|
Title: Warning about possible phishing from wimberleyelectrians.com Post by: Syoleen on November 18, 2015, 06:01:42 PM Today I received an email pretending to be from localbitcoins.com, saying a support ticket raise for me to action.
I clicked the ticket URL , which actually links to wimberleyelectricians.com but with localbitcoins.com logo. That page asked me localbitcoins username, password and even PIN number, Email verification code and 2FA code! And then some one logged in my localbitcoins.com account from a Canada IP ( I live in Australia)! 11/19/2015 04:36 Successfully logged in 199.19.94.193 Title: Re: Warning about possible phishing from wimberleyelectrians.com Post by: MomoCoin on November 18, 2015, 06:11:48 PM So when did you actually realise the domain name was different...
Title: Re: Warning about possible phishing from wimberleyelectrians.com Post by: Syoleen on November 18, 2015, 07:08:03 PM So when did you actually realise the domain name was different... After the real LocalBitcoins sent me login warning from unknown IP. Then I check the URL of my Safari browser. I then knew I'm on an different website. Especially when I pressed the Wallet button on the fake website. It showed the electrician service info. Login attempt details ---------------------- IP address: 199.19.94.193 Country: (Unknown country) Web browser: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0 Title: Re: Warning about possible phishing from wimberleyelectrians.com Post by: Syoleen on November 18, 2015, 08:12:19 PM Here is the details (from his website) of the guy tring to do phishing!
AJA Electrical ServicePersonal Attention and Professional Service Call Us Today! 512-557-5605 Serving Wimberley, TX Title: Re: Warning about possible phishing from wimberleyelectrians.com Post by: xetsr on November 18, 2015, 08:35:58 PM Here is the details (from his website) of the guy tring to do phishing! AJA Electrical ServicePersonal Attention and Professional Service Call Us Today! 512-557-5605 Serving Wimberley, TX Site was probably hacked. Hackers usually hack these sites (older wordpress, bad plugins, etc) and add extra pages. Can you link directly to the phishing page? Title: Re: Warning about possible phishing from wimberleyelectrians.com Post by: Syoleen on November 18, 2015, 09:31:32 PM Site was probably hacked. Hackers usually hack these sites (older wordpress, bad plugins, etc) and add extra pages. Can you link directly to the phishing page? Here is the URL in my email: http://wimberleyelectricians.com/done/lc.php It WAS pretending to be localbitcoins. I keep the screenshot. But now it's back to normal. You are probably right about being hacked. |