New campaign targetting MSN credentials | vague de vol d'identifiants MSN

20.10.2009

Well, this is not new, but it is not a reason not to talk about that, I guess.

THis time, the supposed online MSN access server is hosted on the domain: come-face-the-truth.com.
To be more accurate, I recently received the following MSN message, coming from one of my contacts:

Here is a screeshot of the website the user is being sent to, if he clicks on the link provided in the MSN conversation:

Please don't give your MSN credentials to suspisicous websites!

I also found interesting this domain WhoIs: see http://www.domaincrawler.com/domains/view/come-face-the-truth.com
- the server IP address is said to be in Hong Kong
- while all the provided contacts are located in Beijing.

Well, I would sincerely suggest everybody to be carefull with that.

About security means?

This URL is not yet very well classified within URL blocking systems, AFAIK, but:

- Google Chrome: no alert before the 19th of October. Now, it does display a warning while trying to access the website. So Firefox should do it as well (Google Safe Browsing functionnality).

- IE8? nothing... I reported it to the SmartScreen system. Let's see what happens next.

- Safari? nothing...

I'll give more details as I find out.