# Somebody stealing Dope content, again. **URL:** \ **Category:** About This Message Board\ **Created:** [July 10, 2013, 5:34pm UTC](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152 "2013-07-10T17:34:36Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![gnoitall](https://avatars.discourse-cdn.com/v4/letter/g/bb73d2/32.png) [@gnoitall](https://boards.straightdope.com/u/gnoitall)\ **Post date:** [July 11, 2013, 1:29pm UTC](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152/21 "2013-07-11T13:29:24Z")
> [@aruvqan](#): > > So what happens if you have SD bookmarked and your computer autologs you? That’s not an issue if the bad guys have cloned the site but are operating it at a different web address (URL) than the real thing (which they are)… and they’d have to hack SDMB’s domain registration to redirect the real SDMB URL to their website for that to happen.\* It’s like if someone constructs a fake bank looking to copy everyone’s safe deposit box key patterns… if it’s not at the address of the real bank, I don’t know how anyone would wind up at the fake bank. Unless they’re dim enough to come upon a copy of their bank in the middle of a cornfield and go “Derp, hey, look, it’s my bank; I think I’ll check my safe deposit box!” \*There are variations on the theme: they could register look-alike addresses that capitalize on common typos and have them redirect to the fake website, but I don’t know if there’s any evidence of that. ---
**Author:** ![gnoitall](https://avatars.discourse-cdn.com/v4/letter/g/bb73d2/32.png) [@gnoitall](https://boards.straightdope.com/u/gnoitall)\ **Post date:** [July 11, 2013, 1:50pm UTC](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152/22 "2013-07-11T13:50:45Z")
> [@gnoitall](#): > > That’s not an issue if the bad guys have cloned the site but are operating it at a different web address (URL) than the real thing (which they are)… and they’d have to hack SDMB’s domain registration to redirect the real SDMB URL to their website for that to happen.\* > > It’s like if someone constructs a fake bank looking to copy everyone’s safe deposit box key patterns… if it’s not at the address of the real bank, I don’t know how anyone would wind up at the fake bank. Unless they’re dim enough to come upon a copy of their bank in the middle of a cornfield and go “Derp, hey, look, it’s my bank; I think I’ll check my safe deposit box!” > > \*There are variations on the theme: they could register look-alike addresses that capitalize on common typos and have them redirect to the fake website, but I don’t know if there’s any evidence of that. Missed the edit window. I did think of another way the phishers could expect to attract logins: manipulate Google to put their website at the top for SDMB-related searches. Which, going back to the bank analogy, would be like if people routinely ask a stranger for directions to get to their bank, and the bad guys co-opt the “ask a stranger for directions” process to get the strangers to give directions to the fake bank. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [July 11, 2013, 2:27pm UTC](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152/23 "2013-07-11T14:27:56Z")
> [@gnoitall](#): > > It’s like if someone constructs a fake bank looking to copy everyone’s safe deposit box key patterns… if it’s not at the address of the real bank, I don’t know how anyone would wind up at the fake bank. Thru google. ---
**Author:** ![Leo\_Bloom](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/leo_bloom/32/10377_2.png) [@Leo\_Bloom](https://boards.straightdope.com/u/Leo_Bloom)\ **Post date:** [July 11, 2013, 3:31pm UTC](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152/24 "2013-07-11T15:31:28Z")
Hey, new word! “Scraping.” Thanks. ---
**Author:** ![Irishman](https://avatars.discourse-cdn.com/v4/letter/i/b487fb/32.png) [@Irishman](https://boards.straightdope.com/u/Irishman)\ **Post date:** [July 11, 2013, 5:37pm UTC](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152/25 "2013-07-11T17:37:13Z")
> [@aruvqan](#): > > So what happens if you have SD bookmarked and your computer autologs you? Not going to happen. It only looks like an SD site, it doesn’t have any access to the SD database and your autologin info will not recognize the site as the real thing. It’s like somebody printed out a photo of George Clooney and made a paper mask, then walked around pretending to be George Clooney. The face looks right, but you know something’s wrong when his body is 500 lbs. ---
**Author:** ![JSexton](https://avatars.discourse-cdn.com/v4/letter/j/96bed5/32.png) [@JSexton](https://boards.straightdope.com/u/JSexton)\ **Post date:** [July 11, 2013, 5:55pm UTC](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152/26 "2013-07-11T17:55:11Z")
This could coincide with finding email address for Dopers and sending them a phishing email that says “Your account has been compromised! Please log in here (fake website url) to change your password immediately!” Most people won’t fall for it, but a small percentage might. ---
**Author:** ![Skywatcher](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/skywatcher/32/254_2.png) [@Skywatcher](https://boards.straightdope.com/u/Skywatcher)\ **Post date:** [July 11, 2013, 7:11pm UTC](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152/27 "2013-07-11T19:11:01Z")
> [@Crazyhorse](#): > > It’s extremely unlikely that this person has any idea their website has been hacked and used this way. > > In most cases scraped sites aren’t hosted by the actual scammers. That obviously wouldn’t work out well for them. They find unused or infrequently updated sites with security vulnerabilities and take them over. > > The site is hosted by CloudFlare in San Francisco. If they’re notified that it’s a counterfeit site they can shut it down. Then it’s up to them to worry about finding their customer and notifying them the site was hacked. According to the first link in post #6, the actual servers are in China and the same email behind remortgagebestdeals has been behind a scrape of Bioware and a scrape of Gamespot. The search **Duckster** ran returned several more websites associated with that email. Seems to me that all this lends credence to the idea that someone’s been deliberately going around making sites for scrapers. ---
