Fake Cambodian E-visa Website!

[welo]

I just found out that there is a website around that issues fake Cambodian e-Visas.

The official website is

http://evisa.mfaic.gov.kh/e-visa/vindex.aspx

(as has been stated on this forum correctly many times.)

When I could not access the official website yesterday (timeout), I really got tricked when reading reports of a law suite between the company contracted to run the service and the Cambodian government. I then found a second website which looked nearly identical and very professional, and nearly fell for it.

However, I did another Google search today and it brought up a several reports that this second website is actually a FAKE, issuing fake Visas that will NOT be accepted at the border.

The supposedly fake website is www cambodiaonarrival com (don't want to publish the link in order not to boost that website).

The reports date back to March 2009, maybe it was discussed on thaivisa back then, I didn't find any reports on that topic though.

(hope the links don't violate forum rules, but hey, that's an important issue here!)

http://news.xinhuanet.com/english/2009-03/...nt_11021549.htm

http://www.tripadvisor.com/ShowTopic-g2939...Phnom_Penh.html

Anybody knows more about it?

Anybody can confirm the e-Visa service on the official website is still working and reliable?

welo

Note: Please don't get off-topic and discuss the purpose of the e-Visa (do a forum search or start a new topic if you really want to).

[cjwinks]

Hi,

I successfully got an e-visa this week, the service was good but it wasn't straight forward

Strangely I couldn't (and still can't) access the official site using my Thai ISP, I had to use my UK VPN.

I then filled out the application form and received an ASP net error right after the payment successful page. I mailed the help address given on the e-visa help section, but I got a mail delivery error stating this mailbox was full.

I looked around the main mfaic site, found a different contact mailbox (mfaicinfo) and emailed them explaining my problem. They promptly emailed back apologizing, advised they had received payment and issued me my e-visa.

Hopefully they have sorted the ASP Net error and full mailbox problem

Anybody tried since Thursday?

Chris

[welo]

Chris,

thanks for your reply.

Did you actually use the e-Visa at the border already?

Availability of the site from my provider (TOT) is very unstable. Yesterday timeouts all along, this morning OK, now unstable again.

Well, the current ping statistics is pretty normal for my crappy TOT line...

 Pinging evisa.mfaic.gov.kh [202.79.204.118] with 32 bytes of data:

Ping statistics for 202.79.204.118:
Packets: Sent = 20, Received = 17, Lost = 3 (15% loss),
Approximate round trip times in milli-seconds:
Minimum = 293ms, Maximum = 331ms, Average = 306ms

welo

[britmaveric]

I used it last year when the proper people were administering it... these new people are rubbish. The website is more down then up.

[britmaveric]

Ok looks like their DNS is fked up... Need to use 202.79.204.118 before any page.

[cjwinks]

Hi Welo,

On way to border now in friends car so will let you know later today

Cheers

Chris

[welo]

Hi Welo,

On way to border now in friends car so will let you know later today

Cheers

Chris

Awesome! Good luck!

[cjwinks]

Used E-Visa successfully....

Manage to bypass alll the touts, approched the cambodian official direct (in the bit where you queue to enter cambodian side) and played dumb asking "Is Okay to leave and come back straight away?" 200 Bhat later and I was stamped and heading back to Thailand :>

Very good (well cheap compared with Bangkok) market on the Thail side btw.

Still unable to access www.mfaic.gov.kh from my Thai ISP. I'm TOT ADSL also

Cheers

Chris

[welo]

Used E-Visa successfully....

Manage to bypass alll the touts, approched the cambodian official direct (in the bit where you queue to enter cambodian side) and played dumb asking "Is Okay to leave and come back straight away?" 200 Bhat later and I was stamped and heading back to Thailand :>

Very good (well cheap compared with Bangkok) market on the Thail side btw.

Still unable to access www.mfaic.gov.kh from my Thai ISP. I'm TOT ADSL also

Cheers

Chris

So it was 200 Baht to get both entry and exit stamp without queuing, right? They usually want 300 I heard, never had to use the service though since the queue was never long.

Who actually checks the evisa and where? I guess you can skip the VisaOnArrival office completely and head to the immigration where you get your exit stamp? So in your case did anybody check the evisa on the computer? Well, just curious

welo

[cjwinks]

Yep Welo,

skipped the Visa on Arrival, touts tried to guide me into a left hand side office, I stood just out side office showed e-visa,offical directed me to Immigration

So walked to the immigration (right hand side), managed to loose the touts (by telling them I was meeting friend in Poipet for an hour). I only dealt direct with offical handing out arrival cards in the immigration office. I so I guess I didnt pay the middle man, hence 200 baht.

