Jianjun’s Blog

Apr 30 2008

Phishing Sites Exploit MSN Messenger Users

74 responses so far

74 Responses to “Phishing Sites Exploit MSN Messenger Users”

1. # Leaon 03 May 2008 at 5:16 am

   Hi! I have the same problem, I was stupid and logged in…can this be fixed by changing the .NET password, or is there any other way to fix this?

   

   Jianjun reply on May 3rd, 2008 7:36 am:

   Hi Lea,

   You need to change your .NET password immediately. If this password is shared with other services. Immediately change all those passwords too.

   

   Zapnl reply on June 1st, 2008 6:13 pm:

   link i got from someone in the USA, new mexico:
   username.bl1ng.info
   (I’m in the Netherlands, btw, so it has spread far, i guess)

2. # Randyon 03 May 2008 at 12:18 pm

   It’s awful! Lately I visited my closed friend’s blog & want to leave a short comment. Guess what? There got a new comment within a links. I clicked it with no doubt. It came out some kind of Hack program the “online visitor” get high. Just a second from 2 up to 20. I close the file immediately. Later I told my friend ask to del that comment. Thanks God there were no harm cause by that.

   

   Jianjun reply on May 3rd, 2008 12:30 pm:

   Randy,

   If your friend runs WordPress, tell him/her to enable moderation and install a plug-in called Akismet, which is a SPAM comment filter. Besides this, disabling the Ping function may also help.

   I check every URL in each comment on my post. If in doubt, I simply delete the comment or the URL.

   I guess this will help ensure more security for my readers and myself.

   BTW, I just added 輪遞的空間 to my links.

   Jianjun

   

   Randy reply on May 3rd, 2008 7:08 pm:

   Thanks I got it. Thanks again for your links.

3. # Don 13 May 2008 at 12:22 am

   Thank you for the info. I got very close to being infected myself. My friend sent me this link

   “usernamehere.found.some.c0o0ol5tuff.info ” (Don’t click guys, seriously)

   Being suspicious, i tried to look it up but accidentally clicked it. I managed to push the back button before anything could load and luckily nothing happened. I was worried that it was a virus, and if anything happens, I’ll be on the lookout.

   Thanks again.

4. # useron 15 May 2008 at 2:33 am

   Some more dangerous URLs:

   adp0int.info
   real.awesome-stuff.info
   cache2.imagehosters.info

5. # A friend got phishedon 15 May 2008 at 3:34 pm

   Other URL’s I got from a friend:
   h0st3d.on.prof1lepix.info
   save.p1ctures.info
   adp0int.info

   All of these were sent prefixed with the user’s msn name.

   Obviously, you’d want to block the top-level domains “prof1lepix.info”, “p1ctures.info” etc.

6. # tmon 16 May 2008 at 12:34 am

   One more MSN phishing URL:
   username.get.n1ce4ds.info

   Thanks for a good article.

7. # tmon 16 May 2008 at 1:13 am

   Don’t click the following link which appears one Google 1º result page, searching “TST Management, Inc.”
   Clicking on it, it asks my firewall to accept opening some .exe file:

   “MSN E-Mail ] [ MSN Password ] – By logging in you accept the Terms …
   Terms of Use / Privacy Policy: By filling out this form, you authorize TST Management, Inc to spread the word about this 100% real and upcomming Messenger …
   arm18618.this.are.the.fri3ndp1x.info/ – 6k – Cached – Similar pages”

8. # Mitchelon 16 May 2008 at 7:04 pm

   I just got this one:

   username.likes.ch33se.info

9. # Jemimuson 18 May 2008 at 11:46 pm

   I got this one:

   jemimus.was.d1ssed.info/

10. # Marchon 19 May 2008 at 11:32 pm

    one of my contacts got this from me

    tescarim@ch3k3r.info

11. # aliciaon 20 May 2008 at 1:56 am

    and this one : username.ch3ck3r.info

12. # marianaon 20 May 2008 at 3:11 am

    jianjun thanks for the information!
    i got this virus to, so what we can do? I already change my password, so my friends gonna stop to receive the link?
    can make disaster in ours computers?
    I got this two
    username.pr0filepix.info (dont open!!!)
    and
    username.the.great-th1ng.info (dont open)
    again thanks

13. # Karenon 20 May 2008 at 5:12 am

    I have gotten the virus or trojan from MSN instant messanger , does any one know how to get rid of this ? I have changed my pass words to all my accounts but is there some thing else I can do ?

