Case:
Not so technical colleague got scammed for 2 months rent. What can he do?<p>Steps:
1. He found apartment listing on immobiliare.it<p>2. Some emails were exchanged<p>3. He receives the link to the _real_ airbnb listing<p>4. He cant find it there, and the scammer sends the phishing page[1] (from @expertdesigner.eu)<p>5. Soon after he receives another email saying that the database is down from @airbnb.sa.com and he should meanwhile move the money using transferwise.com<p>6. Payment done<p>7. Scammer replies: Payment received<p>The login page was quite well made, and I think most of non technical people might get fooled<p>[1] The URL: https://airbnb.com-itinerary.app/rooms/762837232/files/login.php?id=572465&locale=en&sale=203&<p>Thoughts?
I don't have any advice but I hope they are able to recover their money. Shitty people like that are why some US states like Massachusetts now require all renters to find apartments through a registered broker. Sounds nice and safe but it ended up in me paying 4 months rent to get a new apartment. (2 months rent + security deposit + broker fee which was over a month's rent)
There's more to it, more php machinery, but in short:<p><i></i> Basic Info<p>- username at home dir: comitin1
- LiteSpeed server
- SERVER_ADMIN=webmaster@airbnb.com-itinerary.app
- English not first language<p>- Sends over location, victim ip-port pair, protocol, client, TLS encryption suite<p><i></i> Client (Victim):<p>From main.html:<p>POST /transaction.php?id=1 --> transaction.html<p>POST /transaction-process.php --> attacker no longer cares...empty response body<p><i></i> Admin<p><a href="https://airbnb.com-itinerary.app/rooms/762837232/files/management/" rel="nofollow">https://airbnb.com-itinerary.app/rooms/762837232/files/manag...</a><p>Login with POST /index.php with username and password<p>There is a whole interface for easy management of properties, with its own UI!
It does proper client and server-side validation of inputs, uses a set of images
of houses and hosters.<p>POST /process-data.php<p>POST /send-discount.php for a particular property id<p>POST /edit-discount-process.php