HN Explorer

FACEBOOK SCAM DO NOT LOG INTO THIS

3 points by agentbleu ↗ HN
faceilbook.com

I just got an email from one of my friends, It took me to faceilbook.com which is a FB phising site, Firefox did not come up with any alert, (it did the second time).

I cannot get this bastards IP.

here are hes other details:

changfeng zhang 03783306601 fax: 03783306601 kaifenghuanghedadao246hao61 kaifeng henan 475100 cn

ns1.4everdns.com ns2.4everdns.com

12 comments

[ 5.0 ms ] story [ 39.5 ms ] thread
noonespecial
Quick, someone cook up a ruby script to generate a million or so bogus logins to swamp any real logins they might have gotten so far. Pass it around.
thenextweb
I have always wondered if that would work for spam too. What if we would set-up a bunch of servers to follow all links (times 10) in all spam messages. Even better, make it a plug-in for Outlook & Mail. Then, if a spammer would send out 100.000 messages he would immediately receive 1 million hits. No problem if you are authentically sending a few emails but a huge problem if you are sending out millions of mails.

If would be an active spam fighting solution instead of all the 'turn the other cheek' solutions that are popular right now...

kleevr
Until they turn around and use it for DoS attacks.
thenextweb
Yeah, but don't they already do that?
noonespecial
I don't think either of us are advocating outright DOS attacks against the spammer/phisher. I'm also unsure as to why these were modded down. Even if everyone on the list simply manually provided one fake set of credentials, the noise added to the phisher's database might be sufficient to make the endevour useless.

Right now I'm guessing that most of the hits he gets are legit from fooled users. If we were somehow able to break the model by making 99.9% of all of the info gathered worthless, they might stop altogether. In any case it would provide some cover for the people who were fooled and supplied legit creds to have a million or so bogus ones surrounding them.

agentbleu
Here is the IP of part of this bastards network,

202.111.175.39

This is also part of the scam: Logonsish.com

These are other sites hosted on the same IP

1) advertise-bz.com (view site)

2) com.rnyspacelogon.com (view site)

3) debtbreakfreeusa.com (view site)

4) demographic-data.net (view site)

5) fanebook.com (view site)

6) flawlesswatches.com (view site)

7) getremoved.net (view site)

8) join-today.net (view site)

9) mchughrecruitment.com (view site)

10) mylyearbook.com (view site)

11) myspecai.com (view site)

12) myzyearbook.com (view site)

13) rnyspacelogon.com (view site)

14) secure-myspace.com (view site)

15) sxygirls.net (view site)

16) vids-rnyspace.com (view site)

17) vids-rnyspace.com (view site)

agentbleu
What is weird is that the email was sent from this IP 69.63.184.102 which is registered to Thefacebook.com

Received: (qmail 21415 invoked from network); 9 Aug 2008 23:04:31 -0000 Received: from 69.63.184.102 (HELO mx-out.facebook.com) (69.63.184.102) by mrelay4-g25.free.fr with SMTP; 9 Aug 2008 23:04:31 -0000 Received: from www.facebook.com (intlb01-mip2.sctm.tfbnw.net [10.1.240.7]) by mx-out.facebook.com [email005.ash1.facebook.com] (8.13.7/8.13.6) with ESMTP id m79N4TdV020866 for ; Sat, 9 Aug 2008 16:04:30 -0700 X-Facebook: from zuckmail ([67.159.5.178]) by www.facebook.com with HTTP (ZuckMail);

WHOIS - 69.63.184.102 mail iconEmail link to results Generated by www.DNSstuff.com

Location: United States [City: Baltimore, Maryland]

OrgName: Thefacebook.com OrgID: THEFA-3 Address: 156 University Ave, 3rd floor City: Palo Alto StateProv: CA PostalCode: 94301 Country: US

NetRange: 69.63.176.0 - 69.63.191.255 CIDR: 69.63.176.0/20 NetName: TFBNET2 NetHandle: NET-69-63-176-0-1 Parent: NET-69-0-0-0-0 NetType: Direct Assignment NameServer: DNS1.SCTM.TFBNW.NET NameServer: DNS2.SCTM.TFBNW.NET NameServer: DNS04.SF2P.TFBNW.NET NameServer: DNS05.SF2P.TFBNW.NET Comment: Contact @facebook.com with issues. RegDate: 2007-02-07 Updated: 2007-03-12

RAbuseHandle: OPERA82-ARIN RAbuseName: Operations RAbusePhone: +1-650-543-4800 RAbuseEmail: @facebook.com

RNOCHandle: OPERA82-ARIN RNOCName: Operations RNOCPhone: +1-650-543-4800 RNOCEmail: @facebook.com

RTechHandle: OPERA82-ARIN RTechName: Operations RTechPhone: +1-650-543-4800 RTechEmail: @facebook.com

OrgTechHandle: OPERA82-ARIN OrgTechName: Operations OrgTechPhone: +1-650-543-4800 OrgTechEmail: *@facebook.com used to send the