Someone here posted about another one called Data321.net a while back (link to that thread
here). That one was revealed to be content mirror for Chinese users so apparently it wasn't malicious (if one trusts the description in the footer):
if you visit the site and scroll to the bottom, you'll see this:
本网站为比特币加速站点，只为方便中国用户搜索及查找相关答案，属于非营利网站,友情链接或者其他相关问题，请联系QQ:2450057300.
which translates to
This website is Bitcoin accelerate site, only for the convenience of Chinese users to search and find relevant answers, a non-profit website, links or other related issues, please contact QQ: 2450057300.
Mystery solved. all you had to do was scroll down.
It seems to be offline now.
Bitcoin-forums.net on the other hand, lacks an explanation for its existence. However, it was found to contain embedded code for ad/affiliate (?) revenue:
Google is stupid and has trouble differentiating bitcointalk.org from mirrors. That site is trying to exploit this in order to occasionally place above or near bitcointalk.org in search results, and then use this position to make money in various ways. It seems that currently they were paid to increase the click stats of some specific URLs, and they're doing this by putting some extra iframes in each page.
Google is stupid and has trouble differentiating bitcointalk.org from mirrors. That site is trying to exploit this in order to occasionally place above or near bitcointalk.org in search results, and then use this position to make money in various ways. It seems that currently they were paid to increase the click stats of some specific URLs, and they're doing this by putting some extra iframes in each page.
Hmm... I always thought Google's search engine ranking algorithm penalized sites that have duplicate content. Strange to see that it isn't the case for Bitcointalk. I also regularly see Bitcointa.lk being placed higher in search results than this site too.
Didn't notice the iframes until you pointed it out. Yes, very sneaky. I can see them in the code:
<iframe scrolling="no" frameborder="0" src="http://www.entekcms.com/" width="0" height="0"></iframe>
<iframe scrolling="no" frameborder="0" src="http://s.click.aliexpress.com/e/JYNzzbIiI" width="0" height="0"></iframe>
<iframe scrolling="no" frameborder="0" src="http://www.findhe.com/gg/ggindex.php" width="0" height="0"></iframe>
Not sure how they would be able to profit from this though.
There also seems to be some extra JavaScript at the end for StatCounter too as well as something that looks Chinese.
Not sure how they would be able to profit from this though.
for the aliexpress link: cookie stuffing
Despite its philanthropic-sounding description, Data321.net was also suspected of having the same purpose:
Its not a phishing site per sais, but its a content stealing mirror. They mirror bitcointalk.org and inject ads into any traffic that google throws their way. Theymos could likely DCMA takedown them if required but it was discussed and decided not to previously.
It's also possible that both the sites above could be covert phishing attempts.
Another thing I found quite interesting about these mirrors is that when the forums were hacked and offline for a few days, these mirrors also stopped working and went offline as well.
EDIT: Lastly, there is Bitcointa.lk. That one is a mirror of Bitcointalk too, but it uses a completely different forum software and the person who owns it is well known around these forums. The official thread for that project can be found
here. It's not a phishing site but last time I checked, it hadn't been updated in months.
