On Saturday January 3rd Twitter was hit with its first major phishing scam.

Basically folks were sent a Direct Message (DM) that said “Hey, I found a website with your pic on it… LOL check it out here” OR “hey! check out this funny blog about you…” in which folks were directed to a phishing website that looked identical to the Twitter.com webpage, and where they could enter in their login information.

Once the user entered in their information, the scammers would take that information, and send Direct Messages (DM’s) to everyone in their account, and the cycle would repeat itself.

If you did not enter your information into these phishing websites, then your Twitter account has not been compromised.  This means that if you did not give up your username and password, then you have nothing to worry about.

At the time of this posting the first site (jannawalitix) has been taken down showing the following screen capture:
hey! check out this funny blog about you… http://jannawalitax.blogspot.com/ *****THIS IS A PHISHING WEBSITE*** DO NOT ENTER YOUR INFORMATION***

 

The second phishing site, which is still currently active a the time of this writing
Hey, i found a website with your pic on it… LOL check it out here ….**THIS IS A PHISHING WEBSITE***http://twitterblog.access-logins.com/login/*****THIS IS A PHISHING WEBSITE

  

 They put forth a lot of effort compared to regular phishing sites, as even the majority of the links are active.

A WHOIS search on Network Solutions identified this as a Chinese company with the following details:
http://www.networksolutions.com/whois-search/access-logins.com

Domain Name : access-logins.com PunnyCode : ACCESS-LOGINS.COM Registrant: Organization : zhang xiaohu Name : zhang xiaohu Address : changningzhonghuainanlu192hao City : changning Province/State : Hunan Country : CN Postal Code : 421500 Administrative Contact: Name : zhang xiaohu Organization : zhang xiaohu Address : changningzhonghuainanlu192hao City : changning Province/State : Hunan Country : CN Postal Code : 421500 Phone Number : 86-0734-3211451 Fax : 86-0734-3211451 Email : zhangxiaohu_0098@126.com Technical Contact: Name : zhang xiaohu Organization : zhang xiaohu Address : changningzhonghuainanlu192hao City : changning Province/State : Hunan Country : CN Postal Code : 421500 Phone Number : 86-0734-3211451 Fax : 86-0734-3211451 Email : zhangxiaohu_0098@126.com Billing Contact: Name : zhang xiaohu Organization : zhang xiaohu Address : changningzhonghuainanlu192hao City : changning Province/State : Hunan Country : CN Postal Code : 421500 Phone Number : 86-0734-3211451 Fax : 86-0734-3211451 Email : zhangxiaohu_0098@126.com
Current Registrar: XIN NET TECHNOLOGY CORPORATION
IP Address: 122.136.45.47 (ARIN & RIPE IP search)
IP Location: CN(CHINA)-BEIJING-BEIJING
Lock Status: ok
DMOZ  no listings
Y! Directory:  see listings
Data as of: 14-Jun-2005

WHAT YOU CAN DO

1. Let folks know of this Phishing scam
2. If you get a DM from a person with these subject lines, let them know that they need to change their password (if they still are able to)
3. Read up on Twitters comments on Phishing
4. Let others know about this post identifying the details behind the scam
5. Thanks to the Twitter team for posing details on Phishing
   http://blog.twitter.com/2009/01/gone-phishing.html
   http://www.fraud.org/tips/internet/phishing.htm

UPDATE Sunday @7:50 PM MT

There are two new versions of this DM phishing scam are emerging… THESE URLS ARE PHISHING SCAMS DO NOT ENTER YOUR TWITTER INFORMATION

1. Check out this blog type website. you need to see it..   http://bloggertwit.access-logins.com/login/
2. heyy!!! i want u to see my blog!!   http://blogtwitter.access-logins/login

Summary of Phishing DM’s

1. hey! check out this funny blog about you… http://jannawalitax.blogspot.com/
2. Hey, i found a website with your pic on it… LOL check it out here http://twitterblog.access-logins.com/login/
3. Check out this blog type website. you need to see it..   http://bloggertwit.access-logins.com/login/
4. heyy!!! i want u to see my blog!!   http://blogtwitter.access-logins/login

If you know of any more versions please let us know!

Tags: phishing, Twitter