2

I've created and published a .com web-application (nodejs-express in backend, react in frontend) with social-login (facebook, google, linkedin etc..). But I haven't gone out publicly to ask people to use it, just a few beta-testers.

Today I when I googled the name of the site just to see if I could find it as a search result, I realized that a mirror with the .me domain came up first, and that led to the webpage. But it had not https, so I had to click "advanced -> proceed anyways" in chrome.

What are they trying to do, is it common with such attacks? Are they usually automated or made manually? And what can I do to stop it? Perhaps crash the site if it's not https or on the correct path?

if(location.origin !== 'mydomain.com' || location.protocol !== 'https:'){
document.body.innerText = ''
}
Improve this question
  • That JavaScript idea won't work against anyone even slightly competent, as they'll just change/remove it in their copy. – Joseph Sible-Reinstate Monica Nov 16 '19 at 5:18
  • 1
    There is nothing known about your site and of the behavior of the mirror so it is unclear what "they" intend to do by mirroring it. If you would specify the exact domain names one could have a closer look. But with this current lack of information any answer would be pure speculation which makes the question too broad. – Steffen Ullrich Nov 16 '19 at 7:00
  • 1
    @user1506145 IMO it's not worth it at all. – Joseph Sible-Reinstate Monica Nov 17 '19 at 2:35
  • 1
    @user1506145: This was essential information because it shows that there is likely no attack at all. myserials.me simply points to the same IP address as your domain. This IP address is hosted by DigitalOcean. Likely the owner of myserials.me had this domain once hosted at DigitalOcean and later abandoned it without removing the DNS records. – Steffen Ullrich Nov 17 '19 at 17:01
  • 1
    @user1506145: To make it more clear: there is no mirroring done at all. It is simply that both domains resolve to the same IP address and thus end up at the same server - your server at DigitalOcean. And since the certificate is only valid for your domain any HTTPS access using the other domain name results in a certificate warning - details will then show that the certificate is issued for your domain (as expected since it is your server). – Steffen Ullrich Nov 17 '19 at 17:10

Browse other questions tagged or ask your own question.