Phishing, in 140 Characters or Less

A phishing scam, in 140 characters or less? That's what we have here, as a phishing scam apparently hit Twitter on Saturday.

According to Twitter,

If you receive an email notice saying you’ve received a Direct Message with a link that redirects to what seems like Twitter.com, be careful about entering your Twitter credentials. Instead, look closely at the URL to see if it’s not really Twitter but a sketchy phishing site like http://twitter.access-logins.com. If this has you feeling a bit weirded out, feel free to change your Twitter password.

If you get the direct message in question, you'll get a message like the following, which Chris Pirillo received.

hey! check out this funny blog about you… jannawalitax . blogspot . com

Go to that URL, and you get redirected to http://twitter.access-logins.com/login/ which looks like the below (click to enlarge):


Interestingly, go to http://twitter.access-logins.com/ and, welcome to Facebook, as you'll see what looks to be the Facebook homepage, but isn't, of course.

Do a WHOIS on the site, and you'll see the registrant is in China:

Organization : zhang xiaohu
Name : zhang xiaohu
Address : changningzhonghuainanlu192hao
City : changning
Province/State : Hunan
Country : CN
Postal Code : 421500

You might want to take a look at a game developed by Carnegie-Mellon called Anti-Phishing Phil. It might be a good time to take a refresher. One thing it'll do is teach you is to check for invalid sub-domains like the above, as well as a lot more. It's worth a few minutes of your time.