Thread: I am the stupid -I got phished

I got PWNED tonight big time. :evil:

Some clever MF sent me a link to a video

It looks like a you tube video

the message said "do you know about this?" and it had my main image for the screen shot of the supposed video.

this is what the offending code looked like:

do you know about this<br><br><a href="h t t p : / / www.bestsofunny.com"><img src="http://image.bestsofunny.com/bestsofunny1.jpg" width=453 height=20><br><img src="http://a575.ac-images.myspacecdn.com/images01/48/s_c32b80ecebe1b7b2f918b4ed9cf6a876.jpg" width=453 height=341><br><img src="http://image.bestsofunny.com/bestsofunny2.jpg" width=453 height=31></a>

I can't figure out how they did it!

Damn newbie you!

Repeat after me....
NEVER BUT NEVER OPEN ANY LINK IN ANY EMAIL FROM PEOPLE YOU DO NOT KNOW!
AND EVEN THEN, DON'T OPEN!

what is PWNED?

Let's break this down

Code:

<a href="h t t p : / / www.bestsofunny.com"><img src="http://image.bestsofunny.com/bestsofunny1.jpg " width=453 height=20>

This picture:


was linked to bestofbunny.com

Code:

<img src="http://a575.ac-images.myspacecdn.com/images01/48/s_c32b80ecebe1b7 b2f918b4ed9cf6a876.jpg" width=453 height=341><br><img src="http://image.bestsofunny.com/bestsofunny2.jpg " width=453 height=31></a>

These two images:





Weren't linked to anything. One image (presumably the one that looked like the video) is gone or doesn't allow eternal hotlinking.

It's social Engineering, the newest and most dangerous kind of spam.

Edit here is an example:




Looks like a youtube vid but it's linking to WTF. It's easy to trick people..

Half those images didn't work Dan. And how does Family Matter always end up in posts. LOL

*smacks Tim upside the head*
Whatsamaddawityou?

So anything bad happen, or you just went to their site?

Originally Posted by LaCabra

what is PWNED?

To school someone. To kick someone's ass.

Or in this case, to kick ass and get Tim to click on a link.

Originally Posted by iowadawg

Damn newbie you!

Repeat after me....
NEVER BUT NEVER OPEN ANY LINK IN ANY EMAIL FROM PEOPLE YOU DO NOT KNOW!
AND EVEN THEN, DON'T OPEN!

I feel the need, the need to click
stupid thing is, I've seen this before

Originally Posted by LaCabra

what is PWNED?

Urban Dictionary: pwned

Originally Posted by Big Dan

Let's break this down

Code:

<a href="h t t p : / / www.bestsofunny.com"><img src="http://image.bestsofunny.com/bestsofunny1.jpg " width=453 height=20>

This picture:


was linked to bestofbunny.com

Code:

<img src="http://a575.ac-images.myspacecdn.com/images01/48/s_c32b80ecebe1b7 b2f918b4ed9cf6a876.jpg" width=453 height=341><br><img src="http://image.bestsofunny.com/bestsofunny2.jpg " width=453 height=31></a>

These two images:





Weren't linked to anything. One image (presumably the one that looked like the video) is gone or doesn't allow eternal hotlinking.

It's social Engineering, the newest and most dangerous kind of spam.

Edit here is an example:




Looks like a youtube vid but it's linking to WTF. It's easy to trick people..

Hammertime, break it down!

I understand the ploy.

What I didn't get is how clicking on a link could harvest my account info on myspace?

Originally Posted by stefanie

Half those images didn't work Dan. And how does Family Matter always end up in posts. LOL

worked for me

Originally Posted by Zap

*smacks Tim upside the head*
Whatsamaddawityou?

sad thing is I've seen this ploy before mg:

Originally Posted by Grim

So anything bad happen, or you just went to their site?

as soon as I clicked on it, myspace redirected to my main page (like the UCP)...it said you've been phished, we caught it, and you need to change your password...

how can iot phish if I did not enter any info??

it's not like it was a fake login page for myspace or anything!!

Originally Posted by timsdd

as soon as I clicked on it, myspace redirected to my main page (like the UCP)...it said you've been phished, we caught it, and you need to change your password...

how can iot phish if I did not enter any info??

it's not like it was a fake login page for myspace or anything!!

Maybe they sniffed your cookie. :sick:

Originally Posted by timsdd

as soon as I clicked on it, myspace redirected to my main page (like the UCP)...it said you've been phished, we caught it, and you need to change your password...

how can iot phish if I did not enter any info??

it's not like it was a fake login page for myspace or anything!!

IDK unless somehow with framing, cookies, script or something he was able to log your details

Yes, if you notice the image that isn't showing up anymore was a myspace image site

Code:

http://a575.ac-images.myspacecdn.com/images01/48/s_c32b80ecebe1b7 b2f918b4ed9cf6a876.jpg

That's how they got your cookie.. I don't know how they actually phished the cookie, would be cool to know just for the sake of knowing though.

Originally Posted by Big Dan

Yes, if you notice the image that isn't showing up anymore was a myspace image site

Code:

http://a575.ac-images.myspacecdn.com/images01/48/s_c32b80ecebe1b7 b2f918b4ed9cf6a876.jpg

That's how they got your cookie.. I don't know how they actually phished the cookie, would be cool to know just for the sake of knowing though.

hands off my cookie!!!!!!!!

Originally Posted by timsdd

hands off my cookie!!!!!!!!

Hey did it all for the cookie (errr.nookie) . So you can take that cookie and ....

Great drunken sing -a-long song

Originally Posted by Big Dan

Hey did it all for the cookie (errr.nookie) . So you can take that cookie and ....

