Ask HN: Someone cloned GitHub, not sure why

Posted by rbobby on Tuesday December 07, 2021 @10:50PM
from the ask-hn dept.

I was looking at serilog enrichers trying to figure out why one wasn't working.

I stumbled across this list of enrichers:

https://causlayer.orgs.hk/topics/serilog-enrichers

Which have a few links to github repositories. I looked at one or two and then click the link for laurentiustamate94 / serilog-enrichers-aspnetcore and eventually noticed it took me to this page:

https://causlayer.orgs.hk/laurentiustamate94/serilog-enrichers-aspnetcore

A pretty exact copy. Everything works, though some links (like profile etc) take you to the real github.

Why would someone put that amount of work into this?

If you go to https://causlayer.orgs.hk it's a copy of the github home page with a fake login page!

Is this something github should be aware of? If so where would you report it?

( 15 comments | 21 points | on HN )

Re:Ask HN: Someone cloned GitHub, not sure why by LinuxBender on Tuesday December 07, 2021 @11:26PM (#29481257)

VirusTotal [1] is lighting up on that site. Do not click those links and I would remove the links from HN.

[Edit] HN Moderator removed it.

[1] - https://www.virustotal.com/gui/url/f298f1b568fccc7d942aa39c1...

[ Parent | on HN ]

Re:Ask HN: Someone cloned GitHub, not sure why by hermitsings on Tuesday December 07, 2021 @11:53PM (#29481396)

I just clicked and went straight to the site. What do I do now?

[ Parent | on HN ]

Re:Ask HN: Someone cloned GitHub, not sure why by LinuxBender on Tuesday December 07, 2021 @11:56PM (#29481406)

Ensure your anti-malware is up to date. If its a work computer let your security team know. If its yours probably clear cache close browser install anti-malware and scan the machine. I dont have time to dig into whats on that site to see what it does.

[ Parent | on HN ]

Re:Ask HN: Someone cloned GitHub, not sure why by disqard on Tuesday December 07, 2021 @11:22PM (#29481225)

Probably a phishing site to steal username + password.

[ Parent | on HN ]

Re:Ask HN: Someone cloned GitHub, not sure why by Nextgrid on Tuesday December 07, 2021 @11:01PM (#29481125)

I wonder if it's someone's reverse-proxy to bypass censorship of the main site.

[ Parent | on HN ]

Re:Ask HN: Someone cloned GitHub, not sure why by tyingq on Tuesday December 07, 2021 @11:46PM (#29481350)

It does look like a live proxy rather than a copy/clone.

The responses have headers like "X-GitHub-Request-Id", which would be a pretty easy detail to forget if it were a copy.

[ Parent | on HN ]

Re:Ask HN: Someone cloned GitHub, not sure why by robbedpeter on Tuesday December 07, 2021 @11:12PM (#29481180)

To bypass the great firewall? Or possibly, to bypass country level restrictions on content blocks? You might have just outed some group in China.

[ Parent | on HN ]

Re:Ask HN: Someone cloned GitHub, not sure why by magpi3 on Tuesday December 07, 2021 @11:37PM (#29481303)

github is not blocked in China

[ Parent | on HN ]

Re:Ask HN: Someone cloned GitHub, not sure why by egberts on Tuesday December 07, 2021 @11:27PM (#29481263)

Someone is going to have to be brave enough to login and see if their private repositories got cloned as well.

I have no private repo. It would suck if that too got cloned.

[ Parent | on HN ]

Re:Ask HN: Someone cloned GitHub, not sure why by nostoc on Tuesday December 07, 2021 @11:38PM (#29481310)

Don't do that, it's obviously a phishing site

[ Parent | on HN ]

Re:Ask HN: Someone cloned GitHub, not sure why by mosdl on Tuesday December 07, 2021 @11:05PM (#29481145)

To steal passwords?

[ Parent | on HN ]

Re:Ask HN: Someone cloned GitHub, not sure why by tony-allan on Tuesday December 07, 2021 @11:20PM (#29481215)

More likely just to read the website in China

[ Parent | on HN ]

Re:Ask HN: Someone cloned GitHub, not sure why by smoldesu on Tuesday December 07, 2021 @11:53PM (#29481394)

Looks like a social engineering attack of some sort.

[ Parent | on HN ]

Re:Ask HN: Someone cloned GitHub, not sure why by piyh on Tuesday December 07, 2021 @11:42PM (#29481330)

Is this basically a MitM attack as a proxy?

[ Parent | on HN ]

Re:Ask HN: Someone cloned GitHub, not sure why by omarhaneef on Tuesday December 07, 2021 @11:45PM (#29481346)

Bob: Susan, remember not to make the GitHub staging site public by accident.

Susan: or what?

Bob: someone might me see it!

Susan: an obscure url like that? not a chance.

Bob: still, a small chance

Susan: and so what if someone sees it? it’s not like it will show up on the front page of Hacker News!

[ Parent | on HN ]