**Author:** ![Skywatcher](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/skywatcher/32/254_2.png) [@Skywatcher](https://boards.straightdope.com/u/Skywatcher)\ **Post date:** [July 11, 2013, 7:19pm UTC](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152/28 "2013-07-11T19:19:22Z")
By the way, the second link in post #6 mentions a site that had been scraping Fox Sports, with the same email. ---
**Author:** ![Senegoid](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/senegoid/32/6606_2.png) [@Senegoid](https://boards.straightdope.com/u/Senegoid)\ **Post date:** [July 11, 2013, 9:53pm UTC](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152/29 "2013-07-11T21:53:37Z")
> [@Lute Skywatcher](#): > > By the way, the second link in post #6 mentions a site that had been scraping Fox Sports, with the same email. That same thread, if you read more of the posts there, lists a _whole bunch_ of similarly affected sites. ---
**Author:** ![Crazyhorse](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/crazyhorse/32/31_2.png) [@Crazyhorse](https://boards.straightdope.com/u/Crazyhorse)\ **Post date:** [July 12, 2013, 5:29am UTC](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152/30 "2013-07-12T05:29:21Z")
> [@Lute Skywatcher](#): > > According to the first link in post #6, the actual servers are in China and the same email behind remortgagebestdeals has been behind a scrape of Bioware and a scrape of Gamespot. The search **Duckster** ran returned several more websites associated with that email. Seems to me that all this lends credence to the idea that someone’s been deliberately going around making sites for scrapers. Not at all. That only lends credence to the idea that the same one customer registered several domains, maybe with big plans for the future, but left them all sitting dormant with the same unpatched vulnerabilities just waiting to be hacked. The SDMB cloned site is hosted at IP 108.162.198.93 which is an IP address owned by CloudFlare in San Francisco. [Online investigation tool - Reverse IP, NS, MX, WHOIS and Search Tools](http://www.tcpiputils.com/browse/ip-address/108.162.199.93) The first link you provided discusses something similar that happened to another forum, and the cloned version of that forum is hosted at 108.162.198.245, a different webserver also hosted by CloudFlare in San Franciso. Someone in that thread says they did some investigating and the server is in China, but they offer no basis for that incorrect conclusion. It could be that if one dissects the source code of the cloned pages there are some links that send data to china if someone tries to log in or something like that, but at a glance I don’t see anything like that. Either way the pages are hosted from San Francisco and the person who can shut them down works at CloudFlare. The two domain names that point to those two servers happen to be registered by the same customer. That doesn’t make it any more likely that they are aware their sites were hacked in order to host phishing scams. The second link provided is a discussion on another forum about a clone that is hosted at 77.95.228.234 which is owned by Ghesi in the Netherlands. The domain that points to that IP address is registered by someone other than the person above. Across the internet there are thousands of these and in no case will you ever find identifying information about the hackers by doing a “whois” on the domain name. Posting the registrants info here only serves to invite possible emails and calls to them for years into the future, long after their site is shut down or repaired. ---
**Author:** ![clairobscur](https://avatars.discourse-cdn.com/v4/letter/c/839c29/32.png) [@clairobscur](https://boards.straightdope.com/u/clairobscur)\ **Post date:** [July 12, 2013, 6:12am UTC](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152/31 "2013-07-12T06:12:18Z")
I had no clue such things existed :eek: When I opened the thread, I assumed it would be refering to a site posting the column’s content, for instance, and adding a lot of ads. Not a all a copy of the message board. ---
**Author:** ![Measure\_for\_Measure](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/measure_for_measure/32/557_2.png) [@Measure\_for\_Measure](https://boards.straightdope.com/u/Measure_for_Measure)\ **Post date:** [July 12, 2013, 6:39am UTC](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152/32 "2013-07-12T06:39:48Z")
FYI only: GD at least was scraped less than 10 minutes ago, so their bots are still whirring. I was able to access a post of mine written that long ago (without logging in of course). ---
**Author:** ![Skywatcher](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/skywatcher/32/254_2.png) [@Skywatcher](https://boards.straightdope.com/u/Skywatcher)\ **Post date:** [July 12, 2013, 4:11pm UTC](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152/33 "2013-07-12T16:11:06Z")
> [@Crazyhorse](#): > > the same one customer registered several domains, maybe with big plans for the future, You’ve got to be kidding me. Did you bother to look at those names? They’re like the domain naming equivalent of a Nigerian scam! ---