Great drunken sing -a-long song

That it is

now how do I go about kicking them in the pecker region?

Registrant:
Domains by Proxy, Inc.

DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States

Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
Domain Name: BESTSOFUNNY.COM
Created on: 01-Aug-07
Expires on: 01-Aug-08
Last Updated on: 01-Aug-07

Administrative Contact:
Private, Registration BESTSOFUNNY.COM@domainsbyproxy.com
Domains by Proxy, Inc.
DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States
(480) 624-2599 Fax -- (480) 624-2599

Technical Contact:
Private, Registration BESTSOFUNNY.COM@domainsbyproxy.com
Domains by Proxy, Inc.
DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States
(480) 624-2599 Fax -- (480) 624-2599

Domain servers in listed order:
NS51.DOMAINCONTROL.COM
NS52.DOMAINCONTROL.COM

Contact GoDaddy.. GD isn't very nice to scammers.

Let their web host know too.

Or is it their site, could the site be a third party they setup in the code to take the blame?

Originally Posted by Grim

Or is it their site, could the site be a third party they setup in the code to take the blame?

the plot thickens mg:


theoretically speaking or typing, myspace should look into it since I reported it

Originally Posted by timsdd

theoretically speaking or typing, myspace should look into it since I reported it

Yes they should

Originally Posted by Grim

Yes they should

here's a first...a same day (within 3 hours yet) email reply and it even looks like it relates to my issue!!

Hello,

Thank you for reporting this instance of abuse. You have received a form
of "spam" that is tricking users to visit a site unaffiliated with
MySpace. We are actively investigating this issue and taking proactive
measures to block and remove the spam.

While we work to correct this, if your account has received or sent out
any of these messages or you have used your MySpace login and password
to visit any site other than MySpace.com, please change your MySpace
password.

Thank you,

MySpace.com

1051

It's probably a mass email that they send out.

Originally Posted by stefanie

It's probably a mass email that they send out.

MTL, I still feel like a gooberspank though!

PM me your email address.

I will then forward all the paypal, ebay, banks, lotteries and so forth emails that I receive so that you can click on the links and be happy.

Originally Posted by iowadawg

PM me your email address.

I will then forward all the paypal, ebay, banks, lotteries and so forth emails that I receive so that you can click on the links and be happy.

so basically the electronic equivalent of putting my anal cavity square into a fire ant mound??

guess I'll pass...THIS time

Originally Posted by timsdd

so basically the electronic equivalent of putting my anal cavity square into a fire ant mound??

guess I'll pass...THIS time

you might like it Tim

Hahahahhaaha...
He might have done it one time and enjoyed the after-effects.

Besides, you can never tell.
Just one of those lottery winner emails MIGHT be .002% true.

Originally Posted by stefanie

you might like it Tim

no! I'm a baby, hate the pain!

Originally Posted by Zap

Let their web host know too.

Originally Posted by Grim

Or is it their site, could the site be a third party they setup in the code to take the blame?

In either case, I'm sure their web host will want to know about it.

Scottsdale, Arizona

I'm really good at jumping to conclusions, Tim, but we do have a mutual pain in the neck that is from Scottsdale, Arizona...

Originally Posted by fantasy

I'm really good at jumping to conclusions, Tim, but we do have a mutual pain in the neck that is from Scottsdale, Arizona...

ya think???? that would be the last straw!!

I swear I have seen that domain somewhere before...

Originally Posted by fantasy

I swear I have seen that domain somewhere before...

put on your detective things

The latest type phishing emails, or they just load a site or emails with trojans, are this type I have noticed.
Simple email that says your information has been received and before your newsletter subscription can begin, please click this link.
So know if you join a newsletter subscription!
Easy check is to see who the email is sent to and/or for.
If it does not have your email and name, more than likely it is a phishing email.

The other type looks innocent.
Again, simple email saying that you get a free gift for stopping by their site and signing up for their newsletter.
There is an attachment and probably a nice trojan if you are dumb enough to open.

ANd the spammers and scammers are getting a bit smarter.
They no longer put live links in the emails.
Instead they tell you to copy and paste, or just go to this site.
Anything to bypass filters.

Originally Posted by timsdd

put on your detective things

How did you know about this.... mg:

I searched and came up with nothing... Ya suppose there might be more than one idiot in Scottsdale, Arizona??

Well, one of my sisters lives there, so I would have to say YES!
Hahahahahhaha...you would have to know her.

Originally Posted by Big Dan

Let's break this down

Code:

<a href="h t t p : / / www.bestsofunny.com"><img src="http://image.bestsofunny.com/bestsofunny1.jpg " width=453 height=20>

This picture:


was linked to bestofbunny.com

Code:

<img src="http://a575.ac-images.myspacecdn.com/images01/48/s_c32b80ecebe1b7 b2f918b4ed9cf6a876.jpg" width=453 height=341><br><img src="http://image.bestsofunny.com/bestsofunny2.jpg " width=453 height=31></a>

These two images:





Weren't linked to anything. One image (presumably the one that looked like the video) is gone or doesn't allow eternal hotlinking.

It's social Engineering, the newest and most dangerous kind of spam.

Edit here is an example:




Looks like a youtube vid but it's linking to WTF. It's easy to trick people..

LOL! You sure fooled me Big Dan I actually clicked because i thought it was a video :P Didn't read the whole thread before

So then what happened? Anything bad?

Originally Posted by JaneM

So then what happened? Anything bad?

myspace amazingly has measure in place now that recognized the phish and it told me that I must change my password asap.

but nothing happened in this case other than feeling like a ...............nOOb