{"id":36,"date":"2011-08-13T23:35:16","date_gmt":"2011-08-14T04:35:16","guid":{"rendered":"https:\/\/www.falatic.com\/?p=36"},"modified":"2011-08-13T23:55:27","modified_gmt":"2011-08-14T04:55:27","slug":"new-old-twitter-password-stealer-making-the-rounds","status":"publish","type":"post","link":"https:\/\/www.falatic.com\/index.php\/36\/new-old-twitter-password-stealer-making-the-rounds","title":{"rendered":"New (old?) Twitter password stealer making the rounds…"},"content":{"rendered":"

If you click a Twitter link and it sends you to a Twitter login page, beware… look closely at the address bar and ensure you’re actually at Twitter’s login page and not a thieving imposter’s page!<\/strong><\/p>\n

<\/strong>Recently a friend on Twitter sent a link as part of a message:<\/p>\n

“Look! it’s you in this picture.. [along with a tinyurl link]<\/em>”<\/p>\n

Other variants of this exist, such as “you’ll laugh when you see this pic of you<\/em>… [along with a tinyurl link]<\/em>“.<\/p>\n

Turns out, my friend’s account had been hijacked. (Yes, it really was a friend… I’ve seen this before with Twitter and other sites but it looks identical to an attack I saw about a month ago).<\/p>\n

In this case, the bogus link went to a subpage on itwittiler.com<\/strong> (IP address 220.164.140.252), a domain registered in China\u00a0– earlier today! The page looks<\/em> like Twitter’s login page but it’s not. In fact, I sandboxed it and entered a bogus username\/password to see if it’d redirect to Twitter no matter what was entered. No… it redirected me to a “StalkTrak” page, clearly malformed and totally bogus. Read this Sophos security article<\/a> for more info.<\/p>\n

Another subpage (found via some searching online) does redirect to Twitter, but to a user who doesn’t exist. In all cases, the first page you go to looks just like the Twitter login page (there are some subtle yet sloppy differences, but next time there might not be.)<\/p>\n

It’s quite likely the page is harvesting credentials along the way. If you get stung, go to the real Twitter homepage and reset your password pronto (after closing your browser windows).<\/strong><\/p>\n

More info on itwittiler.com<\/strong>, via whois<\/em>:<\/p>\n

Domain Name: ITWITTILER.COM
\nRegistrar: JIANGSU BANGNING SCIENCE & TECHNOLOGY CO. LTD
\nWhois Server: whois.55hl.com
\nReferral URL: http:\/\/www.55hl.com
\nName Server: DNS5.4CUN.COM
\nName Server: DNS6.4CUN.COM
\nStatus: ok
\nUpdated Date: 13-aug-2011
\nCreation Date: 13-aug-2011
\nExpiration Date: 13-aug-2012<\/p>\n

Update:<\/strong> Another StalkTrak spam domain made the rounds last month: itiwitter.com<\/strong>. Surprise! It’s registered to the very same registrar! Judging by the same subpage structure I strongly suspect it’s the very same scammer using the very same site (or site structure)… while the IP address won’t resolve, it turns out this site’s for sale!<\/a> And the IP address when last they checked? 220.164.140.252. Isn’t that special?<\/p>\n

Domain Name: ITIWITTER.COM
\nRegistrar: JIANGSU BANGNING SCIENCE & TECHNOLOGY CO. LTD
\nWhois Server: whois.55hl.com
\nReferral URL: http:\/\/www.55hl.com
\nName Server: DNS5.4CUN.COM
\nName Server: DNS6.4CUN.COM
\nStatus: clientHold
\nStatus: clientTransferProhibited
\nUpdated Date: 20-jul-2011
\nCreation Date: 15-jul-2011
\nExpiration Date: 15-jul-2012<\/p>\n

Still more information can be found on this site<\/a><\/strong>, which talks about the same scam (back before the scammers changed domain names and came back from the “dead”).<\/p>\n\n","protected":false},"excerpt":{"rendered":"

If you click a Twitter link and it sends you to a Twitter login page, beware… look closely at the address bar and ensure you’re actually at Twitter’s login page […]<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"Layout":"","footnotes":"","_links_to":"","_links_to_target":""},"categories":[1],"tags":[64,65,63,62],"class_list":["entry","author-marty","has-more-link","post-36","post","type-post","status-publish","format-standard","category-uncategorized","tag-scams","tag-securiity","tag-social-networking","tag-twitter"],"_links":{"self":[{"href":"https:\/\/www.falatic.com\/index.php\/wp-json\/wp\/v2\/posts\/36","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.falatic.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.falatic.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.falatic.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.falatic.com\/index.php\/wp-json\/wp\/v2\/comments?post=36"}],"version-history":[{"count":0,"href":"https:\/\/www.falatic.com\/index.php\/wp-json\/wp\/v2\/posts\/36\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.falatic.com\/index.php\/wp-json\/wp\/v2\/media?parent=36"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.falatic.com\/index.php\/wp-json\/wp\/v2\/categories?post=36"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.falatic.com\/index.php\/wp-json\/wp\/v2\/tags?post=36"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}