3 ms·

Archived: https://archive.ph/YjHW8 https://archive.ph/YjHW8

by mitchbob 5y ago

hericium 5y ago
- mywacaday 5y ago
  Mitchelbob appears to post dozens of links to archive.ph and not much else, is this an organized phishing attempt or just an issue with archive.ph?
  - chaosite 5y ago
    They seem to submit a link then post an archive.ph link as a comment.
  - seszett 5y ago
    ... indeed, looks like all the recent links to archive.ph that I can find in HN comments (https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=archive.ph&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...) have this same JS code injected.
  - dang 5y ago
    Come on you guys - users obviously do that because they want to be helpful to readers. If you look through mitchbob's comments it's not hard to find perfectly legit posts on other things, e.g. https://news.ycombinator.com/item?id=30435861 https://news.ycombinator.com/item?id=30435861
  - rosndo 5y ago
    What could possibly make you think that this was a phishing attempt? Because you are a xenophobic asshole and think all Russians are evil hackers trying to steal your data? It’s really sad to see such nastiness rearing it’s head on HN. top.mail.ru is a huge analytics platform, exactly like google analytics, run by the biggest tech company in Russia.
- seszett 5y ago
  Yes, it's hard to give the poster benefit of the doubt. I haven't run https://top-fwz1.mail.ru/js/code.js https://top-fwz1.mail.ru/js/code.js myself but a quick glance at it seems to indicate that it tries to harvest data from the page (references to "gender", "age", etc) and some shady-named variables like "bait". Also a function that fetches data from top-fwz1.mail.ru and then tries to submit a hidden 1px*1px form created in an iframe using this data and who knows what else. All other archive.ph links from the poster seem to contain the same JS code from mail.ru, which makes it either doubly suspicious, or just means their computer or network is infected with something that injects it into their pages, who knows.
  - hericium 5y ago
    Thanks - nice quick research. I have flagged this user's recent submissions containing his comments with links to archive.ph.
    - seszett 5y ago
      See my other comment though, it seems like the injection is performed by archive.ph itself. I tried to archive simply my own blog (a very simple page without any JS) and the script gets injected there as well. So it might just be a coincidence that mitchbob happens to be the one who posted a link where that script gets noticed. It's hard to know for sure of course.
      - hericium 5y ago
        I've seen it and only flagged posts with [comments by the same author with links to] malicious content. It doesn't matter whether user is affiliated with this content's host or phishing campaign since this is most of his HN activity. This should stop even if is unintentional.
        pvg 5y ago
        If you think someone's doing something wrong, email the mods. You can't be starting some innuendo campaign and vote brigading against some user just because you have a bad feeling about their posts, that's in the guidelines.

Archived: https://archive.ph/YjHW8 https://archive.ph/YjHW8

hericium 5y ago

mywacaday 5y ago
Mitchelbob appears to post dozens of links to archive.ph and not much else, is this an organized phishing attempt or just an issue with archive.ph?
- chaosite 5y ago
  They seem to submit a link then post an archive.ph link as a comment.
- seszett 5y ago
  ... indeed, looks like all the recent links to archive.ph that I can find in HN comments (https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=archive.ph&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...) have this same JS code injected.
- dang 5y ago
  Come on you guys - users obviously do that because they want to be helpful to readers. If you look through mitchbob's comments it's not hard to find perfectly legit posts on other things, e.g. https://news.ycombinator.com/item?id=30435861 https://news.ycombinator.com/item?id=30435861
- rosndo 5y ago
  What could possibly make you think that this was a phishing attempt? Because you are a xenophobic asshole and think all Russians are evil hackers trying to steal your data? It’s really sad to see such nastiness rearing it’s head on HN. top.mail.ru is a huge analytics platform, exactly like google analytics, run by the biggest tech company in Russia.
seszett 5y ago
Yes, it's hard to give the poster benefit of the doubt. I haven't run https://top-fwz1.mail.ru/js/code.js https://top-fwz1.mail.ru/js/code.js myself but a quick glance at it seems to indicate that it tries to harvest data from the page (references to "gender", "age", etc) and some shady-named variables like "bait". Also a function that fetches data from top-fwz1.mail.ru and then tries to submit a hidden 1px*1px form created in an iframe using this data and who knows what else. All other archive.ph links from the poster seem to contain the same JS code from mail.ru, which makes it either doubly suspicious, or just means their computer or network is infected with something that injects it into their pages, who knows.
- hericium 5y ago
  Thanks - nice quick research. I have flagged this user's recent submissions containing his comments with links to archive.ph.
  - seszett 5y ago
    See my other comment though, it seems like the injection is performed by archive.ph itself. I tried to archive simply my own blog (a very simple page without any JS) and the script gets injected there as well. So it might just be a coincidence that mitchbob happens to be the one who posted a link where that script gets noticed. It's hard to know for sure of course.
    - hericium 5y ago
      I've seen it and only flagged posts with [comments by the same author with links to] malicious content. It doesn't matter whether user is affiliated with this content's host or phishing campaign since this is most of his HN activity. This should stop even if is unintentional.
      - pvg 5y ago
        If you think someone's doing something wrong, email the mods. You can't be starting some innuendo campaign and vote brigading against some user just because you have a bad feeling about their posts, that's in the guidelines.