blogstring.com

I just got a message on GTalk from someone I almost never talk with on IM. The message:

Check out this funny video- http://tinyurl.com/something

Upon clicking, I was redirected to viddyho.com, which asked for my GTalk login:

Of course, I didn’t enter my gmail credentials, as I can’t think of a reason why I should add my email/IM credentials to check out a video on someone else’s site. But I’m guessing quite a few people did. Looking at the whois information

ICANN Registrar: GODADDY.COM, INC.
Created: 2009-02-17
Expires: 2011-02-17
Updated: 2009-02-17
Registrar Status: clientDeleteProhibited
Registrar Status: clientRenewProhibited
Registrar Status: clientTransferProhibited
Registrar Status: clientUpdateProhibited
Name Server: NS1.AFRAID.ORG (has 34,014 domains)
Name Server: NS2.AFRAID.ORG
Whois Server: whois.godaddy.com

Administrative Contact:
Ton-That, Cam-Hoan
HappyAppy Inc
25 Stillman St
San Francisco, California 94107
United States
(415) 627-8634 Fax –

Technical Contact:
Ton-That, Cam-Hoan
HappyAppy Inc
25 Stillman St
San Francisco, California 94107
United States
(415) 627-8634 Fax –

Domain servers in listed order:
NS1.AFRAID.ORG
NS2.AFRAID.ORG

You can see that the site has only been around for a couple of days. Also, if you go to the root, you’ll see that ViddyHo is “Coming Soon”, but if you go to /videos.php, you can see the full list of sites that they’re trying to capture credentials from:

• MSN Messenger
• AIM
• ICQ
• Yahoo!
• Google Talk
• Myspace

Another thing: all the images on the ViddyHo site are being served up from a photobucket account, which has a few other albums aside from one called viddyho:

1. Twitquizzes- Featuring photos of twitter users like Shaq, Hammer, and other celebrities.

2. HaveYou- Which seems kind of random.

3. Yourather- Which has a lot of random images.

So, it looks like someone has created a bunch of sites aimed at hijacking usernames and passwords, and likely are holding them for ransom or paying them.

Filed under: GTalk Phishing, social media, ViddyHo