The domain is registered with webnic.cc, but all the registrar details are hidden:
puck@dirk:~$ whois gnu-cash.org Domain Name: gnu-cash.org Registry Domain ID: 9a42474dfe5d4a8e9e50e0c56e101812-LROR Registrar WHOIS Server: https://iwhois.webnic.cc Registrar URL: https://www.webnic.cc/ Updated Date: 2022-10-25T22:39:36Z Creation Date: 2022-10-20T22:39:13Z Registry Expiry Date: 2023-10-20T22:39:13Z Registrar: Web Commerce Communications Limited dba WebNic.cc Registrar IANA ID: 460 Registrar Abuse Contact Email: compliance_ab...@webnic.cc Registrar Abuse Contact Phone: +603.89966799 Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited Registry Registrant ID: REDACTED FOR PRIVACY ... Perhaps an abuse report to the above email address? Cheers, Andrew On Sat, 2022-12-10 at 12:59 +1300, Andrew Ruthven wrote: > Hey, > > This IP is assigned to Cloudflare: > > puck@dirk:~$ whois 2606:4700:3030::6815:5f93 > ... > NetRange: 2606:4700:: - 2606:4700:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF > CIDR: 2606:4700::/32 > NetName: CLOUDFLARENET > NetHandle: NET6-2606-4700-1 > Parent: NET6-2600 (NET6-2600-1) > NetType: Direct Allocation > OriginAS: AS13335 > Organization: Cloudflare, Inc. (CLOUD14) > RegDate: 2011-11-01 > Updated: 2017-02-17 > Comment: All Cloudflare abuse reporting can be done via > https://www.cloudflare.com/abuse > Ref: https://rdap.arin.net/registry/ip/2606:4700:: > ... > > Cheers, > Andrew > > On Fri, 2022-12-09 at 17:53 -0600, David Carlson wrote: > > Mystery deepens! When I tried to open this fake website it was not > > available in Tor browser but pinging it revealed a response from > > IPV6 > > address 2606:4700:3030::6815:5f93. That IP does not seem to be > > registered > > > > On Fri, Dec 9, 2022 at 5:40 PM Vincent Dawans <dawa...@gmail.com> > > wrote: > > > > > Added screenshot showing fake gnucash site ad at top of google > > > results. > > > > > > On Fri, Dec 9, 2022 at 3:31 PM Vincent Dawans <dawa...@gmail.com> > > > wrote: > > > > > > > Precision: the link to the fake site reported below is actually > > > > https://gnu-cash.org/main.php -- you need the full page link to > > > > see the > > > > fake site that shows in the google ad. > > > > > > > > On Fri, Dec 9, 2022 at 3:24 PM Vincent Dawans > > > > <dawa...@gmail.com> wrote: > > > > > > > > > I just typed gnucash in google and the first hit was an ad > > > > > pointing to > > > > > gnu-cash.org (with a dash). It is a fake site that is a > > > > > carbon copy of > > > > > the official site but the download link goes to a setup.exe > > > > > that is most > > > > > likely a corrupted virus file. > > > > > > > > > > We need this removed ASAP. There is an option in google to > > > > > report the > > > > > site and mark it as spam/phishing. I imagine if more people > > > > > do this it > > > will > > > > > get removed faster hopefully. > > > > > > > > > > > > _______________________________________________ > > > gnucash-devel mailing list > > > gnucash-devel@gnucash.org > > > https://lists.gnucash.org/mailman/listinfo/gnucash-devel > > > > > > > > -- Andrew Ruthven, Wellington, New Zealand and...@etc.gen.nz | Catalyst Cloud: | This space intentionally left blank https://catalystcloud.nz | _______________________________________________ gnucash-devel mailing list gnucash-devel@gnucash.org https://lists.gnucash.org/mailman/listinfo/gnucash-devel
