That sucks. Sorry to hear it.

So do we get rid of this site? Is there anyway to notify Yahoo of this so others do not fall into this trap. I also wonder how many other geocities pages they have that they are using?

This is getting really bad and I don't see how its going to get better anytime soon!

The anti-Phishing component in IE 7 caught this site as being a suspicious website.

So maybe there is hope! Now we need to make sure Firefox and Safari include this technology to protect the masses!

How do we know that it is really you writing this blog?

I reported the site to Yahoo. Haven't heard anything from them.

Here's their email: mailto:phishing-abuse@cc.yahoo-inc.com

I was recently victim to a huge phishing scam with a major online auction site (can't discuss details as the lawsuit is still pending)...several thousand dollars worth of phishing to be exact. I trust absolutely NOTHING on the internet now.

Joe, good question. How do you know I've ever written any posts on this blog? This is all produced by an automated vbscript.

What? Don't I get some credit for reporting this to you? How about some love?

Don't feel bad. I think your IM phish was the fourth one I got this month. Of course, they were from all biz dev types...You were the first tech guy -- you get a cookie!

Thanks man. I showed some love in my last post. Thanks man!

So what did you do to regain control of your account? I think I am suffering from the same thing!

I contacted Yahoo Customer Care. I had to fax them the information I used when first signing up for the account.

I did the same thing and went to a geocities site sent to me from someone on my buddy list. I copied and pasted the link into my browser and it stole my password. When I signed up with that yahoo account I used false informatio that I didnt write down. Yahoo customer service is worthless. I have been trying to learn how to hack just to get my own email account back.

Same thing happened to me 2 days back. I opened the link when I just woken up. I have emailed yahoo customer support. I am not sure if they will resolve it. :(

Hey I am also suffering from same thing..Please help me getting back my inbox and other contacts.My id is also hacked .Please help me what should I do?? Your help will be greatly appreciated

I am also a victim along with 10 other friend of mine. Two more links
-->http://geocities.com/great_new_pics0288_3858/

-->http://www.geocities.com/pics_of_me_2007/

How long did it take you to get back your account?

How did you contact Yahoo Customer Service.Please give me details

I contacted them via their website. You can go to this link Yahoo Customer Care.

This happened to me today. I reported the url to US-CERT.GOV for good measure. I also reported it to google at http://www.google.com/safebrowsing/report_phish/

Anyway, i found that my yahoo userid and password got sent to staff.yahoo.mail.admin@gmail.com

via http://www2.fiberbit.net/form/mailto.cgi

I did whois on this domain and it's registered to someone in Japan.

I realized that this might be phishing and confirmed it using a network tcp packet sniffer to watch the http traffic. I changed my password immediately, so I should be ok.

Note that IE7 and Firefox 2 will have anti-phishing measures.

Joe Hanink

My account got hacked too. I received this link a geocities from a relative 2 - 3 weeks back saying yahoo owns geocities now and view my photographs.. i logged into it to view the photos.. the id got hacked on aug/19/2006.
i lost my id and it is not verifying my personal information :(

can anyoone help me in retrieving my password? :-(

-Hina

I just got nailed today and now I cannot get my ID, Mail or anything else to work. I've contacted yahoo customer care, but have not heard anything back yet. How do I get my Id back? I need some serious help here!!
~KIDD~

On August 18, 2006 I became a victim of a phishing scam through my yahoo messenger. I have call yahoo at there customer support # which is 866 562 7219 which I just get referred back to emailing yahoo security which is
account-security-help@cc.yahoo-inc.com
which I have sent over 30 emails asking for help. The sad thing of this matter is the hacker change all aspects of my account information, my zip code don't match what yahoo has on record now. The secret question they ask for I don't recall. So to make a long story short I loss pictures I had stored of my children, family, friends and several contacts that I only had stored there. Yahoo has been NO help at all to me. So I guess the phishing hacker won this battle with the help of yahoo customer service if any one reads this with a similar experience that finally got there account back please let me know I'll be back checking this site... Thanks for letting me Vent...Steve

Same happen to me has anyone here, got their account back yet? Trying to determine how long it will take to get your account back, if you can at all.

- and so i join the esteemed club of those snookered by the geocities phishing scam. my old account is still active, but i cannot access it because, as you all know, the personal information and security questions have been changed by the interloper. - yahoo was indeed useless to me, but it isnt really their fault. - i have pretty much given up on ever getting my old id back, but i am curious; does anyone know who these people are, what they are looking for and 'why' my account would still be active months after being hacked? - (i remain open to suggestions for retrieving my old id.) - good luck to all sabatoged.
- die phisher scum.

