[SECURITY] Malicious clone website at catch2.org impersonating official project

[vi-is-ramen]

Summary

I've discovered a live website at catch2.org that impersonates the Catch2 project. It is not a mirror or an old version — it is a malicious clone that attempts to redirect visitors to scam/adult sites and links to other fraudulent websites. I'm reporting it here so the maintainers are aware and can warn users if needed.

Details

• The official project is hosted at github.com/catchorg/Catch2 and (to my knowledge) does not have a standalone domain.
• The site at catch2.org looks like a legitimate project page, but:
  • Some buttons and links intermittently redirect to adult websites (e.g., x-hamster, bonga-cams). The redirects happen randomly, so the same button may work differently across visits — a common anti-detection trick.
  • The footer of catch2.org contains a link to lastactivityview.com, which is itself a scam clone of NirSoft’s LastActivityView utility. The genuine utility is at nirsoft.net. The fake site also performs the same kind of random redirects to adult content.
• Both domains appear to be part of the same scam network, cross-linking to boost perceived legitimacy.
• I visited these sites from a Linux machine, so no executable malware was involved — but the risk for Windows users who might download and run something from these pages is obvious.

Reproduction steps

1. Visit catch2.org (carefully — don't click anything without an adblocker / script blocker).
2. Observe the footer link titled "LastActivityView" pointing to lastactivityview.com.
3. Interact with links/buttons on either site. After a few attempts, you may be redirected to explicit adult content (I saw it happen in Firefox with no special extensions).

Why this matters

• Users searching for Catch2 tutorials or downloading the framework may land on this clone and be tricked into downloading malicious files or visiting harmful sites.
• The existence of a credible-looking phishing domain damages the project's reputation and can lead to support burden.

Suggested actions (for maintainers)

• If possible, send an abuse report to the domain registrar of catch2.org (and lastactivityview.com) for phishing/impersonation.
• Consider issuing a short warning in the README or project docs that catch2.org is not affiliated with the project.
• Optionally, reach out to Google Safe Browsing / Bing Webmaster Tools to flag the domain as deceptive.

Environment

• OS: Linux (no infection risk, I was simply researching)
• Browser: Firefox (latest stable)

Thank you for your time and for maintaining Catch2 — I hope this report helps protect the community.

Contact me:

• E-mail: vi.is.chapmann@gmail.com
• Telegram: t.me/viqxq

Screenshots of malicious sites:

[horenmar]

Yeah, I reported this to the registrar over a month ago, but nothing has ever happened.

[vi-is-ramen]

I reported this to the registrar too, bot also to their ISP. second one said "we'll do all what we can" and vanished ☹️

[stefanhendriks]

oof, so I got there and thought the site was hacked, even tried to send a form via javascript console. Probably never happened. I got redirected a few times when clicking anywhere :/