***Caution***: Paypal Users - Page 6

Richard M · 07-02-2005, 19:07

Quote:

Originally Posted by JohnHorb

If not already thought of, a warning e-mail to all registered users might be an idea?

We need to be sure of the facts first.
We recently hired a security company to do an audit of the server and they found no problems FYI.

**Paul** · 07-02-2005, 19:48

Quote:

Originally Posted by Damien

How could they have gotten into the database? Also if they did what are the chances of them getting my password for this site?

Zero chance - passwords are double encrypted with a one way encryption system.
__________________

It does appear that these were somehow sent to the e-mail addresses that people have on the forum. We have checked the server out and found nothing that would indicate how they might have been obtained. It also does not appear to have gone to everyone, only a select number.

Just in case, I spent some time earlier today changing all our database and server passwords.

Another thing we can't tell is how old the addresses they appear to have used are - it could be that they date from a month or more ago, making it almost impossible to ever know how they may have been obtained.

Basically we have investigated as much as we can, and taken all the measures we can think of. I can 100% assure everyone that we have not willingly, or knowingly, given anyones forum e-mail address out to anyone, nor will we do so in the future.

etccarmageddon · 07-02-2005, 19:49

Quote:

Originally Posted by nffc

II'm sure, unless it's got hold of a forum list or something [which reading the thread could be possible] they just generate random addies and hit gold sometimes...

Although, if it had got the forum list, I would have got one...?

BTW, I don't use Paypal, it's too dodgy- too many scams IMO.

my email address is nowt like my CF ID and there's no way a random generator would have come up with it!

so chances are someone got the list by hacking into the database?

TheBlueRaja · 07-02-2005, 20:19

There does appear to be something fishy here, i've never had spam on the e-mail addy i use for this site until now.

And then we all seem to be getting this mail.

So - somethings going on.

Mal · 07-02-2005, 20:40

My address is the same. It's slightly unusual and I never use it to give it out.

altis · 07-02-2005, 20:41

I received one of these this morning. My email addy has only been active for 36 days and this is the first spam I have received on it. My headers are slightly different:

Code:

Return-Path: <nobody@vps.seeitout.com>
Received: from aamta06-winn.mailhost.ntl.com ([212.250.162.8])
          by mta13-winn.mailhost.ntl.com with ESMTP
          id <20050207045724.YNNW11211.mta13-winn.mailhost.ntl.com@aamta06-winn.mailhost.ntl.com>
          for <***@ntlworld.com>; Mon, 7 Feb 2005 04:57:24 +0000
Received: from vps.seeitout.com ([207.58.136.198])
          by aamta06-winn.mailhost.ntl.com with ESMTP
          id <20050207045723.ICEY1438.aamta06-winn.mailhost.ntl.com@vps.seeitout.com>
          for <***@ntlworld.com>; Mon, 7 Feb 2005 04:57:23 +0000
Received: from nobody by vps.seeitout.com with local (Exim 4.43)
	id 1Cy0xd-0004pS-3Z
	for ***@ntlworld.com; Sun, 06 Feb 2005 23:57:21 -0500
To: ***@ntlworld.com
Subject: User agreement has been changed [372002]
From: service@paypal.com
Reply-To: service@paypal.com
Errors-To: service@paypal.com
Date: 2005-02-06 23:57:20
Content-type: text/html; charset=iso-8859-1
Message-Id: <E1Cy0xd-0004pS-3Z@vps.seeitout.com>
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - vps.seeitout.com
X-AntiAbuse: Original Domain - ntlworld.com
X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12]
X-AntiAbuse: Sender Address Domain - vps.seeitout.com
X-Source: 
X-Source-Args: 
X-Source-Dir:

I have tried informing seeitout.com but, so far, there has been no response.

07-02-2005, 20:42

Quote:

Originally Posted by TheBlueRaja

There does appear to be something fishy here, i've never had spam on the e-mail addy i use for this site until now.

And then we all seem to be getting this mail.

So - somethings going on.

I suppose if anyone is really worried about this, they can change their email & password in the CP

http://www.cableforum.co.uk/board/pr...o=editpassword

- I know that is 'after the horse has bolted', but for people who have used an address unique to registration on this forum, it should prevent any future phishing attempts using that addy.

My message came through on my cable forum registered addy - but I do use it elsewhere, so no big - I'm glad i forward my mail to gmail, though - it had put the message in the spam folder, marked as a possible problem, just like Incog's

**Maggy** · 07-02-2005, 20:45

Quote:

Originally Posted by homealone

I suppose if anyone is really worried about this, they can change their email & password in the CP

http://www.cableforum.co.uk/board/pr...o=editpassword

- I know that is 'after the horse has bolted', but for people who have used an address unique to registration on this forum, it should prevent any future phishing attempts using that addy.

My message came through on my cable forum registered addy - but I do use it elsewhere, so no big - I'm glad i forward my mail to gmail, though - it had put the message in the spam folder, marked as a possible problem, just like Incog's

It was picked up as spam in OE by Spamnet(best money I've ever spent) and by Gmail an excellent free service.

iadom · 07-02-2005, 20:45

Add my name to the list, I just got rid of it via Mailwasher.
The one and only time I have used Paypal is for donations to a certain web site.

danielf · 07-02-2005, 20:47

Quote:

Originally Posted by Paul M

<snip>

Another thing we can't tell is how old the addresses they appear to have used are - it could be that they date from a month or more ago, making it almost impossible to ever know how they may have been obtained.
<snip>

The member posting in post 15 received the email and has joined on 15-01-05 (according to his/her profile), so the list cannot be more than 3 weeks old. If others who joined later and got the email would say so, it may be possible to narrow it down further?

BTW, I got one as well, to the address I used for this site, and I have never had a paypal account.

Marge · 07-02-2005, 20:52

I've had two emails as well, one to an email address that I gave to a friend who registered here but has never posted and one that is defo mine that I use here

TBH I'm getting right fed up of these emails, if I ever get my hands on the scrote who's doing this

**Maggy** · 07-02-2005, 20:58

Just out of interest I thought I would check my hotmail addy which I NEVER use but is in my profile as my MSN messenger name(as is my Yahoo Addy for Yahoo Messenger).I do not thus far have any paypal spam in hotmail.

It's all hotmail spam instead

danielf · 07-02-2005, 21:02

Just a thought: The second newsletter was sent out on 24-01-05. Could this have been compromised in any way to show the recipient list?

dilli-theclaw · 07-02-2005, 21:05

I thought I'd add my name to the list of people that have had this email. I got one today and it is the first spam since I came back to ntl.

**Damien** · 07-02-2005, 21:21

Quote:

Originally Posted by iadom

Add my name to the list, I just got rid of it via Mailwasher.
The one and only time I have used Paypal is for donations to a certain web site.

I wonder they is a link between the paypal donate feature and the spam