Ask HN: Why buy domains and 301 redirect them to me? Say I'm running a SaaS product, example.com. Somebody has bought several domains like getexample.com, buyexample.io, joinexample.net, and is 301 redirecting them to example.com. What's their play here? Is this setup for a phishing attack in the future? Are they just going to try and sell the domains to me in the future? Not encountered behaviour like this before (or at least, I don't know if this is the beginning phase of a common scam) |
A somewhat innocent reason could be that someone sent a newsletter email or shared a link to your site, but mistyped the URL, so to save their users from getting NXDOMAIN errors l, or even worse, someone registering it with illintentions, they registered and 301 redirected to you.
------ SEO Abuse:
Use your legitimate site to boost the SEO rank of unrelated domains. Create toxic backlinks that harm your domain’s SEO ranking if not properly disavowed.
----- Phishing Campaigns:
Send emails with their domains (e.g., fake password reset or invite emails) claiming to be you, redirecting users to phishing pages masquerading as your brand.
Serve phishing content to users based on conditions such as geography, user agent, or time of day.
----- Domain Aging:
"Age" their domain by associating it with your legitimate service to make it appear trustworthy for future malicious activities. Targeted Malware:
Use redirects to detect vulnerable users and deliver malware or drive-by attacks to those targets while serving legitimate content to others. Regional Phishing or Malware Delivery:
Redirect normal traffic to your site while targeting specific regions for phishing or malware, avoiding detection for longer periods.
----- Hijacking Search Results:
Build up search engine traffic for their domains by associating them with your brand and later weaponize the domains (e.g., for phishing or fraud). Affiliate Fraud:
Redirect traffic with an affiliate ID (if you use affiliate links), attempting to claim commissions fraudulently. Brand Impersonation:
Use domains similar to your brand to impersonate your service, potentially harming your reputation.
----- Extortion/Domain Ransom:
Build traffic or search relevance on their domains and later attempt to extort money from you by offering to stop the redirect or sell the domain.
----- Invoice Scams:
Represent your service fraudulently to businesses for invoice scams or credit fraud.
----- Bypass Sanity Checks:
Use 301 redirects to bypass user sanity checks, tricking users into believing they are visiting legitimate sites.
---- Traffic Monetization:
Use ad-infested parking pages for a fraction of the traffic and redirect the rest to your site to generate revenue.
----- Reputation Damage:
Cause your brand to be associated with scam or phishing domains, which can harm public perception and trust.
----- Legal Liability:
Misuse of your brand or domain to commit fraud could lead to potential legal complications for you.
----- False Phishing Reports:
Cause false flags in phishing reports, harming your brand credibility and delaying the takedown of malicious domains. Hidden Routes for Malicious Content:
Redirect general traffic to you while hosting specific malicious routes (e.g., URLs hosting phishing or malware).
----- Impersonation via Emails:
Send emails claiming to be your service, and when users visit the domain, they see your page after a redirect, adding legitimacy to the scam.
----- Scam Awareness Manipulation:
Target your traffic by hosting fraudulent educational content or warnings related to your domain to sow distrust.
-------------------------- Mitigation Strategies: --------------------------
• Monitor Backlinks: Regularly check backlinks and disavow toxic links using Google’s Disavow Links Tool.
• HTTP Referrer Checks: Implement referrer or origin header-based redirects to flag and warn users arriving via fraudulent domains.
• Warn Users: Create a visible warning for users redirected from suspicious domains.
• Trademark/IP Enforcement: Leverage trademark protections to take action against impersonating domains.
• Manual Domain Actions: Periodically check for indexed pages and investigate potential abuses of similar or related domains.
If they want to sell you sth, or scam, they won't do 301, because after 301 the juice power will gradually move to your domain, and its pointless to do this before any scams and sales.
Of all the answers presented so far, this one feels the most plausible to me.
First and foremost, guide visitors with a popup alert or a banner that you only conduct legitimate business through example.com.
Did you buy used/old/expired domain? Any patterns you can see or a random increase in traffic out of nowhere? What about your competitors?
A 301 redirect isn't a bad thing unless someone has the knowledge to turn it into something bad.
If you know that is happening with HTTP you can redirect those requests, based upon origin, to a honeypot of your choosing. It’s free traffic you didn’t have to work for to use as you wish without disruption to your business requirements. You can use that traffic to experiment with new features under experimental branding, AB testing, and more.
