HN Explorer

Ask HN: Best way of dealing with fraudulent websites

2 points by VBprogrammer ↗ HN
My partner was caught out by a website which impersonated a UK government website. I've reported the domain to the registrar, the domain which is used to host the data collection service and reported the IP address to the owner of that IP address range.

Any other techniques which can get it taken down quickly?

The original site was https://gov.allowance-uk.top/payment.html and I followed the data collection to https://u2.wyzadmin.top/index.php/click/loadMainPage?page=job/payment.html

4 comments

[ 1.4 ms ] story [ 31.8 ms ] thread
sim7c00
not sure, gettung stuff taken down is really hard and often agencies and desks tasked with this are very overloaded so you might find yourself at the right place but in a long queue. sites like this can help identify clones which i hope more services will utilize to fight their evil twins: https://didsomeoneclone.me/ (made by friend). for your own protection, theres different types of security software and hardware that can be used to try and reduce risk, though those are often also not flawless.

some services will check for example age of certificates etc. to try and determine legitimacy of a site which can be fairly effective.

i cant recommend a certain tool tho as most ive used are propriatary and too expensive for individuals. at home i try not to visit any link :').. open it at work :D where theres enterprise level url filters

solardev
The spammers will always be able to make fake sites quicker than they can be taken down.

Teach your partner safe browsing habits: How domains work, and to never trust anything government unless it's from a .gov.uk directly before the first slash. Bookmark their banks for them and tell them to never access anything banking-related except from those bookmarks, and never from a link or an email. If in doubt, just have them wait and ask you.

My partner got scammed out of $300 a few years back. Told her to never send money to anyone online without checking with me first, and we've been fine since.

-----

If you really want to, you can report the link to non-government blocklists, like:

- Google's: https://safebrowsing.google.com/safebrowsing/report_general/

- uBlock Origin's https://gitlab.com/malware-filter/phishing-filter#phishing-u... and https://gitlab.com/malware-filter/urlhaus-filter#malicious-u...

But I wouldn't bother. They can make them quicker than you can report them.

VBprogrammer
In fairness to her - this wasn't a drive by attack. She was in the process of applying for the benefit that the site claimed to be part of. To my mind this is either a complex technical attack, or more likely perhaps, an inside job. The money from a single victim wouldn't justify creating the website IMHO so I suspect they have a long list of 'warm leads' which makes it a hell of a lot more convincing.

She did spot that it was fake a few minutes after inputting her details and we then blocked all her cards. So all they got out of it was some semi-private details (name, address etc).

solardev
How did they get the link to her?