Ask HN: Why buy domains and 301 redirect them to me?

As others have mentioned this is likely one of a couple of scenarios, roughly ordered by my guess on likelihood:

- Attempting to use your legitimate content and services to improve the SEO rank of other domains (even unrelated ones). This can usually be checked by looking for a sitemap.xml, there will be pages not redirected to your site that contain pages of links.

- Closely following the above, the pages may not be links to other sites but might be hosting phishing pages for other services unrelated to yours. The redirect here acts as a bluff for casual inspection of the domain. You won't see page entries in a sitemap.xml file for these ones.

- Attempting to "age" a domain. Not many talk about this option, but new domains are a red flag to a lot of automated security processes. When purchasing a domain and giving it a history associated with a legitimate service they make the domain look less suspicious for future malicious use.

- Preparation for a targeted campaign. This is pretty unlikely, you need to be really worth a dedicated long term campaign effort specifically against you or your company. If you're doing controversial/novel research, are managing millions of dollars, performing a service a state actor would object to, or have high profile clientele then maybe you fall into this category. These are patient campaigns and want to make the domain "feel normal and official". They won't do anything public with the domain such as SEO tweaking or link spam, they'll use these domains only for specific targeted one-off low-noise attacks. They're relying on staff to see that the domain has been connected to your service for years and is likely just a domain someone in marketing purchased and forgot about. This is exceptionally rare.

Their play is to send emails with those domains but in the emails claiming to be you and when people reading the email go to the domain, they see your page (they got redirected).

They'll weaponize them at some point. How exactly is to be seen, but if people associate your product with domains you do not control (e.g. via SEO searches and hyperlinks left in public places), then everyone is on the hook the moment these domains stop redirecting to your service.

I haven't seen this before but back in the early 2010s I had some India-based group that iframed our SaaS website under a new domain. I caught it early and implemented this fix: https://stackoverflow.com/questions/2896623/how-to-prevent-m...

I think this was a common attack vector around then, but is no longer common.

It’s possible `/` redirects but other hidden routes phish. If someone gets e.g.: a fake password reset email, it might help the attacker bypass sanity checks users make.

Just had a look - it appears you’ve got nine .com domains registered with your brand name in the same second on GoDaddy: explore/get/join/meet/my/team/the/tryEXAMPLE.com and EXAMPLEconnect.com.

The Cloudflare redirect likely has GoDaddy underneath, based on what’s visible at myEXAMPLE.com/lander and others.

Half of the domains are set for Outlook Mail, the other for Google Mail which points to a potential email game.

It doesn’t make things safer that your brand name is a top-400 frequency word in one of the European languages. Not owning your .com and having a dozen businesses with similar names just compounds the risk.

What to do really depends on the specifics of your case, including trademark and competition factors. If you’re stuck, feel free to ping me at aghackernews [at] gmail.

Another possibility: Does your example.com point to something with an ideological or humanitarian goal?

There was a humanitarian charity I've donated to, and I saw people erroneously linking to the wrong URLs when spreading news of it. (Say, `foobar.org` and `boofar.com` when the charity is at `boofar.org`.)

So, I just bought the URLs and had them redirect to the correct URL, before a bad actor could snap them up.

Check if your site has any manual actions against it. https://support.google.com/webmasters/answer/9044175?sjid=11....

They might be trying to create toxic back links to their domains and if those domains 301 to your domain, I believe this can negatively impact the SEO of your domain (from what I read). If so you can try to disavow them https://support.google.com/webmasters/answer/2648487?hl=en

Phishing. Regular visits to these domains will 301 redirect them to you, but there's at least one URL that will instead be handled by the scammers themselves.

They'll then send out an email campaign with a From: address in the counterfeit domain (which will have valid SPF/DKIM/whatever), a subject like "Example.com: You've been invited to join a project!", quickly-come-see-this-secret-stuff body copy, and a call-to-action button linked to that URL.

The page hosted on the URL will have your branding and everything, and collect a bunch of personal information and/or access credentials for the scammers.

