5 ms·

It would become a legendary case study if this site turned out to be an information phishing site. (This one is legit but I expect it to happen someday. I'm sur

It would become a legendary case study if this site turned out to be an information phishing site. (This one is legit but I expect it to happen someday. I'm surprised it hasn't already.) After all this site links to the law firm JND, but nowhere does JND mention this site. So any of us could have made this site. Use the form below to find out if your information was impacted and if you are a class member. Last Name _______ Last 6 Digits of Social Security Number ________

Zombieball 7y ago
A security researcher setup a similar domain with a phishing page. Equifax made the mistake of linking to his page rather than their own on twitter!!! https://www.google.ca/amp/s/www.nytimes.com/2017/09/20/business/equifax-fake-website.amp.html https://www.google.ca/amp/s/www.nytimes.com/2017/09/20/busin...
jwp23 7y ago
Your comment inspired me to take a look. I compared the SSL certificate and the whois information to equifax.com. The settlement site uses a different company for the certificate. The settlement site uses Starfield Technologies vs DigiCert for equifax.com. The settlement site uses GoDaddy for their DNS vs UltraDNS for equifax.com. It's not impossible that a division in the company or a different law firm uses different SSL certificate provider and DNS provider, but it may point to some caution. Edit: As another commenter pointed out, this site is linked to from the FTC site about the breach.
- ocdtrekkie 7y ago
  Being linked to from the FTC isn't a safe bet. Bear in mind Equifax sent people to a fake Equifax website before: https://money.cnn.com/2017/09/20/technology/business/equifax-fake-site-twitter-phishing/index.html https://money.cnn.com/2017/09/20/technology/business/equifax...
- deleted 7y ago
  [deleted]
- simonsarris 7y ago
  Yeah its totally legit, its just funny to think about. I expect it to happen someday. This site is using godaddy presumably because the law firm also does, though they do use different certs!
- azernik 7y ago
  You're assuming that this site is run by Equifax; it is not. It is run by a "Settlement Administrator", a third-party entrusted by the court to handle the money and record-keeping associated with a class-action settlement. This is to avoid possible manipulation of the settlement by the defendant.
- devcpp 7y ago
  Why compare it to Equifax? I'd just assume it's an unrelated malicious opportunist. I'd rather compare it to JND to have evidence towards proving that it's legit. Anyway it is legit since it's mentioned on the FTC site.
  - jwp23 7y ago
    I made a faulty assumption. As others have pointed out, the settlement site is run by a third party.
  - niij 7y ago
    At this point I'd consider the government more competent than Equifax.
- mandevil 7y ago
  Legally, the settlement administrator must be totally independent from Equifax, so comparing their hosting providers, cert providers, etc. you'd only expect them to match by random chance.
moonlighter 7y ago
Here's the "official" page on the ftc.gov site, which has links to the settlement site in the FAQ section. https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq...
acomjean 7y ago
Update. I tried a different last name and told I wasn't eligible, so thats good. >I just entered "Smith" and 6 digits. (Not real) I was eligible.
- ocdtrekkie 7y ago
  Arguably, your best bet for this kind of test is a very blatantly fake name, like "Zxzxzx". It's entirely possible that there is someone with the last name Smith (since it's very common) who also has those six digits at the end of their SSN.
  - acomjean 7y ago
    Good point.. I tried "potter" and I got Not eligible. So either I'm a great last digit guesser (Though I'm usually not lucky in things like gambling....) I'll update my original comment.
    - ocdtrekkie 7y ago
      It may not be so much a great guess as a statistical likelihood! In 2000, there were over 2.3 million Smiths in the United States: https://blogs.ancestry.com/cm/smith-a-short-history-of-americas-most-popular-surname/ https://blogs.ancestry.com/cm/smith-a-short-history-of-ameri... (This number has likely grown roughly alongside our population, so let's use 2000 numbers for this.) In 2000, we had 281 million people in the US, which means 0.8% of Americans have the last name Smith. If we assume every possible SSN could be handed out, a trailing six digit entry could have anywhere up to 999 possible SSNs, so you're firing out a shotgun with a pretty big number of potential targets each time you guess an SSN.
astura 7y ago
Its somewhat of an unsolved problem, there's all sorts of these kind of sites that are legitimate but look really suspicious, like they could be phishing sites. Examples: https://www.annualcreditreport.com/ https://www.annualcreditreport.com/ https://www.optoutprescreen.com/ https://www.optoutprescreen.com/ You can tell these two are legit because they are listed on official government sites: https://www.ftc.gov/faq/consumer-protection/get-my-free-credit-report https://www.ftc.gov/faq/consumer-protection/get-my-free-cred... https://www.consumer.ftc.gov/articles/0262-stopping-unsolicited-mail-phone-calls-and-email https://www.consumer.ftc.gov/articles/0262-stopping-unsolici... However, I can see how some people wouldn't think to go through .gov sites and there's really nothing stopping me from registering a phishing site with a similar domain and hosting it in Russia or something to confuse people into using mine rather than the official one. I think freecreditscore.com has been confused with annualcreditreport.com in the past. Freecreditscore.com is owned by Experian now and it actually does offer a real free no strings attached credit score NOW, but in the past it used to be one of those sites that tricked you into signing up for a subscription. Then, of course, there was the Equifax data breach site that totally looked like a phishing site.
- rhizome 7y ago
  It's only a problem if the authority is obscured by an unrelated domain name. If the page was a location on a site with known authority, or a subdomain, it could be validated much more easily. Unfortunately, vanity gets in the way.
  - astura 7y ago
    Its not just vanity though, in these two cases "the authority" is the industry as a whole, thus many "authorities." For example: >OptOutPrescreen.com is a joint venture among Equifax Information Services, LLC, Experian Information Solutions, Inc., Innovis Data Solutions, Inc., and TransUnion, LLC (collectively the "Consumer Credit Reporting Companies"). >[annualcreditreport.com] is maintained by Central Source, LLC. Central Source, LLC is sponsored by Equifax, Experian and TransUnion so you have a single site where you can ask for all three of your free credit reports.
caymanjim 7y ago
I got this site link directly from the FTC's settlement announcement, or I would have worried about that myself. https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq...
_bxg1 7y ago
The FTC - verified on Twitter - tweeted the URL. That chain of trust is good enough for me.
partiallypro 7y ago
The site didn't ask for my social
- bdcravens 7y ago
  It asks for the SSN (last 6 digits) on the eligibility page, not the claim page: https://eligibility.equifaxbreachsettlement.com/en/eligibility https://eligibility.equifaxbreachsettlement.com/en/eligibili...
jcsnv 7y ago
I was wondering this as well, but the link came from the FTC's site: https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq...
chpwssn 7y ago
You think they would have learned since the breach. Right after the breach was disclosed they made their information page equifaxsecurity2017.com. It had the same prompt for last name and last digits of the visitor's SSN. Then just said something along the lines of ~"Thanks for the information, we'll have more details later".
espeed 7y ago
Search for "Copyright © 2019 JND. All rights reserved" -- there are a ton of sites of the same form.
dwild 7y ago
In Quebec we recently had a massive information leak from Desjardins, a credit union used by most of the population. It didn't take long for people to receive phishing SMS trying to get information from people. It's not exactly the same, but work the same way.
foxc 7y ago
how do you know it links back to JND?
Vordimous 7y ago
I put in bogus name and social. It said i was affected by the incident. So.... Probably phishing.

