记一次博客被反向代理

昨天闲来无事在看谷歌分析统计出来的数据，看到了一条从来没见过的域名的引用，原本以为是那种采集站或者是谁参考了我的文章，打算去看看的，但是打开页面之后直接看到打开了我的博客（原封不动）。

内容不能说一模一样吧，只能说连页面的结构都一样。见过采集的也见过参考的，但是还没见过整个站都反代过去的。。。

# 一开始

本来以为站点是直接扒下来的，不打算管了之后，后来发现，是直接用 CloudFlare Worker 反代的，而且修改了 host 头，所以防盗链之类的操作基本上都没用了。。。

经过Google之后发现可以用 JS 脚本来应对这种事情。

刚开始的时候直接用 JS 判断窗口域名是否正确，不正确即跳转到正确的域名。

代码如下请放到Head里面

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
const validDomains = [
 'blog.xpdbk.com',
 'vlblog.xpdbk.com',
 'lelfeng.netlify.app',
 'cfblog.xpdbk.com', 
'1x000.github.io',
 'adaewfd321fg3.cachefly.net',
 '127.0.0.1:1313',
 'localhost:1313'
] 
try {  
 if (validDomains.indexOf(document.location.hostname +':'+ document.location.port) === -1) {
 window.location.href = 'http://blog.xpdbk.com';
 }
} catch(e) {}

但是这个人不讲武德的通过反代把文件内的域名全部替换为了他的域名，就出现了死循环。

后来通过 https://obfuscator.io/ 混淆的方式，把JS给混淆了，这样就防止了域名被修改。

混淆后的示例代码如下：

1
const _0x43eb42=_0x27a7;(function(_0xafca11,_0x40b2b8){const _0x35c55e=_0x27a7,_0x15b338=_0xafca11();while(!![]){try{const _0x517e5b=parseInt(_0x35c55e(0x188))/0x1*(parseInt(_0x35c55e(0x196))/0x2)+-parseInt(_0x35c55e(0x189))/0x3+-parseInt(_0x35c55e(0x18c))/0x4+parseInt(_0x35c55e(0x194))/0x5+parseInt(_0x35c55e(0x1a6))/0x6+-parseInt(_0x35c55e(0x19c))/0x7*(parseInt(_0x35c55e(0x1a3))/0x8)+-parseInt(_0x35c55e(0x19a))/0x9*(-parseInt(_0x35c55e(0x19d))/0xa);if(_0x517e5b===_0x40b2b8)break;else _0x15b338['push'](_0x15b338['shift']());}catch(_0x6c5198){_0x15b338['push'](_0x15b338['shift']());}}}(_0x17e0,0x5e4df));const _0x130d92=(function(){let _0x2e53a6=!![];return function(_0x323b74,_0x490435){const _0x1c497f=_0x2e53a6?function(){if(_0x490435){const _0x33bf80=_0x490435['apply'](_0x323b74,arguments);return _0x490435=null,_0x33bf80;}}:function(){};return _0x2e53a6=![],_0x1c497f;};}()),_0x4b63bb=_0x130d92(this,function(){const _0x982257=_0x27a7;return _0x4b63bb[_0x982257(0x184)]()[_0x982257(0x192)](_0x982257(0x198))[_0x982257(0x184)]()[_0x982257(0x19f)](_0x4b63bb)[_0x982257(0x192)](_0x982257(0x198));});_0x4b63bb();const _0x3f0a06=(function(){let _0x2f2ee3=!![];return function(_0xf1a2dc,_0x12daa7){const _0x2c78dc=_0x2f2ee3?function(){if(_0x12daa7){const _0x1e1bbf=_0x12daa7['apply'](_0xf1a2dc,arguments);return _0x12daa7=null,_0x1e1bbf;}}:function(){};return _0x2f2ee3=![],_0x2c78dc;};}()),_0x11b84d=_0x3f0a06(this,function(){const _0x5958bf=_0x27a7;let _0x1c1520;try{const _0x48284c=Function(_0x5958bf(0x18d)+_0x5958bf(0x18a)+');');_0x1c1520=_0x48284c();}catch(_0x560e71){_0x1c1520=window;}const _0x4777cb=_0x1c1520['console']=_0x1c1520[_0x5958bf(0x1a5)]||{},_0x10f092=[_0x5958bf(0x1a4),_0x5958bf(0x1a0),_0x5958bf(0x187),_0x5958bf(0x18b),_0x5958bf(0x19b),_0x5958bf(0x193),_0x5958bf(0x185)];for(let _0x41e094=0x0;_0x41e094<_0x10f092[_0x5958bf(0x190)];_0x41e094++){const _0xa11f57=_0x3f0a06[_0x5958bf(0x19f)][_0x5958bf(0x197)]['bind'](_0x3f0a06),_0x5853a5=_0x10f092[_0x41e094],_0x418439=_0x4777cb[_0x5853a5]||_0xa11f57;_0xa11f57[_0x5958bf(0x1a1)]=_0x3f0a06['bind'](_0x3f0a06),_0xa11f57[_0x5958bf(0x184)]=_0x418439[_0x5958bf(0x184)]['bind'](_0x418439),_0x4777cb[_0x5853a5]=_0xa11f57;}});_0x11b84d();const validDomains=[_0x43eb42(0x191),_0x43eb42(0x195),_0x43eb42(0x18e),_0x43eb42(0x18f),_0x43eb42(0x19e),'adaewfd321fg3.cachefly.net',_0x43eb42(0x186),'localhost:1313'];function _0x27a7(_0x30b2be,_0x27f11a){const _0x2f8ec1=_0x17e0();return _0x27a7=function(_0x11b84d,_0x3f0a06){_0x11b84d=_0x11b84d-0x183;let _0x2ded53=_0x2f8ec1[_0x11b84d];return _0x2ded53;},_0x27a7(_0x30b2be,_0x27f11a);}function _0x17e0(){const _0x30092e=['__proto__','http://blog.xpdbk.com','248mjjPBK','log','console','2331390Rbmidg','location','toString','trace','127.0.0.1:1313','info','1hGmVnj','511494uNxHBt','{}.constructor(\x22return\x20this\x22)(\x20)','error','1689000vVCMXN','return\x20(function()\x20','lelfeng.netlify.app','cfblog.xpdbk.com','length','blog.xpdbk.com','search','table','2697315oyIMgb','vlblog.xpdbk.com','405444fEnPtY','prototype','(((.+)+)+)+$','hostname','422352iCyGvT','exception','119035WNGFBa','80LiPhiY','1x000.github.io','constructor','warn'];_0x17e0=function(){return _0x30092e;};return _0x17e0();}try{validDomains['indexOf'](document[_0x43eb42(0x183)][_0x43eb42(0x199)]+':'+document[_0x43eb42(0x183)]['port'])===-0x1&&(window[_0x43eb42(0x183)]['href']=_0x43eb42(0x1a2));}catch(_0x573349){}

获得加密后的代码随机插入至站点某个引用的脚本其中，就会让那些镜像站的垃圾无从下手。

至此问题就基本解决了。让那些Yee玩意哭去吧