MegaUpload typosquatting exposed

It’s only natural, given the relevance of the MegaUpload takedown, for people to be interested. What does the FBI message pasted on the MegaUpload front page look like? Is the site still down, or has it found some way to survive? But beware, because curiosity can infect the cat.

GFI Labs is warning about Megaupload(dot)cm. That’s not my typo – it’s the criminals hoping that you do one of your own. If you mistype ‘cm’ for ‘com’ you won’t go to the file-sharing website, you’ll go to a completely different site, registered in the Cameroons (cm). 

Megaupload(dot)cm was registered way back in 2009. It is one of many Cameroon-registered sites seeking to capitalize on mistyping. In the wake of the MegaUpload takedown, GFI Labs is warning that this particular mistyping will redirect visitors to surveytakelive(dot)com, which offers prizes in exchange for some personal information. After this, the visitor is offered three options.

The GFI Labs researcher concerned, Christopher Boyd, didn’t follow the process through to it’s natural conclusion. He chose ‘a love thermometer’ (shaped like a baseball bat) but doesn’t know what lies beyond it (other than another site, enterfactory(dot)com). The internet is full of such scams, all leading to nefarious destinations. This one relies on an initial user typo, and is particularly relevant given the MegaUpload takedown.

The solution is simple: don’t go there, and, as Boyd says, “Be mindful of what you’re typing into the URL bar, and let me know if you discover what the Love Thermometer actually does…”

What’s hot on Infosecurity Magazine?