4 ms·

The website appears to be compromised. It's hosting and redirecting to webstores/spam/porn/etc. It seems an enterprising agent decided to start building and se

The website appears to be compromised. It's hosting and redirecting to webstores/spam/porn/etc. It seems an enterprising agent decided to start building and selling his own covert camera boxes but I wonder how old these things are now. Perhaps they've been forgotten?

thekevan 6y ago
I want it to be a conspiracy. No one is intended to see the inside of the box and thus the website unless the box is compromised. So when an unauthorized person sees it and goes to that website, they see it as a spammy forgotten domain, but it's actually trying to install surveillance software to see who you are and later why you've been poking around in a box they never intended you to poke around in. (This of course includes the fact that they never intended on an internet rando finding unsecured boxes and sharing it with the world on the internet.)
- blaser-waffle 6y ago
  That's pretty clever. If I had to bet money though, I'd assume something more mundane, like they are actually dumb enough to put a name and email on one of those. Do we have any reason to think that the person posting this is not the FBI themselves? Or some other foreign surveillance types?
  - rolph 6y ago
    this reminds me of finfisher and payloaded media files used to drop the spyware. thus mass surveilance, or mass botnet
  - thekevan 6y ago
    Yeah, that's my romantic view, but probably unlikely.
dsfyu404ed 6y ago
The website doesn't appear to be compromised or registration expired to me. When I visited the site and presented a boring old chrome on mac useragent I got the following page back. https://i.postimg.cc/D0GxnRdY/Screen-Shot-2020-05-13-at-1-44-47-PM.png https://i.postimg.cc/D0GxnRdY/Screen-Shot-2020-05-13-at-1-44... When I followed the link to the login page I got an error trace.
- vsareto 6y ago
  Google: site:http://ipsurvconcepts.com/ http://ipsurvconcepts.com/ You'll find stuff in /userfiles serving all sorts of shady things that have nothing to do with the site.
  - dsfyu404ed 6y ago
    Makes sense. I didn't really want to poke at the server itself in a manner any more in depth than firing a web browser at the thing in the normal manner.
mdszy 6y ago
That's not necessarialy a sign of the site being compromised, I've had that happen to my own domains by: 1. Host an application on some VPS with a static IP on a domain. 2. Destroy the VPS server but don't change the domain entry. 3. Boom, domain now seems to be hosting porn or other random stuff eventually as the IP in the A record gets used for other things.
0xdeadb00f 6y ago
The website is suspiciously gone now. Looks like the domain is for sale?

thekevan 6y ago

I want it to be a conspiracy. No one is intended to see the inside of the box and thus the website unless the box is compromised. So when an unauthorized person sees it and goes to that website, they see it as a spammy forgotten domain, but it's actually trying to install surveillance software to see who you are and later why you've been poking around in a box they never intended you to poke around in. (This of course includes the fact that they never intended on an internet rando finding unsecured boxes and sharing it with the world on the internet.)

blaser-waffle 6y ago
That's pretty clever. If I had to bet money though, I'd assume something more mundane, like they are actually dumb enough to put a name and email on one of those. Do we have any reason to think that the person posting this is not the FBI themselves? Or some other foreign surveillance types?
- rolph 6y ago
  this reminds me of finfisher and payloaded media files used to drop the spyware. thus mass surveilance, or mass botnet
- thekevan 6y ago
  Yeah, that's my romantic view, but probably unlikely.

dsfyu404ed 6y ago

The website doesn't appear to be compromised or registration expired to me. When I visited the site and presented a boring old chrome on mac useragent I got the following page back. https://i.postimg.cc/D0GxnRdY/Screen-Shot-2020-05-13-at-1-44-47-PM.png https://i.postimg.cc/D0GxnRdY/Screen-Shot-2020-05-13-at-1-44... When I followed the link to the login page I got an error trace.

vsareto 6y ago
Google: site:http://ipsurvconcepts.com/ http://ipsurvconcepts.com/ You'll find stuff in /userfiles serving all sorts of shady things that have nothing to do with the site.
- dsfyu404ed 6y ago
  Makes sense. I didn't really want to poke at the server itself in a manner any more in depth than firing a web browser at the thing in the normal manner.

mdszy 6y ago

That's not necessarialy a sign of the site being compromised, I've had that happen to my own domains by: 1. Host an application on some VPS with a static IP on a domain. 2. Destroy the VPS server but don't change the domain entry. 3. Boom, domain now seems to be hosting porn or other random stuff eventually as the IP in the A record gets used for other things.

0xdeadb00f 6y ago

The website is suspiciously gone now. Looks like the domain is for sale?