+- Hack Forums (https://hackforums.net)
+-- Forum: Hack Forums Official Information (https://hackforums.net/forumdisplay.php?fid=1)
+--- Forum: Site News (https://hackforums.net/forumdisplay.php?fid=2)
+--- Thread: HF phishing site (/showthread.php?tid=2555867)
HF phishing site - KILLM3 - Jun 4, 2012
DO NOT VISIT THE FOLLOWING SITE AND INPUT INFORMATION.
[deleted]
Avoid this site.
EDIT: It does not apear to have a JDB.
https://www.virustotal.com/url/91d27056bd0e08afa6fffdfbc4f004f5d9f6a3b18ae25f1382a727d74562e5d7/analysis/1338839649/
EDIT2: No malicious scripts either. All scripts are being pulled straight from cdn2.hackforums.net
The only thing malicious are the Base64 encoded advertisements, which are monetizing off of omni's work and the login forms.
EDIT3:
Confirmed phishing site:
Code
<form method="post" action="member.php"><input name="action" type="hidden" value="do_login"><input name="url" type="hidden" value="http://www.louisvuittonpurses4.com/"><input name="quick_login" type="hidden" value="1"><input name="quick_username" id="quick_login_username" type="text" value="Username/Email" class="textbox" onfocus="if(this.value == 'Username/Email') { this.value=''; }" onblur="if(this.value == '') { this.value='Username/Email'; }"> <input name="quick_password" id="quick_login_password" type="password" value="Password" class="textbox" onfocus="if(this.value == 'Password') { this.value=''; }" onblur="if(this.value == '') { this.value='Password'; }"> <input name="submit" type="submit" value="Login" class="button"><span class="remember_me"><input name="quick_remember" id="quick_login_remember" type="checkbox" value="yes" class="checkbox" checked="checked"><label for="quick_login_remember"> Remember me</label></span> — <a href="https://hackforums.net/member.php?action=lostpw">Lost Password?</a> — <a href="https://hackforums.net/member.php?action=register">Register</a></form>* - Omega™ - Jun 4, 2012
I doubt anyone would visit that website.
However thanks op!
* - sh@d0w - Jun 4, 2012
Hahaha that's a fag thing for someone to do
* - Minnesota Nice - Jun 4, 2012
That is quite interesting I'd be surprised if anyone fell for that though.
* - Dr.Money - Jun 4, 2012
Thanks for the heads up man. Much thanks
* - JinxyHF - Jun 4, 2012
I'd hope nobody falls for that... Thanks for the heads up though.
* - KILLM3 - Jun 4, 2012
(Jun 4, 2012 12:55 PM)Minnesota Nice Wrote: That is quite interesting I'd be surprised if anyone fell for that though.
If someone were to get infected, and their hosts file were changed...
hackforums.net = phishing site.
There'd be now way to tell the difference.
* - Snow - Jun 4, 2012
yeah if anyone seriously accidentally trys to login to that -___- that would be an epic fail lolz.
* - Trihunter3 - Jun 4, 2012
its weird though the ip is 1 diget off the same as hfs, and all the threads are the same there.
* - Oats - Jun 4, 2012
I have to say thats quite an impressive fake.
Either way doubt many are stupid enough to fall for it.
Oats
* - Pіkachu - Jun 4, 2012
Wait, is it updating the same time this site is updating? Nobody will fall for it of course, the URL alone isnt anything like it lol. But still... how the fuck?
* - Failedattempt - Jun 4, 2012
Just the website name makes me laugh.
It'd be a shame if a user goes there and forgets about it then logs in.
* - Draw - Jun 4, 2012
For anyone who uses xerotic's scripts, they would notice that the added links at the top of the page are missing.
* - Th3PonyWizard - Jun 4, 2012
(Jun 4, 2012 01:00 PM)Oats Wrote: I have to say thats quite an impressive fake.^This. Using the informative servers... Not bad. Gotta learn dis trick.
Either way doubt many are stupid enough to fall for it.
Oats
* - Haters Ganna Hate - Jun 4, 2012
I dont understand the URL and what its saying