notblox1 (OP)
Legendary
Offline
Activity: 2184
Merit: 1304
Logo Designer ⛨ BSFL Division1
|
![](https://bitcointalk.org/Themes/custom1/images/post/exclamation.gif) |
October 25, 2020, 06:07:37 PM Last edit: October 29, 2020, 09:59:32 AM by notblox1 Merited by DdmrDdmr (2), o_e_l_e_o (2) |
|
![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.imgur.com%2FXscPToL.png&t=665&c=I5QpWThQuutO9g) Please watch out for newest Ledger wallet phishing email from fake Ledger support, asking you to download and update. Fake email used: info@ledgersupport.ioreal ledger email: noreply@ledger.comThey probably used all emails they got from hack they had few months ago, and they sent them to everyone from their list. Don't download or install anything!They used website with letter ė with dot above: https://i.imgur.com/7bBrVE1.pnghttps://ledgėr.com/ https://www.xn--ledgr-9za.com/ Domain name: xn--ledgr-9za.com Registry Domain ID: 2567440131_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.namecheap.com Registrar URL: http://www.namecheap.comUpdated Date: 0001-01-01T00:00:00.00Z Creation Date: 2020-10-22T03:48:00.00Z Registrar Registration Expiration Date: 2021-10-22T03:48:00.00Z Registrar: NAMECHEAP INC Registrar IANA ID: 1068 Registrar Abuse Contact Email: email@namecheap.comRegistrar Abuse Contact Phone: +1.6613102107 Reseller: NAMECHEAP INC
|
|
|
|
jackg
Copper Member
Legendary
Offline
Activity: 2856
Merit: 3071
https://bit.ly/387FXHi lightning theory
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
October 25, 2020, 06:11:15 PM |
|
Ledger's website had its emails hacked? That doesn't sound very promising for what is essentially a cybersec firm...
It's disapointing I can't see. To use that email address to find anything related to the scam... (it's easy to just copy and paste when you get a suspicious email then).
|
|
|
|
notblox1 (OP)
Legendary
Offline
Activity: 2184
Merit: 1304
Logo Designer ⛨ BSFL Division1
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
October 25, 2020, 06:20:41 PM |
|
Ledger's website had its emails hacked? That doesn't sound very promising for what is essentially a cybersec firm...
It's disapointing I can't see. To use that email address to find anything related to the scam... (it's easy to just copy and paste when you get a suspicious email then).
Yes they had some July 2020 e-commerce and marketing data breach. I can't be sure this is related with latest phishing, but else is everyone getting this emails. Here is their explanation from July: https://www.ledger.com/addressing-the-july-2020-e-commerce-and-marketing-data-breach
|
|
|
|
DdmrDdmr
Legendary
Offline
Activity: 2436
Merit: 10989
There are lies, damned lies and statistics. MTwain
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
October 25, 2020, 06:28:31 PM Last edit: October 25, 2020, 07:08:47 PM by DdmrDdmr |
|
More than likely that the phishing campaigns is directly related to the data breach (perhaps not limited to). There’s a person on Reddit that claims he received it on an email that he created specifically for dealing with Ledger (purchase presumably: https://www.reddit.com/r/ledgerwallet/comments/jhrp95/is_this_mail_from_ledger_o_is_this_fishing/). As people are commenting over the internet, the emails is well redacted, and is one of those that are not trivial to spot looking at neither the domain nor the grammar. The claim has a feasibility ring to it in the context of the breach, although one needs to be always wary and never download anything from an email, but rather always visit the original site (and not from a link on the email, if present). I’m trying to find a report on the malware that get’s installed. My guess is that it could be some sort of RAT or a Ledger Live clone, but the latter should prove rather more difficult to elaborate and set into motion. Edit: There’s an entry on the above provided Reddit link that states: its freaking well done, u click on the link, it redirects u to the official ledger site, and at the same time automatically downloads of the scam ledger-live on the background --- newbies will fall for it, ledger should immediately send out an email
Ledger is being slow displaying information on their site about this specific phishing attempt, specially after their past data breach. The only thing I've found is this, and is generic and prior to this attemp (5 day old blog post): https://www.ledger.com/ongoing-phishing-campaignsEdit2: The fake Ledger Live may be asking you to change your pin, and (classic here), requiring your 24 mnemonic in order to do so (see https://peakd.com/ledger/@hatoto/your-ledger-wallet-may-be-compromised-ledger-phishing -> Google translate the last big paragraph). If I had clicked the link and downloaded the software, I would have downloaded a malicious software update for Live Ledger. If I had installed this, I would have been asked to change the PIN of my hardware ledger after the start. This is only possible by entering my 24 secret words. This would have given the hackers my 24 secret words with which they could have fed their own hardware ledger so that they would actually have access to my credit.
