Midnight Pub

Creepy Clone/Mirror of the Pub.

~softwarepagan

Hi.

I have recently discovered there is a creepy mirror of the pub at zolvut.cloud

I have no idea why this exists and the fact that it does is so massively creepy I felt the need to inform everyone here.

Since m15o is MIA I doubt anything will get done about it, so just be careful posting.


acolyte

Regarding the site, I'm doing some digging. Looks like they host registration/login pages for the pub as part of their mirror at zolvut.cloud/register etc. I'm not sure if this is an attempt at phishing credentials or just because they are mirroring the site in its entirety.

Looking further, some text has been edited to replace midnight.pub with zolvut.cloud.

"You see an intriguing place in the alley, with a moon on its door. It reads "The zolvut.cloud"."

"zolvut.cloud - Small alley off mainstreet"

The donations page directs to /m15o on Buy Me a Coffee's URL. I haven't bothered to check if m15o is the legit profile or if it's the real BMaC URL. I'm guessing that swiping donations isn't the point here.

The site has some HTML references to a JavaScript script that isn't present on the main site. The reference suggests it's cloudflare analytics, and it has a SHA512 checksum and a token. It's set to "crossorigin: anonymous" - I'm not a web developer so I'm not sure what that does to the browser.

Exiting the pub does NOT direct to some homepage for zovult.cloud. It directs to nightfall.city.

Requesting a key for registration directs to the actual Midnight Pub key request form, so it's possible they're trying to phish keys and creds for new users who don't know the real Midnight Pub URL.

I don't use Matrix, so I can't attest for the Matrix link on the manual page.

My guess, given all the information? Phishing site aimed at taking credentials and keys off of new users, or just a really bad phishing site for taking login information from regular old users. There's no conclusive evidence, but the fact that the registration pages are active but the speakeasy 404's is pretty suspicious.

I would like to know more about this one. OP, where/how'd you stumble across this web domain? Is there any more information you think might be productive to further sleuthing? What makes you think that mirroring the site is a more productive espionage method than just scraping it, as you implied? ("be careful posting.")

Let's get to the bottom of this together!

reply

softwarepagan

I was searching my usernames to probe my privacy and security and it showed up as a search result.

reply

m15o

Wow. Why would anyone do this is beyond my comprehension... thanks for letting me know ~softwarepagan!

reply

ew

because anything, that can be done, will be done eventually, no matter what.

reply

m15o

:(

reply

softwarepagan

He lives!

reply

teacup

He does! Hey m15o, glad to see you o/

reply

fallenriver

this post was also mirrored over there too. very weird.

reply