cPanel's cPrapid.com website being used by scammers for phishing. - Page 1
Forum section: electronics / general

author: MrMobodies
author_rank: Super Contributor
timestamp: April 29, 2021, 08:23:30 pm
content: I got a phising email in late January to a fake NHS portal requesting payment details for a vaccine.I knew it was fake and had look around on separate broswer and profile to see what it was also about and I reported it as usual.It redirected from an Indian medical college website that had been compromised to "https //195-201-99-52.cprapid.com/app/index.php":https //www.jknursing.com/m/ (without the m)Now I got a DPD one today from the same domain:https: 52-237-172-196.cprapid.com/e677b160964b525bd7c28e1b2099578f879/loginand then I found this:https://forums.cpanel.net/threads/cprapid-com-is-breaching-privacy.685437/QuoteI didn't know at the time that the cprapid domain was owned by Cpanel.The link on the DPD one only seems to work once until reloading whereas the NHS one was going for a couple of days or so.It looks like the scammers have a found a way to exploit it for their phising campaigns.See attached pictures:

author: amyk
author_rank: Super Contributor
timestamp: April 29, 2021, 11:47:13 pm
content: It's no different to the free subdomains you get with hosting services... low effort but also low convincingness.

author: MrMobodies
author_rank: Super Contributor
timestamp: July 09, 2021, 11:12:03 pm
content: There's a another scam on CpRapid going on at the moment.I reported it some days ago but still there.I'd recommend Use a test browserhttps://www.21cssindia.com/th/Legitimate website but adding /th/ and you get a different url on CpRapid for everytime it is accessed.It looks like the scammers have free reign to do what they like.The CpRapid URL's don't work after a certain amount of time and seems triggered from that Indian domain.Also the fake receipt email also has what looksto me like Indian language so maybe it originated there.Actually no it is Turkish according to Google language tools auto detect:"2 öge için siparis ayrintilari, 22 Haziran 2021 Sali ("Order details for 2 items, Tue 22 June 2021

author: amyk
author_rank: Super Contributor
timestamp: July 10, 2021, 05:01:30 am
content: Quote from: MrMobodies on July 09, 2021, 11:12:03 pmThat's because the only thing there is a script that redirects randomly to one of (currently) 7 destinations:Code:<SCRIPT LANGUAGE=JAVASCRIPT>function randomlinks(){var myrandom=Math.round(Math.random()*7)var links=new Array()links="https://139-59-177-41.cprapid.com/"links="https://18-118-197-147.cprapid.com/"links="https://18-118-106-84.cprapid.com/"links="https://18-118-112-157.cprapid.com/"links="https://165-232-154-182.cprapid.com/"links="https://20-203-162-92.cprapid.com/"links="https://3-127-149-97.cprapid.com/"links="https://18-118-195-100.cprapid.com/"window.location=links}window.open(randomlinks(),'_self');</script>Everything about the above code suggests extreme amateurishness. They didn't even bother optimising or obfuscating, just copiedhttp://www.javascriptkit.com/javatutors/random2.shtmlwith some changes.I recommend telling the company their site has been hacked and used to redirect people to phishing sites.

author: MrMobodies
author_rank: Super Contributor
timestamp: July 10, 2021, 05:44:08 am
content: Good find with the 7 url destinations.I did tell them some time ago with another scam and here is the reply from the last time:QuoteThey have no control so yes the scammers can do what they like until the CpRapid URL is reported.

author: NiHaoMike
author_rank: Super Contributor
timestamp: July 10, 2021, 05:35:41 pm
content: Time to flood those phishing websites with fake data so that they'll have a harder time using it?

author: amyk
author_rank: Super Contributor
timestamp: July 10, 2021, 11:03:56 pm
content: No, cPanel is not the responsible one here, so that response was not surprising at all - I meant telling 21cssindia about it.

author: MrMobodies
author_rank: Super Contributor
timestamp: July 11, 2021, 04:16:49 am
content: I already tried that but the submit button don't seem to do anything.Actually looking at it again I see an email address at the bottom the page.contact@21cssindia.comObviously I didn't look well enoughJust reported it to them.