macfansforum phishing scam?

Just thought I'd warn others/ask for their experiences, re what looks like a phishing scam aimed at Mac users--one that Google currently (albeit unintentionally) seems to be driving!

When I search Google for macrumors plus some topic I know is in the forums, Google presents results titled properly MacRumors Forums--but when you click you get "macfansforum" instead. I won't add the .com but it does nothing anyway: it's divided into subdomains that clone Mac-related sites almost perfectly.

Sometimes the clone site comes up higher than the real MR forum page, which is why I clicked it. (You can tell by the small green URL in the Google results--but who expects a clone of the very thing you were after>)

Here's the thing: what you get LOOKS exactly like MR, and even has the latest forum posts/replies. Looks legit. But you're logged out... so naturally, you go to log in.

Which fails, since the site is a fake. And now they have your MR username and password. (So I immediately did a password reset.)

Other MS "sister sites" (TouchArcade and Appshopper, and MR's Guide and Forum Spy) seem to be cloned as well. Haven't noticed any non-MR-related clones yet. One way to see some things is to Google "macfansforum" in quotes--you'll see lots of cloned profiles of MR users, for instance.

So--just a warning. Hopefully Google will de-list them soon, but for now, it seems to be very easy to wander into a Mac-related phishing site.

(And knowing that such clones exist, and Google's not blocking them promptly, I will no longer trust Google results for known sites! I used to: one way to make sure I got to a "real" bank site was to Google the bank and trust Google to present the real deal first. That trust is fine until it's not. So the silver lining here: I'm less trusting now, and thus more safe!)

P.S. Arn speculated that its an SEO scam rather than phishing. Who knows? He has blocked them for now, but they could get around it:

https://forums.macrumors.com/threads/1682320/

And the block just makes it hard for them to clone additional content. They already have the existing cloned stuff; they even copied user avatars and host their own copies.

(In the end, hopefully Google will de-list them regardless.)

It's hit or miss, but here's an example--the search that snared me:

macrumors ipad air smart cover

https://www.google.com/search?clien...rumors+ipad+air+smart+cover&ie=UTF-8&oe=UTF-8

I then scrolled down to the particular complaint I'd been looking for ("not FLAT!") which was the last result on the page 1. Click it and you get what looks like the real MR site, but is just a scraped copy.

(Granted, Google customizes everyone's search results based on watching your habits, so your mileage may vary. It might be higher or lower in the ranking.)

Arn says they have scraped only some fraction of MR's content, not every thread/page.

localoid said:

That just searches for pages that have those words (macrumors ipad air smart cove) on the page. That's not really a site search that limits results (only) to macrumors.com.

If you results only from macrumors.com use the site search operator, as shown below:

Click to expand...

Of course, and that's a useful workaround now that we know these guys have done this--but using the "site:" keyword is seldom necessary and seldom done by most people: Google's normally better at getting you to the right place. These guys have scammed Google and MR alike--for now. They won't get me again

localoid said:

Yep. Sites that scrape content from Macrumors.com are taking something that doesn't belong to them. It's wrong. They probably know that and don't care. They do it for the hits, since hits can mean mo' money from ad revenue, etc.

That said though, the way you're formatting your search strings you may get results that aren't from macrumors.com ---you'll get results that include Web pages that have the word "macrumors" somewhere on their pages.

For example, you'll get this page from Forbes.com that has the word "macrumors" on the page, showing up in your search results, if you search for: macrumors "black friday".

Using the site search operator isn't a "workaround" -- it's the proper way to limit search results to a specific site.

Click to expand...

No argument--but in all my years of doing this on a near-daily basis, I've never needed the site: operator for that. I've used site: for years, but in special cases only. I use it when I find that the easier/quicker search doesn't work--but that's extremely rare.

So for me, it is indeed a workaround (and maybe also for the majority of people, who I suspect use site: even less than I). I wouldn't say there's anything improper about omitting the site: term when it's never been needed and is more of a power-user option (one needing extra keystrokes and punctuation, and one needing knowledge not made obvious to most people).

Site: will remain rarely used--Google's gotten that good--but it's an awesome trick when needed! It's good that you added a reminder of that to the discussion.

(I rarely need to eliminate hits from other sites--I don't care if they're there or not, as long as the result I DO want is present and quickly spotted. But in this case: spoofed.)