News for hackers. Stuff that matters.

A comment on Google-hosted malvertising leads to fake Keepass site that looks genuine. Parent comment

Re:Google-hosted malvertising leads to fake Keepass site tha... by Semaphor on Thursday October 19, 2023 @05:16AM (#37940417)
I just tried it and… it redirects me to the actual page https://keepass.info/

That is weird. I don’t have mobile debugging set up, or I’d try and figure out what’s going on there.

[ Parent | on HN ]
Re:Google-hosted malvertising leads to fake Keepass site tha... by cengizIO on Thursday October 19, 2023 @06:42AM (#37940992)
Right now, using curl, [ķ]eepass.info redirects to xn--eepass-vbb.info and consequently that redirects to official domain keepass.info.
[ Parent | on HN ]
Re:Google-hosted malvertising leads to fake Keepass site tha... by Semaphor on Thursday October 19, 2023 @07:19AM (#37941264)
So it might be triggering on certain UAs
[ Parent | on HN ]
Re:Google-hosted malvertising leads to fake Keepass site tha... by crtasm on Thursday October 19, 2023 @08:58AM (#37942254)
It's sending me to a rickroll now (Youtube).
[ Parent | on HN ]
Re:Google-hosted malvertising leads to fake Keepass site tha... by jan_Sate on Thursday October 19, 2023 @10:27AM (#37943380)
Those questionable websites often do redirection to a legit site like Google unless certain condition is met. For example, it could detect and only lead the user to the fake site if the user is coming from the ad. It's a common technique for them to avoid getting caught.
[ Parent | on HN ]