Taking down this stuff is tedious, but you can try -- least you can do for now is display a prominent 'this is not an authorized example.com domain' warning for inbound visits from these redirects, create a public Knowledge Base-like article warning about this abuse as well (making very clear this has nothing to do with you), and block the domains involved on your inbound mail server.

Silver lining: apparently your SaaS is successful enough to be used as a lure for scammers. Congrats?

I did this for a fraudulent health product. They had .org but not .com. Registered .com and redirected it. Waited for SEO to pick up on it. Created the page calling it out as fraud. Created some social media accounts and put the .com in the about info. Started commenting on their posts, anyone that looked at the fake profiles would find my page with info on why it was fraudulent.

I think you can check the HTTP_REFERER header and block the redirect using your back-end code, like PHP or Node or Python, not sure what tech stack you are using.

Whatever their play, detect and drop the redirects. Good job on noticing it early on!

IMHO you should take action ASAP - at the cost of sacrificing all traffic coming from them. Regardless of their endgame, I'd just detect the HTTP referer and redirect back to them: crawlers and browsers will detect the redirect loop and happily complain about their domain. This will render their redirects ineffective, eg. any phishing attempt will have broken links.

This is preferable rather than returning 404, 403, or warning users something fishy is going on - since anything you return from your site will have browsers and crawlers complaining about your site, and your URL/contents might suffer penalties or deindexing as a result.

Yes, phishing. It might happen in the future, it could be happening right now, emails from getexample.com, a specific path on getexample.com that doesn't redirect to the real thing, etc.

File a DMCA with the registrar and the hosting provider.

Check out Google’s Disavow Links Tool.

Do you have an affiliate plan, or likely to have one? Maybe they plan to redirect with their affiliate ID at some point?

OT: How did you detect this?

Just curious, seems like something we should all start monitoring for.

I’ve seen one or two domains like that serving 301s to some IPs and their own website to others. This could be a 1000:1 ratio. Then they serve an absolutely ad-infested parking page-style website to those others. And that’s how they skim a little bit of revenue off your customers.

They may also represent you to real life businesses for invoice scams or credit.

Rare but possible scenarios worth considering.

I don't know if it still happens, but Google used to have an issue that I would see in Verbatim mode whereby non-Wikipedia domains would rank as particular Wikipedia pages by redirecting to Wikipedia. I can't seem to replicate it now, so it might be resolved or vary from country to country.

I posted about it at the time, but no one seemed to be able to replicate it:

https://x.com/jfozonx/status/1570710776540958723

Always wondered how much traffic those domains were accumulating. Even though it was an edge case, it must've been quite a lot in aggregate.

Can you provide more information about what's in the headers? Additionally, are there any tracking parameters appended to the URL?

I'm guessing it will look normal but it could provide some insights if something weird is there.

It’s likely an attempt to steal usernames and passwords for privilege escalation. I had a large corporate client who faced a very similar issue. In their case, the scammer not only registered similar domains but also created Google Ads campaigns targeting those domains. It’s worth investigating further and taking preventative measures to protect your brand and users.

Check this: https://github.com/kgretzky/evilginx2

I don't have the slightest clue about your case, a business,

I have done this once in the past, for a sort of community project. the project was at example.org and I had a VPS with a free domain I didn't use, so I had the example.[something] pointed there for a couple years. Basically just white-hat domain squatting it so no one else snags it up.

Whatever their plan - if you have a trademark or similar IP protection on "Example", that might be prove extremely useful here. (If not - consider getting some protection ASAP.)

It's been a while, and IANAL - but I've seen both domain resellers and registrars cave pretty quickly when contacted with "that name very obviously infringes on our trademark".

Lots of answers about why, and it could be one or many of them. Scammy reasons likely.

A somewhat innocent reason could be that someone sent a newsletter email or shared a link to your site, but mistyped the URL, so to save their users from getting NXDOMAIN errors l, or even worse, someone registering it with illintentions, they registered and 301 redirected to you.