Passport and evisa print out disappeared for a few minutes while I sat in the Immigration, so not sure if ever got entred on computer system. But got passport back with two stamps and small e-visa stamp with hand written visa no.

Still got hounded by kids with umbrellas on the thai side.

Have you applied for e-visa yet?

Chris

[welo]

Chris,

no, didn't apply yet, wanted to make sure I will not get a fake one LOL, will do today. It's for a friend, who has a passport with only half a page left. I hope they can squeeze the eVisa stamp in somewhere. He will do the new passport after this border-run.

I am pretty sure they check the eVisa for validity.

Thanks for your update,

welo

Yep Welo,

skipped the Visa on Arrival, touts tried to guide me into a left hand side office, I stood just out side office showed e-visa,offical directed me to Immigration

So walked to the immigration (right hand side), managed to loose the touts (by telling them I was meeting friend in Poipet for an hour). I only dealt direct with offical handing out arrival cards in the immigration office. I so I guess I didnt pay the middle man, hence 200 baht.

Passport and evisa print out disappeared for a few minutes while I sat in the Immigration, so not sure if ever got entred on computer system. But got passport back with two stamps and small e-visa stamp with hand written visa no.

Still got hounded by kids with umbrellas on the thai side.

Have you applied for e-visa yet?

Chris

[welo]

Hi guys!

I am still not comfortable with the current state the evisa website is in.

If I try to access the website via the offical domain name I get timouts.

The website works when using the IP 202.79.204.118.

However, the website obviously has been compromised and is not safe to use!!!

The website contains code that tries to load Javascript from the domain http://8f8el3l.cn/, which is rated by Google as a malicious website that hosts malware and script exploits.

For non-technicians: this website is NOT SAFE and attacks users that visit that page. This applies to the website 8fel3l.cn as well as to the Cambodian eVisa website when accessed via 202.79.204.118. Most probably that also applies to the eVisa website when accessed by its offical domain name http://evisa.mfaic.gov.kh/e-visa/vindex.aspx. Be careful!

See the screenshot taken from Firefox 3.0.11. One can see the script tags pointing to the malicious website. Maybe one of the installed addons provide a security feature that prevents the code to work, hence it shows up on the page (or the attackers actually messed up and got something wrong).

This Google has to say about the domain http://8f8el3l.cn

What happened when Google visited this site?

Of the 22 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on2009-07-21, and the last time suspicious content was found on this site was on 2009-07-21. Malicious software includes 910 scripting exploit(s), 14 trojan(s), 1 exploit(s).

This site was hosted on 1 network(s) including

AS4134 (China Telecom backbone)

.

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, 8f8el3l.cn appeared to function as an intermediary for the infection of 43 site(s) including

che360.com.cn/

,

bhhospital.com/

,

wlcbnews.com/

.

Has this site hosted malware?

Yes, this site has hosted malicious software over the past 90 days. It infected 63 domain(s), including

bhhospital.com/

,

wlcbnews.com/

,

69169.cn/

.

Maybe TOT has blocked the website for security reasons. However, usually blocked websites redirect to a short information page, therefore I think the timeouts are due to the attackers messing around with the Cambodian server.

Can somebody please confirm my observations!

welo

[welo]

To Chris and others who have used the eVisa website recently. I would keep a good look at your upcoming credit card statements. Your credit card credentials might have been stolen!

welo

[welo]

Btw just found the original Thaivisa news post from March 2009 on the Cambodian Government press release warning of three fraudulent visa websites.

http://www.thaivisa.com/forum/Websites-Bla...iv-t250656.html

[welo]

More updates:

The blog at www welovecambodia com states that the three websites described as fraudulent by the Cambodian Government are actually run by the former contractor that used to run the eVisa website during the first years after the company was kicked out of the contract by the Cambodian Government.

From jpatokal:

Re: the Xinhua story on sites being blacklisted for “fake visa

information”, two of them appear to be not fake sites at all, but sites

run by the original e-Visa operator who was kicked out under murkycircumstances and now whines about it all over the net: 1) www cambodiaevisa com 2) www welovecambodia com

From Jamamni: The so-called official website claimed by Ministry of

Foreign Affairs of Cambodia (www.mfaic.gov.kh & evisa.mfaic.gov.kh)

are obviously an ASP-coded version imitating the original PHP-coded

version of Cambodia e-Visa website, now hosted under www.cambodiaonarrival.com.

