HN Explorer

Ask HN: How do you stop someone from promoting a fake GitHub?

22 points by etewiah ↗ HN
Just came across a copy of github hosted on an entirely different domain:

https://github.innominds.com/etewiah/quasar-property-web-builder

The disturbing thing is that it came up higher in the search results for my google search. How can this be stopped???

12 comments

[ 3.0 ms ] story [ 44.9 ms ] thread
dfcowell
An abuse complaint to their web host or domain registrar would be the first place to start. infosniper.net is one place to start, any random Whois provider will turn up their registrar.
etewiah
Thanks, will give that a go. There must be some way to alert google too right? It is pretty bad that they serve it up as a legitimate search result. You would expect the real github to be recognized and any other duplicate flagged automatically as fake.
rand846633
If you manage to get something done, please be so kind and let us know here. Good luck!
tata71
> You would expect

Google is not the arbiter of truth.

They've just convinced a bunch of people they were briefly.

[deleted]
(comment deleted)
legostormtroopr
It doesn’t look like a “fake” GitHub as it has every page I looked for on GitHub. I’d wager that they have set up a dns so that their team can push to a Github subdomain for some reason. Unless they are mirroring absolutely every public GitHub page.

To odd thing is, if that’s the case why is GitHub returning pages on a non-GitHub domain at all?

lucideer
They're at least proxying, as the IP is not Github's.

So there's a hosting aspect here, which is a major security and authenticity concern and I would associate with the word "fake".

[deleted]
(comment deleted)
flala
Perhaps the domain was created by CoPilot! All is well, we are just moving to the next level of software development!
[dead] Proven
It's shocking that Google enables this kind of behavior.

The fucking Git Memory, the .it link farms, shitty comparison sites, and now this.

Just how negligent a search engine has to be to have all these (and more) going on at the same time?

Every time I use GSE, and that's not often, I ask myself "do I really have to use GSE". At least I got to the point where it's never a natural and automatic choice.

LinuxBender
Anti-malware don't like that IP. There is probably something more going on than just posing as github. VirusTotal [1] also has a couple findings. You could try calling their ISP's customer service in the off chance they may do something with it. That network also shows up in the firehol [2] blocklists so they may cycle their IP within that network to evade some anti-malware. I would wager they have many domains and IP addresses to choose from.

  grep -c "^115.111.91" 2>/dev/null *set | grep -E -v ":0$"

  cruzit_web_attacks.ipset:1
  firehol_level4.netset:1
  iblocklist_cruzit_web_attacks.netset:1
  nullsecure.ipset:1
whois:

  organisation:   ORG-TCL6-AP
  org-name:       Tata Communications Limited
  country:        IN
  address:        Customer Service & Operations
  address:        Plot Nos. C-21 & C-36
  address:        'G' Block, Bandra Kurla Complex,
  phone:          +91-22-66502826
  fax-no:         +91-22-66502039
  e-mail:         ip-addr@tatacommunications.com
  mnt-ref:        APNIC-HM
  last-modified:  2017-08-14T01:05:24Z
  source:         APNIC
[1] - https://www.virustotal.com/gui/url/bba0280c47f58e96f1ff15af7...

[2] - https://github.com/firehol/blocklist-ipsets.git

nyanpasu64
Reminds me of http://github.55860.com/ from a few weeks or months ago. I still don't know if that was setup to steal passwords from a fake login form, or for a Chinese company to access GitHub from behind the Great Firewall.