6 ms·

posting another comment here too for visibility, but this _just_ happened to me as well.... Time Monday, December 27, 2021 at 1:41 PM EST Location São Paulo, S

posting another comment here too for visibility, but this _just_ happened to me as well.... Time Monday, December 27, 2021 at 1:41 PM EST Location São Paulo, SP 01323, BRAZIL IP address 160.116.88.235

sillysaurusx 5y ago
Hmm. So I don't know if this means anything, but I was googling for the IP address and wound up at https://ipinfo.io/160.116.88.235 https://ipinfo.io/160.116.88.235 which says hostname: visit.keznews.com. When you go to that hostname, it's one of the best phishing sites I've ever seen. They dynamically inserted my ISP's logo (Spectrum) and tried to do a phishing attempt: https://i.imgur.com/C9HQw1c.png https://i.imgur.com/C9HQw1c.png The full non-clickable URL: https://us.poonstate.click/us/i/spectrum/?track=u.pslnk.link&key=eyJ0aW1lc3RhbXAiOiIxNjQwNjM4NTIyIiwiaGFzaCI6IjNiZjRkYTg5MTA5MzMzNmU5NjRmMjZiNDY1NWUyN2UwMjk3NzI0OTYifQ%3D%3D&tsid=7ae4766b-0de5-4865-9f1b-025a45c71c3f&bemobdata=c%3D314f53db-f844-46ea-99f8-f277456639d3..l%3Df57d9a37-1c67-4958-ac52-6f4854ce6840..a%3D2..b%3D1..z%3D0.0016..e%3Dzr4b7f4393675711ecb78f122b3efc6f65f31163358f914cea90c49d2c8cc35b7b0612682b8c773fbcf1..c1%3Dwhiskey-oar-eAcMKVvZ..c2%3Dgriseous-trout..c4%3DDOMAIN..c6%3DNON-ADULT..c8%3D1655308..c9%3Dfbb8c5b0-5140-11ec-a217-0aea8b85a94f..c10%3D0# I went through and answered the "questions", and it tried to take me to the actual phishing site: https://i.imgur.com/wYt5WB3.png https://i.imgur.com/wYt5WB3.png https://i.imgur.com/Picaw4a.png https://i.imgur.com/Picaw4a.png Screenshots of the actual phishing site https://i.imgur.com/Bh5c2lZ.png https://i.imgur.com/Bh5c2lZ.png https://i.imgur.com/q7xnSki.png https://i.imgur.com/q7xnSki.png https://i.imgur.com/GX4hWnQ.png https://i.imgur.com/GX4hWnQ.png And its url (non-clickable): https://welcome.myonlineeconomy.com/us/238700/25/?pubid=aff-us&pob=3&click_id=61ca28bcf92ca000011aa4c0&subid=RT-60338e1b79fcbe00012195a3-168&utm_medium=mail&utm_term=ipadpro&terms=y&email=&fname=&lname=&fp=&address=&city=&zip=&state=&lpkeyua=a17666fa4eadface9331c0311b1e8875.1640638952 Now, the interesting part is that this phishing attempt only happened once. When I tried to visit again just now, it just says "something went wrong" (on the first site) and "Access denied" (on the second site). I saved the sites to disk as I went, but I doubt these dumps will tell you much. Just in case though: 1. https://gist.github.com/shawwn/4deace812e7c752949a0df096ef66f3a https://gist.github.com/shawwn/4deace812e7c752949a0df096ef66... 2. https://gist.github.com/shawwn/721f235e760dd2257cd760edb1188ebb https://gist.github.com/shawwn/721f235e760dd2257cd760edb1188... Long story short: It sounds like all of you got phished. I suspect you installed a malicious app that somehow targeted your web browser's LastPass extension, modifying it to send your master password to these fine people. ¯\_(ツ)_/¯
- gregsadetsky 5y ago
  Hey, That's quite possible, for sure. I am not beyond/above/below being phished like anyone else, ha! The issue -- what makes it perplexing -- is that I haven't used this LastPass password since 2017. I know because this LastPass account was only used to share passwords within an org that I left back then. Is it possible that I was phished 4 years ago, and they sat on the password? Sure. But 2 other people in this thread being phished from the same exact same phishing server/group? Or we were separately phished using different techniques, and now one Brazil server attempted to use all of our logins? That's what's rather strange.
  - trevcanhuman 5y ago
    I feel like this sounds more like a zero-day exploit being used to target the LastPass login servers.
  - wutwutwutwut 5y ago
    Couldn't it just be that someone got a copy of the password some years ago and now sold the list of credentials to someone else, who then tried to use it? Maybe the original owner of the list didn't realize some of the credentials was for LastPass, for example. I'm still seeing hackers trying to log on using passwords I haven't used in ~10 years, because it's on a list somewhere.
    - sillysaurusx 5y ago
      This seems likely.
    - gregsadetsky 5y ago
      I agree, that could make sense. So LastPass (their extension) may have been hacked ~5 years ago ish, a few people here on the thread were all hacked in the same way, our passwords were sold off, and now the same Brazil IP range just tried all of those passwords.
      - kreetx 5y ago
ajb 5y ago
Not sure it's really in Brazil. LACNIC says the IP range was transferred to AFRINIC. They then say that it is owned by: Affiliated Computing Services (Pty) Ltd descr: P. O. Box 261333 descr: Excom 2023 country: ZA But then further note that ownership is in dispute! We need someone to look it up in the current routing tables to see where it's presently being routed to.
- gregsadetsky 5y ago
  I also saw that very weird thing -- Brazil vs AFRINIC. Help/insight from ASN? BGP? networking experts would be appreciated..! Thanks a lot
  - Godel_unicode 5y ago
    That IP is present in a cn record for visit[.]keznews[.]com, whose whois record lists an admin contact in CZ. Be very wary of geo-ip results, on the modern internet they are effectively useless.
    - colejohnson66 5y ago
      Ignoring VPNs, why are they useless?
      - wholinator2 5y ago
        Why ignore VPNs? Im sure someone else can chime in but to my knowledge that's what makes them useless. You can't be sure someone isn't running VPN, then you can never be certain GeoIP is correct, thus it's useless.
        colejohnson66 5y ago
        Because everyone knows that VPN IPs’ geoloc is useless, so I assumed that those were being ignored. Also because it’s possible to see if an IP is (possibly) a VPN one by looking up the owner.

