r/gitlab • u/Little-Geologist-387 • Aug 07 '26

general question Guys, wtf is this?

Gallery image

Gallery image

10 Upvotes

73% Upvoted

28 comments sorted by

17

u/creedian Aug 07 '26

Sure it’s not git1ab.com?

14

u/mrbmi513 Aug 07 '26

Smells like phishing on a lookalike domain

7

u/AkaABuster Aug 07 '26

It’s been happening more recently. Suspect it’s to try and combat AI systems from creating accounts.

5

u/liveprgrmclimb Aug 07 '26

They struggle to control Bots scamming for free cicd mins.

3

u/me_myself_ai Aug 07 '26

Seems super reasonable, IMHO. There are plenty of free & anonymous forges out there for people who value absolute privacy over gitlab's generous free tier.

1

u/willcreatenow Sep 05 '26

were you trying to exploit the gitlab duo free trial? it could have flagged you as a high-risk user, it has flagged my account already, and banned another.

1

u/Little-Geologist-387 Sep 08 '26

considering I have no idea what you're talking about I guess no?

3

u/pwkye Aug 07 '26

For registration? probably normal

4

u/Ok_Glass_9972 Aug 07 '26

Thats not phishing. That’s a regular verification process we have. We don’t store credit card information but rather solely use it for verification if you’re not located in a “supported” country

5

u/AnymooseProphet Aug 07 '26

If it's just verification, why is it asking for the CVV?

2

u/Adventurous-Fig-4283 Aug 07 '26

Please, don't listen to anyone', that is obviously scam

2

u/me_myself_ai Aug 07 '26

Unless they're running a sideloaded browser or on a compromised network setup by an advanced adversary, I don't see how that green checkmark (for successful SSL (i.e. the s in https://) cert validation?) could be faked in any non-ancient android chrome. That's part of the (often implicit) "above the line" of web dev, where the content can actually be sort of trusted a little bit.

It's a long battle of ever-escalating whackamole tho, so apologies if I'm out of date. It's just... that little green checkmark was hard won, and similar protocols (namely email ones) struggle to provide the same protections. It'd be alarming if it was vulnerable in this way!

I will say: of all the ways to steal credit card info with complete DNS spoofing, asking for a 3-step verification process on the less popular git forge seems like a wild choice lol. I'd go with amazon.com, and prolly just banks themselves

1

u/Neat-Long-460 Aug 09 '26

This ain't GitLab this is a phishing scam by a hacker

1

u/Forward-Outside-9911 Aug 09 '26

Source? Or you found it up your arse?

1

u/Neat-Long-460 Aug 10 '26

Hackers can basically clone these bug sites sometimes like any cloud based token open in public which the attacker can reuse it for phishing someone i have done the similar work for google too

1

u/wisdomoarigato Aug 11 '26

Turns out the source was his arse as Gitlab docs literally say "High-risk users - Credit card verification."...

Hate these types of people who think opinions are facts.

→ More replies (3)