|
|
|
|
jackg
Copper Member
Legendary
Offline
Activity: 2856
Merit: 3071
https://bit.ly/387FXHi lightning theory
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
October 25, 2020, 07:02:01 PM |
|
Wow! They've had at least 1 million customers, thats surprising to me. And yeah I guess this could've been due to employees having to work from home or something too during the pandemic (and sometimes ecc is slow for certain operations).
|
|
|
|
Smartvirus
Legendary
Offline
Activity: 1554
Merit: 1139
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
October 25, 2020, 07:37:48 PM |
|
one needs to be always wary and never download anything from an email, but rather always visit the original site (and not from a link on the email, if present).
This is the part that gets most anxious users with a need to be quick in getting out of the lame light into trouble. It makes you elude all the critical steps to determining the authenticity of the email and link. Again, Ledger expresses a lot of uncertainty in the data breach they experienced lately as contained in this statement; ''On the 14th of July 2020, a researcher participating in our bounty program made us aware of a potential data breach on the Ledger website. We immediately fixed this breach after receiving the researcher’s report and underwent an internal investigation. A week after patching the breach, we discovered It had been further exploited on the 25th of June 2020, by an unauthorized third party who accessed our e-commerce and marketing database – used to send order confirmations and promotional emails – consisting mostly of email addresses, but with a subset including also contact and order details such as first and last name, postal address, email address and phone number." https://www.ledger.com/addressing-the-july-2020-e-commerce-and-marketing-data-breachIt's very possible that they are yet to be certain on other areas or length to which the breach was reached as it is by a bounty researcher that discovered an raised alarm of this on 14th June and again another was discovered on the 25th July. A complete swipe should be done on all aspect of their services not only the e-commerce section of not done already.
|
|
|
|
khaled0111
Legendary
Offline
Activity: 2646
Merit: 2995
Top Crypto Casino
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
October 25, 2020, 08:28:11 PM Last edit: October 25, 2020, 08:44:17 PM by khaled0111 |
|
There’s an entry on the above provided Reddit link that states: its freaking well done, u click on the link, it redirects u to the official ledger site, and at the same time automatically downloads of the scam ledger-live on the background --- newbies will fall for it, ledger should immediately send out an email
Is it possible to compromise the whole server through an API key? Either the attacker succeeded to inject some malicious codes into their databases or that user clicked on the fake link which redirects to a completely different server: Warning: phishing website!With ~1M leaked emails, certainly there will be many victims!
|
|
|
|
OcTradism
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
October 26, 2020, 03:00:39 AM |
|
It is a punnycode (homograph) phishing attack. Scammers use it to steal password, get access to accounts and withdraw funds. Punycode and how to protect yourself from Homograph Phishing attacks?If a person logs in account on a phishing site, their account will be compromised but if email and 2FA application are logged in and stored on a different device, fund in compromised account can not be withdraw. Hackers or phishers can not get access to email, and 2FA application then 2FA code for confirmation of suspicious IP address or to confirm withdrawals. Unfortunately many people store all eggs on a single device: exchange accounts (login, password), email (always login), 2FA application. If that device is compromised, they will lose money.
