648203 - Phishing protection dont get triggered at certain case

Status: RESOLVED INVALID

(Toolkit :: Safe Browsing, defect)

Description

[Biju]

Phishing protection dont get triggered at certain case.

Steps:-
1. goto http://antispyware-pack.co.cc/fast-scan/ 
   - Phishing protection get triggered.
2. goto http://tinyurl.com/trap-user 
   
result:-
   It get redirected to 
   http://antispyware-pack.co.cc/fast-scan/ 
   but no Phishing protection screen.

Expected:-
   Phishing protection screen popup.
When you got http://tinyurl.com/trap-user make sure you have automatically
forwarded to http://antispyware-pack.co.cc/fast-scan/ and seeing 
"

Comment 1

[Mehdi Mulani [:mmm] (I don't check this)]

Good catch!

The redirect actually takes me to http://antispyware-rebate.co.cc/fast-scan/ or http://antispyware-gmail.co.cc/fast-scan/ (note -rebate/-gmail and not -pack).
I have reported the site from Help -> Report Web Forgery and encourage you to do the same.

(Marking this INVALID as Firefox is working exactly as expected in this case.)

Comment 2

[Biju]

Problem is complicated.

1. my URL http://tinyurl.com/trap-user redirect to google

2. Google access http://revcon.osce.org/revcon/1/94.php?q=mozilla-thunderbird-3
   in the IFRAME/FRAME
   which is Organization for Security and Co-operation in Europe | OSCE

3. which access target of tinyURL http://tinyurl.com/trap-user-2
   (preview http://preview.tinyurl.com/trap-user-2 )
    ie, http://gvknnfev.cw.cm/
   (cw.cm is a free domain service provide)

4. http://gvknnfev.cw.cm/**** is redirect to 
   http://antispyware-*****.co.cc/fast-scan/

Comment 3

[Biju]

I have submitted a report against http://gvknnfev.cw.cm/

=== report comment ========
They are redirecting to 
http://antispyware-*****.co.cc/fast-scan/

See details at
https://bugzilla.mozilla.org/show_bug.cgi?id=648203#c2
=== report comment end ========

Comment 4

[Biju]

looks like culprit is http://revcon.osce.org/revcon/1/94.php?q=a
if the referrer is google it send back "CURRENTLY" active   http://***.cw.cm/**** which is redirect to latest 
http://antispyware-*****.co.cc/fast-scan/