New Facebook Like-button hijack: http://marikafr.altervista.org/

Post Reply
toblakai
Posts: 3
Joined: Mon Mar 28, 2011 8:00 pm

New Facebook Like-button hijack: http://marikafr.altervista.org/

Post by toblakai » Mon Mar 28, 2011 8:00 pm

In total there are 3 hidden Facebook Like buttons hidden beneath what seems like a play button for the video.

Please visit the page, check the source and confirm this for yourself. Use a debugger if you want to see the script codes attached to the buttons after page is loaded (Firebug, Dragonfly etc.). Alternatively by logging into a fake facebook account and click the button. Then help rating it down in WOT since it currently has a green light.

Code: Select all

<div style="width:80px;height:71px;margin-top:117px;margin-left:127px;">
  <div id="wjp" style="padding-left:16px;padding-top:14px;">
    <fb:like href="http://marikafr.altervista.org/" width="30" action="like" layout="button_count" id="f1" class=" fb_edge_widget_with_comment fb_iframe_widget">
      <span>
        <iframe id="f714dd2804e4b4" name="f1a4ce06dc0efc" title="Like this content on Facebook." class="fb_ltr" style="border-top-color: currentColor; border-left-color: currentColor; border-right-color: currentColor; border-bottom-color: currentColor; border-top-width: medium; border-left-width: medium; border-right-width: medium; border-bottom-width: medium; border-top-style: none; border-left-style: none; border-right-style: none; border-bottom-style: none; width: 90px; height: 20px" src="http://www.facebook.com/plugins/like.php?action=like&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D0%23cb%3Dff88482301564e%26origin%3Dhttp%253A%252F%252Fmarikafr.altervista.org%252Ff132f1ecc06a2a%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fmarikafr.altervista.org%2F&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90" frameborder="0" scrolling="no" allowtransparency="true" onload="FB.Content._callbacks.f1d1a1da286d97()"></iframe>
      </span>
    </fb:like>
    <br>
    <fb:like href="http://marikafr.altervista.org/" width="30" action="like" layout="button_count" id="f2" class=" fb_edge_widget_with_comment fb_iframe_widget">
      <span>
        <iframe id="fa360763237002" name="f6ddb73fcf2c96" title="Like this content on Facebook." class="fb_ltr" style="border-top-color: currentColor; border-left-color: currentColor; border-right-color: currentColor; border-bottom-color: currentColor; border-top-width: medium; border-left-width: medium; border-right-width: medium; border-bottom-width: medium; border-top-style: none; border-left-style: none; border-right-style: none; border-bottom-style: none; width: 90px; height: 20px" src="http://www.facebook.com/plugins/like.php?action=like&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D0%23cb%3Df3b7f179b40e0c%26origin%3Dhttp%253A%252F%252Fmarikafr.altervista.org%252Ff132f1ecc06a2a%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fmarikafr.altervista.org%2F&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90" frameborder="0" scrolling="no" allowtransparency="true" onload="FB.Content._callbacks.f26cb131a28c4d()"></iframe>
      </span>
    </fb:like>
    <br>
  </div>
</div>

toblakai
Posts: 3
Joined: Mon Mar 28, 2011 8:00 pm

RE: New Facebook Like-button hijack: http://marikafr.altervista.

Post by toblakai » Mon Mar 28, 2011 8:35 pm

List of domains/hosts:

List of domains/hosts

  • marikavideo.altervista.org
  • mfruscio.altervista.org
  • marikafrusci.altervista.org
  • mireggaeton.com/bella.html
  • marikafr.altervista.org
  • marikavideonews.altervista.org
  • marikff.altervista.org/maricac.php

spectre
Posts: 7922
Joined: Sun May 03, 2009 10:43 pm

RE: New Facebook Like-button hijack: http://marikafr.altervista.

Post by spectre » Mon Mar 28, 2011 11:20 pm

Thank you.
marikff.altervista.org/maricac.php and mireggaeton.com/bella.html have been removed but the others are similar to this:

[img]http://i56.tinypic.com/21lkilk.png[/img]


[img]http://i55.tinypic.com/14cbmrp.png[/img]

c۞g
Posts: 21225
Joined: Mon Jan 05, 2009 4:02 am

RE: New Facebook Like-button hijack: http://marikafr.altervista.

