gahomesaver.com is a clone of PC Gaming Wiki, is this thing legit?

[Zweihander2020 0]

I found this website, gahomesaver.com that looks and functions like an exact copy of PCGamingWiki. Is this website at all affiliated with PCGamingWiki? I am concerned that it might be malicious since it might be trying to deceive someone.

[Aemony 142]

No, it's not affiliated. From the looks of things, they seem to be proxying traffic to the real site anyway, as a change on PCGW appeared in an instant on that mirror site. They're also injecting custom code into the site, as evidenced by the ads and stereotypical torrent / comments links they're adding to the very bottom of the webpage.

@snuxoll, any ideas on how to prevent this sort of proxying from happening? Or is the only approach a wack-a-mole one where we determine their IP through the traffic logs and ban said IP?

[Zweihander2020 0]

Hopefully it's doing nothing except proxying to the real site with custom ads displayed. It rubs me the wrong way they are basically profiteering off of a wiki. On the other hand, I am concerned about the intentions behind whomever is behind the site, since the traffic to the site is unsecured/unecrypted. I tried to dig up some info on the host and people behind the domain, but I got nothing asides from the fact that this site was created on January 11  2020.

By the way, I'm usually just a guy browsing the wiki, and made this account just to report this. Is there anyway to deactivate or delete my account after this is resolved?

[snuxoll 2]

In the immediate term I’ve blacklisted the IPs at the CloudFlare level, they don’t seem to be very intelligent and if they decide to keep IP hopping I can automate the blocking easily. I am recording the backend addresses and will be submitting abuse complaints to the appropriate service providers if they persist as well.

[snuxoll 2]

In an abundance of caution and because the time is overdue I am disabling native authentication on both the wiki and community site to prevent credential theft attacks. I can't directly protect against somebody proxying the SSO domain, but the SSO service will *not* hand out authentication tokens to non-PCGW domains. I will be adding links to the SSO account management to appropriate locations tonight and I advise all users to setup 2FA for their accounts.