I clicked on a link from a friend, and it said yahoo pictures so stupid me put in my yahoo name and password and someone hijacked my account. I know some of my friends on messenger got the link from me but I didn't send it. I guess it sent after I clicked it and they lost their yahoo accounts too. If you did have this happen you need to email yahoo at this email addres.
account-security-help@cc.yahoo-inc.com
I got this email from the support guy at yahoo. The phone number there is 1-866-562-7219. It took me forever to find this number so write it down for safe keeping. If you email them about your account being stolen, in the subject just type your yahoo id and then in the body explain what happened. They will email you back an auto response and you fill it in and email it back. I guess I forgot my security question or something and they emailed me back and told me to fax them my state id. I did this and a few days later they emailed me and I had my account back. It took me about a week to get this done. Hope this helps anyone out there.

This may help. I forgot I still had this. This was my final step in getting back my ID. It worked for me. Good Luck.

Hello Susan,

Thank you for writing to Yahoo! Account Security.

We apologize for the miscommunication that contributed to this
confusion.

In order to assist you with the account in question, we ask that you
provide the answers to all of the questions below. Yahoo! keeps
detailed records of the information you provided during the registration
of your account. Without an *exact* match we will be unable to assist
you with your account. Fax or send via regular postal mail the
information listed below. (We are sorry for the inconvenience, but in
order to provide proper security for our member accounts, these steps
are necessary.) Please send us all of the following:

* Your name

* An email address where we can contact you -- at this time we are only
able to reply via email.

* Copy of a state/government issued photo ID (please copy on the
lightest setting of your copier).

* Yahoo! ID

* Permission for Yahoo! to enter your account

* Birthdate on the account

* ZIP code and country

* Your alternate email address

Please fax the information to:

(503) 615-3883
Attn: CC Account Security Team

or mail it to:

Yahoo!
attn: Customer Care/Account Security
701 First Avenue
Sunnyvale, CA 94089-1019

For security reasons, if you are unable to supply us with the correct
information in your next request, we will not be able to offer
assistance with this account.

The latest scam is to send links to Geocities sites that appear to have amusing or sexual content, i.e. www.geocities.com/blondybabe_45325, www.geocities.com/spermbank_sarah, and www.geocities.com/eat_my_cherry_pie10. After being tricked into logging on, you are either directed to a Geocities web site that has the type of content you expect, or else the "build your own website" generic Geocities page.

I did not ever lose control of my account, the hijacker seemed to only use my IM to send out more links to other users. But I do not use Yahoo! Wallet (for precisely this reason) and use this account only for social email and chat - so there was not really anything else useful the hackers could get from me besides a possible way into more profitable accounts.

I too have recently received an IM suggesting there were new photos at a geocities site from one of my Yahoo! Messenger friends. Not really thinking about it, I clicked. I have my settings so that I am always already signed into Yahoo! sites when I click from a messenger window so was never asked for my ID and password...I simply was brought to an error page. I sent an offline to my friend saying I wasn't able to see her pictures and she eventually IMed back saying she never sent that IM to me. :o Yikes! Well, I don't believe I have at any point so far lost control of my Yahoo! account, but as a precaution, I did change my password.

thanks this is really useful ... Since I was also victim of that.

Just had a similar (lucky) escape. Received an IM from a buddy, who's obviously fallen for this phish to "visit this really cool site" clicked on the link:

http://www.geocities.com/nkygirlie/

and was shown a geocities 360 beta log in page. Logged in and sussed it straight away and changed my password immediately. I almost got suckered though because it was from someone I knew.

I too fell for this scam. I thought, gee, I guess 'profile-surfers' got tired of me blocking them and reporting them as spam and they finally reported me. I too go to the 'yahoo website' and put in my info and BAM, there it all went wrong.
Anyway, all of you know what happened after that. I emailed Yahoo on Monday morning around 9 a.m. I got an email telling me how to change my password. I told them I already did that. They emailed me and asked for my secret answer. I told them that since I started this ID 10 years ago, I can't remember what the question was! I got another email telling me how to change my password. This went on for 3 days or so. On Friday A.M., I got another email telling me what my Security Question was, so I emailed back the answer. FINALLY, Friday afternoon around 4, my password was changed back and MY YAHOO IS BACK!!!!
So, the moral of this story? PERSISTANCE PAYS OFF!!!! Good luck for everyone who is still trying to get their ID back!

hi all, i just got phished sunday morning after clicking on a link saying that i would find my pictures being used there. well, low and behold i couldnt enter my account after being kicked off of it. it keeps saying invalid. i emailed yahoo several times and i even called customer care in which they referred me to this email in which i send them all my original registration information.
now im waiting for a response from the email in hopes of getting my yahoo account back. how can i remember the secret question if when i request my password, my zip code was changed? this is a job in itself!! the information provided on this sited is pretty useful, thanks alot guys. and good luck to all in pursuit of getting your accounts back.

