A security researcher setup a similar domain with a phishing page. Equifax made the mistake of linking to his page rather than their own on twitter!!!

https://www.google.ca/amp/s/www.nytimes.com/2017/09/20/busin...

Its somewhat of an unsolved problem, there's all sorts of these kind of sites that are legitimate but look really suspicious, like they could be phishing sites. Examples:

https://www.annualcreditreport.com/

https://www.optoutprescreen.com/

You can tell these two are legit because they are listed on official government sites:

https://www.ftc.gov/faq/consumer-protection/get-my-free-cred...

https://www.consumer.ftc.gov/articles/0262-stopping-unsolici...

However, I can see how some people wouldn't think to go through .gov sites and there's really nothing stopping me from registering a phishing site with a similar domain and hosting it in Russia or something to confuse people into using mine rather than the official one.

I think freecreditscore.com has been confused with annualcreditreport.com in the past. Freecreditscore.com is owned by Experian now and it actually does offer a real free no strings attached credit score NOW, but in the past it used to be one of those sites that tricked you into signing up for a subscription.

Then, of course, there was the Equifax data breach site that totally looked like a phishing site.

My mortgage company uses similar URLs that I always associate with scams. It's something like PayMyMortgage.com or something along those lines.

I had 401k through https://www.yourinvestmentaccount.com/ at one point. So sketchy.

They had a virtual keyboard with only 16 choices of chars to type your password in on there at one point.

Is it https://yourmortgageonline.com/?

That site looks super sketchy.

I've also had benefits through something like "mybenefitsportal.com" or something (made up, I forget the real URL).

I don't understand why companies do this. I completely understand that my health insurance is through "Empire Blue Cross Blue Shield" or whatever. So I expect to go to your corporate website and click "log in". If you think your website is so bad that it will damage your corporate brand... well maybe you should work on that.

If it's an SEO thing, that's also shady. If Bank A has "myonlinebillpay.com" and Bank B has "easyonlinebillpay.com"... how am I going to end up at the right one?

It makes me mad.

It's only a problem if the authority is obscured by an unrelated domain name. If the page was a location on a site with known authority, or a subdomain, it could be validated much more easily. Unfortunately, vanity gets in the way.

Its not just vanity though, in these two cases "the authority" is the industry as a whole, thus many "authorities."

For example:

>OptOutPrescreen.com is a joint venture among Equifax Information Services, LLC, Experian Information Solutions, Inc., Innovis Data Solutions, Inc., and TransUnion, LLC (collectively the "Consumer Credit Reporting Companies").

>[annualcreditreport.com] is maintained by Central Source, LLC. Central Source, LLC is sponsored by Equifax, Experian and TransUnion so you have a single site where you can ask for all three of your free credit reports.

So why can't Equifax, Experian, Innovis, and TransUnion each set up a subdomain to redirect to this domain? Then they can each direct people to their own subdomain, and people can be more sure that the site they end up on is one that the respective company intends them to.

I feel like the lack of this kind of thinking helps keep people dumb about what a URL looks like, so that phishing links like www.bank-of-america--interestpayments.com/your-account/secure.html keep working. The less people are parsing the few domains they really do interact with, in favor of specialty URLs for every little thing keeps it all confusing.

Here's the "official" page on the ftc.gov site, which has links to the settlement site in the FAQ section.

https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq...

Your comment inspired me to take a look. I compared the SSL certificate and the whois information to equifax.com. The settlement site uses a different company for the certificate. The settlement site uses Starfield Technologies vs DigiCert for equifax.com. The settlement site uses GoDaddy for their DNS vs UltraDNS for equifax.com. It's not impossible that a division in the company or a different law firm uses different SSL certificate provider and DNS provider, but it may point to some caution.

Edit: As another commenter pointed out, this site is linked to from the FTC site about the breach.

You're assuming that this site is run by Equifax; it is not. It is run by a "Settlement Administrator", a third-party entrusted by the court to handle the money and record-keeping associated with a class-action settlement. This is to avoid possible manipulation of the settlement by the defendant.

Being linked to from the FTC isn't a safe bet. Bear in mind Equifax sent people to a fake Equifax website before: https://money.cnn.com/2017/09/20/technology/business/equifax...

Legally, the settlement administrator must be totally independent from Equifax, so comparing their hosting providers, cert providers, etc. you'd only expect them to match by random chance.

Why compare it to Equifax? I'd just assume it's an unrelated malicious opportunist. I'd rather compare it to JND to have evidence towards proving that it's legit. Anyway it is legit since it's mentioned on the FTC site.

I made a faulty assumption. As others have pointed out, the settlement site is run by a third party.

At this point I'd consider the government more competent than Equifax.

Yeah its totally legit, its just funny to think about. I expect it to happen someday.

This site is using godaddy presumably because the law firm also does, though they do use different certs!

I got this site link directly from the FTC's settlement announcement, or I would have worried about that myself.

https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq...

You think they would have learned since the breach. Right after the breach was disclosed they made their information page equifaxsecurity2017.com. It had the same prompt for last name and last digits of the visitor's SSN. Then just said something along the lines of ~"Thanks for the information, we'll have more details later".

I was wondering this as well, but the link came from the FTC's site: https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq...

In Quebec we recently had a massive information leak from Desjardins, a credit union used by most of the population. It didn't take long for people to receive phishing SMS trying to get information from people.

It's not exactly the same, but work the same way.

The FTC - verified on Twitter - tweeted the URL. That chain of trust is good enough for me.

Update. I tried a different last name and told I wasn't eligible, so thats good.

>I just entered "Smith" and 6 digits. (Not real) I was eligible.

Arguably, your best bet for this kind of test is a very blatantly fake name, like "Zxzxzx". It's entirely possible that there is someone with the last name Smith (since it's very common) who also has those six digits at the end of their SSN.

Good point.. I tried "potter" and I got Not eligible.

So either I'm a great last digit guesser (Though I'm usually not lucky in things like gambling....) I'll update my original comment.

It may not be so much a great guess as a statistical likelihood! In 2000, there were over 2.3 million Smiths in the United States: https://blogs.ancestry.com/cm/smith-a-short-history-of-ameri... (This number has likely grown roughly alongside our population, so let's use 2000 numbers for this.) In 2000, we had 281 million people in the US, which means 0.8% of Americans have the last name Smith.

If we assume every possible SSN could be handed out, a trailing six digit entry could have anywhere up to 999 possible SSNs, so you're firing out a shotgun with a pretty big number of potential targets each time you guess an SSN.

I put in bogus name and social. It said i was affected by the incident. So.... Probably phishing.

Search for "Copyright © 2019 JND. All rights reserved" -- there are a ton of sites of the same form.

The site didn't ask for my social

It asks for the SSN (last 6 digits) on the eligibility page, not the claim page:

https://eligibility.equifaxbreachsettlement.com/en/eligibili...

how do you know it links back to JND?