Imagine our surprise when among the dozens of phishing e-mails that arrive to our inboxes was one message that leads not to a free hosting provider but to a .GOV.CN site URL. Hackers are apparently in control of a Chinese government web server, or someone at that site is engaged in phishing Paypal accounts.
The e-mail, like many others of that ilk, told us about the need to log-in due to “suspect activity”. It reads “We recently noticed one or more attempts to log in to your PayPal account from a foreign IP address”.
It continued “If you recently accessed your account while traveling, the unusual log in attempts may have been initiated by you. However if you are the rightful holder of the account,click on the link below to log into the account and follow the instructions.”
Below, one could see the familiar Paypal log-in address, but once you looked where the hyperlink lead to, it was instead to
http://gtt.xinjiang.gov.cn/remark.html
Knowing it was a fake, I visitied the site and to my amusement was forwarded to a fake Paypal log-in screen in studypoint.sk, a Slovakia domain - a country far away that this gaucho knows nothing about.
Hours later, when I tried the URL again, the redirector at the Chinese .gov.cn site changed its destination to an IP address, clearly hinting out that the persons in charge of this redirector had access to change the remark.html file contents so they can create new fake log-in pages elsewhere once the first ones are reported and shut down, so they could continue their exercise forever.
But what is http://gtt.xinjiang.gov.cn, the server hosting the “remark.html” redirector?. This ignorant scribbler never heard of Xinjiang before, so I had to look it up on the wackypedia, which tells Xinjiang is an autonomous region in the People’s Republic of China, right next to Mongolia, Russia, and Kazakhstan.
The INQ scribbler and correspondent in Taiwan, Simon Burns, stepped to the plate and said: “it appears to be an official website of a department of the Xinjiang Provincial Government. The site title translates to Xinjiang Land and Natural Resources Office, I think. I’d guess it’s the office in charge of stuff like
land zoning regulations and probably also connected to things like mining and mineral rights - though my Chinese isn’t that great, so I can’t be certain that these areas are their main focus”.
The redirector now leads to an IP address
So there you have, a Chinese Government web site hosting a “remark.html” redirector file that through a “refresh” command in the HTML “head”, loads a fake Paypal log-in form. I’m sure the Chinese authorities will quickly find the person in charge of the web site and ask him how was that possible.
Since the INQ does not have currently any correspondent in the Chinese Turkestan, we will rely on the knowledge of our readers up there in Asia to seek comment from the proper authorities. Or perhaps our colleague the great Kzakh journalist, Mr. Borat can give us a hand and cross the border to find out the realities of the Chinese Turkestan, predictably with “Great Success”?
News Source:the INQUIRER