sillysaurusx 5y ago

Hmm. So I don't know if this means anything, but I was googling for the IP address and wound up at https://ipinfo.io/160.116.88.235 https://ipinfo.io/160.116.88.235 which says hostname: visit.keznews.com. When you go to that hostname, it's one of the best phishing sites I've ever seen. They dynamically inserted my ISP's logo (Spectrum) and tried to do a phishing attempt: https://i.imgur.com/C9HQw1c.png https://i.imgur.com/C9HQw1c.png The full non-clickable URL: https://us.poonstate.click/us/i/spectrum/?track=u.pslnk.link&key=eyJ0aW1lc3RhbXAiOiIxNjQwNjM4NTIyIiwiaGFzaCI6IjNiZjRkYTg5MTA5MzMzNmU5NjRmMjZiNDY1NWUyN2UwMjk3NzI0OTYifQ%3D%3D&tsid=7ae4766b-0de5-4865-9f1b-025a45c71c3f&bemobdata=c%3D314f53db-f844-46ea-99f8-f277456639d3..l%3Df57d9a37-1c67-4958-ac52-6f4854ce6840..a%3D2..b%3D1..z%3D0.0016..e%3Dzr4b7f4393675711ecb78f122b3efc6f65f31163358f914cea90c49d2c8cc35b7b0612682b8c773fbcf1..c1%3Dwhiskey-oar-eAcMKVvZ..c2%3Dgriseous-trout..c4%3DDOMAIN..c6%3DNON-ADULT..c8%3D1655308..c9%3Dfbb8c5b0-5140-11ec-a217-0aea8b85a94f..c10%3D0# I went through and answered the "questions", and it tried to take me to the actual phishing site: https://i.imgur.com/wYt5WB3.png https://i.imgur.com/wYt5WB3.png https://i.imgur.com/Picaw4a.png https://i.imgur.com/Picaw4a.png Screenshots of the actual phishing site https://i.imgur.com/Bh5c2lZ.png https://i.imgur.com/Bh5c2lZ.png https://i.imgur.com/q7xnSki.png https://i.imgur.com/q7xnSki.png https://i.imgur.com/GX4hWnQ.png https://i.imgur.com/GX4hWnQ.png And its url (non-clickable): https://welcome.myonlineeconomy.com/us/238700/25/?pubid=aff-us&pob=3&click_id=61ca28bcf92ca000011aa4c0&subid=RT-60338e1b79fcbe00012195a3-168&utm_medium=mail&utm_term=ipadpro&terms=y&email=&fname=&lname=&fp=&address=&city=&zip=&state=&lpkeyua=a17666fa4eadface9331c0311b1e8875.1640638952 Now, the interesting part is that this phishing attempt only happened once. When I tried to visit again just now, it just says "something went wrong" (on the first site) and "Access denied" (on the second site). I saved the sites to disk as I went, but I doubt these dumps will tell you much. Just in case though: 1. https://gist.github.com/shawwn/4deace812e7c752949a0df096ef66f3a https://gist.github.com/shawwn/4deace812e7c752949a0df096ef66... 2. https://gist.github.com/shawwn/721f235e760dd2257cd760edb1188ebb https://gist.github.com/shawwn/721f235e760dd2257cd760edb1188... Long story short: It sounds like all of you got phished. I suspect you installed a malicious app that somehow targeted your web browser's LastPass extension, modifying it to send your master password to these fine people. ¯\_(ツ)_/¯

