Incident pathway

How an old link becomes someone else's traffic

Each step looks like a helpful correction. The control point is checking where the new link really ends before you change it.

1
REQUEST"We own the site you link to"

An email claims to come from the owners of a website that has closed, and offers a "mirror" copy.

2
VERIFYOpen the new link first

See where it really ends. If the original site is gone, link to an archive.org copy instead.

3
REDIRECTThe link ends elsewhere

The "mirror" redirects to an unrelated commercial site, which inherits the trust of your old link.

Documented from a public report and from the redirects observed on 14 October 2026. No live page from these sites is embedded here.
What the example presents
We are the owners of the site you link to
What to examine
Why does the new link end on a hotel website?

Audience / at-risk group

Bloggers, librarians, Wikipedia editors and anyone who maintains old web pages with links

What you can notice

  • On 9 October 2026 a site administrator reported receiving emails from people posing as the legitimate owners of expired domains he had linked to, asking him to point those links to copies hosted on en-html.org.
  • On 14 October 2026 the en-html.org home page showed "Under Maintenance" and linked to 23 subdomains named after defunct organisations, such as sharksavers, minneapolishistorical, ancient-egypt and fairmountpark.
  • On the same day sharksavers.en-html.org answered with a permanent redirect (HTTP 301) to a page on beachhotel.net titled "Shark Savers: Protecting the Oceans, One Shark at a Time | Beachhotel.net", and minneapolishistorical.en-html.org redirected to a page on hotelsdowntown.info.
  • en-html.org was registered on 28 April 2025 through Spaceship, Inc.

The takeaway

A request to update an old link is not proof that it comes from the original owner. Check the new address before changing anything. If the original site is gone, link to an archive.org copy instead of a "mirror" offered by a stranger.

What the source reports

Russell Coker documented the emails and the en-html.org mirrors on his blog on 9 October 2026 and recommends replacing such links with archive.org copies. The redirects to hotel websites were observed by the Digital Fraud Observatory on 14 October 2026.

What this evidence cannot tell us

The aim of building search ranking from old links is the source's inference; it is not confirmed by the operator. This case does not show that anyone lost money or that the hotel sites commissioned the scheme. The redirects can change at any time; they are described as they stood on 14 October 2026.

Suggest a correction