.
My sister got scammed by this exact mechanism just last week.
Residential proxies on the other hand i don't think have any legitime usecase. I would support people working around Youtube to export interesting videos to Bittorrent. But what's happening is malicious actors going around rate limiting to run bad-behaving scrapers on smaller sites. That, and much worse is the residential proxy economy.
[0] https://www.fdn.fr/the-fdn-and-gitoyen-networks-are-blocked-...
Brands and their ordering providers that watch for their site loading under someone else's domain, or for checkout sessions that never reach the real payment provider, are well placed to catch these sites early.
It can be detected if the IT folks look in the right places. I suppose a SCAM ALERT page could be presented to a reverse proxy when discovered.
Excuse me while I go throw up, can’t believe I just recommended that.
In the old days, delivery was limited to pizza, and occasionally Chinese. You'd call the restaurant directly and place the order. The only possible way a scammer would get you is if you called the wrong number. That's why we had the Yellow Pages.
It seems from comments here that Google is a lot less reliable than the Yellow Pages were.
Maybe its time to turn off the web. Its only going to get worse.
We’ve been trained to ignore the domain name and accept putting sensitive content into random third party providers. How does a scam site look any different?
Either:
- They actually decided to remove one of the most annoying things about the modern web... and replace it with something very similar to tell you that they removed it, or...
- They found some legal justification for getting me to accept their cookies for dismissing the "no cookie banner banner"
Either choice makes me think less of them.
[edit: added extra newlines so bullets showed up correctly]
Then it links to a page which is even more explicit about how little they collect: https://www.infohawk.com/cookies
My point is: they did all the necessary work required (no third party tracking cookies) to NOT HAVE TO show a banner...
... and then they chose to show a banner.
I took down a fully static public web page that had basically no traffic and no cookies. It literally just said that a domain that I had was not associated with a popular brand name that was on a different TLD so don’t email me about it.
I got as many emails complaining there was no cookie banner as I had previously gotten about the brand. There is some brand of privacy crank out there that likes to harass people about those banners (and similar gdpr regs).
If you just show the actual content in a readable format that uses the screenspace people will get scared and think of your site as unprofessional. People are so used to these popups, modals and annoyances that interrupt, take away screen space from and cover the content that they expect them.
Laughter is the best medicine.
Is it just some JS on bad.com shuttling assets from the real site and displaying them on the fake one? Shouldn't the right CORS headers from the real site prevent this?
Is it a real browser running on a server somewhere visiting the real site, and then rendering that output on a <canvas> on the fake site to avoid the browser's built in protections against this kind of thing? And throwing up their own credit card entry form when the time is right?
Maybe the answer's in there somewhere. Too much Claudish to parse through.
So you don't need to worry about CORS from the perspective of the web app, nor need a real browser, because the victim is only ever interacting with the evilsite endpoints.
Certainly there are ways the target site could try to thwart this (i.e. detect unusual request patterns from wherever the proxy server is fetching from; client-side JS to detect the site being hosted on a foreign domain; etc). But at that point it's an arms race.
jummyjonhsanbich
jummyjorsandvotch
i wonder if the malicious sites will need an adpative tranform of reverse-proxied content so that the real content fetched from real site is updated to insert these "correct" spellings so that the customer dont find it ... suspicious?
And yet Google says sideloading is where users are getting hijacked. FFS
The hackers should pass on the order to the real restaurant to reduce suspicion.
>Google's public Ads Transparency pages now show "Can't find ad" for the creatives and "No ads found" for the domains we checked, which suggests Google has taken them down
So much for transparency, removing evidence that Google served ads on these impersonating domains
What could we possibly do to limit the damage from this? Malicious Chrome extensions can also rewrite entire web pages, so if bad actors purchase or infiltrate legitimate extensions, they can also put users at risk.
We are considering continuing work on our own browser, since we could ship certificates to use client-side, but it's a recursive problem since our users would have to get the first trusted version before they could trust updates to it. If they have trouble reaching our site in the first place, through poisoned Google search results, poisoned DNS, and poisoned IP routing, then it is difficult to do this.
[1] https://stateofutopia.com/laws/2/law2/law2.html
Save that page (with curl or wget), you should get this sha256:
BFE524880867A84C9A438A057734B58954B860843BDB5B15C9E4ED70C534126D (updated after I removed a script injection attack).
though if you're reading this comment through a proxied Hacker News clone, someone might rewrite that hash to their version of what they want our law to say.
Simple and effective