WARNING: Hacking attempt

marol · Postby **marol** » Wed Oct 12, 2005 9:14 pm

WARNING!

Some users received following mail:

It's been two weeks since you registered for a Cantr II account. We
hope you're having a great time. Please log into your account through
http://comservhost.com/cantr within 3 days to confirm that you are
checking your e-mail regularly and it belong to you.

Jos Elkink
Cantr Administrator

This is probably hacking (phishing) attempt to steal your password by fake Cantr login page. If you logged by this page, then you have to change your password immediately.

nitefyre · Postby **nitefyre** » Wed Oct 12, 2005 9:21 pm

Grzegorz,

All that I received in your PM was the following:

WARNING! Some users received following mail

Edit : better now

marol · Postby **marol** » Wed Oct 12, 2005 9:25 pm

60 seconds later I corrected this message

You're fast.

Oasis · Postby **Oasis** » Wed Oct 12, 2005 9:56 pm

Jos? Find anything on this?

I hope no one clicked this link. Thank you for posting it, Marol.

Sparkle · Postby **Sparkle** » Wed Oct 12, 2005 9:59 pm

Tsk tsk tsk...*shakes head*

Bowser · Postby **Bowser** » Wed Oct 12, 2005 10:39 pm

Someone please explain this to me, it hasn't happened to me, but are you trying to tellme that someone is going through all this trouble to get my Cantr password so they can make my characters do funny things?

AngelSpice · Postby **AngelSpice** » Wed Oct 12, 2005 10:47 pm

Maybe someone wants to have your charries give theirs all their worldly goods?

Savanik · Postby **Savanik** » Wed Oct 12, 2005 10:54 pm

$ whois comservhost.com@whois.wildwestdomains.com
[whois.wildwestdomains.com]
The data contained in this Registrar's Whois database,
while believed by the company to be reliable, is provided "as is"
with no guarantee or warranties regarding its accuracy. This information
is provided for the sole purpose of assisting you in obtaining
information about domain name registration records. Any use of
this data for any other purpose is expressly forbidden without
the prior written permission of the Registrar. By submitting an
inquiry, you agree to these terms of usage and limitations of warranty.
In particular, you agree not to use this data to allow, enable, or
otherwise make possible, dissemination or collection of this data, in
part or in its entirety, for any purpose, such as the transmission of
unsolicited advertising and solicitations of any kind, including spam.
You further agree not to use this data to enable high volume, automated
or robotic electronic processes designed to collect or compile this data
for any purpose, including mining this data for your own personal or
commercial purposes.

Please note: the owner of the domain name is specified in the "registrant" field.
In most cases, the Registrar is not the owner of domain names listed in this database.

Registrant:
SETH EDWARDS
2715 W LIBERTY ST
GIRARD, Ohio 44420
United States

Registered through: powerhoster.com
Domain Name: COMSERVHOST.COM
Created on: 23-Jun-05
Expires on: 23-Jun-06
Last Updated on: 31-Jul-05

Administrative Contact:
EDWARDS, SETH SLE09@AOL.COM
2715 W LIBERTY ST
GIRARD, Ohio 44420
United States
(330) 530-3410
Technical Contact:
EDWARDS, SETH SLE09@AOL.COM
2715 W LIBERTY ST
GIRARD, Ohio 44420
United States
(330) 530-3410

Domain servers in listed order:
PARK5.SECURESERVER.NET
PARK6.SECURESERVER.NET

Cheers!

Sav

Racetyme · Postby **Racetyme** » Wed Oct 12, 2005 11:06 pm

Sav, could you explain the relevance of your post to me, I don't really understand exactly what is going on with it. I know I probably just misread it, but humour me please.

Savanik · Postby **Savanik** » Wed Oct 12, 2005 11:19 pm

That's the whois information for the site the phishing email directs you to. The Whois database stores contact information about who manages a web site.

I would give fairly good odds that the person listed as the 'technical contact' for that site is the person trying to get people's passwords. It's possible that I'm incorrect, however.

Sav

[ed] P.S., if anyone has header information from an email such as this, I'd be interested in taking a gander through it.

Racetyme · Postby **Racetyme** » Thu Oct 13, 2005 1:13 am

Gotcha, I figured it was something of the type.

marol · Postby **marol** » Thu Oct 13, 2005 6:31 am

Savanik wrote:P.S., if anyone has header information from an email such as this, I'd be interested in taking a gander through it.

I'll contact with one of its victims.

Oasis · Postby **Oasis** » Thu Oct 13, 2005 6:36 am

Just to note, we have no player by the name Seth Edwards, nor anyone with his email address.

Postby **Jos Elkink** » Thu Oct 13, 2005 1:52 pm

No no, Seth Edwards is not suspicious

... He's a web provider. We have clearer indications of who is behind this and the ProgD is a few steps ahead of this thread

... We're just warning people about this site, but we're also investigating of course, behind the scenes ..

Savanik · Postby **Savanik** » Thu Oct 13, 2005 3:49 pm

Jos Elkink wrote:No no, Seth Edwards is not suspicious ... He's a web provider.

Ehh? What kind of web provider uses AOL as their contact email?

Obviously he is not l33t.

Ah, well. Sorry for the confusion from my end.

Sav

WARNING: Hacking attempt

WARNING: Hacking attempt

Who is online