|
| | . .Duelbits. | │ | ..........UNLEASH.......... THE ULTIMATE GAMING EXPERIENCE | │ | DUELBITS FANTASY SPORTS | ████▄▄▄█████▄▄▄ ░▄████████████████▄ ▐██████████████████▄ ████████████████████ ████████████████████▌ █████████████████████ ████████████████▀▀▀ ███████████████▌ ███████████████▌ ████████████████ ████████████████ ████████████████ ████▀▀███████▀▀ | . ▬▬ VS ▬▬ | ████▄▄▄█████▄▄▄ ░▄████████████████▄ ▐██████████████████▄ ████████████████████ ████████████████████▌ █████████████████████ ███████████████████ ███████████████▌ ███████████████▌ ████████████████ ████████████████ ████████████████ ████▀▀███████▀▀ | /// PLAY FOR FREE /// WIN FOR REAL | │ | ..PLAY NOW.. | |
|
|
|
libert19
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
October 26, 2020, 03:35:52 AM |
|
This seems legit af, I wouldn't be surprised if someone fell for it.
|
| | . .Duelbits. | │ | ..........UNLEASH.......... THE ULTIMATE GAMING EXPERIENCE | │ | DUELBITS FANTASY SPORTS | ████▄▄▄█████▄▄▄ ░▄████████████████▄ ▐██████████████████▄ ████████████████████ ████████████████████▌ █████████████████████ ████████████████▀▀▀ ███████████████▌ ███████████████▌ ████████████████ ████████████████ ████████████████ ████▀▀███████▀▀ | . ▬▬ VS ▬▬ | ████▄▄▄█████▄▄▄ ░▄████████████████▄ ▐██████████████████▄ ████████████████████ ████████████████████▌ █████████████████████ ███████████████████ ███████████████▌ ███████████████▌ ████████████████ ████████████████ ████████████████ ████▀▀███████▀▀ | /// PLAY FOR FREE /// WIN FOR REAL | │ | ..PLAY NOW.. | |
|
|
|
Lycan70
Jr. Member
Offline
Activity: 63
Merit: 1
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
October 26, 2020, 07:50:50 AM |
|
I'm recieving many emails daily, my solution is deliting it without opening the suspescious emails. I once been a victim of phishing emails like this so I am fully aware of it.
|
|
|
|
|
notblox1 (OP)
Legendary
Offline
Activity: 2184
Merit: 1304
Logo Designer ⛨ BSFL Division1
|
![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.imgur.com%2Fv5PaJ5z.png&t=665&c=K2UUm9-xt8RSBA) ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.imgur.com%2Fgdtp98p.png&t=665&c=-amMgB2sgoH2NQ) People are now getting SMS messages telling them to go to phishing Ledger sites like Ledger(.)media or Ledger(.)report or Ledger(.)legal ! They probably have all customers phone numbers from ledger database hack that happened few months ago.
