1

One website is the....com the other is teh....com. They display the same content.

The whois data is radically different. Ping reports different IPs.

TheGuardian.com hasn't responded to my request for clarification.

How can I investigate the maliciousness, if any?

user567324
  • 19
  • 1
  • 1
    To investigate potential maliciousness, you investigate the suspect site. I'm not sure what you are asking. All you have said is "I found a site that mirrors another. The domains are owned by different parties." There are many reason why this could be. – schroeder Apr 22 '17 at 07:00
  • 1
    If your question is "can you investigate for me" then that question is off-topic (we don't investigate). If you want to know *how* to investigate, then we need more details. – schroeder Apr 22 '17 at 07:03

1 Answers1

2

How can I investigate the maliciousness, if any?

It is not malicious, the tehguardian.com can be considered as a parody of the guardian.com.

They display the same content.

If you look very closely you will see the are not identical.

Some Background

The Guardian Newspaper is well known for containing for containing spelling mistakes and grammatical errors - it had the nickname The Grauniad as a result:

Deliberate misspelling of Guardian, coined by the UK satirical magazine Private Eye. Refers to the fact that in earlier years the Guardian newspaper was well-known for typographical errors.

Someone (stef) then thought it would be funny to produce a spoof website that was a copy of the The Guardian website but with deliberately inserted mistakes.

I’ve made a little hack called TehGuardian.com — it inserts random grammar and punctuation mistakes into TheGuardian.com. Can you spot the mistakes?

You may remember that in 2013 The Guardian rebranded online as The Guardian. No, I thought it was a bit odd too. Something to do with guardian.co.uk changing to theguardian.com

Now, if you saw that happening, what would your immediate reaction be?

Of course. Same here. I went to my usual domain registrar site, and whacked in thegrauniad.com but obviously they’d thought of that.

So I typed in “tehguardian.com”, “teh” being the proper way to spell “the” on the internet, and gosh. Would you look at that? Somehow nobody had thought to buy it. And I use one of those one-click domain registrars. And I was feeling mischevious. And…

...

TehGuardian.com

It’s the Guardian website as we know and love. But every single article page has up to five grammatical errors introduced into it.

So if you make the mistake of typing in “teh” instead of “the” when you try to reach the Guardian, you’ll also receive a slightly glitchy version back.

It’s quite subtle. Probably my subtlest hack yet.

Every article that you read via tehguardian.com is exactly the same as an article on theguardian.com except that I have introduced incorrect Oxford commas, instances of “s’s” where it should be “s’”, swapped “they’re” for “their” and a handful of other grammar-pedant-traps.

Source Teh Guardian FTW!!!1!

DavidPostill
  • 121
  • 1
  • 6
  • tehguardian.com is missing the banner ads, but if you use the intra-site search, the results begin with a set of ads whose URLs contain teh 'referrer' tokens, such as `https://www.googleadservices.com/.........&res_url=https‌​://www.tehguar‌​dian.com/us/trav‌​el&rurl=http://tehguardian.com.........` – user567324 Apr 21 '17 at 22:58
  • @user567324 I use uBlock Origin so I don't see the ads :) – DavidPostill Apr 21 '17 at 23:04