Malware Domain List

Malware Related => Malicious Domains => Topic started by: SysAdMini on January 29, 2010, 10:44:06 pm

Title: NCSoft Phishing
Post by: SysAdMini on January 29, 2010, 10:44:06 pm
These kind of emails are circulating around.

Code: [Select]
From: makelelejr@hotmail.com
To: makelelejr@hotmail.com
Subject: Password Reset Success
Date: Thu=2C 28 Jan 2010 10:46:17 +0800


Someone 65.255.34.173 Aion has been reset to your game account password. If=
 you not make the change=2C please contact support https://secure.ncsoft.co=
m/login.=20
    =20
_________________________________________________________________
Hebben jij en je vrienden leuke foto's van jullie feestje? Maak een groepsa=
lbum en geniet nog extra na.=20
http://www.microsoft.com/belux/nl/windows/windowslive/products/photos.aspx=

--_dbc36d6a-7f7d-4903-bc68-889fe7f7df07_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<style><!--
.hmmessage P
{
margin:0px=3B
padding:0px
}
body.hmmessage
{
font-size: 10pt=3B
font-family:Verdana
}
--></style>
</head>
<body class=3D'hmmessage'>
<BR>&nbsp=3B<BR>
<HR id=3DstopSpelling>
From: makelelejr@hotmail.com<BR>To: makelelejr@hotmail.com<BR>Subject: Pass=
word Reset Success<BR>Date: Thu=2C 28 Jan 2010 10:46:17 +0800<BR><BR>
Someone 65.255.34.173 Aion has been reset to your game account password. If=
 you not make the change=2C please contact support <A href=3D"http://www.se=
cure-ncsoft-nic.com/">https://secure.ncsoft.com/login</A>. <BR>    =
<br /><hr />Gratis verblufffende panoramafoto's maken?  <a href=3D'http://w=
ww.microsoft.com/belux/nl/windows/windowslive/products/photo-gallery.aspx' =
target=3D'_new'>Met Photo Gallery is dit zo gebeurd. </a></body>
</html>=

--_dbc36d6a-7f7d-4903-bc68-889fe7f7df07_--

The link inside this html email directs to

Code: [Select]
http://www.secure-ncsoft-nic.com

This page redirects to the Phishing page at

Code: [Select]
http://safe.saouar-ncsoft.com/
The original secure page at NCSoft is

https://secure.ncsoft.com/login

Everything else is a fake !!

Title: Re: NCSoft Phishing
Post by: SysAdMini on February 03, 2010, 08:17:13 pm
Now phishing page is at
Code: [Select]
accountlogin.saouar-ncsoft.com
Title: Re: NCSoft Phishing
Post by: SysAdMini on March 26, 2010, 01:05:12 pm
Code: [Select]
http://ukncsoft.com/1/