Zombieball 7y ago

A security researcher setup a similar domain with a phishing page. Equifax made the mistake of linking to his page rather than their own on twitter!!! https://www.google.ca/amp/s/www.nytimes.com/2017/09/20/business/equifax-fake-website.amp.html https://www.google.ca/amp/s/www.nytimes.com/2017/09/20/busin...

jwp23 7y ago

Your comment inspired me to take a look. I compared the SSL certificate and the whois information to equifax.com. The settlement site uses a different company for the certificate. The settlement site uses Starfield Technologies vs DigiCert for equifax.com. The settlement site uses GoDaddy for their DNS vs UltraDNS for equifax.com. It's not impossible that a division in the company or a different law firm uses different SSL certificate provider and DNS provider, but it may point to some caution. Edit: As another commenter pointed out, this site is linked to from the FTC site about the breach.

ocdtrekkie 7y ago
Being linked to from the FTC isn't a safe bet. Bear in mind Equifax sent people to a fake Equifax website before: https://money.cnn.com/2017/09/20/technology/business/equifax-fake-site-twitter-phishing/index.html https://money.cnn.com/2017/09/20/technology/business/equifax...
deleted 7y ago
[deleted]
simonsarris 7y ago
Yeah its totally legit, its just funny to think about. I expect it to happen someday. This site is using godaddy presumably because the law firm also does, though they do use different certs!
azernik 7y ago
You're assuming that this site is run by Equifax; it is not. It is run by a "Settlement Administrator", a third-party entrusted by the court to handle the money and record-keeping associated with a class-action settlement. This is to avoid possible manipulation of the settlement by the defendant.
devcpp 7y ago
Why compare it to Equifax? I'd just assume it's an unrelated malicious opportunist. I'd rather compare it to JND to have evidence towards proving that it's legit. Anyway it is legit since it's mentioned on the FTC site.
- jwp23 7y ago
  I made a faulty assumption. As others have pointed out, the settlement site is run by a third party.
- niij 7y ago
  At this point I'd consider the government more competent than Equifax.
mandevil 7y ago
Legally, the settlement administrator must be totally independent from Equifax, so comparing their hosting providers, cert providers, etc. you'd only expect them to match by random chance.