This feels like a never-ending cat and mouse activity, but depending upon your hosting infrastructure, you ought to be able to maintain a list of these domains and 403/404 incoming requests that are being referred from the list. Better to just dump them to an error / scam warning page than 301 them out to somewhere else (to avoid redirect loops)

I created this summary for my own reference:

------ SEO Abuse:

Use your legitimate site to boost the SEO rank of unrelated domains. Create toxic backlinks that harm your domain’s SEO ranking if not properly disavowed.

----- Phishing Campaigns:

Send emails with their domains (e.g., fake password reset or invite emails) claiming to be you, redirecting users to phishing pages masquerading as your brand.

Serve phishing content to users based on conditions such as geography, user agent, or time of day.

----- Domain Aging:

"Age" their domain by associating it with your legitimate service to make it appear trustworthy for future malicious activities. Targeted Malware:

Use redirects to detect vulnerable users and deliver malware or drive-by attacks to those targets while serving legitimate content to others. Regional Phishing or Malware Delivery:

Redirect normal traffic to your site while targeting specific regions for phishing or malware, avoiding detection for longer periods.

----- Hijacking Search Results:

Build up search engine traffic for their domains by associating them with your brand and later weaponize the domains (e.g., for phishing or fraud). Affiliate Fraud:

Redirect traffic with an affiliate ID (if you use affiliate links), attempting to claim commissions fraudulently. Brand Impersonation:

Use domains similar to your brand to impersonate your service, potentially harming your reputation.

----- Extortion/Domain Ransom:

Build traffic or search relevance on their domains and later attempt to extort money from you by offering to stop the redirect or sell the domain.

----- Invoice Scams:

Represent your service fraudulently to businesses for invoice scams or credit fraud.

----- Bypass Sanity Checks:

Use 301 redirects to bypass user sanity checks, tricking users into believing they are visiting legitimate sites.

---- Traffic Monetization:

Use ad-infested parking pages for a fraction of the traffic and redirect the rest to your site to generate revenue.

----- Reputation Damage:

Cause your brand to be associated with scam or phishing domains, which can harm public perception and trust.

----- Legal Liability:

Misuse of your brand or domain to commit fraud could lead to potential legal complications for you.

----- False Phishing Reports:

Cause false flags in phishing reports, harming your brand credibility and delaying the takedown of malicious domains. Hidden Routes for Malicious Content:

Redirect general traffic to you while hosting specific malicious routes (e.g., URLs hosting phishing or malware).

----- Impersonation via Emails:

Send emails claiming to be your service, and when users visit the domain, they see your page after a redirect, adding legitimacy to the scam.

----- Scam Awareness Manipulation:

Target your traffic by hosting fraudulent educational content or warnings related to your domain to sow distrust.

-------------------------- Mitigation Strategies: --------------------------

• Monitor Backlinks: Regularly check backlinks and disavow toxic links using Google’s Disavow Links Tool.

• HTTP Referrer Checks: Implement referrer or origin header-based redirects to flag and warn users arriving via fraudulent domains.

• Warn Users: Create a visible warning for users redirected from suspicious domains.

• Trademark/IP Enforcement: Leverage trademark protections to take action against impersonating domains.

• Manual Domain Actions: Periodically check for indexed pages and investigate potential abuses of similar or related domains.

In a higher chance, they want to nuke your website, because too many 301 can be harmful to SEO in some rare cases.

If they want to sell you sth, or scam, they won't do 301, because after 301 the juice power will gradually move to your domain, and its pointless to do this before any scams and sales.

Are you sure it isn't the marketing team setting up domains for email marketing blasts?

mostly for phishing (if you're successful), to send e-mail looking like from you

it can bypass some whitelisting if you for example have redirects checking if address is example.com but validation is poorly written ("startswith", "contains") , on login page or anywhere else.

Could be for phishing. Is the SAAS in a domain that involves money (payments/crypto etc) ? Then even more likely so. I would drop those redirects at my webserver level. Easy to d0.

Another alternative is that they will hijack those links once they gain traction in search results. Almost as a hedge against your future success.

It's not that easy to find their play.