gregsadetsky 5y ago
Hey, That's quite possible, for sure. I am not beyond/above/below being phished like anyone else, ha! The issue -- what makes it perplexing -- is that I haven't used this LastPass password since 2017. I know because this LastPass account was only used to share passwords within an org that I left back then. Is it possible that I was phished 4 years ago, and they sat on the password? Sure. But 2 other people in this thread being phished from the same exact same phishing server/group? Or we were separately phished using different techniques, and now one Brazil server attempted to use all of our logins? That's what's rather strange.
- trevcanhuman 5y ago
  I feel like this sounds more like a zero-day exploit being used to target the LastPass login servers.
- wutwutwutwut 5y ago
  Couldn't it just be that someone got a copy of the password some years ago and now sold the list of credentials to someone else, who then tried to use it? Maybe the original owner of the list didn't realize some of the credentials was for LastPass, for example. I'm still seeing hackers trying to log on using passwords I haven't used in ~10 years, because it's on a list somewhere.
  - sillysaurusx 5y ago
    This seems likely.
  - gregsadetsky 5y ago
    I agree, that could make sense. So LastPass (their extension) may have been hacked ~5 years ago ish, a few people here on the thread were all hacked in the same way, our passwords were sold off, and now the same Brazil IP range just tried all of those passwords.
    - kreetx 5y ago

ajb 5y ago

Not sure it's really in Brazil. LACNIC says the IP range was transferred to AFRINIC. They then say that it is owned by: Affiliated Computing Services (Pty) Ltd descr: P. O. Box 261333 descr: Excom 2023 country: ZA But then further note that ownership is in dispute! We need someone to look it up in the current routing tables to see where it's presently being routed to.

gregsadetsky 5y ago
I also saw that very weird thing -- Brazil vs AFRINIC. Help/insight from ASN? BGP? networking experts would be appreciated..! Thanks a lot
- Godel_unicode 5y ago
  That IP is present in a cn record for visit[.]keznews[.]com, whose whois record lists an admin contact in CZ. Be very wary of geo-ip results, on the modern internet they are effectively useless.
  - colejohnson66 5y ago
    Ignoring VPNs, why are they useless?
    - wholinator2 5y ago
      Why ignore VPNs? Im sure someone else can chime in but to my knowledge that's what makes them useless. You can't be sure someone isn't running VPN, then you can never be certain GeoIP is correct, thus it's useless.
      - colejohnson66 5y ago
        Because everyone knows that VPN IPs’ geoloc is useless, so I assumed that those were being ignored. Also because it’s possible to see if an IP is (possibly) a VPN one by looking up the owner.