14. # Ericon 23 May 2008 at 1:00 am

    Hi Jianjun,

    another domain is called:
    username.partyp1x.info

    Received an im right a few seconds ago.

    Thx and best wishes,
    Eric

15. # 80w3r81rdon 23 May 2008 at 5:51 am

    jianjun thanks for the information!
    my wife got this.
    her messenger sent it to me and i instantly knew what it was.
    my wife is falling for im worms alot.

    here is another one.

    username.1ik5.info

    an interesting thing here.
    one of the pages it sent to her to open was a page to put in her phone number.
    she did and now all her pre-paid credit is gone, it keeps spamming her phone with premium sms charges.

16. # lion406on 23 May 2008 at 11:43 pm

    thx @jianjun….I got this like @eric write…with party1…etc.

    And also I was login in….I am stupid…

    My friend send me your link and I read what you write….THANK YOU again !!!…

    I change pass for MSN….but I don`t have PayPal or any kind of account with money…

    If I see another link I will write here….

    Rgd !!!

17. # Kksqueenon 24 May 2008 at 1:15 am

    Thanks Jianjun,
    I’m french so forgive me for my spelling mistake please.
    I’ve been infected yesterday by the link: username.partyp1x.info (dont try it !!)
    I’ve immediately changed my different passwords.
    But today I realized that I lost 10 Go of music in my documents..I would like to know if the virus is responsable of that? I guess it’s impossible to have the music again isn’t it?
    I gonna install Bitdefender to eliminate this virus, does it the best antivirus?
    Thanks.

18. # Nathaniel Dooron 24 May 2008 at 8:51 am

    Here’s another one:
    username.awes0me.info

    It’s also registered with TST Management. The same person also.

    She also sent me one at:
    username.found.some.c0o0ol5tuff.info

    Which was mentioned by someone else above, but doesn’t seem to have been added to your list.

    Thanks for the info! I had her do a virus scan, but it sounds like that wouldn’t have helped. She’s changing her password.

19. # Jianjunon 24 May 2008 at 9:58 am
    Help your friend by telling them about this. 

    

    
20. # Jianjunon 24 May 2008 at 10:00 am

    People will appreciate it if you could post any further information about this phishing attempt – any new domains they used or other tricks they employed. Please just leave a comment here and I’ll continue to update the post.

    Thank you.
    Jianjun

21. # Marchon 25 May 2008 at 1:06 am

    hey, I got phished as well as i told a few days ago.
    I changed msn password and no other one cause all the others are different. anyway, today one of my friend told me again that he received this message from me. what else could i change or can i do? i don’t want to quit this account cause i dont want to create another

    

    Jianjun reply on May 25th, 2008 6:47 am:

    If you changed password, the phishing site can’t access your MSN account.

    Maybe your friend received a delayed offline message from several days ago when the phishing site sent it out.

    So there’s no need to worry. Make sure your new password is strong enough by adding *#$ and numbers.

    

    Eric reply on May 25th, 2008 5:14 pm:

    Just a tiny addition for all of you how to select a strong, easy to remember, effective and secure password (even for so called “brute-force-attacks”):

    1) Look out for a sentence you like most (a sentence or a title of a poem, film- or music-title etc.) – let’s say, you use:
    “Indiana Jones and the Kingdom of the Crystal Skull”

    2) Now use the first (or last) letter of each word: “IJatKotCS” (in this case it’s the first letter).