**Author:** ![Digital\_is\_the\_new\_Analog](https://avatars.discourse-cdn.com/v4/letter/d/a88e4f/32.png) [@Digital\_is\_the\_new\_Analog](https://boards.straightdope.com/u/Digital_is_the_new_Analog)\ **Post date:** [July 13, 2013, 1:06am UTC](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152/34 "2013-07-13T01:06:47Z")
Is anyone else disappointed that fartypants dot remortgagebestdeals dot com doesn’t work? ---
**Author:** ![Hershele\_Ostropoler](https://avatars.discourse-cdn.com/v4/letter/h/e47c2d/32.png) [@Hershele\_Ostropoler](https://boards.straightdope.com/u/Hershele_Ostropoler)\ **Post date:** [July 13, 2013, 1:12am UTC](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152/35 "2013-07-13T01:12:55Z")
> [@moriah](#): > > For those new to the 'Net (hey, we keep reproducing!), this is a phishing site. By fooling you into thinking it is one of the top forums on the 'Net, you log on with your username and password. > > What good does that do them? They use or sell your username to black hearted folks who try that same combination on lots of other sites to hack into your account because you used the same password on multiple web sites. Don’t do that. I don’t remember\*, but I don’t think I use my Dope password for anything else. Hah! \*I have a cookie, Chrome is saving the password, and I use KeePass > [@echo7tango](#): > > I use the same user name and password here and also on another forum. Is there any harm in that? > [@Senegoid](#): > > Not necessarily, but it’s considered a bad idea. If anybody manages to find your password on any account, then they have your password on every other web site where you’ve used the same password. That’s what they are looking for. Especially if you use the same password to sign in to your bank account, your credit card account, your doctor’s office, insurance site, . . . You don’t want that to happen. Yeah, I double up on a couple of sites I rarely use or where no one can use my account for their own benefit (like, the utility company) but everything important or where someone logging in as me can affect my finances or reputation has a unique password (and in one case, username). ---
**Author:** ![Crazyhorse](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/crazyhorse/32/31_2.png) [@Crazyhorse](https://boards.straightdope.com/u/Crazyhorse)\ **Post date:** [July 13, 2013, 6:08am UTC](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152/36 "2013-07-13T06:08:22Z")
> [@Lute Skywatcher](#): > > You’ve got to be kidding me. Did you bother to look at those names? They’re like the domain naming equivalent of a Nigerian scam! I’m not kidding. I think you’re drawing an incorrect conclusion. The idea that someone registered bunches of domains with big ideas about making millions in advertising or remortgaging or whatever and then didn’t, so left the sites unpatched and vulnerable, only makes it all the more likely they were hacked by whoever is actually scraping the site. Don’t you think if they registered domains with the intent of scraping the SDMB and stealing passwords they might choose something more like “[straighdope.com](http://straighdope.com)” instead of “[remortgagebestdeals.com](http://remortgagebestdeals.com)”? There are 2 scraped sites that we know of linked to that person’s domains, and about 2 million linked to other people’s domains. The odds are strongly supportive of the notion that you’re not on to something here with this pattern of 2 that you have detected. ---
**Author:** ![RaftPeople](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@RaftPeople](https://boards.straightdope.com/u/RaftPeople)\ **Post date:** [July 13, 2013, 5:03pm UTC](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152/37 "2013-07-13T17:03:47Z")
> [@Measure\_for\_Measure](#): > > FYI only: GD at least was scraped less than 10 minutes ago, so their bots are still whirring. I was able to access a post of mine written that long ago (without logging in of course). I noticed one of my posts over there also, but it looks like they corrected my typos and fixed some errors in the point I was trying to make. ---
**Author:** ![aceplace57](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/aceplace57/32/3500_2.png) [@aceplace57](https://boards.straightdope.com/u/aceplace57)\ **Post date:** [July 13, 2013, 6:06pm UTC](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152/38 "2013-07-13T18:06:23Z")
Why would a phishing site bother to edit grammar or content in a post? Criminals with a dislike for bad grammar. That’s a first. 😉 ---
**Author:** ![Zakalwe](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zakalwe/32/270_2.png) [@Zakalwe](https://boards.straightdope.com/u/Zakalwe)\ **Post date:** [July 14, 2013, 1:30pm UTC](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152/39 "2013-07-14T13:30:41Z")
> [@aceplace57](#): > > Why would a phishing site bother to edit grammar or content in a post? > > Criminals with a dislike for bad grammar. That’s a first. 😉 Maybe instead of shutting them down, we should just invite them in. Sounds like our kind of people. 🙂 ---
**Author:** ![dropzone](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dropzone/32/7515_2.png) [@dropzone](https://boards.straightdope.com/u/dropzone)\ **Post date:** [July 15, 2013, 1:09am UTC](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152/40 "2013-07-15T01:09:21Z")
> [@RaftPeople](#): > > I noticed one of my posts over there also, but it looks like they corrected my typos and fixed some errors in the point I was trying to make. Then I guess it isn’t a Nigerian scam. [Previous page](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152.md?page=1) [Next page](https://boards.straightdope.com/t/somebody-stealing-dope-content-again/663152.md?page=3)