From a programmer point of view, this is a case of infringement where

government trying to kick out the original team and therefore an

injunction against TY Thong, Adrian Phang and Hong Pangharith was file in Malaysia

welovecambodia further claims that the official website now contains coding errors that make the website vulnerable. They are obviously interested in discrediting the official website - this regardless of whether their claims are true or not.

For me I still wonder who is to trust in this scenario. The story seems plausible, and whoever runs the website now has obviously severe problems offering a stable and relyable servie. However, that does not necessarily mean the three mentioned websites are NOT fraudulent - one might even imagine a scenario where somebody tries to hack the official website to put discredit it further (pure speculation though without any opinion from my side)

I hope the fix the website soon since I promised a friend to do the evisa for him since he doesn't have any full page left for is next visa run (3rd August)!!!

welo

[welo]

Applied for the eVisa this morning and just received the eVisa by email - 3hrs processing time is pretty good (and a lot faster than the 3 working days stated on the website).

The application process was pretty straight forward. The step of approving the credit card payment took more than 30 seconds during which one might be tempted to refresh the browser - which would not be a good idea since it might mess up the process and lead to re-submission which ultimately might have you charged the fee 2 times. So just be patient and wait for the page to reload.

Another minor glitch is that after the message stating the success of the billing process (which you are supposed to print for documentation purposes) the page refreshes automatically after 20 seconds and redirects to another page which however fails. So it seems that at the moment the final page of the process will be an error page. Nevertheless, in my case (and I guess in others too) this is AFTER the process has successfully finished, so don't worry.

From what I undertand you can restart the application process as many times as you want during the first 2 steps when you enter the application details (e.g. I did since I decided to upload a different picture), but do NOT re-submit the billing page where you enter your credit card details (the sole exception is if your payment was rejected because you missed to fill a field or something like that). If you submit this page twice you might be charged twice - I don't think the intention is to trick people, just that the system does not seem to be sophisticated enough to work around these cases. The last page before the e-billing page even contains a note that warns not to re-submit.

Be sure to copy/write down/print the page BEFORE you start the e-billing. This page contains a reference number that you can use to track the status of your application (http://www.mfaic.gov.kh/e-visa/status.aspx).

In case you accidentally resubmit you can also contact the support staff and have it sorted out - see Chris' post here.

The problem that the domain is not accessible for TOT users and one has to use the IP instead seems to be an issue with the TOT DNS servers - this is not limited to this page but occurs with other pages too (though from my experience not as regularly as with the evisa page). Whatever, change your DNS servers to openDNS, DNSadvantage or similiar and the problem is gone.

Conclusion: It seems the eVisa service works pretty smooth but with minor glitches and is also pretty fast. However, the recent attacks on the website (see my screenshots above) and the change from paypal to a new e-billing company do not actually boost my confidence concerning security. So I would not recommend the service unless you have good reasons not to use the Visa On Arrival office at the border (e.g. save one passport page).

welo

[Murf]

Before i read this thread i have already applied for a Cambo Visa online at;

http://www.cambodiaonarrival.com/start.php

The cost is $10... But then when you have bought the visa it says you have to pay an extra $20 at the border for a "stamping fee"

Is this correct?

I hope i haven't been ripped off, although it is only $10.

Also will i be able to pay in $ at the border or will they insist on baht at a ridiculous exchange rate?

Edited October 21, 2010 by Murf

[Murf]

Before i read this thread i have already applied for a Cambo Visa online at;

http://www.cambodiaonarrival.com/start.php

The cost is $10... But then when you have bought the visa it says you have to pay an extra $20 at the border for a "stamping fee"

Is this correct?

I hope i haven't been ripped off, although it is only $10.

Also will i be able to pay in $ at the border or will they insist on baht at a ridiculous exchange rate?

Anyone?

[britmaveric]

$25

This is the only official site.

http://www.mfaic.gov.kh/evisa/

Not sure where you got the $10 from or the $20 at the the border.

[pjbradley]

Before i read this thread i have already applied for a Cambo Visa online at;

http://www.cambodiao...l.com/start.php

The cost is $10... But then when you have bought the visa it says you have to pay an extra $20 at the border for a "stamping fee"

Is this correct?

I hope i haven't been ripped off, although it is only $10.

Also will i be able to pay in $ at the border or will they insist on baht at a ridiculous exchange rate?

If you read the beginning of this thread from last year, you'll note that the site you went to is a rip-off, issuing fake visas that aren't accepted at the border. I guess that's why the site says there's a "stamping fee," to obscure the fact that what you bought is worthless and you will have to pay the real fee at the border. Make sure to check your credit card for any suspicious charges. Good luck!