    3) Select a special char like Jianjun wrote *#$_ and put it right behind the letters. Your password’s now e.g.: “IJatKotCS#”

    4) Finally you look for a number you like best – the number of DVDs you own, the age of your girl-/boy-friend, the age of your pet etc. – let’s say you use 34 and put this at the end of your password.

    Then you got your final password:
    IJatKotCS#34

    Believe me – this password will be hard to be cracked and you will always remember it, since only you know the meaning…

22. # Ericon 25 May 2008 at 4:56 pm

    Hi Jianjun – just wrote a blogentry to this item in German to ensure German readers to be aware of this – I even integrated the link to your post.

    Here’s my permalink:
    http://erichaas.spaces.live.com/blog/cns!20AE01BBC9DF0C0!1014.entry

    Would be great if you could add this to your trackbacks…?

    Thx and best wishes,
    Eric

23. # Ericon 25 May 2008 at 5:26 pm

    Fyi, a user let me know about a new domain:

    fileho5t.info

    Best wishes,
    Eric

24. # Ericon 25 May 2008 at 5:32 pm

    Sorry, Jianjun, for leaving these many comments but there’s another one:

    m33tpoint.info

    Maybe you put these in your list and delete my posts or combine them in one.

    Thx and best wishes,
    Eric

    

    Jianjun reply on May 25th, 2008 7:31 pm:

    Hi Eric,

    Thanks for the feedback and that password tip. I believe visitors will find it rather useful. Your translation of this post into German certainly will help more people who don’t read English. I appreciate the effort!!

    I disabled trackbacks outside my own domain to prevent some automated spam. There are so many of them these days.

    Have a nice weekend!
    Jianjun

25. # Blackholeon 25 May 2008 at 6:29 pm

    First, thanks for all those useful informations about this phishing virus, and i’ll add one domain to this list;

    checkdiz.info

    Best regards,

    B.

26. # Nicoleon 26 May 2008 at 4:14 pm

    Hi there
    i got same case with you guys(also my close fd)
    however, when i click on the site, it juz doesn’t work
    juz couldn’t open it, (for serval times she sent me the link and i couldn’t open it, so i ask my fds, if you wanna bulid up a site, i can help you, coz i know her doesn’t have any idea how to bulid it up)

    i didn’t login at all, not like Jianjun
    so, am i infected as well?

    but i found out someone login to my a/c recently

    

    Jianjun reply on May 26th, 2008 4:22 pm:

    Nicole

    If your account was logged in by other people, you should change password anyway, although it was probably not by this particular phishing site.

    

    Nicole reply on May 26th, 2008 5:38 pm:

    Hi, Jianjun

    I juz wondering who did this stupid thing,
    (i was thinking would this is issue were generated by some programmes, but today i found it shouldn’t be a programme issue, so, =]..

    I just wanna make sure whether is programme or my other fds did it

    but anyways, Thanks for your advise =]

27. # davidon 31 May 2008 at 1:12 am

    Hi!
    Just I got this:
    julieplout.t0nez.info
    from a friend I’ve to Tagged… It just need to be idiot to type its login and passwords on such a page!

28. # brarton 31 May 2008 at 1:57 am

    username.t0nez.info

29. # HUEYon 31 May 2008 at 2:54 am

    my sister got this:
    username.t0nez.info

    and then will be redirect to:
    snapsh0t.info/indexxx.php

30. # Ericon 31 May 2008 at 3:25 am

    Hi Jianjun,

    again a new domain:

    - t0nez.info

    Have a nice weekend and best wishes,
    Eric

    BTW…thx a lot for mentioning my blog in your update

31. # Ag3nton 31 May 2008 at 11:02 pm

    Hy, I’ve found another…

    username.ther1ng.info

32. # Alistairon 01 Jun 2008 at 2:30 am

    A friend told me i’ve been sending out this:

    Party Pics.. http://username.ther1ng.info

    I remember getting sent it a while ago and clicking on it and nothing happening. I have NEVER inputed my user/password on any site, i would never do anything like that. Perhaps now simply visiting those sites is enough for them to phish you? Seems strange. Anyway, have now changed the password.

