[napsterbr]

Whatever their play, detect and drop the redirects. Good job on noticing it early on!

[kbolino]

You cannot detect a 301 redirect when you're only in control of the destination.

[eastbound]

Not through the referrer?

[HughParry]

Presumably just throwing a 403 if they have this referrer is ok and won't have a weird SEO impact or something?

[jsheard]

Couldn't the attacker evade that by sending Referrer-Policy: no-referrer with their redirect?

[thiago_fm]

No, and the earlier you do the better.

Later it might have