Hey HN,

I am Francesco and I am so proud to finally be launching Indie Affiliates, a platform to share your affiliate program in minutes.

I built it because when I created my first affiliate program, I was super pumped about it but then I realized "How are marketers going to know that I created an affiliate program?"

So I started researching on Google but all the directories I could find to submit an affiliate program where:

A. Asking for $199/year or more B. Were not the right "environment" for my SaaS

Which lead me to create Indie Affiliates, a platform where Indie Hackers (and startuppers in general) can easily submit their affiliate marketing program.

Yes, that's exactly what they are doing.

How can I stop this?

In Next.js you can use middleware to sniff the domain and do something (block or redirect to your own): https://nextjs.org/docs/app/building-your-application/routin...

On the frontend you can also use Javascript to do the same thing and just redirect their traffic to your own (or block them).

Make sure to specify canonical tags etc too so Google doesn't think those duped domains are yours.

If you have any API routes, make sure you set up CORS and CSPs and such to block requests from unauthorized domains.

(Edit: You can probably also just throw Cloudflare in front of the whole setup: https://vercel.com/docs/integrations/external-platforms/clou...)

If your site is only meant for human end users, you can get lists of datacenter IPs and use that to block them (assuming they are running in a datacenter that's on the list). That tends to block all sorts of abuse.

If you are worried about blocking legit users with this method, you can show a CAPTCHA instead on every request from a suspect IP.

At any rate, get their IP from your logs and run a whois on it to get their ISP and location. You could also try emailing the ISP's abuse contact or filing a DMCA complaint with their hosting provider, although of course that might not work.

Put CORS in place and a strict CSP.

Look the Host header in your API backend and block it. It might be forged, but probably not.

Identify their host (reverse IP lookup) and block requests from that ASN. If they host in same place as you, complain and get them shut down (or move).

The obfuscated JS based domain checking others suggested.

None of these is perfect, but they don’t have to be. Just keep adding layers until they go away for good.

I had a similar thing happen to one of my websites. In Varnish I used something like this:

if (req.http.host ~ "^(?i)(example.com|www.example.com)") { #redirect to https } else { return(synth(403, "Not allowed.")); }

It basically checks if the host is my domain. I don’t know know what the equivalent of `req.http.host` is on the web server you use. This "solution" might run into issues with Google Translate, but I’m not sure.

One naive approach would be to look at what IP address(es) they're using when proxying and blocking them. (Or detecting them in code and redirecting them to your domain, perhaps.)

Configure which domains your server accepts requests from. Only serve requests coming from the domain that's actually yours.

block the ip of that log entry

Hey Ryan,

For now I prefer to just stick to Google Authentication as that is really secure and avoids me the "pain" of having to deal with password (which I value a lot).

Hey everyone!

My name is Francesco and I decided to create Leader Menu to help restaurant owners create their own digital menu easily and in a timely manner.

As I mentioned in the post, feedback would be much much appreciated.

Thank you for your time!

Thank you!

Thanks man! Any tips on how I could improve this?

That's actually a nice idea, will think of a few ways this can implemented.

Thank you!

Hey!

Will maybe add it in the future, possibly with magic links, but I want to focus on the product itself before adding this.

Thanks for the feedback!

Hello everyone!

My name is Francesco and recently I found myself looking for a tattoo design.

However, I did not want to go the "conventional" way, and decided to mix my passion for tech with the one for tattoos.

That's when I came up with Ink Studio AI!

Any feedback is more than welcome.