Redirected traffic is coming from one or more dedicated locations performing the redirection. The source of redirection is still identifiable by IP address. So, if you know the traffic is coming from the a given IP and is a 301 you have all you need. Even after that the identified traffic, if not bots, can then be further tracked via a variety of client-side things like cookies and localStorage.
if the domains being forwarded have had penalties it could leak into your domain SEO value
could also be a mistake :)
Step 2: offer to sell them to you for some inflated price
Step 3: make your life hell if you dont pay
Expired domains and Domains on the marketplace, with hundreds or thousands of “backlinks” to them, are valuable. In the listing you may see something like “20000 back links.” And those links are usually worthless , spam, and will vanish as soon as you buy. But you can find domains that have real backlinks. TEN backlinks from reputable websites are more valuable than a thousand spam BLs.
You used to be able to buy and run software , “backlinks explorer” to investigate everyone who links to a domain you’re thinking about buying. And you can also research a “20000 backlinks” claim to see if this is just someone spamming that domain all over blogger and forums.
A good domain to buy will have legit backlinks from real websites that the website linked on purpose. If it’s been spammed thousands of times for a “5000 backlinks claim” , expect google to punish it!
Because if you 301 them to your site, google et al assume you’re the legitimate successor to that website and people mean to link to you.
So you come up higher in search.
I’ve used this to be the first or second result on google. And certainly on the first page of results.
It overcomes downranking for being a new domain nobody links to.
Google has its own criteria for evaluating whether your page is spam or a scam, and whether you’re abusing this to promote spam or a scam.
I have a trio of ancient highly ranked domains that I forward to a new page for about a year.
They’ll hit page one on google within a week or two or three.
After I remove the 301s or recycle those domains, the pages usually still come up within the first page of results afterwards.
Before you get too horrified here, I did this to bury a “competitor” who had registered a similar domain name, stolen my entire repo and website from a disgruntled employee, copied all my software and copied my webpage word for word trying to drum up business on my IP. The whole time they mocked me in email about stealing my customers and putting me out of business.
It worked. (Sort of. If you hire them they don’t actually have any idea how to do what I do.)
I did not do this to scam or phish or what have you. I just did this to bump them from #1 on google. Which they got by incorporating with a similar business name and registering with a similar URL.
They did ultimately manage to shut that business down and disrupt it after years of this and I moved on because I have other talents and this venture wasn’t profitable enough to deal with this entity kneecapping me for years and years.
But on my way out, I forwarded all of those domains to a reasonable and legitimate website that’s in the same line of work, resulting in them now dominating the other site in search. So I walked away and used this trick one last time to at least ensure someone searching for this subject would end up in some safe and reasonable hands.
What’s my point in sharing this?
It’s that the other website has no idea I did this, and has no control over it. You might see this and assume the worst about the other website.
someone could be doing this to manipulate SEO or search results over sites they don’t even own. For reasons that might (?) make sense or be well intended.
and for reasons that don’t, or might even be malicious.
* MULTIPLE edits for clarification
This is less true than it used to be, but people still do it.
And they're not obvious mouse slips like redirecting googl.com -> google.com - they're more of the form <verb>mydomain.com.
I was mostly interested in what the actual play from them here is tbh
The fraudulent domains are only sending traffic to OP.
My guess is that they want to either phish visitors, or they want to ask OP for affiliate revenue, like a digital version of the guys who wash your windshield or your shoes without asking first, and then ask for money.
Or planning to threaten to divert organic traffic through the impersonation domains away from the canonical domain, if you don't pay them.
They registered $my_projectname.org and loaded my site in a full screen iframe with ads over it.
Traffic was up to 500 users per day that I was never able to monetise, I doubt they got a lot from their iframe either.
But they beat me and some other similar sites on SEO very hard, very fast and I never quite figured out how.
I ended up serving a white page to that referer.
- Attempting to use your legitimate content and services to improve the SEO rank of other domains (even unrelated ones). This can usually be checked by looking for a sitemap.xml, there will be pages not redirected to your site that contain pages of links.
- Closely following the above, the pages may not be links to other sites but might be hosting phishing pages for other services unrelated to yours. The redirect here acts as a bluff for casual inspection of the domain. You won't see page entries in a sitemap.xml file for these ones.
- Attempting to "age" a domain. Not many talk about this option, but new domains are a red flag to a lot of automated security processes. When purchasing a domain and giving it a history associated with a legitimate service they make the domain look less suspicious for future malicious use.
- Preparation for a targeted campaign. This is pretty unlikely, you need to be really worth a dedicated long term campaign effort specifically against you or your company. If you're doing controversial/novel research, are managing millions of dollars, performing a service a state actor would object to, or have high profile clientele then maybe you fall into this category. These are patient campaigns and want to make the domain "feel normal and official". They won't do anything public with the domain such as SEO tweaking or link spam, they'll use these domains only for specific targeted one-off low-noise attacks. They're relying on staff to see that the domain has been connected to your service for years and is likely just a domain someone in marketing purchased and forgot about. This is exceptionally rare.
