Beware new MtGox phishing scam - MLGOX.TK

btcinstant

full member

Activity: 180

Merit: 100

Quote from: Phinnaeus Gage on December 18, 2011, 04:34:42 PM

Quote from: btcinstant on December 18, 2011, 03:20:39 PM

looks like this guys if falling for it Huh

http://www.reddit.com/r/Bitcoin/comments/ngnkv/mtgox_has_allowed_me_to_become_a_verified_user/

Thanks, btcinstant. I'm not a reddit reader, but your link offered me another source for keeping up in the Bitcoinshere.

Not a problem Phinnaeus it's one of the better sources of information I read it daily enjoy!

Phinnaeus Gage

legendary

Activity: 1918

Merit: 1570

Bitcoin: An Idea Worth Spending

Quote from: btcinstant on December 18, 2011, 03:20:39 PM

looks like this guys if falling for it Huh

http://www.reddit.com/r/Bitcoin/comments/ngnkv/mtgox_has_allowed_me_to_become_a_verified_user/

Thanks, btcinstant. I'm not a reddit reader, but your link offered me another source for keeping up in the Bitcoinshere.

ineededausername

hero member

Activity: 784

Merit: 1000

bitcoin hundred-aire

You know what's hilarious? The majority of phishers don't even know how to spoof an email address properly, so they send from emails like "grnail.com." This phisher is, ironically, one of the smarter ones. xD

phatsphere

hero member

Activity: 763

Merit: 500

here is a way to report phishing to google (which might end up in warning you about this in ff+chrome)
http://www.google.com/safebrowsing/report_phish/?hl=en

btcinstant

full member

Activity: 180

Merit: 100

looks like this guys if falling for it Huh

http://www.reddit.com/r/Bitcoin/comments/ngnkv/mtgox_has_allowed_me_to_become_a_verified_user/

Phinnaeus Gage

legendary

Activity: 1918

Merit: 1570

Bitcoin: An Idea Worth Spending

Quote from: mckoss on December 13, 2011, 02:36:43 AM

Quote from: ineededausername on December 13, 2011, 12:02:52 AM

mlgox.tk? lol... I bet they fooled nobody. Bitcoiners are too smart to be phished

I was *close* to being fooled (bringing up the web site on a mobile phone, where my eyes have a hard time distinguishing the small text in the address bar).

Interesting! In a normal browser, one may easily recognize a phishing site, but less likely on a smart phone. I bet phishers are well aware of this fact and taking full advantage of it. Thanks, mckoss, for this revelation.

~Bruno~

runeks

legendary

Activity: 980

Merit: 1008

Another, and perhaps better way, would be for Mt. Gox themselves to create some fake user/password combinations that only they know, and try to log in to this phishing site using these credentials - from a different IP for each login.
Then at their servers, whenever someone logs in, look for these specific user/password combinations, and if a login is attempted with one of these combinations, add the IP from which it came to a black list.

The weakness with the above Python script is that it will be obvious that 1000 login attempts from the same IP are not genuine. And perhaps they can also filter out the user names and passwords based on their composition (ASCII and numbers).

runeks

legendary

Activity: 980

Merit: 1008

(Cross post from reddit):

Hey everyone: please run this Python script for a while to spam this scammer with invalid user/pass combinations:

Code:

import urllib2, random, string

while True:
user = ''.join(random.choice(string.ascii_letters + string.digits) for x in range(random.randrange(4,20)))
passw = ''.join(random.choice(string.ascii_letters + string.digits) for x in range(random.randrange(4,20)))
test = urllib2.urlopen(urllib2.Request("http://mlgox.tk/login.php", "login="+user+"&password="+passw+"&LOGIN=Login"))
test.read()

I'm no HTTP expert but as far as I can tell this creates invalid login attempts at the fake site. Please post a revised edition if something is wrong here.

mckoss

newbie

Activity: 52

Merit: 0

Quote from: ineededausername on December 13, 2011, 12:02:52 AM

mlgox.tk? lol... I bet they fooled nobody. Bitcoiners are too smart to be phished

I was *close* to being fooled (bringing up the web site on a mobile phone, where my eyes have a hard time distinguishing the small text in the address bar).

Mt.Gox_Natalie

member

Activity: 68

Merit: 10

Thank you very much for the notice. We have posted it up at our Phishing Forum on our Support website.

ineededausername

hero member

Activity: 784

Merit: 1000

bitcoin hundred-aire

mlgox.tk? lol... I bet they fooled nobody. Bitcoiners are too smart to be phished

dark_st3alth

newbie

Activity: 33

Merit: 0

Quote from: Mt.Gox Support on December 12, 2011, 10:30:34 PM

Hi folks

First of all NEVER hesitate to contact us by email or via the support whenever you come across something like this. While we are trying to be on top of these kinds of things we may miss some of them. Anyway we are now working on making sure that this domain will be deactivated ASAP.

Cheers

Good to see you guys getting on top of it right away

As for the email, I always make sure I see the text version. It would point these little tricks out.

Additional Info:

- The real website is "http://w5xhdezxlz.tmweb.ru/".

- Uses a PHP POST request.

- Redirects to the legitimate login site.

Mt.Gox Support

vip

Activity: 308

Merit: 250

Hi folks

First of all NEVER hesitate to contact us by email or via the support whenever you come across something like this. While we are trying to be on top of these kinds of things we may miss some of them. Anyway we are now working on making sure that this domain will be deactivated ASAP.

Cheers

Andrew Bitcoiner

sr. member

Activity: 396

Merit: 250

Send correspondance to GPG key A372E7C6

Sneaky.

CoinLab

sr. member

Activity: 270

Merit: 250

1CoinLabF5Avpp5kor41ngn7prTFMMHFVc

I got this message today:

Quote

From: <[email protected]>
Date: Mon, Dec 12, 2011 at 7:16 AM
Subject: [Mt.Gox] Your account is currently pending review.
To: xxxxxxxxxxxxxxx

Dear Mt.Gox user,

Your account is currently pending review, please visit
https://mtgox.com/forms/verification
For those users who have had their accounts marked for review, an
explanation of why were are implementing these security measures can be
found here:

Security Measures
Explained

When formatted as HTML, the MtGox URL displayed obscures a "MLGOX.TK" domain address. Which looks like the new MtGox design, but is actually phishing for your password.

Topic: Beware new MtGox phishing scam - MLGOX.TK (Read 2212 times)