Slashdot Mirror
How Do I Fight Russian Site Cloners?
An anonymous reader writes "I used to run a small web design service, the domain for which I allowed to expire after years of non-use. A few weeks ago, I noticed that my old site was back online at the old domain. The site-cloners are now using my old email addresses to gain access to old third-party web services accounts (invoicing tools, etc.) and are fraudulently billing my clients for years of services. I've contacted the Russian site host, PayPal, and the invoicing service. What more can I do? Can I fight back?"
If you have a summary of your clients (and you should) you should send out a mass email and let them know what's going on
"Take off and nuke 'em from orbit. It's the only way to be sure."
Oh wait, they're in post-soviet Russia...
(Sirens wailing)
That probably wasn't a very good--
[NO CARRIER]
The Future of Human Evolution: Autonomy
Good thing your site is hosted in Russia. That makes things a whole lot easier.
check the dns domain registrar of theirs and report domain abuse.
that's what whois information is about too.
How do they know which third-party web services you used to use, unless it's one of your old clients?
Wouldn't it just be cheaper/easier to just never let even remotely valuable/vulnerable domains expire since it costs so little to keep renewing them?
The only way to deal with the Russians is with the Italians or the Irish.
So either:
"Say hello to my little friend"
or
"This guy takes a blunt object, fuckin', waah! Hits the guy with the bandages around his head, right? Why? 'Cause he's smart. He knows the guy with the bandages around his ass, he ain't goin' nowhere. He's goin' fuckin' nowhere. "
I assume this is a form of wire fraud, international at that.
To ease your conscience, pull together your old contact list and let your former clients know that you've not been running the business (or charging for services) for years. Advise them of the current scam, and hope they get your message before they pay the bad guys.
While I have your attention, shame on you for letting your business go dark without tying up the loose ends (e.g., informing your customers). I feel for your customers.
I use irony whenever I can, but my shirts are still wrinkled...
Of how Russian Free Enterprise works, I would suggest either hiring hitmen to brazenly gun-down whoever cloned your site, if it is a relatively small operation, or insinuate that the cloner is an enemy of the state, and have him jailed on trumped-up tax evasion charges, if it is a large operation.
If neither of these options suits, I hear that Polonium is the new Earl Grey...
Just an off-the-wall idea here, but check to see how to report this site to Mozilla and Microsoft to get it into their blacklist of phishing/scam sites. If I got something from a site, and, upon trying to visit it, my browser's filter warned me about it, I might suspect something fishy is going on.
Doing this is by no means a complete solution, but it could get you part of the way there.
Check out Uniform Domain Name Dispute Resolution. It is often overturned in court, and isn't always effective, but taking back control of the domain in whatever way possible is more than likely the only way you will fully recover from this. Otherwise you are simply on a damage mitigation mission.
"It's ok, I'm completely secure as long as my iron is off"
Why didn't you close your third party accounts when you were shutting down your old site?
Always proofread carefully to see if you any words out.
That's a rather dangerous and almost certainly illegal thing to do.
However, I was thinking about suggesting that he post the URL here so that people here in slashdot could take a look at the site and get some ideas about what to do about the ...
...oh, wait.
Create a GUI interface using Visual Basic to track their IP address.
Done.
There's a problem with these automated tools - and that is that they're the shotgun approach.
We run some mainstream sites, and we also allow affiliate promotion.
We have a zero-tolerance spam / mailing policy, but that doesn't stop people trying.
If or when complaints come through (SpamCop, SpamHaus, etc) - we deal with them, and nuke the affiliates - we're just as anti-spam & fraud as the BL guys.
The problem, however, is that with the use of this / these tools, when DNS, upstream and network providers are scatter-bombed with complaints, over, and over, you end up getting blacklisted. Even if you're not in the wrong, you get blacklisted.
If you've ever been on the end of a SpamCop / SpamHaus complaint, as much as they may have intended to setup a good service, their 'service' is incredibly partial.
For example, the latest email back from SH to our host, when we had banned a fraudulent affiliate:
Their website 'evidence' archives are full of libel and blackmail - if you email SH with a fake complaint, and say that company X participates in money laundering, international fraud and spam - they'll publish it - without an ounce of fact checking.
Somewhat off topic, but these issues burn - who watches the 'watchers' / internet 'police'
> A few recommendations...
a) Read the article.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Publish the link to the site on Slashdot (and don't forget to mention it has some free pr0n). The site will die within minutes, after the first 10 million slashdotters visit it.
The site-cloners are now using my old email addresses to gain access to old third-party web services accounts (invoicing tools, etc.) and are fraudulently billing my clients for years of services.
Assuming your domain's e-mail has been bouncing for *years*, how in the hell did perfect strangers a world away(?) dig up your data? This sounds like something that happens after an unshredded trash rummage.
1. How do they know what all your internal e-mail addresses were?
2. How do they know what your web services were?
3. How do they know who your clients were?
4. How do your clients believe you're still doing work for them after years of silence?
5. How are these web services still holding your account data after years of inactivity? Invoice tools ain't free.
Hard to believe we're getting the whole story here. I think Ask Slashdot just got phished.
In Soviet Russia, site clones YOU!
"Flyin' in just a sweet place,
Never been known to fail..."
This is the fundamental thing to take away from this incident, and, while it may be obvious, it deserves stating plainly:
Domain control / email address control is an authentication tool.
We've brushed by the concept in prior conversations about validating new user sign-ups.
Implications include, as in this scenario, human verification by looking at a web page of a familiar domain, human verification by email correspondence with a familiar email address, and password resetting when in control of an email address; SSL certificate-based identity (if the decrypted certificate can also be acquired), URL -referenced data validity (executables for download), and probably a number of other authentication/control mechanisms reliant on domain/address -- your ideas are solicited.
DNS hijacking, then, should be a serious concern. DJB warned about cache poisoning via brute-force source port + transaction ID spoofing in 1999. A long time went by before the issue got enough publicity (in 2008) to force the major DNS software purveyors to clean up their acts. This guy needs to be taken seriously.