-8

Original site: ---topbargains-com-au

A fake replica: --topbargain-org

How dangerous is this? Have they copied the whole database?

Edit: Removed the URLs to satisfy a spam allegation

Edit: The fake replica site contains this line in the footer.

src="http://js.tongji.linezing.com/3598203/tongji.js

Edit: See below comments, it seems like a masking attempt. Still no idea how to report them?

4
  • Nice spam attempt as both domains are registered in June. – Jeroen Jul 10 '15 at 13:50
  • God, I hope you are just having a bad day else you would have noted that first site is 10 year old domain. – KBS Jul 10 '15 at 14:05
  • I have removed the links to counter your unfounded suspicion. Can you help with the issue now? – KBS Jul 10 '15 at 14:06
  • 1
    I have no idea what you're asking. Are you saying that the replica site is a full copy of the original website? What do you want to report them for? – schroeder Jul 10 '15 at 15:39
2

Are you thinking of a phishing attack? A phishing attack involves tricking a user into entering credentials into a website that looks much like a legitimate one.

For example, suppose First World Bank has the domain name of firstworldbank.com. Eve, the attacker, might create firstw0rldbank.com or flrstworldbank.com. She then sends an email to Bob that claims his passsword needs to be renewed, with a link to one of the fake websites. If Bob falls for the trick and logs in, he loses his credentials.

I seriously doubt this is a phishing attempt, however! A cursory glance at both websites shows that they have significantly different layouts and content. It's much more likely that two different people decided that "top bargain" is a good name for a coupon-related service.

They are the same website, or, at least, appear to be so. The .org domain contains a traffic-monitoring script, but otherwise appears to be the same. They also resolve to different IP addresses. I'm not a web guru, so I can't say if this is suspicious or not.

As a precaution, though, you may want to query the customer support of the .com.au domain. I'm certain they'll let you know if the other site is legitimate or not.

7
  • No the layout is same - you are seeing different content due to caching. Upon further research, it seems they are just masking the domain and including a script for malicious purposes. No server has been breached for sure. – KBS Jul 10 '15 at 14:57
  • Another attempt they made at masking another coupon website (HOTUKDEALS) virustotal.com/en/domain/hotvouchercodes.org/information – KBS Jul 10 '15 at 14:59
  • Oh, I see. I jumped to a different page on the .org site than on the .com.au site, so it looked different. Updating my answer now. – etherealflux Jul 10 '15 at 15:10
  • Thanks mate .. I work for the .com.au site and know for sure that other site is not authorized. – KBS Jul 10 '15 at 15:41
  • Ahh, you should have said that sooner! In that case, they're probably redirecting to your site and appending a traffic monitoring script to see how many people are going through the domain. I might dig through it this evening and see what's up. – etherealflux Jul 10 '15 at 15:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.