I wonder about one thing, you are saying its your friend's or bosses or relatives on your yahoo buddy list , so they are the hackers or some one who hacked their accounts sending these URLS ?

Kevin

Now that we all know that our account has been hacked and being misused, Yahoo should help us in getting our account back with any proof we have that proves our ownership of account. If they will ask predefined questions like date of birth, pin code etc etc and insist on their exact match, they are doing nothing but help the hackers.

I got victimized by this phising this morning when I carelessly clicked on a link on an offline message from a relative (there are more than 10 of them listed). When an empty IE window opened I immediately remebered about this scam and I opened another IE window to log in to my yahoo Inbox and lo! I got the wrong password error three times I tried. Got back to IM immediately, clicked on the email icon below for my Inbox, a prompt that asked if I want to log automatically came up, I chosed yes and then I got to my Inbox with relief and immediately changed my password, saved!!!

I got tricked into this one too, and I am usually so careful!
I would like to know to, what's a hacker want with my yahoo info? I mean, what's the point of this scam?

>> http://www.geocities.com/picturesofme_61

This is the link I got from my friend on friday, and saturday, everybody on my buddylist got an offline message from me with a somewhat similar link. Then I figured I got tricked. One of my friends who got the link suggested me to change my password. Maybe the hackers are trying to get credit information or such from our accounts. Who knows, I changed the password immediately. I am not sure if they will be able to continue what they intended. I am sorry for the friends who got the link from my account... Hope nobody gets tricked.

My turn.

As of this morning, 11/06/06 I lost the ability to sign into my Yahoo messenger and e-mail .

About three or four weeks ago, someone on my Yahoo messenger sent me and instant message, saying to check out a profile on geocities. I assumed it was a friend of hers.

I clicked on the link. What appeared as a geocities sign in page appeared. I put in my username and password. I got the response "web site busy, check back later".

I wrote customer care this morning because I can't remember all my original info since i moved several times.

Told them to either cancel the account completely or help me with a new password.

Oh well.

From a friend of mine, a heartwarming tail xD
>>>
Just wanted to let you know, I almost fell victim to the same thing. A friend of mine who had a certain sense of humor had her account hijacked, and sent me a message in much the same fashion. Timeline:

1. Attempted login at the phishing site the first time, used wrong password.

2. Wondered why I didn't get logged in. Tried again with real password.

3. Now really wondered why I didn't get logged in. Then recalled that the form data sent the stuff to some third party site, and that Yahoo Photos wasn't on Geocities.

4. Hit back, viewed source code of page, noticed form was being sent to third party unsecure mailer cgi. Resent username and password, with password as "Fuck you".

5. Found password changer on yahoo site, changed password twice, just in case a bot was able to login and survive one password change. (You never know)

6. Thirty minutes later, sent off 20,000 faulty username/password combinations through same mailer to the gmail account of the phisher.

7. Switched to random interval mailings of the same thing, so that they blend in with stolen real username/password combinations. (To date: several days)

8. As a result, received buddy list request from someone named "Fucking_stop_emailing"

Just wanted to share with you all

Keep sending - don't stop!!!

==
Mine and my wife's ID has been stolen a week ago.. the same link-from-body scam. Talked to Yahoo customer (don't) care and got into a vicious circle - can't provide alternate address, because phisher has already changed it... therefore can't get back my account. Asked them to delete my account and they keep asking me for the password. How do I get a new password? By alternate email address, of course! Dumb operators.

Talked to a supervisor but she kept asking me the same question - the alternate email address!!! What a stupid situation? Is there a way to TALK to somebody there who has brain? There are so many ways to verify an identity.

If I would intend to "steal" somebody's email address, would I call Yahoo's customer service at all?

A follow up report. I called Yahoo customer service yesterday morning. Surprisingly, I had very little problem getting through.

Long story short: The only thing Yahoo can do for you is what you can already do for yourself.

If you click on the LOST PASSWORD link, there is a form to enter your date of birth, zip code, username.

