[tyingq]

Just tried http://www.equifax.com/fcra myself...it redirects to obviously shady sites, right now.

Edit: Currently it's doing it only for specific client user agents. Try an android one. This javascript is driving part of it: https://a248.e.akamai.net/f/248/5462/3h/hints.netflame.cc/se...

Edit: Found the bad bits. They are here: https://aa.econsumer.equifax.com/aad/uib/js/fireclick.js

See the part that starts with document.write()

Edit: maybe a red herring. Sure looks shady though.

[ballenf]

What's the stack used for the real https version? I got redirected there (I guess malware doesn't like Safari desktop or uBlock origin saved me) and felt like I fell through a time warp to 2007 (update: 2004, in actuality) with the form Equifax presents. So much low-res skeuomorphism I almost got nostalgic.

Not necessarily related to the security issues, just curious.

Edited to add: The site has a Copyright of 2004. None of the JS tools are later than that. Is this really the current site in use? Unchanged for 13 years... wow. Would be sorta cool, you know, if it wasn't completely hacked.