Author Topic: NCSoft Phishing  (Read 6058 times)

0 Members and 1 Guest are viewing this topic.

January 29, 2010, 10:44:06 pm
Read 6058 times

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
These kind of emails are circulating around.

Code: [Select]
From: makelelejr@hotmail.com
To: makelelejr@hotmail.com
Subject: Password Reset Success
Date: Thu=2C 28 Jan 2010 10:46:17 +0800


Someone 65.255.34.173 Aion has been reset to your game account password. If=
 you not make the change=2C please contact support https://secure.ncsoft.co=
m/login.=20
    =20
_________________________________________________________________
Hebben jij en je vrienden leuke foto's van jullie feestje? Maak een groepsa=
lbum en geniet nog extra na.=20
http://www.microsoft.com/belux/nl/windows/windowslive/products/photos.aspx=

--_dbc36d6a-7f7d-4903-bc68-889fe7f7df07_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<style><!--
.hmmessage P
{
margin:0px=3B
padding:0px
}
body.hmmessage
{
font-size: 10pt=3B
font-family:Verdana
}
--></style>
</head>
<body class=3D'hmmessage'>
<BR>&nbsp=3B<BR>
<HR id=3DstopSpelling>
From: makelelejr@hotmail.com<BR>To: makelelejr@hotmail.com<BR>Subject: Pass=
word Reset Success<BR>Date: Thu=2C 28 Jan 2010 10:46:17 +0800<BR><BR>
Someone 65.255.34.173 Aion has been reset to your game account password. If=
 you not make the change=2C please contact support <A href=3D"http://www.se=
cure-ncsoft-nic.com/">https://secure.ncsoft.com/login</A>. <BR>    =
<br /><hr />Gratis verblufffende panoramafoto's maken?  <a href=3D'http://w=
ww.microsoft.com/belux/nl/windows/windowslive/products/photo-gallery.aspx' =
target=3D'_new'>Met Photo Gallery is dit zo gebeurd. </a></body>
</html>=

--_dbc36d6a-7f7d-4903-bc68-889fe7f7df07_--

The link inside this html email directs to

Code: [Select]
http://www.secure-ncsoft-nic.com

This page redirects to the Phishing page at

Code: [Select]
http://safe.saouar-ncsoft.com/
The original secure page at NCSoft is

https://secure.ncsoft.com/login

Everything else is a fake !!

Ruining the bad guy's day

February 03, 2010, 08:17:13 pm
Reply #1

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
Now phishing page is at
Code: [Select]
accountlogin.saouar-ncsoft.com
Ruining the bad guy's day

March 26, 2010, 01:05:12 pm
Reply #2

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
Code: [Select]
http://ukncsoft.com/1/
Ruining the bad guy's day