macfansforum phishing scam?

Discussion in 'Community Discussion' started by nagromme, Dec 8, 2013.

  1. nagromme macrumors G5

    nagromme

    Joined:
    May 2, 2002
    #1
    Just thought I'd warn others/ask for their experiences, re what looks like a phishing scam aimed at Mac users--one that Google currently (albeit unintentionally) seems to be driving!

    When I search Google for macrumors plus some topic I know is in the forums, Google presents results titled properly MacRumors Forums--but when you click you get "macfansforum" instead. I won't add the .com but it does nothing anyway: it's divided into subdomains that clone Mac-related sites almost perfectly.

    Sometimes the clone site comes up higher than the real MR forum page, which is why I clicked it. (You can tell by the small green URL in the Google results--but who expects a clone of the very thing you were after>)

    Here's the thing: what you get LOOKS exactly like MR, and even has the latest forum posts/replies. Looks legit. But you're logged out... so naturally, you go to log in.

    Which fails, since the site is a fake. And now they have your MR username and password. (So I immediately did a password reset.)

    Other MS "sister sites" (TouchArcade and Appshopper, and MR's Guide and Forum Spy) seem to be cloned as well. Haven't noticed any non-MR-related clones yet. One way to see some things is to Google "macfansforum" in quotes--you'll see lots of cloned profiles of MR users, for instance.

    So--just a warning. Hopefully Google will de-list them soon, but for now, it seems to be very easy to wander into a Mac-related phishing site.

    (And knowing that such clones exist, and Google's not blocking them promptly, I will no longer trust Google results for known sites! I used to: one way to make sure I got to a "real" bank site was to Google the bank and trust Google to present the real deal first. That trust is fine until it's not. So the silver lining here: I'm less trusting now, and thus more safe!)
     
  2. Jaro65 macrumors 68040

    Jaro65

    Joined:
    Mar 27, 2009
    Location:
    Seattle, WA
    #2
    Haven't come across this yet. Thank you for letting us know!
     
  3. nagromme, Dec 8, 2013
    Last edited: Dec 8, 2013

    nagromme thread starter macrumors G5

    nagromme

    Joined:
    May 2, 2002
    #3
    P.S. Arn speculated that its an SEO scam rather than phishing. Who knows? He has blocked them for now, but they could get around it:

    http://forums.macrumors.com/showthread.php?t=1682320

    And the block just makes it hard for them to clone additional content. They already have the existing cloned stuff; they even copied user avatars and host their own copies.

    (In the end, hopefully Google will de-list them regardless.)
     
  4. localoid macrumors 68020

    localoid

    Joined:
    Feb 20, 2007
    Location:
    America's Third World
    #4
    What's the format of the search string look like that you're using to search?

    When I search Google using site: search operator for a common and recent topic such as "Black Friday" and use "site:macrumors" all the results I get are for the real macrumors.com.

    For example: black friday site:macrumors.com
     
  5. nagromme thread starter macrumors G5

    nagromme

    Joined:
    May 2, 2002
    #5
    It's hit or miss, but here's an example--the search that snared me:

    macrumors ipad air smart cover

    https://www.google.com/search?clien...rumors+ipad+air+smart+cover&ie=UTF-8&oe=UTF-8

    I then scrolled down to the particular complaint I'd been looking for ("not FLAT!") which was the last result on the page 1. Click it and you get what looks like the real MR site, but is just a scraped copy.

    (Granted, Google customizes everyone's search results based on watching your habits, so your mileage may vary. It might be higher or lower in the ranking.)

    Arn says they have scraped only some fraction of MR's content, not every thread/page.
     
  6. localoid macrumors 68020

    localoid

    Joined:
    Feb 20, 2007
    Location:
    America's Third World
    #6
    That just searches for pages that have those words (macrumors ipad air smart cove) on the page. That's not really a site search that limits results (only) to macrumors.com.

    If you results only from macrumors.com use the site search operator, as shown below:
     

    Attached Files:

  7. nagromme thread starter macrumors G5

    nagromme

    Joined:
    May 2, 2002
    #7
    Of course, and that's a useful workaround now that we know these guys have done this--but using the "site:" keyword is seldom necessary and seldom done by most people: Google's normally better at getting you to the right place. These guys have scammed Google and MR alike--for now. They won't get me again :)
     
  8. localoid macrumors 68020

    localoid

    Joined:
    Feb 20, 2007
    Location:
    America's Third World
    #8
    Yep. Sites that scrape content from Macrumors.com are taking something that doesn't belong to them. It's wrong. They probably know that and don't care. They do it for the hits, since hits can mean mo' money from ad revenue, etc.

    That said though, the way you're formatting your search strings you may get results that aren't from macrumors.com ---you'll get results that include Web pages that have the word "macrumors" somewhere on their pages.

    For example, you'll get this page from Forbes.com that has the word "macrumors" on the page, showing up in your search results, if you search for: macrumors "black friday".

    Using the site search operator isn't a "workaround" -- it's the proper way to limit search results to a specific site.
     
  9. nagromme thread starter macrumors G5

    nagromme

    Joined:
    May 2, 2002
    #9
    No argument--but in all my years of doing this on a near-daily basis, I've never needed the site: operator for that. I've used site: for years, but in special cases only. I use it when I find that the easier/quicker search doesn't work--but that's extremely rare.

    So for me, it is indeed a workaround (and maybe also for the majority of people, who I suspect use site: even less than I). I wouldn't say there's anything improper about omitting the site: term when it's never been needed and is more of a power-user option (one needing extra keystrokes and punctuation, and one needing knowledge not made obvious to most people).
     
  10. localoid macrumors 68020

    localoid

    Joined:
    Feb 20, 2007
    Location:
    America's Third World
    #10
    The Google search engine isn't smart enough to know that when you use of the word "macrumors" as part of the search string that you really want to limit results to just results from macrumors.com.


    Google isn't sentient. Google can't read your mind. (At least not yet...)

    If you could jump into a time machine and fast forward to 2113 and search for "Macintosh apple", even a sentient Google would have no way of knowing whether you wanted to search for an eatable product*or a type of computer system, unless it asked you for specifics first, such as: "Are you looking for an apple Macintosh computer or a type of fruit?"

    Additionally, 22nd century sentient Google would have no way of knowing if you wanted your search for "Macintosh apple" to be restricted to just results from apple.com or not...

    It's likely that in the near future, you'll be able to just talk into a mic and say something like "OK Google. Find Macintosh at apple's website" and get results (only) from apple.com that contain the word "Macintosh".

    Until then, just add "site:apple.com" on the end of your search string.

    *the type of fruit can be spelled as: McIntosh, Macintosh, or Mackintosh
     
  11. nagromme thread starter macrumors G5

    nagromme

    Joined:
    May 2, 2002
    #11
    Site: will remain rarely used--Google's gotten that good--but it's an awesome trick when needed! It's good that you added a reminder of that to the discussion.

    (I rarely need to eliminate hits from other sites--I don't care if they're there or not, as long as the result I DO want is present and quickly spotted. But in this case: spoofed.)
     
  12. localoid macrumors 68020

    localoid

    Joined:
    Feb 20, 2007
    Location:
    America's Third World
    #12
    Yep. Site: is for power users. It's not for you.
     

Share This Page