Closed Bug 409652 Opened 18 years ago Closed 18 years ago

url leads to malicious website instead of google search

Categories

(Firefox :: Security, defect)

Product:
Firefox
Component:
Security
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED INVALID

People

(Reporter: luc.antw, Unassigned)

References

(
URL
)

Details

User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1.10) Gecko/20071126 Fedora/2.0.0.10-1.fc7 Firefox/2.0.0.10 Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1.10) Gecko/20071126 Fedora/2.0.0.10-1.fc7 Firefox/2.0.0.10 The url, opened in firefox, opens a malicious casino site (http://hotcasinosite.com) opening the url in lynx or opera gives the google search page. Reproducible: Always Steps to Reproduce: 1. just opening the url in firefox / fedora 2. 3. Don't know about the security issues involved. The final url field shows the url of the real site. Marked it as security related to play safe.
This is a trick that's going around and google will have to deal with it. If you un-encode the search string (q=..._) you get q=site:hotcasino.com At the end "btnI=Lucky" makes this an "I'm feeling lucky" search, where Google simply opens what they think is the best match (top search term). Since all the matches are restricted to that site ("site:") that's where you end up. Other sites have tried doing this by having a unique nonsense string on their site and then searching for that with the Lucky button. There's no reason this shouldn't have worked in Opera unless you turned off redirects. It's no longer working in Firefox either so maybe you just didn't test Opera until after Google fixed it on their end.
Group: security
Status: UNCONFIRMED → RESOLVED
Closed: 18 years ago
Resolution: --- → INVALID

This is due to a particular website that exploits typo.
When typing https://https://whatever.com or http://https://whatever.com you are redirected to https.com which have a malicious behavior.
It happens whatever the search engine you select in your configuration.

This shoud be adressed, since it happens only on Firefox ! Others major navigators doesn't forward you to that efing website (tested on chrome, edge & opera).

(In reply to zwazobleu from comment #2)

This is due to a particular website that exploits typo.
When typing https://https://whatever.com or http://https://whatever.com you are redirected to https.com which have a malicious behavior.
It happens whatever the search engine you select in your configuration, and even when an url is missredacted in a website and you clic on it.

This shoud be adressed, since it happens only on Firefox ! Others major navigators doesn't forward you to that efing website (tested on chrome, edge & opera).

sorry about the reply, I just ewanted to edit the msg to add the fact tat it happens even when clicking on a badly written within another website

You need to log in before you can comment on or make changes to this bug.