Friday 30 March 2018

Sidney Crosby has NOTHING to do with EnduraFlex - Fake ESPN Site EXPOSED AGAIN

The Sidney Crosby FakeESPN Scam is back. The only difference between the new version and the version debunked in the Global News link is that "Alpha Force Testo" is search-and-replaced with "EnduraFlex Performance Enhancer". The red flags are the same; the "free" trial offer, the fake comments, the fake "results", and the fact that the REAL ESPN site would never shill a supplement like this. Note to any scamvertisers reading this: Search-and-replacing the name of the product won't help un-debunk one of your fake news articles. Once again, stay away from EnduraFlex.

Josh Brolin has NOTHING to do with EnduraFlex

This is another scamtastic fake news story; this time, it's promoting a muscle supplement called "EnduraFlex", which is just a rebadging of Alpha Force Testo (a.k.a. the Sidney Crosby FakeESPN Scam Supplement). The site pretends to be a magazine called "Men's Health Life", which is an obvious attempt to imitate the real Men's Health magazine without infringing on its trademarks (scamvertisers don't know very much about trademark infringement). The scammers are trying to cash in on the Deadpool 2 hype by using the likeness of Josh Brolin, who is playing the character "Cable", to lure unsuspecting fans into signing up for their 8000-CAD-per-month "free" trial. The red flags are classic; the "free" trial offer, the fake results, and the fake comments. Also note that the use of the phrase "legal steroid" in muscle supplement fake-news articles dates back to circa 2006-2007. As this fake news article is hosted on a "checkout" subdomain, it is vulnerable to the Voluumdata XSS Exploit, which the scammers haven't fixed yet; therefore, you can still turn the page into a wall of Goatse images by simply copy-pasting a short snippet of code into the URL bar. Avoid EnduraFlex, and once again, don't believe everything you read on the Internet.

Wednesday 28 March 2018

Bill Gates has NOTHING to do with Intelligex - Fake Forbes Site EXPOSED

This is a fake news story from a website pretending to be Forbes. It claims that Bill Gates admitted to using a "smart drug" called Intelligex in a CNN interview. This is an obvious fake, recycled from a similar fake news story about Stephen Hawking after he (Hawking, not Gates) died. They even kept some of the Hawking references in there! The same old red flags are there: the "free trial" and the fake comments. (Note that the link to the "free trial" site is broken - oops.) There have been many brain-supplement-shilling fake news sites pretending to be Forbes over the years; the REAL Forbes has tried to sue the operators of these sites many times, but they (the fake news site operators, not Forbes) are apparently based in Bermuda, making it almost impossible for US-based companies (like Forbes) to file lawsuits against them. Stay away from Intelligex, and don't believe everything you read on the Internet.

Vanna White Scam Part II: Revenge of the Pink Diamond

This is a newer version of the Vanna White scam. There are a few differences; it uses a variation of the "Entertainment Today" layout instead of just copying everything from the People Magazine website, it advertises Pink Diamond instead of Ziladerm, and the fake news story itself is slightly different. However, the red flags (the free trial and the fake comments) are the same as every other skin care scam out there. Stay away from Pink Diamond, and don't believe everything you read on the Internet.

Sunday 18 March 2018

Shania Twain has NOTHING to do with Creme (+ XSS Security Hole in "checkout" Subdomains)

This is more BS from Creme. This time, they pretend that Shania Twain created it. There are the usual red flags (the "Entertainment Today" layout, the "free trial" offers, and the fake comments); the formatting used for the "trial" and the "comments" seems to have been butchered, and they forgot the IFRAME redirect. However, I just went into the "checkout" subdomain and discover it manually. I also discovered an XSS security hole in their "checkout" subdomains (I originally found it on a fake Vogue article that pretended that Melania Trump created Creme, which has since been taken down, but it works on every one of their sites that has a "checkout" subdomain). This has easily-exploitable results; the only things that DON'T work with it are "script" and "iframe src" tags (which are automatically emptied). Here is an example, with a wall of goatse replacing the aforementioned Shania Twain article. Once again, avoid Creme, and if the scammers are reading this, they should fix the security hole.

UPDATE: They actually set up the redirect (using the traditional methods instead of the fancy IFrame), and changed the fake news to advertise Pink Diamond. The security hole is still there.