Re: [GNC-dev] URGENT: Fake gnucash website with fake download, most likely compromised file

Hey,

This IP is assigned to Cloudflare:

puck@dirk:~$ whois 2606:4700:3030::6815:5f93
...
NetRange: 2606:4700:: - 2606:4700:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF
CIDR: 2606:4700::/32
NetName: CLOUDFLARENET
NetHandle: NET6-2606-4700-1
Parent: NET6-2600 (NET6-2600-1)
NetType: Direct Allocation
OriginAS: AS13335
Organization: Cloudflare, Inc. (CLOUD14)
RegDate: 2011-11-01
Updated: 2017-02-17
Comment: All Cloudflare abuse reporting can be done via
https://www.cloudflare.com/abuse
Ref: https://rdap.arin.net/registry/ip/2606:4700::
...

Cheers,
Andrew

On Fri, 2022-12-09 at 17:53 -0600, David Carlson wrote:
> Mystery deepens!  When I tried to open this fake website it was not
> available in Tor browser but pinging it revealed a response from IPV6
> address 2606:4700:3030::6815:5f93.  That IP does not seem to be
> registered
> 
> On Fri, Dec 9, 2022 at 5:40 PM Vincent Dawans <[email protected]>
> wrote:
> 
> > Added screenshot showing fake gnucash site ad at top of google
> > results.
> > 
> > On Fri, Dec 9, 2022 at 3:31 PM Vincent Dawans <[email protected]>
> > wrote:
> > 
> > > Precision: the link to the fake site reported below is actually
> > > https://gnu-cash.org/main.php -- you need the full page link to
> > > see the
> > > fake site that shows in the google ad.
> > > 
> > > On Fri, Dec 9, 2022 at 3:24 PM Vincent Dawans <[email protected]>
> > > wrote:
> > > 
> > > > I just typed gnucash in google and the first hit was an ad
> > > > pointing to
> > > > gnu-cash.org (with a dash). It is a fake site that is a carbon
> > > > copy of
> > > > the official site but the download link goes to a setup.exe
> > > > that is most
> > > > likely a corrupted virus file.
> > > > 
> > > > We need this removed ASAP. There is an option in google to
> > > > report the
> > > > site and mark it as spam/phishing. I imagine if more people do
> > > > this it
> > will
> > > > get removed faster hopefully.
> > > > 
> > > 
> > _______________________________________________
> > gnucash-devel mailing list
> > [email protected]
> > https://lists.gnucash.org/mailman/listinfo/gnucash-devel
> > 
> 
> 

-- 
Andrew Ruthven, Wellington, New Zealand
[email protected] |
Catalyst Cloud: | This space intentionally left blank
https://catalystcloud.nz |

_______________________________________________
gnucash-devel mailing list
[email protected]
https://lists.gnucash.org/mailman/listinfo/gnucash-devel