[GNC] URGENT: Fake gnucash website with fake download, most likely compromised file

[Dr. David Kirkby]

I'm not seeing it in the UK. But when I did a lookup of the domain using

https://www.namesilo.com/

one gets some limited information. It looks like it was registered in
Germany in October 2022. I changed the domain name to BAD.org to stop
search engines finding it in my post. I don't know if there's any point in
emailing compliance_abuse at webnic.cc to report this. I suspect it is.

Domain Name: BAD.org
Registry Domain ID: 9a42474dfe5d4a8e9e50e0c56e101812-LROR
Registrar WHOIS Server: https://iwhois.webnic.cc
Registrar URL: https://www.webnic.cc/
Updated Date: 2022-10-25T22:39:36Z
Creation Date: 2022-10-20T22:39:13Z
Registry Expiry Date: 2023-10-20T22:39:13Z
Registrar: Web Commerce Communications Limited dba WebNic.cc
Registrar IANA ID: 460
Registrar Abuse Contact Email: compliance_abuse at webnic.cc
Registrar Abuse Contact Phone: +603.89966799
Domain Status: clientDeleteProhibited
https://icann.org/epp#clientDeleteProhibited
Domain Status: clientTransferProhibited
https://icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited
https://icann.org/epp#clientUpdateProhibited
Registry Registrant ID: REDACTED FOR PRIVACY
Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: unknown
Registrant Street: REDACTED FOR PRIVACY
Registrant City: REDACTED FOR PRIVACY
Registrant State/Province: Berlin
Registrant Postal Code: REDACTED FOR PRIVACY
Registrant Country: DE

Dr David Kirkby Ph.D
Email: drkirkby at kirkbymicrowave.co.uk Web:
https://www.kirkbymicrowave.co.uk/
Kirkby Microwave Ltd (Tel 01621-680100 / +44 1621-680100)
Stokes Hall Lodge, Burnham Rd, Chelmsford, Essex, CM3 6DT.





On Fri, 9 Dec 2022 at 23:24, Vincent Dawans <dawansv at gmail.com> wrote:

> I just typed gnucash in google and the first hit was an ad pointing to
> gnu-cash.org (with a dash). It is a fake site that is a carbon copy of the
> official site but the download link goes to a setup.exe that is most likely
> a corrupted virus file.
>
> We need this removed ASAP. There is an option in google to report the site
> and mark it as spam/phishing. I imagine if more people do this it will get
> removed faster hopefully.
> _______________________________________________
> gnucash-user mailing list
> gnucash-user at gnucash.org
> To update your subscription preferences or to unsubscribe:
> https://lists.gnucash.org/mailman/listinfo/gnucash-user
> -----
> Please remember to CC this list on all your replies.
> You can do this by using Reply-To-List or Reply-All.
>