I recently had a huge increase in visits of a website I manage. On deeper check I discovered I had a new referral. When I opened the website I was quite surprised.
It's not a just a referral, basically someon bought a domain and is opening my website from inside a full page frame like this:
frame name="main" noresize framespacing="0" frameborder="no" border="0" src="http://zzovq.voluumtrk.com/*****-*****-****-85c7-890*****?idade=35+"
* stands for numbers.
Through the url in src they get my website. Proxyed, apparently.
Besides the iframe they track visits on their page via Google analytics.
My question is: is this a new angle of attack? What are they trying?
I can think of a few possible attacks. They could be proxying the website and changing content (I didn't discover any evidence). Doing some JS injection (apparently not). In principle XSS is not possible like this. What's the point of this?