geewiz phishing scam

[spiff]

anyon else get this message when going to geewiz website?

 

[EmmanuelGoldstein]

Site loads okay on my side… see that those Jews are closed on Wednesday too

 

[Fulcrum29]

No issue with the Geewiz website that I can see, but what are you clicking to go to the Geewiz domain?

 

[LandyMan]

I also had concerns about their website and payment gateway a few years ago

 

[Smiggles]

AVG? Uninstall that spam.

It might be time to stop using antivirus

Update your software and OS regularly instead, practice skeptical computing.

arstechnica.com

 

[WAslayer]

Are you clicking on some link received in a email ?
View attachment 1850154 is not their correct url (shown in AVG warning)

No shyte, Sherlock..

This is obviously a URL loading as part of the many requests made when browsing to geewiz.co.za.. Not something OP is explicitly clicking on..

 

[biena]

No shyte, Sherlock..

This is obviously a URL loading as part of the many requests made when browsing to geewiz.co.za.. Not something OP is explicitly clicking on..

whatever. I looked at my router log and that dns didnt show. now looked at page sources and indeed it loads some script from that site. won't try to help again.

 

[Lupus]

anyon else get this message when going to geewiz website?

View attachment 1850153

That's not the geewiz website, kinda gives you the problem right at the top.

 

[DrJohnZoidberg]

That js looks extremely sus. Bunch of obfuscated functions that looks to be masquerading as jquery.

 

[spiff]

then what is the right website?

my first pic is the result of clicking on www.geewiz.co.za

I've used geewiz many times before and never got a scam alert like this.

That's not the geewiz website, kinda gives you the problem right at the top.

 

[WAslayer]

That js looks extremely sus. Bunch of obfuscated functions that looks to be masquerading as jsquery.

Been trying to figure out how it was encoded but not having much luck with that.. the initiator chain is also suspect..

 

[WAslayer]

That's not the geewiz website, kinda gives you the problem right at the top.

It's a URL that loads when browsing to geewiz.co.za...

 

[Lupus]

then what is the right website?

my first pic is the result of clicking on www.geewiz.co.za

I've used geewiz many times before and never got a scam alert like this.


View attachment 1850160

Yeah checking the website


May need to bring it up to them?

 

[Lupus]

It's a real domain for the Pescara province

Provincia di Pescara

Sito ufficiale Provincia di Pescara

www.provincia.pescara.it

In Italy, so really odd that there is a call to it in Geewiz

 

[EmmanuelGoldstein]

It's a real domain for the Pescara province

Provincia di Pescara

Sito ufficiale Provincia di Pescara

www.provincia.pescara.it

In Italy, so really odd that there is a call to it in Geewiz

That website is likely compromised and used as a zombie to serve that jQuery script file which itself is also probably messed with to steal information from the victim

 

[spiff]

That website is likely compromised and used as a zombie to serve that jQuery script file which itself is also probably messed with to steal information from the victim

AVG just shuts it down immediately.

 

[Fulcrum29]

Yeah checking the website
View attachment 1850164
View attachment 1850165
May need to bring it up to them?

It is blocked on my side, but that is loaded down below (Footer). Not going to post it here.

 

[Fulcrum29]

From their last web archive, it is not present. Their host or site has a vulnerability, or someone maliciously added it.

 

[rustypup]

That website is likely compromised and used as a zombie to serve that jQuery script file

"Web 2.0" all the way down. Loose collection of external tools, utilities and code over which the "dev" has no insight, control or concept of supply chain attacks.

See this with many corporate sites of late. Given how many of these extended services we block some sites are hilariously broken. (WIX, hubspot, etc, etc)

All filthy. All been used to attack us at various times. Terrible behaviour but how many corps out there actually do code review?

Bounced many dev houses looking for work by just checking their public presence site.

 

[spiff]

Ok mystery solved.

used bing to load www.geewiz.co.za and it worked normally.

cleared out my chrome browser history

tried chrome again and it worked normally

thanks guys for the quick response