Now, supposedly, it's supposed to be based on your ORIGINAL zip code when you first signed up. This says to me that even if the hacker changed the zip code after stealing the account, Yahoo's database should have a record of the original zip code on file.

Unfortunately, I cannot backtrack far enough to figure out which zip code it was. So again, they can't help me.

So once again: The only thing Yahoo can do for you is what you can already do for yourself. They are basically no help at all.

Fortunately (like Scott St above 09/19/06) I only used the account for anonymous social networking and chat. No credit cards were associated with the account.

Obviously the hackers are using the account to send out the false geocities sign in pages to more people; but to what end?

KEEP POSTING PEOPLE...THIS IS A HOT TOPIC

I was also a victim of this incredible prank.
My screen name was used to IM to all my friends and family, including my 13 yr old niece.
I was really upset, thanks to the Lord she was not able to enter the site.
It is unreal that Yahoo can't do nothing to help us in this matter.
I talked to Latoya, a Yahoo customer rep., and she said the only thing I could do was change my password weekly. By doing that it would be more difficult to the jacker to get access to my account or any other account.
And today, it was confirmed when a friend emailed me to tell me that she also got jacked.
If you see an IM from me or anyone with the link http://www.geocities.com/ladivabev/photos_pics.html (or rather any geocities link) DO NOT CLICK ON IT.

SUCCESS!

I managed to "hack" my way back in this morning.

I am laughing at myself for putting in information that was so misleading even I couldn't remember it. (I didn't want my exact birthday since someone could combine that with some other account information). I had to guess what I was thinking at the time.

My suggestion is this:

Click on "Forget your ID or Password"

Write down every zip code you've lived at since you created that Yahoo username.

Put in your birthday and username

When you get that much it gives you a security question you put in. After that it gives you a new password to use on the screen.

Some things to note:

The hacker didn't open a single e-mail. They were all unread. Even the e-mail confirming the hacker's password change was unread. I can't figure out the purpose of this "scam" if you can even call it that.

The hacker didn't go into any of the Yahoo services I was using, like Photos or Groups, for instance.

What a sigh of relief that i got control of my account back.

Good luck!

Is this where all the crying goes on or does it help with info and actions? Cause i dont see any info on what to do. But then again i spose' thats typical.

My name has been hacked into also! I cannot find out anything. They changed my password and all of my information! Please help!!!

hey for the people who got there password back do you have any info on what the hacker changed the password too?

this may help us all cause im pretty sure this dude is not changeing all the passwords with diffrent names he will be useing the same password for all his little stoleing acounts?

EITHER:

1. Call Yahoo customer service - 1-866-562-7219

OR:

2. Or click on the link on the e-mail log on page, "Forgot your ID or Password?", and fill out the info: Birthdate, Zip Code, Country, letter from the security image, and your Yahoo ID. If this information matches the info in Yahoo's database, the next screen will be a security question that you orginally used like favorite pet or mother's maiden name(you probably forgot you ever did that).

As was mentioned earlier, when I regained control of my account, I went straight to the e-mail where I had about 150 unopened e-mails. Nothing was tampered with. It's almost as if the goal of this Phishing scam is not to get personal information but to cause inconvenience.

I highly, highly, doubt that this is one "dude" using the same password. This is something that's replicating itself to happen to so many users.

someone got into my yahoo account and changed my account info and password so i couldn't recover my password or anything.
I emailed yahoo constantly but never got anywhere as they kept asking for account info which the hacker had changed.
Eventually I phone yahoo customer services in the UK (0870 3522000). They asked me for my brithdate and then got me to give them a list of people's addresses in my address book to confirm it was catually my account.
I've now got my account back!

I just got off the phone with Chester at Yahoo! customer care and he took care of the problem. I am now able to access my account!
I have changed my password, and will probably change it at least weekly.

Probably the best time to call the folks is around 3pm pacific time. I called at around 5:48 pm eastern time.

I hope this gives someone hope!!
C.

to be are not to be......

this attack is still going around, as I fell for it a few days ago in the exact same way. :-P

I just faxed off the info to Yahoo! Customer Care...

n8

I haven't a clue how or when my yahoo id was stolen. I didn't check it all that often. But when I went to do my check in it told me my password was wrong. So I wasn't sure if they had sut down my email address or not. So I sent a few emails to my old address and they went through which tells me my old address is still up and running. I've been in contact with Yahoo for awhile now and nothing concrete yet.

Well I got it back today but it seems it was all for nothing as I had 0 mail items now in my account. Oh well at least I don't have to worry about someone mis using my account.

someone stoled my friends name i want to get it back how do i?