Tell HN: A case of negative SEO I caught on my service and how I dealt with it

Re:Tell HN: A case of negative SEO I caught on my service an... by markhowe on Friday February 12, 2021 @01:22AM (#26111206)

Setup a honeypot page to log the ‘users’ IP. Keep hitting it via their domain and you’ll build up a list of IP’s to block?

As an aside, I’ve fought credential stuffers by returning real looking but actually false data, and initiating password resets... start serving different data on each hit, you may need to be annoying enough that they give up.

[ Parent | on HN ]

Re:Tell HN: A case of negative SEO I caught on my service an... by santah on Friday February 12, 2021 @01:48AM (#26111284)

A honeypot is exactly how I caught the IPs the first time around.

Problem is - right now I'm over 250 (new) IPs and they keep piling up (their domains now rarely use an IP more than once).

I may have to block entire ranges of IPs or whole ASNs.

[ Parent | on HN ]

Re:Tell HN: A case of negative SEO I caught on my service an... by cmeacham98 on Friday February 12, 2021 @05:55AM (#26112323)

How about automatically honeypotting them? Add some code to your site that will IP ban a user that searches for some random string (and when I say random, I mean literally generate a random string - something no legit user would search for).

Then, setup a script on your laptop or whatever to search this string on their domains every half hour or so.

[ Parent | on HN ]

Re:Tell HN: A case of negative SEO I caught on my service an... by santah on Friday February 12, 2021 @06:10AM (#26112411)

It's basically what I've done, though have not automated it yet.

It even prepares the expression snippet for me to paste directly into a CloudFlare firewall rule.

That's how I got to quickly identify and ban almost 2000 different IPs.

If they continue to expand the IP pool I may need to automate it though.

[ Parent | on HN ]