Slashdot Mirror
How Do I Fight Russian Site Cloners?
An anonymous reader writes "I used to run a small web design service, the domain for which I allowed to expire after years of non-use. A few weeks ago, I noticed that my old site was back online at the old domain. The site-cloners are now using my old email addresses to gain access to old third-party web services accounts (invoicing tools, etc.) and are fraudulently billing my clients for years of services. I've contacted the Russian site host, PayPal, and the invoicing service. What more can I do? Can I fight back?"
If you have a summary of your clients (and you should) you should send out a mass email and let them know what's going on
Good thing your site is hosted in Russia. That makes things a whole lot easier.
check the dns domain registrar of theirs and report domain abuse.
that's what whois information is about too.
Wouldn't it just be cheaper/easier to just never let even remotely valuable/vulnerable domains expire since it costs so little to keep renewing them?
I assume this is a form of wire fraud, international at that.
To ease your conscience, pull together your old contact list and let your former clients know that you've not been running the business (or charging for services) for years. Advise them of the current scam, and hope they get your message before they pay the bad guys.
While I have your attention, shame on you for letting your business go dark without tying up the loose ends (e.g., informing your customers). I feel for your customers.
I use irony whenever I can, but my shirts are still wrinkled...
Of how Russian Free Enterprise works, I would suggest either hiring hitmen to brazenly gun-down whoever cloned your site, if it is a relatively small operation, or insinuate that the cloner is an enemy of the state, and have him jailed on trumped-up tax evasion charges, if it is a large operation.
If neither of these options suits, I hear that Polonium is the new Earl Grey...
Just an off-the-wall idea here, but check to see how to report this site to Mozilla and Microsoft to get it into their blacklist of phishing/scam sites. If I got something from a site, and, upon trying to visit it, my browser's filter warned me about it, I might suspect something fishy is going on.
Doing this is by no means a complete solution, but it could get you part of the way there.
Check out Uniform Domain Name Dispute Resolution. It is often overturned in court, and isn't always effective, but taking back control of the domain in whatever way possible is more than likely the only way you will fully recover from this. Otherwise you are simply on a damage mitigation mission.
"It's ok, I'm completely secure as long as my iron is off"
That's a rather dangerous and almost certainly illegal thing to do.
However, I was thinking about suggesting that he post the URL here so that people here in slashdot could take a look at the site and get some ideas about what to do about the ...
...oh, wait.
It worked!
There's a problem with these automated tools - and that is that they're the shotgun approach.
We run some mainstream sites, and we also allow affiliate promotion.
We have a zero-tolerance spam / mailing policy, but that doesn't stop people trying.
If or when complaints come through (SpamCop, SpamHaus, etc) - we deal with them, and nuke the affiliates - we're just as anti-spam & fraud as the BL guys.
The problem, however, is that with the use of this / these tools, when DNS, upstream and network providers are scatter-bombed with complaints, over, and over, you end up getting blacklisted. Even if you're not in the wrong, you get blacklisted.
If you've ever been on the end of a SpamCop / SpamHaus complaint, as much as they may have intended to setup a good service, their 'service' is incredibly partial.
For example, the latest email back from SH to our host, when we had banned a fraudulent affiliate:
Their website 'evidence' archives are full of libel and blackmail - if you email SH with a fake complaint, and say that company X participates in money laundering, international fraud and spam - they'll publish it - without an ounce of fact checking.
Somewhat off topic, but these issues burn - who watches the 'watchers' / internet 'police'
> A few recommendations...
a) Read the article.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
It probably wasn't even that hard. Once they own the domain, they can park a standard email server on it and capture email sent to the domain, they don't even need to implement the specific addresses.
Try to close your Slashdot account, for example.
Bastard. now I've got to re-register.
1. take over domain
2. setup catch all email account
3. wait for "we wish you were still our customer" email
4. take over old billing accounts
5. repost site from archive.org
6. start tracking down clients perhaps with search for 'site designed by xxxxxxx' and send bills
It's a pretty smart scam.
This is the fundamental thing to take away from this incident, and, while it may be obvious, it deserves stating plainly:
Domain control / email address control is an authentication tool.
We've brushed by the concept in prior conversations about validating new user sign-ups.
Implications include, as in this scenario, human verification by looking at a web page of a familiar domain, human verification by email correspondence with a familiar email address, and password resetting when in control of an email address; SSL certificate-based identity (if the decrypted certificate can also be acquired), URL -referenced data validity (executables for download), and probably a number of other authentication/control mechanisms reliant on domain/address -- your ideas are solicited.
DNS hijacking, then, should be a serious concern. DJB warned about cache poisoning via brute-force source port + transaction ID spoofing in 1999. A long time went by before the issue got enough publicity (in 2008) to force the major DNS software purveyors to clean up their acts. This guy needs to be taken seriously.