|
|
|
|
Pmalek
Legendary
Offline
Activity: 2884
Merit: 7439
Playgram - The Telegram Casino
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
October 29, 2020, 10:43:28 AM |
|
More than likely that the phishing campaigns is directly related to the data breach (perhaps not limited to). It sure is. I wrote about it in the hardware wallet section. My friend who received the parcel with my Ledger received the same type of email. The email got sent to him but they address me with my first name. I added my identity information when I filled out the purchase form. Another combination with my name and his email address doesn't exist. Ledger is being slow displaying information on their site about this specific phishing attempt, specially after their past data breach. The only thing I've found is this, and is generic and prior to this attemp (5 day old blog post): https://www.ledger.com/ongoing-phishing-campaignsThey are busy preparing for the BCH hard fork, so they don't have much time to handle such trivial things as the security of their users and their funds ![Sad](https://bitcointalk.org/Smileys/default/sad.gif) They made a series of security and phishing-related tweets. I guess that's the best we can get from them. https://twitter.com/Ledger/status/1320741436258766849
|
|
|
|
▄▄███████▄▄███████ ▄███████████████▄▄▄▄▄ ▄████████████████████▀░ ▄█████████████████████▄░ ▄█████████▀▀████████████▄ ██████████████▀▀█████████ █████████████████████████ ██████████████▄▄█████████ ▀█████████▄▄████████████▀ ▀█████████████████████▀░ ▀████████████████████▄░ ▀███████████████▀▀▀▀▀ ▀▀███████▀▀███████ | ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ Playgram.io ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ | ▄▄▄░░ ▀▄ █ █ █ █ █ █ █ ▄▀ ▀▀▀░░
| │ | ▄▄▄███████▄▄▄ ▄▄███████████████▄▄ ▄███████████████████▄ ▄██████████████▀▀█████▄ ▄██████████▀▀███▄██▐████▄ ██████▀▀████▄▄▀▀█████████ ████▄▄███▄██▀█████▐██████ ██████████▀██████████████ ▀███████▌▐██▄████▐██████▀ ▀███████▄▄███▄████████▀ ▀███████████████████▀ ▀▀███████████████▀▀ ▀▀▀███████▀▀▀ | | │ | ██████▄▄███████▄▄████████ ███▄███████████████▄░░▀█▀ ███████████░█████████░░█ ░█████▀██▄▄░▄▄██▀█████░█ █████▄░▄███▄███▄░▄██████ ████████████████████████ ████████████████████████ ██░▄▄▄░██░▄▄▄░██░▄▄▄░███ ██░░░█░██░░░█░██░░░█░████ ██░░█░░██░░█░░██░░█░░████ ██▄▄▄▄▄██▄▄▄▄▄██▄▄▄▄▄████ ███████████████████████ ███████████████████████ | | │ | ► | |
|
|
|
|
Mr.right85
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 09, 2020, 04:34:48 AM |
|
Even the various phone and laptop programmers have programmed these devices on default to allow downloads and installation from only safe sources such as Google play store but, in other to make maximum use of our so called xender, we go as far as changing the do not allow default settings to allowing installation from unknown sources. All these because, we hope to save ourselves the time of downloading and data too. While we forget that, this small negligence can cost us more in the future.
|
..Stake.com.. | | | ▄████████████████████████████████████▄ ██ ▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄ ██ ▄████▄ ██ ▀▀▀▀▀▀▀▀▀▀ ██████████ ▀▀▀▀▀▀▀▀▀▀ ██ ██████ ██ ██████████ ██ ██ ██████████ ██ ▀██▀ ██ ██ ██ ██████ ██ ██ ██ ██ ██ ██ ██████ ██ █████ ███ ██████ ██ ████▄ ██ ██ █████ ███ ████ ████ █████ ███ ████████ ██ ████ ████ ██████████ ████ ████ ████▀ ██ ██████████ ▄▄▄▄▄▄▄▄▄▄ ██████████ ██ ██ ▀▀▀▀▀▀▀▀▀▀ ██ ▀█████████▀ ▄████████████▄ ▀█████████▀ ▄▄▄▄▄▄▄▄▄▄▄▄███ ██ ██ ███▄▄▄▄▄▄▄▄▄▄▄▄ ██████████████████████████████████████████ | | | | | | ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄ █ ▄▀▄ █▀▀█▀▄▄ █ █▀█ █ ▐ ▐▌ █ ▄██▄ █ ▌ █ █ ▄██████▄ █ ▌ ▐▌ █ ██████████ █ ▐ █ █ ▐██████████▌ █ ▐ ▐▌ █ ▀▀██████▀▀ █ ▌ █ █ ▄▄▄██▄▄▄ █ ▌▐▌ █ █▐ █ █ █▐▐▌ █ █▐█ ▀▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▀█ | | | | | | ▄▄█████████▄▄ ▄██▀▀▀▀█████▀▀▀▀██▄ ▄█▀ ▐█▌ ▀█▄ ██ ▐█▌ ██ ████▄ ▄█████▄ ▄████ ████████▄███████████▄████████ ███▀ █████████████ ▀███ ██ ███████████ ██ ▀█▄ █████████ ▄█▀ ▀█▄ ▄██▀▀▀▀▀▀▀██▄ ▄▄▄█▀ ▀███████ ███████▀ ▀█████▄ ▄█████▀ ▀▀▀███▄▄▄███▀▀▀ | | | ..PLAY NOW.. |
|
|
|
OcTradism
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 09, 2020, 06:11:42 AM |
|
Even the various phone and laptop programmers have programmed these devices on default to allow downloads and installation from only safe sources such as Google play store
Google Play is not safe. They don't investigate applications too deep and careful before they accept listing applications on Google Play. It is less safe than Apple Store and on Google Play you will meet many fake applications. If you want to find apps or want to download any crypto apps, go to official sites and get links to download it on Apple Store or Google Play. Don't search with app stores or with Google search. Officially visit websites & download apps, not fake ones.
