Emails with the URL anoniemberichtje.com is a phishing attempt and you will get a expensive SMS subscription

MX Lab intercepted some emails with the subject “Lees ffkes mn bericht” – can be translated to “read my message”.

This message is written in the Dutch language – some words in a dialect – and it is targeting Dutch email users  - and is notifying the recipient that a private  messages is waiting to be read.

The message appears to be coming from a Hotmail.com account and is sent from one of the Hotmail servers with the IP 65.55.111.173. The IP seems to be a valid IP address being used by Hotmail.

IP Address: 65.55.111.173
Host: blu0-omc4-s34.blu0.hotmail.com
Location: US, United States
Organization:  Microsoft Corp

The body of the email:

Ik heb u juist een anoniem berichtje gestuurd, kunde da ffkes lezen?

Klik op onderstaande link om het berichtje te zien.

hxxp://www93.anoniemberichtje.com/?message=3191332f9645ad23fc538e1932cd936d

Wij zijn de enigste die het berichtje kunnen zien.

Stuurt ge wa terug?

Translated to English:

I just send you an anonymous message, can you read it?

Click on the link below to see the message.

hxxp://www93.anoniemberichtje.com/?message=3191332f9645ad23fc538e1932cd936d

We are the only one who can see the message.

Do you send something back?

When following the URL you will get the following screen.

Great, you will need to fill in your Windows Live account details on a non Microsoft web site. This looks to me like a genuine phishing attempt in the first place.

We filled in some dummy email address and password combination and the webpage becomes visible.

It’s all in Dutch but I will give you an idea of what this page is about. “You have received 1 private message” and you will need to fill in your mobile number in the webform. From that point on, you will receive an SMS and you will need to confirm your mobile number.

After that, the private message for you will be visible and you can also send unlimited private messages.

The web site also states “Are you under 18? Ask permission from your parent or guardian” and to the right, the black box with 3355 – which is a special mobile SMS number – and 28.00 € / week does make it appear that you will subscribe to a sort of SMS service for that amount each month.

Now, the domain anoniemberichtje.com is registered with the following details.

Domain Name      : anoniemberichtje.com
PunnyCode        : ANONIEMBERICHTJE.COM
Creation Date    : 2010-09-02 13:59:22
Updated Date     : 2010-09-14 09:32:35
Expiration Date  : 2011-09-02 13:59:19

Registrant:
  Organization   : wu ling
  Name           : wuling
  Address        : ShangHai
  City           : Shang Hai
  Province/State : Shanghai
  Country        : cn
  Postal Code    : 200085

Administrative Contact:
  Name           : wuling
  Organization   : wuling
  Address        : ShangHai
  City           : Shang Hai
  Province/State : Shanghai
  Country        : cn
  Postal Code    : 200085
  Phone Number   : 86-755-12345678
  Fax            : 86-755-12345678
  Email          : lixing763@yahoo.cn

Technical Contact:
  Name           : wuling
  Organization   : wuling
  Address        : ShangHai
  City           : Shang Hai
  Province/State : Shanghai
  Country        : cn
  Postal Code    : 200085
  Phone Number   : 86-755-12345678
  Fax            : 86-755-12345678
  Email          : lixing763@yahoo.cn

Billing Contact:
  Name           : wuling
  Organization   : wuling
  Address        : ShangHai
  City           : Shang Hai
  Province/State : Shanghai
  Country        : cn
  Postal Code    : 200085
  Phone Number   : 86-755-12345678
  Fax            : 86-755-12345678
  Email          : lixing763@yahoo.cn

So, the conclusion is that you better do not attempt to fill in your mobile number or your Windows Live account details.