A 301 fits that bill because then the owners browser even when traveling will serve the good content
(I doubt that is the case in OP's situation, but I have seen both of those methods of "hiding" multiple times now)
If they detect something that matches what they want, they may throw some intermediate 301's to pages that attempt to infect the user with something still ultimately redirecting to the "normal" page.
There's a related site compromise where a hacked webserver behaves normally except, when the referrer is google.com, it adds a JavaScript redirect to the end of any page.
You go to example.com, everything looks normal. You click a link to example.com, you end up on a page selling herbal dick pills. Site owner yells at Google thinking it's their fault. Googlebot never gets served the redirect.
You should be able to do the same thing with 301 redirects.
OP, you can search for "site:getexample.com" which will list you any pages that have been indexed for that domain. They might have just redirected the homepage. Worth a shot.
1) set up plausibly-named fake domains that redirect to example.com
2) ensure that the fake domains rank higher than the original domain for "example" searches.
3) after a while, people have gotten used to accessing the service through the fake domains or might even think those are the official domains.
4) pull up the net by replacing the redirect with phishing pages. Suddenly, everyone googling for the service will end up on a phishing site, without any obvious way to fix the situation.
Phishers could also run this scheme for lots of sites in parallel, without needing to have some specific interest in any of them.
Edit: Seems like the semantics of the 301 redirect should prevent this from working though.
Then they build links to their domains. Once it has more backlinks than the real domain, the redirect is removed.
- Reaching out in good-faith with an offer to sell the domain to you. I've had that happen in the past and before receiving the email the person directed the domain to my official website to show good will. I purchased the domain and now own it.
Not saying this is the case here, but just wanted to throw a legitimate scenario into the mix. They should have reached out by now if this was the case.
Then they send an invoice…
I think this was a common attack vector around then, but is no longer common.
Can you not detect and prevent this based on the HTTP referrer? Maybe reroute to goatse or something....
The last thing you would ever want to do is associate your domain name with gross, offensive content like this. The web is crawled all the time for snapshot data.
Additionally, you're more likely to cause your own (potential) users to stumble on this than anything else.
IMO, the best policy is almost always transparency. If you were to redirect users (and referrer-based redirects are a fragile thing), send them to a phishing/spam awareness page and explain that they most likely arrived from such a source.
If I target a specific region with a phishing link and redirect if the requestor is not in that region I can probably maintain my phishing domains for longer.
The Cloudflare redirect likely has GoDaddy underneath, based on what’s visible at myEXAMPLE.com/lander and others.
Half of the domains are set for Outlook Mail, the other for Google Mail which points to a potential email game.
It doesn’t make things safer that your brand name is a top-400 frequency word in one of the European languages. Not owning your .com and having a dozen businesses with similar names just compounds the risk.
What to do really depends on the specifics of your case, including trademark and competition factors. If you’re stuck, feel free to ping me at aghackernews [at] gmail.
There was a humanitarian charity I've donated to, and I saw people erroneously linking to the wrong URLs when spreading news of it. (Say, `foobar.org` and `boofar.com` when the charity is at `boofar.org`.)
So, I just bought the URLs and had them redirect to the correct URL, before a bad actor could snap them up.
They might be trying to create toxic back links to their domains and if those domains 301 to your domain, I believe this can negatively impact the SEO of your domain (from what I read). If so you can try to disavow them https://support.google.com/webmasters/answer/2648487?hl=en
They'll then send out an email campaign with a From: address in the counterfeit domain (which will have valid SPF/DKIM/whatever), a subject like "Example.com: You've been invited to join a project!", quickly-come-see-this-secret-stuff body copy, and a call-to-action button linked to that URL.
The page hosted on the URL will have your branding and everything, and collect a bunch of personal information and/or access credentials for the scammers.
Taking down this stuff is tedious, but you can try -- least you can do for now is display a prominent 'this is not an authorized example.com domain' warning for inbound visits from these redirects, create a public Knowledge Base-like article warning about this abuse as well (making very clear this has nothing to do with you), and block the domains involved on your inbound mail server.
Silver lining: apparently your SaaS is successful enough to be used as a lure for scammers. Congrats?
The user's browser will display a redirect loop error; and most importantly, they won't see your domain.
It keeps your name out of it and makes the email domain look even more fishy.
