redbuddy.be, dynasale.be, linkteria.be: Facebook Phishing Scam

by Jordan Yerman | May 23, 2009 at 07:43 am
28074 views | 22 Recommendations | 28 comments

I had a new private message in my Facebook inbox which simply read "look at redbuddy dot be". That's it. From a friend who normally, you know, actually writes stuff. So right away the security alarms were going off... I typed in the url (since I'm on a Mac) and sure enough Safari's phishing alert popped up. 

Apparently some of my other friends have gotten this as well, along with one pointing to "dynasale dot be". So watch out, Facebookers... avoid actually navigating to redbuddy.be or dynasale.be. Those be phishy waters... Updating to add linkteria.be, whitemart.be, indigoline.be, areps.at... hey, any PM that tells you only to visit a strange link... don't do it.

recommend This comment thread is now closed
1
Amy Judd

I hope people see this before they click on anything if they get one of these messages!

0
cob

i clicked on it and when it opened, it was obviously a phishing site so i closed it.... hope i have nt exposed my PC 2 any nasty stuff?

0
cob

i clicked on it. i hope i have nt harmed my PC in any way?

0
Amy Judd

If you have spyware sofware on your computer, you should be ok.

0
kgcobb

Does this do any damage?  What should someone look for who got the Mac security pfishing message when they went to the redbuddy site?  Stupid me-- I knew it looked funny but the person who sent it to me sends links so I just went there... any ideas?  I am on mac.

0
jonothan

When you visit the site it is a fake facebook sign-in page. I guess that if you type in your email and password in the normal way it will email those details to whomever owns the redbuddy site.

0
Marie Palmer

I think I may have logged into the redbuddy one instead of facebook. Do they steal your password? Does anyone know if I need to reset my password? I guess I should just in case.

0
rob rob

i effin clicked on it and signed in.  i knew i shouldn't have done it.  so i changed my password and cleared my cache. i'm on a mac btw.  hopefully nothing bad happens.  any thoughts anyone?

0
beth_ott

i am not too computer saavy, and i entered in my password with login information.  i immediately have changed my password.  what else should i do to ensure that nothing else happens on my computer?

0
internutter

thanks for leetting us no abouut this!

0
cob

i think what it does if u sign in is send the same message from ur box 2 all ur contacts so they get the same message u got originally ..changing ur password shd help by protecting u from further invasion... i tink...

0
albertacowpoke

Thanks for this Jordan.  Good stuff to know. 

0
macarios

i dont get it, i opened the facebook message but didn't click on anything. will anything still happen?


0
Amy Judd

I don't think so, no

4
Reo

I typed this link into my browser (Firefox 3.0.10) and it immediately downloaded AND EXECUTED a file called "f.exe".  This is the first time I have ever seen a file run ON MY COMPUTER simply by clicking a link (in FF no less).  My software firewall (Comodo IS) started going crazy, warning me that "f.exe" was trying to modify registry entries, etc...

I immediately rebooted my computer and started in safemode.  I ran Spybot S&D, AVG & Malwarebytes.  AVG found "f.exe. and reported it as "Trojan horse SHeur2.AHBP"

If any of you visited this site and successfully saw the facebook login page, YOU MAY BE INFECTED.  Follow the steps I outlined above to remove this virus.

0
N

I got one too!

Actually it was supposed to me who sent the message to everyone!  I wasn't even awake at the time.

I don't even remember logging out Facebook yesterday either, but it was logged out.  I just changed my password.

0
Crap

does it harm Mac's?

1
dragon12345_6

Yeah I got this message too. It said that May Lo ( my aunt) sent me the message. I clicked on the link on my email to take me to the message and it told me "Look at this site redbuddy dot be". Since it was from my aunt supposedly, I typed the addy in and thank go I had the phishing guard on for firefox and it told me that this was a phising scam site and that it blocked the site. Then I did a search for this and came aross this site and thank go I read it. Now, I  tried to send a message and tried to write on the wall to the people on my facebook list about what I got and what it does and this link too but it would not let me send or post the message. It keeps giving me some sort of error or verification error or the message that some of the content is offensive content and it will be blocked but I have no offensive content what so ever. Soooo... I finally tired to make the message I wrote to a jpg and then I was able to send it on facebook. So peoples try to send a message about this to your facebook friends and see if you get the same problem and let me know thanks.

0
chelle888

I just got the redbuddy.be message yesterday and today I got a new one from a friend who never sends me any notes. This one says "look at this 'picoband.be.'  I didn't  googled and found this site so I never  went to either website.  Thank you!! 

0
SL

I got one directing me to whiteflash.be and another to linkteria.be

Wonder what's up with the whole Belgian thing.

0
s&snmtown

I got the message to got to linkteria.be just today but it is from a person who never sends me anything so it would have been important.  This most certainly wasn't important and just looked just exactly like it is... phishy.  I'm glad I didn't click on it and did a search on it first.

0
Bunnybrownie

I've recieved this Phishing Scam email from a cousin I would never get an email from, but is a friend of mine on Facebook.

So does this mean he may have been nfected, & if so, the email is trying to infect me because he may of been infected himself by accidently clicking on the link?

I've left a note on my Facebook homepage warning my friends, thanks to this website x

0
pranoy

yes even i got this thing and thankfully before actually browsing for it my friend forwarded this message to me. thanx a lot.

0
CARLOS62

Thank you for writing this.


great work.

0
Colin Byrne

Anyone that signed in should change there password not only in facebook but in anything else that they use the same password in. A lot of people use the same username and passwords for several different accounts and as a result they might have access to your emails, bebo, twitter, depending on what ones you use the same ID/Password combination.

I went to the site but copped it for what it was, running a scan on my computer now.

0
Sana Tawileh

I tried to publish your article on my facebook page, couldn't because it was blocked and got the following message:

"Some content in this message has been reported as abusive by Facebook users."

I'll publish it on twitter! ;)

0
Mr.sim

What is this all about? a friend on facebook asked me to check this out, but i dont understant

0
Fwiss

I got a PM for Dynasale dot be(or de)

I knew this was not right, and I heard about this stuff in the news. I sent a PM to my friend saying she had been hacked. Was that stupid?

0
Aida

I was looking through my sent messages on facebook and I saw that I had sent a message to all my friends saying hello and then as the body 'linkteria.be'

I sent an apology to my friends. A few days ago (my mac automatically signs me in) I tried to go on facebook and it wouldn't let me sign in. So I changed my password. Is that all I need to do to stop the phishing scam?

This story was created over 3 months ago, the comment thread is now closed.

What is NowPublic?

NowPublic lets people work together to cover news events around the world.

Find out more

Crowd Power

Suranee
First Flagged at 8:44 AM, May 23, 2009 by Suranee

Most Recommended Stories in Tech & Biz

Recommendations (22)

Most recently recommended by:
 

closeSign in to NowPublic

is reporting from