4 ms·

Comodo issued valid certificate for [scam URL] amazon buckets

15 points by dhuyp 8y ago

jstanley 8y ago
The bit you're looking for here is the hostname: > *.s3-amazonaws.com Edit: but I believe real S3 hostnames are of the form foo.s3.amazonaws.com
- wut42 8y ago
  It's s3-amazonaws.com, not s3.amazonaws.com.
wut42 8y ago
It's via CloudFlare. Also the "s3-amazonaws.com" looks like a scam domain.
deleted 8y ago
[deleted]
hiciu 8y ago
s3-amazonaws.com? That's not amazon, that's just some random domain.
ingenieroariel 8y ago
Can the title be updated with the word 'fake amazon buckets'?
- dhuyp 8y ago
  Done
floatingatoll 8y ago
Have you reported the scam domain to Amazon Security?
bashtoni 8y ago
Buckets are at s3.amazonaws.com, the domain mentioned is s3-amazonaws.com. You could certainly argue if Comodo doesn't catch stuff like this then what value are they bringing, but it isn't as serious as the title implies.
- dhuyp 8y ago
  There are some other shady stuff... https://censys.io/certificates?q=sni182947.cloudflaressl.com https://censys.io/certificates?q=sni182947.cloudflaressl.com
rhacker 8y ago
Is the title of this HN post the article? And link is the proof? Just trying to understand what's going on. Some kind of attempt of getting a trick domain?
totalthrowaway 8y ago
That is not Amazon. ~ whois s3-amazonaws.com Domain Name: S3-AMAZONAWS.COM Registry Domain ID: 2246085106_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.namesilo.com Registrar URL: http://www.namesilo.com Updated Date: 2018-03-31T13:23:14Z Creation Date: 2018-03-31T13:07:29Z Registry Expiry Date: 2019-03-31T13:07:29Z Registrar: NameSilo, LLC Registrar IANA ID: 1479 Registrar Abuse Contact Email: abuse@namesilo.com Registrar Abuse Contact Phone: +1.4805240066 Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Name Server: JIM.NS.CLOUDFLARE.COM Name Server: OLGA.NS.CLOUDFLARE.COM DNSSEC: unsigned URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
- dhuyp 8y ago
  It was from good faith, I was just checking s3.amazonaws.com and censys pop me that here, bad reading...
redbeard0x0a 8y ago
Fortunately, this is not the actual S3 domain, but one that is very similar. s3<dash>amazonaws instead of s3<dot>amazonaws. Regardless, this is still shady.
donmcronald 8y ago
That’s a pretty good scam domain. Can’t big companies scan CT logs to be proactive about those types of domains?
dhuyp 8y ago
Sorry about the initial title, I was tricked by the result https://censys.io/certificates?q=s3.amazonaws.com&page=6 https://censys.io/certificates?q=s3.amazonaws.com&page=6
jgrahamc 8y ago
I reported this to Cloudflare's Trust and Safety team and it has been taken care of.

15 points by dhuyp 8y ago

The bit you're looking for here is the hostname: > *.s3-amazonaws.com Edit: but I believe real S3 hostnames are of the form foo.s3.amazonaws.com

wut42 8y ago
It's s3-amazonaws.com, not s3.amazonaws.com.

wut42 8y ago

It's via CloudFlare. Also the "s3-amazonaws.com" looks like a scam domain.

deleted 8y ago

[deleted]

hiciu 8y ago

s3-amazonaws.com? That's not amazon, that's just some random domain.

ingenieroariel 8y ago

Can the title be updated with the word 'fake amazon buckets'?

dhuyp 8y ago
Done

floatingatoll 8y ago

Have you reported the scam domain to Amazon Security?

bashtoni 8y ago

Buckets are at s3.amazonaws.com, the domain mentioned is s3-amazonaws.com. You could certainly argue if Comodo doesn't catch stuff like this then what value are they bringing, but it isn't as serious as the title implies.

dhuyp 8y ago
There are some other shady stuff... https://censys.io/certificates?q=sni182947.cloudflaressl.com https://censys.io/certificates?q=sni182947.cloudflaressl.com

rhacker 8y ago

Is the title of this HN post the article? And link is the proof? Just trying to understand what's going on. Some kind of attempt of getting a trick domain?

totalthrowaway 8y ago

That is not Amazon. ~ whois s3-amazonaws.com Domain Name: S3-AMAZONAWS.COM Registry Domain ID: 2246085106_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.namesilo.com Registrar URL: http://www.namesilo.com Updated Date: 2018-03-31T13:23:14Z Creation Date: 2018-03-31T13:07:29Z Registry Expiry Date: 2019-03-31T13:07:29Z Registrar: NameSilo, LLC Registrar IANA ID: 1479 Registrar Abuse Contact Email: abuse@namesilo.com Registrar Abuse Contact Phone: +1.4805240066 Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Name Server: JIM.NS.CLOUDFLARE.COM Name Server: OLGA.NS.CLOUDFLARE.COM DNSSEC: unsigned URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/

dhuyp 8y ago
It was from good faith, I was just checking s3.amazonaws.com and censys pop me that here, bad reading...

redbeard0x0a 8y ago

Fortunately, this is not the actual S3 domain, but one that is very similar. s3<dash>amazonaws instead of s3<dot>amazonaws. Regardless, this is still shady.

donmcronald 8y ago

That’s a pretty good scam domain. Can’t big companies scan CT logs to be proactive about those types of domains?

dhuyp 8y ago

Sorry about the initial title, I was tricked by the result https://censys.io/certificates?q=s3.amazonaws.com&page=6 https://censys.io/certificates?q=s3.amazonaws.com&page=6

jgrahamc 8y ago

I reported this to Cloudflare's Trust and Safety team and it has been taken care of.