This is preferable rather than returning 404, 403, or warning users something fishy is going on - since anything you return from your site will have browsers and crawlers complaining about your site, and your URL/contents might suffer penalties or deindexing as a result.
So what's left is 1) filing a DMCA request with their registrar and 2) hosting provider, 3) checking offending inbound links and using Google’s Disavow Links tool. And if they're plagiarizing some contents, also 4) asking Google to remove infringing pages from their index. I had to do the latter a few years ago.
File a DMCA with the registrar and the hosting provider.
We're a small bot security/captcha company and pretty regularly get various attacks thrown at us - figuring out if somebody is up to something more along those lines was my main concern.
Just curious, seems like something we should all start monitoring for.
They may also represent you to real life businesses for invoice scams or credit.
Rare but possible scenarios worth considering.
I posted about it at the time, but no one seemed to be able to replicate it:
https://x.com/jfozonx/status/1570710776540958723
Always wondered how much traffic those domains were accumulating. Even though it was an edge case, it must've been quite a lot in aggregate.
I'm guessing it will look normal but it could provide some insights if something weird is there.
---
Headers
---
HTTP/2 301
date: Fri, 24 Jan 2025 13:59:51 GMT
content-type: text/html
content-length: 167
location: <the website in question>
cache-control: max-age=3600
expires: Fri, 24 Jan 2025 14:59:51 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JZu4FOa%2ByynaFOXWYlxaePF9KdRQ0qGUJkfm1F1aK2m3VEx6idlvWlb5go%2B08hgSog1zm1zuMobXcVK2BkR4mQD0SEGU%2Bzp2oC6mXPgQs%2FUzvOH7LbqAG96jtf9KNqemV8Q%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 90708be24810e8fe-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=59748&min_rtt=41108&rtt_var=43898&sent=7&recv=8&lost=0&retrans=1&sent_bytes=3535&recv_bytes=789&delivery_rate=33797&cwnd=225&unsent_bytes=0&cid=e5052200af7e27a5&ts=145&x=0"
There isn’t a way to see what a referring site did to do the redirect (301 or 302 or even a js redirect) in your logs. All you’ll see is (potentially) the Referer http header.
Check this: https://github.com/kgretzky/evilginx2
I have done this once in the past, for a sort of community project. the project was at example.org and I had a VPS with a free domain I didn't use, so I had the example.[something] pointed there for a couple years. Basically just white-hat domain squatting it so no one else snags it up.
It's been a while, and IANAL - but I've seen both domain resellers and registrars cave pretty quickly when contacted with "that name very obviously infringes on our trademark".
One quick point of feedback: The "Learn more about our features and pricing" button appears to be broken, at least on Chrome Android.
The click gets intercepted by the registration form somehow, like by some type of overly-broad selector targeting "form button" or similar.
Instead of being taken to the pricing page, it takes me to the next step of the form, which I don't want to fill out before seeing the pricing.
If you click a link on red-herring.com which points to bad-domain.com, which then redirects to good-domain.com, the referer will be red-herring.com (if not disabled entirely).
HTTP redirects have no effect on the referer.
I don't know why everyone seems to think that HTTP redirects are visible in Referer (or Origin or any other header), but that's just not the case: HTTP redirects are completely transparent to the destination server.
They would be if it's a same-origin redirect, no? And I was under the impression that 3xx also set it cross origin (barring a referrer-policy header), though I'm less confident now. (I can't test it ATM).
Edit: I am clearly confused. The browser preserves the original referer when performing a 3xx, as you said.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Or...
In my experience, this solves the sticky 301 issue and you should have no issues with cached 301s anymore.
Works perfect for these kind of investigations or if you made a mistake during site development.
(Fingerprint usage: have https://myfingerprint.example.com 301 to https://myfingerprint.example.com/unique_id_3b136c1cb, then embed https://myfingerprint.example.com in an iframe and see which request is made.)
I still never use 301s for that reason. Things may have changed, but I dare not try!
I use 301 for http:->https: redirects because (a) I doubt we're going back, (b) it prevents some cleartext leaks (like the Host header), and (c) it is slightly cheaper.
> we never figured out how to get the browser to re-learn the responses for those pages without drastic measures.
If you control the target URL it is easy, just redirect back. Seriously: The browser won't loop, it'll just fetch the content again and now not seeing a 301 will forget that nonsense ever happened. This is why 301 is usually a fine default for same-site redirects, or if the redirect target is encoded in the URL (such as in tracking URLs).
The big no-no is don't 301 to a URL you can't control unless you have the appropriate Cache-Control headers on the redirect.
Just uh... don't do this if you have a CDN infront of your site. We had an incident where Cloudfront cached the 301's in both directions