moonlighter 7y ago

Here's the "official" page on the ftc.gov site, which has links to the settlement site in the FAQ section. https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq...

acomjean 7y ago

Update. I tried a different last name and told I wasn't eligible, so thats good. >I just entered "Smith" and 6 digits. (Not real) I was eligible.

ocdtrekkie 7y ago
Arguably, your best bet for this kind of test is a very blatantly fake name, like "Zxzxzx". It's entirely possible that there is someone with the last name Smith (since it's very common) who also has those six digits at the end of their SSN.
- acomjean 7y ago
  Good point.. I tried "potter" and I got Not eligible. So either I'm a great last digit guesser (Though I'm usually not lucky in things like gambling....) I'll update my original comment.
  - ocdtrekkie 7y ago
    It may not be so much a great guess as a statistical likelihood! In 2000, there were over 2.3 million Smiths in the United States: https://blogs.ancestry.com/cm/smith-a-short-history-of-americas-most-popular-surname/ https://blogs.ancestry.com/cm/smith-a-short-history-of-ameri... (This number has likely grown roughly alongside our population, so let's use 2000 numbers for this.) In 2000, we had 281 million people in the US, which means 0.8% of Americans have the last name Smith. If we assume every possible SSN could be handed out, a trailing six digit entry could have anywhere up to 999 possible SSNs, so you're firing out a shotgun with a pretty big number of potential targets each time you guess an SSN.

astura 7y ago

Its somewhat of an unsolved problem, there's all sorts of these kind of sites that are legitimate but look really suspicious, like they could be phishing sites. Examples: https://www.annualcreditreport.com/ https://www.annualcreditreport.com/ https://www.optoutprescreen.com/ https://www.optoutprescreen.com/ You can tell these two are legit because they are listed on official government sites: https://www.ftc.gov/faq/consumer-protection/get-my-free-credit-report https://www.ftc.gov/faq/consumer-protection/get-my-free-cred... https://www.consumer.ftc.gov/articles/0262-stopping-unsolicited-mail-phone-calls-and-email https://www.consumer.ftc.gov/articles/0262-stopping-unsolici... However, I can see how some people wouldn't think to go through .gov sites and there's really nothing stopping me from registering a phishing site with a similar domain and hosting it in Russia or something to confuse people into using mine rather than the official one. I think freecreditscore.com has been confused with annualcreditreport.com in the past. Freecreditscore.com is owned by Experian now and it actually does offer a real free no strings attached credit score NOW, but in the past it used to be one of those sites that tricked you into signing up for a subscription. Then, of course, there was the Equifax data breach site that totally looked like a phishing site.

rhizome 7y ago
It's only a problem if the authority is obscured by an unrelated domain name. If the page was a location on a site with known authority, or a subdomain, it could be validated much more easily. Unfortunately, vanity gets in the way.
- astura 7y ago
  Its not just vanity though, in these two cases "the authority" is the industry as a whole, thus many "authorities." For example: >OptOutPrescreen.com is a joint venture among Equifax Information Services, LLC, Experian Information Solutions, Inc., Innovis Data Solutions, Inc., and TransUnion, LLC (collectively the "Consumer Credit Reporting Companies"). >[annualcreditreport.com] is maintained by Central Source, LLC. Central Source, LLC is sponsored by Equifax, Experian and TransUnion so you have a single site where you can ask for all three of your free credit reports.

caymanjim 7y ago

I got this site link directly from the FTC's settlement announcement, or I would have worried about that myself. https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq...

_bxg1 7y ago

The FTC - verified on Twitter - tweeted the URL. That chain of trust is good enough for me.

partiallypro 7y ago

The site didn't ask for my social

bdcravens 7y ago
It asks for the SSN (last 6 digits) on the eligibility page, not the claim page: https://eligibility.equifaxbreachsettlement.com/en/eligibility https://eligibility.equifaxbreachsettlement.com/en/eligibili...

jcsnv 7y ago

I was wondering this as well, but the link came from the FTC's site: https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq...

chpwssn 7y ago

You think they would have learned since the breach. Right after the breach was disclosed they made their information page equifaxsecurity2017.com. It had the same prompt for last name and last digits of the visitor's SSN. Then just said something along the lines of ~"Thanks for the information, we'll have more details later".

espeed 7y ago

dwild 7y ago

In Quebec we recently had a massive information leak from Desjardins, a credit union used by most of the population. It didn't take long for people to receive phishing SMS trying to get information from people. It's not exactly the same, but work the same way.

foxc 7y ago

how do you know it links back to JND?

Vordimous 7y ago

I put in bogus name and social. It said i was affected by the incident. So.... Probably phishing.