|
| | . .Duelbits. | │ | ..........UNLEASH.......... THE ULTIMATE GAMING EXPERIENCE | │ | DUELBITS FANTASY SPORTS | ████▄▄▄█████▄▄▄ ░▄████████████████▄ ▐██████████████████▄ ████████████████████ ████████████████████▌ █████████████████████ ████████████████▀▀▀ ███████████████▌ ███████████████▌ ████████████████ ████████████████ ████████████████ ████▀▀███████▀▀ | . ▬▬ VS ▬▬ | ████▄▄▄█████▄▄▄ ░▄████████████████▄ ▐██████████████████▄ ████████████████████ ████████████████████▌ █████████████████████ ███████████████████ ███████████████▌ ███████████████▌ ████████████████ ████████████████ ████████████████ ████▀▀███████▀▀ | /// PLAY FOR FREE /// WIN FOR REAL | │ | ..PLAY NOW.. | |
|
|
|
taufik123
Legendary
Offline
Activity: 2646
Merit: 1810
Rollbit.com | Crypto Futures
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 10, 2020, 12:21:33 AM |
|
Even the various phone and laptop programmers have programmed these devices on default to allow downloads and installation from only safe sources such as Google play store
Google Play is not safe. They don't investigate applications too deep and careful before they accept listing applications on Google Play. It is less safe than Apple Store and on Google Play you will meet many fake applications. If you want to find apps or want to download any crypto apps, go to official sites and get links to download it on Apple Store or Google Play. Don't search with app stores or with Google search. Officially visit websites & download apps, not fake ones.Google play store is not too safe and don't trust 100% with the applications in it. because there are several fake applications that have been successfully entered and downloaded by many users. The best and safest way is to download the application via the official website because there will be an embedded link and can be downloaded safely. but be careful of phishing websites and the like. About the posts described by the OP regarding Email Legder and SMS phishing can be avoided if you stay alert and pay attention to every email detail and embedded link. Email will usually go to the SPAM folder
|
R |
▀▀▀▀▀▀▀██████▄▄ ████████████████ ▀▀▀▀█████▀▀▀█████ ████████▌███▐████ ▄▄▄▄█████▄▄▄█████ ████████████████ ▄▄▄▄▄▄▄██████▀▀ | LLBIT | │ | CRYPTO FUTURES | | | | | | | │ | 1,000x LEVERAGE | │ | COMPETITIVE FEES | │ | INSTANT EXECUTION | │ | . TRADE NOW |
|
|
|
mixerbtc
Newbie
Offline
Activity: 14
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
November 10, 2020, 01:18:47 PM |
|
New users, keep this in mind! Never share your password with anyone, regardless of what they say. When accesing a site where you enter sensible data, don't click on hyperlinks. Navigate to it by yourself!
|
|
|
|
|