Re: [nznog] kfcdelivery.co.nz ongoing scam

The warning is from Cloudflare, none of the browsers I have generate a warning themselves - but if cloudflare have it that’s good enough :-) -- Nathan Ward

On 19/10/2015, at 09:48, David Mitchell wrote:

As does Firefox

Cheers

David

From: nznog-bounces(a)list.waikato.ac.nz [mailto:nznog-bounces(a)list.waikato.ac.nz] On Behalf Of Mauricio Freitas Sent: Monday, 19 October 2015 9:46 a.m. To: Dan Wallis ; nznog(a)list.waikato.ac.nz Subject: Re: [nznog] kfcdelivery.co.nz ongoing scam

Still alive in other networks though but now Chrome warns it's a phishing site.

Cheers

Mauricio Freitas http://about.me/freitasm http://about.me/freitasm

From: nznog-bounces(a)list.waikato.ac.nz mailto:nznog-bounces(a)list.waikato.ac.nz mailto:nznog-bounces(a)list.waikato.ac.nz> on behalf of Dan Wallis mailto:mrdanwallis(a)gmail.com> Sent: Monday, October 19, 2015 08:39 To: nznog(a)list.waikato.ac.nz mailto:nznog(a)list.waikato.ac.nz Subject: Re: [nznog] kfcdelivery.co.nz ongoing scam

I've contacted the registrar. They killed this yesterday. Le 18 oct. 2015 19:55, "Neil Gardner" mailto:Neil.Gardner(a)spark.co.nz> a écrit : We've killed the site for spark users.

Cheers N

Sent from my mobile device. Please excuse brevity and any autocorrect issues.

From: Nathan Ward mailto:nznog(a)daork.net> Sent: 18/10/2015 7:40 pm To: Ray Taylor Cc: nznog Subject: Re: [nznog] kfcdelivery.co.nz http://kfcdelivery.co.nz/ ongoing scam

Sure, and they used to do delivery years ago. People want it, which is why this is working so well - I expect there’ll have been several thousand CC numbers go in to this form today.

Police are telling me that KFC have submitted something to the registrar to get the domain pulled, it that could take days for them to get around to that email. Their e-crimes guys aren’t working today apparently so there’s not much they can do to follow up and try nab whoever’s doing this before it gets pulled and they disappear.

I’ve contacted Cloudflare through their abuse site, and through some direct contacts, so we’ll see what comes of that.. I’m sure there’s plenty of hungover people who just want some KFC who’re going to have the headache extended when they find out their CC info has been popped.

-- Nathan Ward

On 18/10/2015, at 19:33, Ray Taylor mailto:ray(a)ruralkiwi.com> wrote:

It sounds like a good idea – Restaurant brands could have a separate company with a depot in each town where the staff deliver for KFC, Starbucks, Carls Jr and Pizza Hut

Ray Taylor Taylor Communications ray(a)ruralkiwi.com mailto:ray(a)ruralkiwi.com

Napier: 06-929-9082 tel:06-929-9082 Waipukurau: 06-928-0549 tel:06-928-0549

From: nznog-bounces(a)list.waikato.ac.nz mailto:nznog-bounces(a)list.waikato.ac.nz [mailto:nznog-bounces(a)list.waikato.ac.nz mailto:nznog-bounces(a)list.waikato.ac.nz] On Behalf Of Nathan Ward Sent: Sunday, 18 October 2015 7:02 p.m. To: nznog Subject: [nznog] kfcdelivery.co.nz http://kfcdelivery.co.nz/ ongoing scam

All,

You might’ve seen ‘kfcdelivery.co http://kfcdelivery.co/.nz’ pop up on social media today. It’s a scam.

If you have the ability to block this website so your users cannot reach it, please do so. If you have stuck your CC details in there, cancel your card.

It is hosted through CloudFlare, don’t block the IPs, but perhaps you can filter on your DNS or something.

I have reached out to the registrar for the domain to get it blocked (discount domains). If anyone has a contact there other than support@ to get it pulled ASAP, please use it - I don’t know anyone there.

The logic of the site is roughly: <snip> # Validate input and set error if validation fails

if(error){ "You must fill in the red fields" }else{ "Our servers are down due to heavy traffic, please try again later" }

# send data to servers anyway </snip>

-- Nathan Ward

_______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz mailto:NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog http://list.waikato.ac.nz/mailman/listinfo/nznog

_______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz mailto:NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog http://list.waikato.ac.nz/mailman/listinfo/nznog_______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog