Author

Topic: Warning about possible phishing from wimberleyelectrians.com (Read 458 times)

newbie
Activity: 11
Merit: 0
Site was probably hacked. Hackers usually hack these sites (older wordpress, bad plugins, etc) and add extra pages. Can you link directly to the phishing page?

Here is the URL in my email:
 http://wimberleyelectricians.com/done/lc.php
 It WAS pretending to be localbitcoins. I keep the screenshot. But now it's back to normal.
You are probably right about being hacked.
legendary
Activity: 1120
Merit: 1000
Here is the details (from his website) of the guy tring to do phishing!


AJA Electrical ServicePersonal Attention and Professional Service
Call Us Today! 512-557-5605
Serving Wimberley, TX

Site was probably hacked. Hackers usually hack these sites (older wordpress, bad plugins, etc) and add extra pages. Can you link directly to the phishing page?
newbie
Activity: 11
Merit: 0
Here is the details (from his website) of the guy tring to do phishing!


AJA Electrical ServicePersonal Attention and Professional Service
Call Us Today! 512-557-5605
Serving Wimberley, TX
newbie
Activity: 11
Merit: 0
So when did you actually realise the domain name was different...

After the real LocalBitcoins sent me login warning from unknown IP. Then I check the URL of my Safari browser. I then knew I'm on an different website. Especially when I pressed the Wallet button on the fake website. It showed the electrician service info.

Login attempt details
----------------------

IP address: 199.19.94.193
Country: (Unknown country)
Web browser: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
full member
Activity: 170
Merit: 100
So when did you actually realise the domain name was different...
newbie
Activity: 11
Merit: 0
Today I received an email pretending to be from localbitcoins.com, saying a support ticket raise for me to action.

I clicked the ticket URL , which actually links to wimberleyelectricians.com but with localbitcoins.com logo. That page asked me localbitcoins username, password and even PIN number, Email verification code and 2FA code!


And then some one logged in my localbitcoins.com account from a Canada IP ( I live in Australia)!


11/19/2015 04:36   Successfully logged in   199.19.94.193
Jump to: