Weird e-mail asking for PB account password

Derlidio · Post by **Derlidio** » Sun Jul 18, 2004 4:12 pm

Today I received an weird e-mail asking for the username and password I use to access PB secure download area. I'm sure that if PB team was having some kind of trouble with that resource they shall post something here, at this forum, probably under the "Announcements" topic. I think I'm not the only one who got that message, and I hope that nobody has replied to it at all (since I think it is clearly an attempt of some nasty guy to breach PB download area security system).

The message received follows:

The following is an email sent to you by Admins via your account on PureBasic. If this message is spam, contains abusive or other comments you find offensive please contact the webmaster of the board at the following address:

purebasic@myforums.net

Include this full email (particularly the headers). Please note that the reply address to this email has been set to that of Admins.

Message sent to you follows
~~~~~~~~~~~~~~~~~~~~~~~~~~~

===================

I am a supporter of purebasic and i just talk you that we are changing our system (host/database...) and we had a problem small with your account. For fix that problem in future, we will need some informations from you.

We need this informations to fix your problem in future:
1.Your current email
2.Your current password
This informations was using for longin at http://www.purebasic.com/securedownload/Login.php

And remember: send email direct to customer_pb@yahoo.com (Don't post it at otherwhere because as you know it need private)

Thank for reading.
Purebasic Support

In case I'm wrong about this conclusion, please, let me know...

Pupil · Post by **Pupil** » Sun Jul 18, 2004 4:17 pm

Your conclusion is correct, there was a thread earlier about the exact same thing, only a different user. See here:
viewtopic.php?t=11747

thefool · Post by **thefool** » Sun Jul 18, 2004 4:25 pm

The following is an email sent to you by Admins via your account on PureBasic

We have an user named "Admins" who have asked people for their password once. "Admins", if this is you again, please stop this shit.
but this is not a job for me, but for the real admins. Would you take a look at this problem?

thefool · Post by **thefool** » Sun Jul 18, 2004 4:32 pm

@Derlidio:

Please try to view the source of the mail, and see if you can track it down.
Or send the whole mail source(the whole source. including headers) to fred or freak. Maybe they can track down the email and do something about this.

Derlidio · Post by **Derlidio** » Sun Jul 18, 2004 4:51 pm

I've sent a whole copy of the e-mail to Fred. I hope he can take appropriated steps in order to stop this threatening spammer.

thefool · Post by **thefool** » Sun Jul 18, 2004 4:55 pm

@fred:

the email tells about you should send the pass and usrname to

customer_pb@yahoo.com

. What about asking yahoo about this mail adress?

Derlidio · Post by **Derlidio** » Sun Jul 18, 2004 4:56 pm

If someone else wants to help track down the sender, here comes a copy of the message source:

Code: Select all

Return-Path: <customer_pb@yahoo.com>
X-Original-To: derlidio@chromatick.com.br
Delivered-To: derlidio-chromatick.com.br@oneserver.com.br
Received: from mail.myforums.net (unknown [65.110.56.190])
	by mail.oneserver.com.br (Postfix) with SMTP id 869A62F0112
	for <derlidio@chromatick.com.br>; Sun, 18 Jul 2004 01:35:58 -0300 (BRT)
Received: (qmail 32585 invoked by uid 48); 18 Jul 2004 04:13:45 -0000
Message-ID: <20040718041345.32584.qmail@mail.myforums.net>
To: derlidio@chromatick.com.br
Subject: Hello, Purebasic customer.
MIME-Version: 1.0
Content-type: text/plain; charset=iso-8859-1
Content-transfer-encoding: 8bit
Date: Sun, 18 Jul 2004 04:13:45 UT
From: customer_pb@yahoo.com
X-AntiAbuse: Board servername - jconserv.net/purebasic
X-AntiAbuse: User_id - 1253
X-AntiAbuse: Username - Admins
X-AntiAbuse: User IP - 203.197.234.177
X-UIDL: `_[!!YSh"!R>d!!&=W"!

Hello Derlidio,

The following is an email sent to you by Admins via your account on PureBasic. If this message is spam, contains abusive or other comments you find offensive please contact the webmaster of the board at the following address:

purebasic@myforums.net

Include this full email (particularly the headers). Please note that the reply address to this email has been set to that of Admins.

Message sent to you follows
~~~~~~~~~~~~~~~~~~~~~~~~~~~

===================

I am a supporter of purebasic and i just talk you that we are changing our system (host/database...) and we had a problem small with your account.  For fix that problem in future, we will need some informations from you.

We need this informations to fix your problem in future:
1.Your current email 
2.Your current password
This informations  was using for longin at http://www.purebasic.com/securedownload/Login.php

And remember: send email direct to customer_pb@yahoo.com (Don't post it at otherwhere because as you know it need private)

Thank for reading.
Purebasic Support
====================

thefool · Post by **thefool** » Sun Jul 18, 2004 4:59 pm

X-AntiAbuse: Username - Admins

I belive we have trouble with the user "Admins"..
Admins, who are you and what are you doing?

thefool · Post by **thefool** » Sun Jul 18, 2004 5:02 pm

it seems that "Admins" is coming from india.

he used the myforums email service to send this mail..

customer_pb@yahoo.com

that must be "Admins" e-mail.

Did a whois on the ip

X-AntiAbuse: User IP - 203.197.234.177

203.197.234.177
delhi-203.197.234-177.vsnl.net.in
Host reachable, 1340 ms. average

203.197.234.176 - 203.197.234.191

VSNL DELHI - Leased Line TV-18 TISL MEDIA
India
for abuse and spam related complaints
abuse@vsnl.com

IP Administrator
ip.admin@vsnl.co.in
6th Floor, LVSB, VSNL
Kashinath Dhuru marg, Prabhadevi
Dadar(W), Mumbai 400028
India
phone: +91-22-56633503
fax: +91-22-24320132

VSNL Tech
ip.tech@vsnl.co.in
6th Floor, LVSB, VSNL
Kashinath Dhuru marg, Prabhadevi
Dadar(W), Mumbai 400028
India
phone: +91-22-56633503
fax: +91-22-24320132

TV18-ND
Updated: 23-Jun-2004 by ip-admin@giasbm01.vsnl.net.in
Source: whois.apnic.net

hmm. the admin of his ip?

IP Administrator
ip.admin@vsnl.co.in
6th Floor, LVSB, VSNL
Kashinath Dhuru marg, Prabhadevi
Dadar(W), Mumbai 400028
India
phone: +91-22-56633503
fax: +91-22-24320132

@Admins (the user "Admins", not the real ones): Stop this shit..
but anyway it would be nice if the real ones would do something about this. I belive they will when they are visiting the board next time-

And about the mail again:

The following is an email sent to you by Admins via your account on PureBasic. If this message is spam, contains abusive or other comments you find offensive please contact the webmaster of the board at the following address:

purebasic@myforums.net

Include this full email (particularly the headers). Please note that the reply address to this email has been set to that of Admins.

I guess you already done that.

and again, "Admins" i guess you are in trouble now..

newbie · Post by **newbie** » Sun Jul 18, 2004 5:15 pm

Hmmm that's a very bad english in addition, Fred has a better english than that !

Moreover, the two email adresses given are not "offcial" or standard, they are not related to purbasic.com domain.

Derlidio · Post by **Derlidio** » Sun Jul 18, 2004 5:17 pm

Indeed, I did

I just hope that the fact of exposing this guy don't bring me consequences.

thefool · Post by **thefool** » Sun Jul 18, 2004 5:19 pm

indeed he has a better english.:

and i just TALK you that we are

@"Admins": Maybe you shouldnt irritate 1000 forum users at a programmer board, because as you guess, most of us have more knowlegde about internet than you ever will get.!
Or at least you wont get knowlegde by doing stupid things like this

kake26 · Post by **kake26** » Sun Jul 18, 2004 6:28 pm

Hi guys,
On a related note I got contancted via yahoo instant messenger by some guy. He said he needed the update for PB, but his ISP blocked purebasic.com cause it had the same name server as a porn site. I entertained this guy for a while and told him if he did legally buy it then he needs to talk to Fred. He kept insisting that he needed it ASAP. Some people may have notice me talking about this on the IRC channel. Needlessly, said the guy got nothing more than Fred's e-maill addr and the IRC chan info out of me. I just thought I'd report this since we are on this topic anyhow.

thefool · Post by **thefool** » Sun Jul 18, 2004 6:30 pm

it seems that there is a lot of this shit going on. but i hope fred or freak will take a look at it. (i dont know if berico is also an admin)

NoahPhense · Post by **NoahPhense** » Sun Jul 18, 2004 6:36 pm

I'm gonna need all of yalls passwords to fix this problem.. 8O

- np