Warning about possible phishing from wimberleyelectrians.com

[Syoleen]

Today I received an email pretending to be from localbitcoins.com, saying a support ticket raise for me to action.

I clicked the ticket URL , which actually links to wimberleyelectricians.com but with localbitcoins.com logo. That page asked me localbitcoins username, password and even PIN number, Email verification code and 2FA code!


And then some one logged in my localbitcoins.com account from a Canada IP ( I live in Australia)!


11/19/2015 04:36   Successfully logged in   199.19.94.193

[1715588744]

1715588744

[1715588744]

1715588744

[1715588744]

1715588744

[1715588744]

1715588744

[MomoCoin]

So when did you actually realise the domain name was different...

[Syoleen]

So when did you actually realise the domain name was different...

After the real LocalBitcoins sent me login warning from unknown IP. Then I check the URL of my Safari browser. I then knew I'm on an different website. Especially when I pressed the Wallet button on the fake website. It showed the electrician service info.

Login attempt details
----------------------

IP address: 199.19.94.193
Country: (Unknown country)
Web browser: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0

[Syoleen]

Here is the details (from his website) of the guy tring to do phishing!


AJA Electrical ServicePersonal Attention and Professional Service
Call Us Today! 512-557-5605
Serving Wimberley, TX

[xetsr]

Here is the details (from his website) of the guy tring to do phishing!


AJA Electrical ServicePersonal Attention and Professional Service
Call Us Today! 512-557-5605
Serving Wimberley, TX

Site was probably hacked. Hackers usually hack these sites (older wordpress, bad plugins, etc) and add extra pages. Can you link directly to the phishing page?

[Syoleen]

Site was probably hacked. Hackers usually hack these sites (older wordpress, bad plugins, etc) and add extra pages. Can you link directly to the phishing page?

Here is the URL in my email:
 http://wimberleyelectricians.com/done/lc.php
 It WAS pretending to be localbitcoins. I keep the screenshot. But now it's back to normal.
You are probably right about being hacked.