Beware HN: The rise of weaponized "abuse" reports

FYI, this post about weaponized abuse reports is being downvoted/flagged. It very quickly disappeared from the front page of HN.

And I'm well aware it's against guidelines to even comment about this on HN, but it's directly relevant to the content of the post and the health of HN as a whole.

It might be falling under most people’s “meta” content filters, I thought this was about the abuse of HN’s flagging feature from the title.

Dropped from 37 to 41 in the minute it took to write this.

Funny to hear that from where I'm sitting. I guess many have not had to deal with these things. I have and as I saw the title I immediately assumed dmca complaints and wondered if the weaponization was to get your hosting pulled or google search results tanked.

I also wondered if this would be related tot he deluge of bad things from the forChaan harass book. No it's not fun learning from the receiving end on what they call the forChaan party vaan, and the other associated weaponization of things around all that.

In my experience, some takedown groups send emails to the hosting company, the contacts for the site and google. Google has a non-transparent site downranking based upon some hidden percentage of complaints for something.

One of my sites actually has something in the search results mentioning complaints and is essentially gone.

Many ways to hurt people from afar using tech, I'm not even sure many of the people sending complaints know the ripple damage that can occur. Just one of the joys of non-decentralized / non-transparent interwebs.

That's a bit...concerning. If I may ask, what was your solution to the abuse? Did you send Namecheap an email to confront them?

I had to respond since I didn't want Namecheap to remove my business from the internet. The response from the support agent was:

""" The preceding report appears to have been sent to you in error. Please accept our apologies for the mix-up and the false positive alert.

Please let us also assure you that we do value our long-term partnership with you and value you as our loyal customer. The situation experienced is no more acceptable to us than it was to you.

Such a time frame was specified in our initial email as phishing is considered to be a time-sensitive issue. However, we try to extend the time frame provided to our loyal customers to the maximum possible extent. Hence, the 24-hour time frame would have been extended in case of no-response from your side and we would tried to reach you again. """

I CC'd the CEO, but haven't heard anything direct. I can't have my domains with a company that has their trigger finger glue to the "suspend" button. I just don't know who else to register with. It's all a race to the bottom in terms of service and pricing. There doesn't seem to be a middle ground between MarkMonitor and Namecheap.

Cloudflare appears to be an option.

You can't register a domain with Cloudflare. You can migrate one to them though. Using AWS as a registrar is probably not a bad idea either.

There used to be a middle ground between MarkMonitor and NameCheap, but Network Solutions was acquired by web.com. Not horrible but they at least do not have a trigger finger on domains and they proved their backups worked in the OVH fire. I had to help teach their support staff how to use "dig" and it took many emails back and forth to get a new tld set up, but no trigger finger. I am happy with Mark Monitor though.

> They claimed a user-generated page on my site was phishing for credentials (because it happened to mention their client's name and had a login form on it).

There was an incident a few years ago where an article talked about Facebook changing its login system. This article ended up being the top Google result for the search "Facebook login". What happens? Hundreds of angry comments asking "Why did you change the login page?!? "How do I login to Facebook, this is so complicated", etc, etc.

The "reputation management company" shouldn't have a case, but well, idiotically, they have a little one.

Another thing I've seen is a blog article talking about how to cancel Amazon Prime. In its comments: several dozen people writing "My Amazon prime account is XYZ, I would like to cancel it please."...

I remember that. Actually It was a blog that allowed Facebook login for comments. People were visiting, scrolling down to the comment area, and using that to log into Facebook rather than just visiting Facebook.com.

I honor polite takedown requests. Many times they'll open an abuse ticket without even bothering to email the whois contact.

They almost always use some ridiculous cyber-scare language. "Confirmed digital threat incident", is one of my favorites.

Like the false DMCA spammers, I doubt they review the content in question before sending their boilerplate.

Host your domain with GoDaddy. In my experience the one thing they're good at is slow-rolling phishing complaints.

This is not what I thought. I figured this would be about PFAs in divorces. I guess that's old news.

This is why I move all my domains to cloudflare. I want a big company that takes security seriously, will be resistant to social engineering attacks, and won't be intimidated. Plus they do renewal at cost, and have an excellent DNS service with an API. Tough to beat that combo.

Namecheap customer here. Is there anything you lost moving to Cloudflare?

Depends what you are using Namecheap for... If you are just registering a domain and changing the nameservers then you wouldn't miss anything. If you use Namecheap's DNS, mail, hosting, etc then obviously it is not just a direct switch.

I moved a few domains from namecheap to Cloudflare recently after the namecheap domain configuration settings wouldn’t load (some JavaScript error).

I contacted their support and after 1 hour of no one possibly accepting that it was a bug (just insisting over and over I clear my cache, use a specific version of Chrome etc) I got fed up. I’m a front end dev. I could see clearly one of their APIs the page depended on was serving a 500.

Anyways I transferred my domains and haven’t missed anything. I was already using cloud flare for DNS though.

Nothing I miss anyway. It's been a good decision in my opinion.

If indeed "This is why I move all my domains to cloudflare" - I suggest people look elsewhere. Cloudflare is great at what they do - but they are not a 'bulletproof" hosting or domaining service.

sure they are not as bad as godaddy at the moment, and maybe they are better than nanecheap at abuse complaints, but I'm not sure of that.

They have ejected customers over complaints, and they have stated they now actively inspect what your users post and report things to three letter places with chains and guns, as well as censor / eject customers based upon a shifting view free speech / well, not all speech but most, depending on the year.

My recent report to cloudflare of a customer of using cloudflare to hijack one of my domains led me to a loop of "we are experiencing a heavy load of support requests and our company is suffering with reduced support staffing for (cant remember, the freeze in tx? covid or something?) - not a huge deal but whatever - similar to google, when you don't spend a lot of money for support it's hard to complain about it I guess.

As the original poster mentioned user generated content, it would not be hard to create issues and weaponize cloudflare's censoring / reporting hammer imho.

Indeed it is a tough to beat combo, but not for the issues the OP was describing imho.

The reputation management company only does what has been hired to do. Te unscrupulous company here is in my opinion Namecheap, for facilitating abuse of its customers.

It's entirely possible for more than one party to be acting in an unscrupulous/undesirable manner in this chain.

On a second thought, yes, you're actually right...

I totally understand Namecheap's response here apart from not visiting the website, which seems lazy even if they have a high volume of reports. Let's examine how a typical phishing campaign works:

1. Fraudster buys a "phish kit" - a crappy PHP script with a skinned login page that emails them credentials

2. Fraudster finds one or more compromised websites (read: small WordPress blogs) and sticks the phish kit there on some new page

3. Fraudster spams a bunch of people with a link to the phish kit

Most of their responses will probably be collected within 24 hours. Most webmasters of exploited sites don't pay attention or have a clue how to remediate issues. This means that it's standard practice to also send phishing reports to registrars and hosting companies in addition to contacting the site's owner and reporting to unified blacklists.

Some phish kits block certain IP ranges to make them harder to detect (e.g. a PayPal phish kit might block PayPal's corp IP range).

How did you arrive at this conclusion? The reputation management company is essentially committing fraud. What they're doing is illegal. How are the 2 situations even comparable?

Finally I understand why Google Search Results are strange to say the least.

Can you build an autoresponder to their boilerplate emails?