Post by c۞g » Tue Mar 29, 2011 12:30 am

View page source:

marikavideo.altervista.org
discovered two iframes


<code>
<div id="wjp" style="padding-left: 16px; padding-top: 14px;">
<fb:like class=" fb_edge_widget_with_comment fb_iframe_widget" href="http&#58;//marikavideo.altervista.org/" width="30" action="like" layout="button_count" id="f1">
<span>
<iframe src="http&#58;//www&#46;facebook.com/plugins/like.php?action=like&channel_url=http%3a%2f%2fstatic.ak.fbcdn.net%2fconnect%2fxd_proxy.php%3fversion%3d0%23cb%3df1ec0b2979544b6%26origin%3dhttp%253a%252f%252fmarikavideo.altervista.org%252ff284df395cacb8%26relation%3dparent.parent%26transport%3dpostmessage&href=http%3a%2f%2fmarikavideo.altervista.org%2f&layout=button_count&locale=en_us&node_type=link&sdk=joey&show_faces=false&width=90" class="fb_ltr" title="like this content on facebook." style="border: medium none; overflow: hidden; height: 20px; width: 90px;" name="f17de1e9f1bf46a" id="f1a346a98126d12" scrolling="no">
</iframe>
</span>
</fb:like>


<fb:like class=" fb_edge_widget_with_comment fb_iframe_widget" href="http&#58;//marikavideo.altervista.org/" width="30" action="like" layout="button_count" id="f2">
<span>
<iframe src="http&#58;//www&#46;facebook.com/plugins/like.php?action=like&channel_url=http%3a%2f%2fstatic.ak.fbcdn.net%2fconnect%2fxd_proxy.php%3fversion%3d0%23cb%3df1ae7713ef4829e%26origin%3dhttp%253a%252f%252fmarikavideo.altervista.org%252ff284df395cacb8%26relation%3dparent.parent%26transport%3dpostmessage&href=http%3a%2f%2fmarikavideo.altervista.org%2f&layout=button_count&locale=en_us&node_type=link&sdk=joey&show_faces=false&width=90" class="fb_ltr" title="like this content on facebook." style="border: medium none; overflow: hidden; height: 20px; width: 90px;" name="f3020e8bd9d343c" id="f2c4f7e5a77a6e8" scrolling="no">
</iframe>
</span>
</fb:like>


</div>
/code>


Rated all, thanks!

Figure10
Posts: 270
Joined: Sun Jun 20, 2010 9:46 pm

RE: New Facebook Like-button hijack: http://marikafr.altervista.

Post by Figure10 » Tue Mar 29, 2011 4:32 am

facemashlolfb.altervista.org

mcolford
Posts: 134
Joined: Sat Dec 04, 2010 2:09 am

RE: New Facebook Like-button hijack: http://marikafr.altervista.

Post by mcolford » Tue Mar 29, 2011 4:59 am

Above domains RATED

'facemashlolfb.altervista.org' - Confirmed Phish Site: See [url=http://www.phishtank.com/phish_detail.php?phish_id=1164271 t=_self]PhishTank[/url]

c۞g
Posts: 21225
Joined: Mon Jan 05, 2009 4:02 am

RE: facemashlolfb.altervista.org

Post by c۞g » Tue Mar 29, 2011 5:48 am

Account suspended

Occsters
Posts: 278
Joined: Thu Dec 23, 2010 5:31 pm

RE: New Facebook Like-button hijack: http://marikafr.altervista.

Post by Occsters » Thu Aug 30, 2012 11:59 pm

Rated and commented via RMT. Also I found another website, which is shown below:

List of domains/hosts

184.107.51.106
You can read the article here: http://facecrooks.com/Scam-Watch/selena-gomez-caught-on-leaked-tape-facebook-scam.html It is known as "Selena Gomez caught on [leaked tape]".

Post Reply

Who is online

Users browsing this forum: Bing [Bot] and 4 guests