    Alistair

33. # Ericon 01 Jun 2008 at 4:18 am

    Hi Juanjin,

    a new variant of the phishing websites are coming up!!

    These are the new domains:

    - greatblockier.info
    - blockierteplatz.info

    I added a screenshot of the new variants of these phishing sites on my new blog-entry:
    http://erichaas.spaces.live.com/blog/cns!20AE01BBC9DF0C0!1022.entry

    Thx and best wishes,
    Eric

34. # Ericon 01 Jun 2008 at 4:20 am

    Additional information:
    The Phishers are still using the same way – via the Windows Live Messengers and several users informed me about this.

    Thx and best wiishes,
    Eric

35. # Zuidelon 01 Jun 2008 at 5:19 am

    Hi, i’ve got a message from a friend with the link ****.ther1ng.info

    after doing a whois I found out this domain is also owned by TST Management

    Zuidel

36. # Chrison 01 Jun 2008 at 6:10 am

    I have experienced the same thing with you. My closed friend sent me the link and I thought the same thing as you and did submitted my login & password for accessing. As I see few pics after login then I know something wrong and I close that window. Then I go back the login page and see the disclaimer (man, is phisher!!!). I search for help and find your site (thank goodness). I follow your instruction and change my MSN .Net password immediately with new strong password. I am also deleting the temporary internet files, history and cookies. Now I am running my AVG Anti-Virus software.

    However, I am still feeling uncomfortable on this. May I kindly ask you whether the phisher able to steal anything from notebook remotely? Whether he can gain access remotely to my notebook? Also if he will send similar spam link to my friend? I hope you can help me to answering all these questions with your kind reply. Thank you very much for your great help by providing a safer Internet environment. Keep it up the good work.

    

    Jianjun reply on June 1st, 2008 6:20 am:

    Hi Chris,

    If your passwords were changed, the phishing guys couldn’t get access to your MSN account. So they couldn’t send offline messages to anybody using your account.

    They *fear* that somebody will sue them, so they put up a Terms of Use like that to trick people. They ask you to give them the credentials *voluntarily* but if you changed those, they couldn’t access it anymore.

    No I don’t think they can access your notebook remotely in anyway. But running a virus scan and setting up a firewall proactively will always be useful.

    Good luck!

    

    Chris reply on June 1st, 2008 7:40 am:

    Hi Jianjun,

    Many thanks for your prompt reply and great help. I hope that is the case. Anyway I have told that friend to start performing virus check and changing her passwords as I believe she did not realize that she has been victim until now. Just wonder if there is way we can stop these people and drive them out of business. Again, many thanks.

    

    Jianjun reply on June 1st, 2008 8:23 am:

    Chris,

    This is something new on the Internet – a new form of phishing – they even display a Terms and Conditions which states they are not a phishing site. But they use your MSN friends’ usernames and passwords in the form of MSN offline messages making you believe they are from your friends. Why don’t they state clearly that these messages are sent by them and without even the notice of your friends? Isn’t this phishing?

    Sometimes these links contain your friend’s MSN username in the url, giving you the impression that it is a personal social network page. Has your friend created that particular personal page under that address? My friends told me they didn’t. Then it’s still phishing – faking the real site (your friends’ personal pages) to *trick* you into establishing a trust with the site.

    Their Terms and Conditions also has the following:

    “This agreement shall be construed and governed by the law of the republic of Panama. You expressly consent to the exclusive venue and personal jurisdiction of the courts located in the Republic of panama for any actions arising from or relating to this agreement.”

    And it’s unlikely they use the real company name, people’s names, phone numbers or addresses in their domain registration. However, I believe one day these people will be brought to justice.

37. # Sigloon 01 Jun 2008 at 6:54 am

    I am surprised that so many people enter there credentials. I hope they are not so reckless with bank accounts…

    Anyway, it’s funny to see that these guys left there server status page open:
    http://xxxx.ther1ng.info/server-status

    Pretty amazing how much load/connections/traffic this server has.

