CoinLab (OP)
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 12, 2011, 06:49:56 PM |
|
I got this message today: From: < info@mtgox.com> Date: Mon, Dec 12, 2011 at 7:16 AM Subject: [Mt.Gox] Your account is currently pending review. To: xxxxxxxxxxxxxxx Dear Mt.Gox user, Your account is currently pending review, please visit https://mtgox.com/forms/verification<http://www.mlgox.tk/forms/verification> For those users who have had their accounts marked for review, an explanation of why were are implementing these security measures can be found here: Security Measures Explained<http://www.mlgox.tk/entries/20471711-security-measures-explained> When formatted as HTML, the MtGox URL displayed obscures a "MLGOX.TK" domain address. Which looks like the new MtGox design, but is actually phishing for your password. ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.imgur.com%2FxVYoT.png&t=665&c=b8lifRfYXmjVlA)
|
|
|
|
|
Mt.Gox Support
VIP
Sr. Member
Offline
Activity: 308
Merit: 250
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 13, 2011, 02:30:34 AM |
|
Hi folks
First of all NEVER hesitate to contact us by email or via the support whenever you come across something like this. While we are trying to be on top of these kinds of things we may miss some of them. Anyway we are now working on making sure that this domain will be deactivated ASAP.
Cheers
|
|
|
|
dark_st3alth
Newbie
Offline
Activity: 33
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 13, 2011, 03:41:23 AM |
|
Hi folks
First of all NEVER hesitate to contact us by email or via the support whenever you come across something like this. While we are trying to be on top of these kinds of things we may miss some of them. Anyway we are now working on making sure that this domain will be deactivated ASAP.
Cheers
Good to see you guys getting on top of it right away ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif) As for the email, I always make sure I see the text version. It would point these little tricks out. Additional Info: - The real website is " http://w5xhdezxlz.tmweb.ru/". - Uses a PHP POST request. - Redirects to the legitimate login site.
|
|
|
|
ineededausername
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 13, 2011, 04:02:52 AM |
|
mlgox.tk? lol... I bet they fooled nobody. Bitcoiners are too smart to be phished ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif)
|
(BFL)^2 < 0
|
|
|
Mt.Gox_Natalie
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 68
Merit: 10
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 13, 2011, 04:47:43 AM |
|
Thank you very much for the notice. We have posted it up at our Phishing Forum on our Support website.
|
|
|
|
mckoss
Newbie
Offline
Activity: 52
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 13, 2011, 06:36:43 AM |
|
mlgox.tk? lol... I bet they fooled nobody. Bitcoiners are too smart to be phished ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif) I was *close* to being fooled (bringing up the web site on a mobile phone, where my eyes have a hard time distinguishing the small text in the address bar).
|
|
|
|
runeks
Legendary
Offline
Activity: 980
Merit: 1008
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 18, 2011, 01:00:07 PM |
|
(Cross post from reddit): Hey everyone: please run this Python script for a while to spam this scammer with invalid user/pass combinations: import urllib2, random, string
while True: user = ''.join(random.choice(string.ascii_letters + string.digits) for x in range(random.randrange(4,20))) passw = ''.join(random.choice(string.ascii_letters + string.digits) for x in range(random.randrange(4,20))) test = urllib2.urlopen(urllib2.Request("http://mlgox.tk/login.php", "login="+user+"&password="+passw+"&LOGIN=Login")) test.read() I'm no HTTP expert but as far as I can tell this creates invalid login attempts at the fake site. Please post a revised edition if something is wrong here.
|
|
|
|
runeks
Legendary
Offline
Activity: 980
Merit: 1008
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 18, 2011, 02:19:17 PM |
|
Another, and perhaps better way, would be for Mt. Gox themselves to create some fake user/password combinations that only they know, and try to log in to this phishing site using these credentials - from a different IP for each login. Then at their servers, whenever someone logs in, look for these specific user/password combinations, and if a login is attempted with one of these combinations, add the IP from which it came to a black list.
The weakness with the above Python script is that it will be obvious that 1000 login attempts from the same IP are not genuine. And perhaps they can also filter out the user names and passwords based on their composition (ASCII and numbers).
|
|
|
|
Phinnaeus Gage
Legendary
Offline
Activity: 1918
Merit: 1570
Bitcoin: An Idea Worth Spending
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 18, 2011, 07:13:13 PM |
|
mlgox.tk? lol... I bet they fooled nobody. Bitcoiners are too smart to be phished ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif) I was *close* to being fooled (bringing up the web site on a mobile phone, where my eyes have a hard time distinguishing the small text in the address bar). Interesting! In a normal browser, one may easily recognize a phishing site, but less likely on a smart phone. I bet phishers are well aware of this fact and taking full advantage of it. Thanks, mckoss, for this revelation. ~Bruno~
|
|
|
|
|
|
ineededausername
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 18, 2011, 08:13:53 PM |
|
You know what's hilarious? The majority of phishers don't even know how to spoof an email address properly, so they send from emails like "grnail.com." This phisher is, ironically, one of the smarter ones. xD
|
(BFL)^2 < 0
|
|
|
Phinnaeus Gage
Legendary
Offline
Activity: 1918
Merit: 1570
Bitcoin: An Idea Worth Spending
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 18, 2011, 08:34:42 PM |
|
Thanks, btcinstant. I'm not a reddit reader, but your link offered me another source for keeping up in the Bitcoinshere.
|
|
|
|
btcinstant
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 18, 2011, 11:08:27 PM |
|
Thanks, btcinstant. I'm not a reddit reader, but your link offered me another source for keeping up in the Bitcoinshere. Not a problem Phinnaeus it's one of the better sources of information I read it daily enjoy!
|
|
|
|
|