First and foremost, guide visitors with a popup alert or a banner that you only conduct legitimate business through example.com.

Did you buy used/old/expired domain? Any patterns you can see or a random increase in traffic out of nowhere? What about your competitors?

A 301 redirect isn't a bad thing unless someone has the knowledge to turn it into something bad.

That is a really good problem to have.

If you know that is happening with HTTP you can redirect those requests, based upon origin, to a honeypot of your choosing. It’s free traffic you didn’t have to work for to use as you wish without disruption to your business requirements. You can use that traffic to experiment with new features under experimental branding, AB testing, and more.

If you have an affliate program, it could for outbound email campaigns to sell your product.

could be phishing or a "negative SEO" attack

if the domains being forwarded have had penalties it could leak into your domain SEO value

could also be a mistake :)

Not a lawyer. Your claim to copyright the term used by your SaaS depends on the website you registered, unless you officially copyrighted the term. Someone having all those websites can also claim the copyright, or claim you didn't enforce it by asking the other websites to be removed.

Many good answers for the why, but can and should you do anything about it?

Sounds like phishing? Try go through their website and see

if the domain is great and strong you can sell it 100% of the price you buy it

Step 1: build reputation as if they are you

Step 2: offer to sell them to you for some inflated price

Step 3: make your life hell if you dont pay

I can answer this one because it was one of my dirtier SEO tricks.

Expired domains and Domains on the marketplace, with hundreds or thousands of “backlinks” to them, are valuable. In the listing you may see something like “20000 back links.” And those links are usually worthless , spam, and will vanish as soon as you buy. But you can find domains that have real backlinks. TEN backlinks from reputable websites are more valuable than a thousand spam BLs.

You used to be able to buy and run software , “backlinks explorer” to investigate everyone who links to a domain you’re thinking about buying. And you can also research a “20000 backlinks” claim to see if this is just someone spamming that domain all over blogger and forums.

A good domain to buy will have legit backlinks from real websites that the website linked on purpose. If it’s been spammed thousands of times for a “5000 backlinks claim” , expect google to punish it!

Because if you 301 them to your site, google et al assume you’re the legitimate successor to that website and people mean to link to you.

So you come up higher in search.

I’ve used this to be the first or second result on google. And certainly on the first page of results.

It overcomes downranking for being a new domain nobody links to.

Google has its own criteria for evaluating whether your page is spam or a scam, and whether you’re abusing this to promote spam or a scam.

I have a trio of ancient highly ranked domains that I forward to a new page for about a year.

They’ll hit page one on google within a week or two or three.

After I remove the 301s or recycle those domains, the pages usually still come up within the first page of results afterwards.

Before you get too horrified here, I did this to bury a “competitor” who had registered a similar domain name, stolen my entire repo and website from a disgruntled employee, copied all my software and copied my webpage word for word trying to drum up business on my IP. The whole time they mocked me in email about stealing my customers and putting me out of business.

It worked. (Sort of. If you hire them they don’t actually have any idea how to do what I do.)

I did not do this to scam or phish or what have you. I just did this to bump them from #1 on google. Which they got by incorporating with a similar business name and registering with a similar URL.

They did ultimately manage to shut that business down and disrupt it after years of this and I moved on because I have other talents and this venture wasn’t profitable enough to deal with this entity kneecapping me for years and years.

But on my way out, I forwarded all of those domains to a reasonable and legitimate website that’s in the same line of work, resulting in them now dominating the other site in search. So I walked away and used this trick one last time to at least ensure someone searching for this subject would end up in some safe and reasonable hands.

What’s my point in sharing this?

It’s that the other website has no idea I did this, and has no control over it. You might see this and assume the worst about the other website.

someone could be doing this to manipulate SEO or search results over sites they don’t even own. For reasons that might (?) make sense or be well intended.

and for reasons that don’t, or might even be malicious.

* MULTIPLE edits for clarification

People do this for SEO purposes. They think that this increases the amount of backlinks to their site, thus increasing their rank in Google and other search engines.

This is less true than it used to be, but people still do it.