    

    Jianjun reply on June 1st, 2008 7:13 am:

    Siglo

    It’s interesting to see the server status of a phishing site. Is there a way to hack into it?

38. # Sigloon 01 Jun 2008 at 7:23 am

    The ssh port is open, if can can guess an account the server is yours

    No exploits found at the moment, the box is running linux, openssh 4.3 , vfstpd 2.0.5, lighthttpd 1.4.19

    Computer name : localhost-3.local.
    Ethernet addr : 00:02:2a:e0:72:d2 (nic vendor is Asound Electronic)

39. # bobon 01 Jun 2008 at 7:01 pm

    bl1ng.info also points to the phishing site…

40. # Sigloon 01 Jun 2008 at 7:30 pm

    bl1ng.info is also used now (you can see it on the status page)

41. # Snejkon 02 Jun 2008 at 11:03 pm

    I got almost hacked with it too, my girlfriend sent me a link on MSN with her username followed by bl1ng.info adress… she got hacked already.

    But those idiots missed one thing in what are they doing…

    Actually, EVERY of their sites has server status open. They will pay soon… Just let people know about their careless actions XD

42. # Mantorokon 03 Jun 2008 at 3:08 am

    I got some new ones

    youtube.glx.nl/watchv/=LJTwgF9BSYk-youtube.com

    myspace.6te.net/britneyspears

43. # Readeron 03 Jun 2008 at 3:52 am

    [Username].bl1ng.info
    [Username].t0nez.info

    Also another MSN virus/phishing

    “this looks alot like you photos.hollosite.com/viewimage.php?=[Mail]
    hey , it’s your image to see there believe yeah ? photos.hollosite.com/viewimage.php?=[Mail]

    (The mail, that is being attached is one’s/the receivers msn mail)

44. # Coreyon 03 Jun 2008 at 7:25 am

    username.b0unce.info is another one

45. # Ericon 03 Jun 2008 at 6:24 pm

    …and a new one:

    flatl1ne.info

    Best wishes,
    Eric

46. # Ericon 03 Jun 2008 at 6:41 pm

    Btw… some of the pages are changing their “outfit” (screenshot on my site) and are now selling ringtones fopr tremendous prices.

    I’m wondering why Funmobile.com (this is the service where the fishers are obviously affiliates) accepts these people…

    Best wishes,
    Eric

47. # Jonoon 03 Jun 2008 at 8:34 pm

    just got this from someone, it’s now on jumphost.info
    Apparently there was a subdomain, so it almost looks real: “messenger_username.jumphost.info”

    bleah.

48. # sLarson 04 Jun 2008 at 5:02 am

    I got this today, some of my brothers children got this viral stuff, or what you shall call it.
    The site is lingesbo.jumphost.info in my case.

    Got a scary scam also that wants you to enter your cell phone number. If you do, they send out a PIN code that you shall enter to
    get “ONE ring tone signal for free”. The page is addressing young people. In Sweden it is very common that young people have their bill payed by their parents.

    The scam is cunningly done, since IF you write the PIN, you agree that 7 USD shall be drawn on your bill EVERY WEEK! So they will scam you for 28 USD before you even see that the childrens bill has suddenly increased. And the parent yells at the child…sad.

    The company is Hong Kong registered. funmobile.com but they got sites for every country. Like se.funmobile.com.

    I did not enter the PIN code, I called the support number. And that guy there sent me a cancellation message. Two times. He got nervous. You could here that.

49. # Jianjunon 04 Jun 2008 at 8:41 am

    Hey friends,

    My database crashed because there were so many comments last night. Some of the comments were lost.

    It’s a pity that this happened but I think it’s advisable that I have to limit comment function. From now on, I suggest you use the video comment – you don’t need to show your face, just record your voice!!

    In reply to a Chinese visitor: 这不是病毒，而是钓鱼。未透露用户名和密码给他人就应该是安全的。不过经常查毒也是应该做的。

50. # Danteon 05 Jun 2008 at 6:01 am

    username.c0mpics.info/login.php#terms

    I got a question about this, is there an executable file inside the infected user’s pc? or if this infected users logs in any other computer starts sending this link?

