Worrying email from 'Pistonheads'

[KevF]

I am sure this isnt a kosha email and received this in my post today..

Dear Pistonhead member

This is an official notification from Pistonheads.Your online advert has expired.If you want to continue to using our services you have to renew your advert right away.If not, your advert will be deleted.
Please click here to renew your advert.


(There is then a link that looks like it goes straight to PH but when the link is clicked it goes to this site)

http://northeastautosales.net/images/www.pistonhea...

Thank you,

Pistonheads Support



It comes from 'PistonHeads [[e-mail]]'



Any idea who/ what this is all about as I have no current adverts so I know its pish...


Kev

Edited by KevF on Wednesday 28th October 17:39

[okgo]

One would assume it would be an @haymarket.com email address..Or at elast @pistonheads.com...

[KevF]

True true....whih is why I worriedly didnt sign into PH using their link and then posted here...

Not sure if I am the only one to get this email...seems strange I would be picked out of the list of members especially as I havent an active advert on PH....


Not sure what anyone would gain from getting me to sign into PH unless there is a way to retrieve bank detials or indeed place a scam advert..

[DaveL86]

Looks like a classic phishing scam to me.

The login page has been saved and reuploaded on another host.

phishing site said:

<!-- saved from url=(0057)http://pistonheads.com/classifieds/manage/manage.asp?lg=1 -->

Stolen file here:
http://northeastautosales.net/images/www.pistonhea...

The login form doesn't post to pistonheads, and simply gathers usernames and passwords:

details sent to said:

http://www.cybercom.net/cgi-bin/MailForm.pl

Further investigation shows:

Try and login with made up details, it will make you think you've logged in and ask for your card details (This is so dangerous its just not funny!)

--Anyone who has fallen for this please give your self a slap for being so vunerable and RING YOUR BANK ASAP!--

Looking into it a little deeper:

Who ever created this has been pretty cleaver to exploit other hosts, for example "northeastautosales.net" has been hacked/exploited and a false PH page has been uploaded, this page then sends all your details via another exploited perl script on another host that actually sends all the card details and passwords, this is all delivered to "[e-mail]".

The only way they are going to get caught is if yahoo release the last access details for that account, but I imagine they have been using multiple proxy's to access it anyway since how cautionious they have been upto now.

Very scary stuff.

Edited by DaveL86 on Wednesday 28th October 18:08

[iluvmercs]

I was subject to a roughly similar scam when I advertised my brother's SEAT on Autotrader.

Had an email asking about my car.
I replied, then received a second email from the mystery person saying my details were linked to different car - they sent me a link.
I clicked on it and up popped (what looked liked) a genuine Autotrader page, asking me to sign in. I did and saw a random advert for an Audi.
I called who AT, who then informed me that I had, unfortunately, fallen for then scam. Simply changed my password and nothing else happened.

Thanks for highlighting this, Kev.

I'm sure the top bods at PH Towers definately want to be informed of things like this!

Darren

[Stuart]

This is a scam/phishing email. Could you possibly send it to [e-mail] ?

Thanks.

Stuart

[KevF]

Stuart,

Email has been forwarded to sales address.

Kev

[Goddamit]

I received one of these today too.

When I hover over the "pistonheads" link in the email, it shows [http://pist0nheads.notlong com]

[monthefish]

Got one as well, from the e-mail address:

[e-mail]

(Stuart - do you want it sent over?)

Did seem a bit dodgy, but I must admit I did nearly fall for it, but fortunately had the sense to log in to the 'my adverts' bit of the site independently to check.

Time to raise the awareness of this, chaps...

[Xenocide]

Can you lookup who's transaction id this was?

DispatcherID mm2imsps1p
PaymentID bW0yaW1zcHMxcC1kcHByLTEyNTY3NDEzNDI0MDE%3D
?

[RacingPete]

Xenocide said:

Can you lookup who's transaction id this was?

DispatcherID mm2imsps1p
PaymentID bW0yaW1zcHMxcC1kcHByLTEyNTY3NDEzNDI0MDE%3D
?

Not transaction details we use for any of our payments, so I can't.

[RacingPete]

This is not the first and will not be the last time we get an email trying to be from PistonHeads to get members or classified user details.

Unfortunately this is a side affect of the success of PistonHeads that it gets attacked more by unscrupulous types (the amount of sql injection attacks on our servers increases too). We are working with the Police and the ISPs on getting any of the sites involved in this latest scam shut down as that is the easiest way to prevent users from falling for this trap.

[the_lone_wolf]

I got one of these yesterday evening too

Filled in some fake details for sts 'n' giggles

Will forward it to the address above, but how did they get my email in the first place?

Last classified ad was deleted back in Feb this year, and I don't publish the address that it came through, even on the classified ads you only get the online form, never get to see the recipient's email...

[Mr Will]

the_lone_wolf said:

how did they get my email in the first place?

There are two ways they can get PH users email addresses, firstly they post a tempting advert and see who emails them. Secondly they send a seemingly genuine enquiry to your advert and then see what email address you reply to them from.

We have measures in place to make both of these things difficult to do on a large scale, but they are impossible to prevent completely.

[monthefish]

Mr Will said:

the_lone_wolf said:

how did they get my email in the first place?

There are two ways they can get PH users email addresses, firstly they post a tempting advert and see who emails them. Secondly they send a seemingly genuine enquiry to your advert and then see what email address you reply to them from.

We have measures in place to make both of these things difficult to do on a large scale, but they are impossible to prevent completely.

Hmmmm, not so sure about that. I've never e-mailed any advert, and all e-mails (I think there were only 3) that I've had from propsective purchasers have been genuine (and have followed up).

So how did they get my e-mail address?

[RacingPete]

monthefish said:

Mr Will said:

the_lone_wolf said:

how did they get my email in the first place?

There are two ways they can get PH users email addresses, firstly they post a tempting advert and see who emails them. Secondly they send a seemingly genuine enquiry to your advert and then see what email address you reply to them from.

We have measures in place to make both of these things difficult to do on a large scale, but they are impossible to prevent completely.

Hmmmm, not so sure about that. I've never e-mailed any advert, and all e-mails (I think there were only 3) that I've had from propsective purchasers have been genuine (and have followed up).

So how did they get my e-mail address?

There could be numerous ways for someone to get email addresses so I wouldn't like to speculate on how they have done it this time, but our PH database is pretty secure with no external connection to the outside world and all SQL injection holes blocked.

There is also nothing to say that non-PH members have received this email too, so we can't say it is just PH members who have got this (Though none in PH Offices have got the email, including a few special email addresses I have in the database to truly spot if we have been compromised).

So whether it is someone fielding advert responses to get the addresses, an affected computer passing on its address book, a hacker reading packet information from an insecure router, screen grabbing HTML pages for email addresses, there are many ways to get email address lists.