    Thanks for your support

    

    Jianjun reply on June 5th, 2008 10:32 am:

    Actually the same question has been answered many times above. Currently only your password and username would be stolen if you entered them. Otherwise, you should be safe. But a regular virus scan is always recommended.

51. # junrenon 07 Jun 2008 at 12:51 pm

    i’ve got another 1: p1mped.info

    i was also silly enough to click the link and entered my account and password. after that, my msn auto log off as it state my msn was signed in from another location.

    i had only changed my password the next day, is it too late? is it QUARANTEED that after i change the password, my account and computer will be safe and there won’t be anymore sending of the link from my msn?

    i’ve read all of the comments above, i felt alot better but i still feel insecure. sorry for the trouble but i really need your help.

    thanks alot!

52. # Super Buson 10 Jun 2008 at 4:06 am

    I just got one too, 我最討厭這些可惡的 Message…

    g4ng.info

53. # Kilgoreon 10 Jun 2008 at 6:39 am

    g4ng.info for today.

54. # kalon 10 Jun 2008 at 7:01 am

    Hi

    Got another one from a friend tonight: username.b4ng.info

    I clicked on the link but when I saw the website I thought immediatly it was a crap phishing attempt.
    And I didn’t enter my login and password cause I’ll never do such a stupid thing!!

    I also put an alert on my MSN personnal message to prevent my other friends to click on weird links or enter their login/passwords anywhere.

    Sorry for my bad english

55. # aileenon 10 Jun 2008 at 10:43 am

    My husband clicked on the link he saw from his MSN buddy but did not enter his MSN user name nor password… now he is infected and is sending a phish link to me. Is this phish site getting stronger and can steal passwords without you actually keying it in?

    The domain is g4ng.info

56. # lion406on 11 Jun 2008 at 6:10 am

    today I get new link how can do it something wrong with you computer…(of course I don`t try it but somebody else try it )
    here is link imageshaack.org/img/Picture275.jpg?=mymailadress@hotmail.com

    If you can put this link in black list…

    Rgd !!!

57. # Williamon 11 Jun 2008 at 11:33 am

    been recieving various ones from my nephew for months, only thing is that he hasn’t had web access since last November.
    so the only way to solve this is to go and delete my msn account and sign up for a new one.

    and a question / comment. I keep seeing the word “infected”, however nothing that I have seen points to anything being infected with any kind of virus.

    once the Phishing site has your login info, it’s too late to change your password, your contact list is already captured, that will stop them from going back in and looking for new info, but that’s kind of lilke closing the barn door after the horse ran off. all you can really do is to e-mail everyone in your contact list and warn them about the issue, remember knowlage is power. pass it on…..

    the website url for this last one is: userxxxx.h0stp1cs.info

58. # Williamon 11 Jun 2008 at 12:02 pm

    I’ve been playing with that server site, (thanks for that by the way) using NeoTracePro, and have come up with some intersting stuff, most of what I’ve found points to a server in Hong Kong, (Sun Networks) and what appears to be some kind of commercial site, with links to u-tube(??) some of you that are good at this sort of thing should check this out if you have NeoTrace or another similar app….

59. # Radoon 12 Jun 2008 at 12:40 am

    FIRST OF ALL – I wanted to say THANK YOU, Jianjun.
    You are so kind, and big of a person to dedicate yourself for the sake of others. thank you.

    now, I wanted to say that my History is completley deleted from my messnger. i think it’s from the virus.

    and i was wondering, the is a question i didn’t see you answer to anyone, i hope you’ll have an answer for it now… the question is:
    “my account and computer will be safe and there won’t be anymore sending of the link from my msn?” & “is it enough to change my password?”

    and some others asked the same question… hope to hear from you.

60. # Snejkon 12 Jun 2008 at 1:06 am

    Hope someone will be able to track them down soon, I wonder if anyone could just simply kick their butt by hacking this thing…