Phishing e-mail

[Xeanor]

Just got another scam e-mail trying to take my daoc passwords, I'm guessing they got my password through this site as this is kind of the only daoc forum I actually have my e-mail in my profile.

Dear user , You have submited a password change request . Click here and you will be forwarded to a password change form.


If you aren`t the person who submited the request , submit a complaint here and we will investigate this fraud attempt.




Warning : NEVER communicate your passwords.You will be asked fot them by members of the Dark Age of Camelot - Europe team only in actions against fraud
Dark Age of Camelot - Europe team
http://www.camelot-europe.com

camelot-europe.info ....


and they're asking for your "e-mail password"


well you have to be pretty dumb to do that, but nonetheless, I thought I'd post it here to warn some others.


but how can they mask the e-mail so that it seems i got it from noreply@goa.com ?

 

[old.Whoodoo]

Bloody yanks:

Domain ID9406393-LRMS
Domain Name:CAMELOT-EUROPE.INFO
Created On:13-Jan-2005 11:55:15 UTC
Expiration Date:13-Jan-2006 11:55:15 UTC
Sponsoring Registrar:R139-LRMS
Status:ACTIVE
Status:OK
Registrant ID:C8519847-LRMS
Registrant Name:Kenneth Allen
Registrant Organization:Ford
Registrant Street1:595 east 13800 south
Registrant City:raper
Registrant State/Province:UT
Registrant Postal Code:84020
Registrant Country:US
Registrant Phone:+1.4355925692
Registrant Email:hunting_shits@yahoo.com
Admin ID:C8519847-LRMS
Admin Name:Kenneth Allen
Admin Organization:Ford
Admin Street1:595 east 13800 south
Admin City raper
Admin State/Province:UT
Admin Postal Code:84020
Admin Country:US
Admin Phone:+1.4355925692
Admin Email:hunting_shits@yahoo.com
Billing ID:C8519847-LRMS
Billing Name:Kenneth Allen
Billing Organization:Ford
Billing Street1:595 east 13800 south
Billing City:raper
Billing State/Province:UT
Billing Postal Code:84020
Billing Country:US
Billing Phone:+1.4355925692
Billing Email:hunting_shits@yahoo.com
Tech ID:C8519848-LRMS
Tech Name Domain Administrator
Tech Organization:HyperMart
Tech Street1:70 Blanchard Road
Tech City:Burlington
Tech State/Province:MA
Tech Postal Code:01803
Tech Country:US
Tech Phone:+1.8772875929
Tech Email:domreg@hypermart.net
Name Server:NS1.HYPERMART.NET
Name Server:NS2.HYPERMART.NET

Just in case:

Domain Name: CAMELOT-EUROPE.BIZ
Domain ID: D9019129-BIZ
Sponsoring Registrar: TUCOWS INC.
Sponsoring Registrar IANA ID: 69
Domain Status: ok
Registrant ID: TUSP8NJEJYTDWFCK
Registrant Name: Ted Lefer
Registrant Organization: ford
Registrant Address1: 200 East End Ave. 9J
Registrant City: New York
Registrant State/Province: NY
Registrant Postal Code: 10128
Registrant Country: United States
Registrant Country Code: US
Registrant Phone Number: +1.2122882507
Registrant Email: stonefingers.x@gmail.com
Administrative Contact ID: TUSP8NJEJYTDWFCK
Administrative Contact Name: Ted Lefer
Administrative Contact Organization: ford
Administrative Contact Address1: 200 East End Ave. 9J
Administrative Contact City: New York
Administrative Contact State/Province: NY
Administrative Contact Postal Code: 10128
Administrative Contact Country: United States
Administrative Contact Country Code: US
Administrative Contact Phone Number: +1.2122882507
Administrative Contact Email: stonefingers.x@gmail.com
Billing Contact ID: TUSP8NJEJYTDWFCK
Billing Contact Name: Ted Lefer
Billing Contact Organization: ford
Billing Contact Address1: 200 East End Ave. 9J
Billing Contact City: New York
Billing Contact State/Province: NY
Billing Contact Postal Code: 10128
Billing Contact Country: United States
Billing Contact Country Code: US
Billing Contact Phone Number: +1.2122882507
Billing Contact Email: stonefingers.x@gmail.com
Technical Contact ID: TUO9DFJNVBT0GATD
Technical Contact Name: Domain Administrator
Technical Contact Organization: HyperMart
Technical Contact Address1: 70 Blanchard Road
Technical Contact City: Burlington
Technical Contact State/Province: MA
Technical Contact Postal Code: 01803
Technical Contact Country: United States
Technical Contact Country Code: US
Technical Contact Phone Number: +1.8772875929
Technical Contact Facsimile Number: +1.7819988586
Technical Contact Email: domreg@hypermart.net
Name Server: NS2.HYPERMART.NET
Name Server: NS1.HYPERMART.NET
Created by Registrar: TUCOWS INC.
Domain Registration Date: Thu Feb 17 16:55:24 GMT 2005
Domain Expiration Date: Thu Feb 16 23:59:59 GMT 2006

and

Domain ID: )104574248-LROR
Domain Name:CAMELOT-EUROPE.ORG
Created On:27-Jun-2004 23:28:32 UTC
Last Updated On:27-Aug-2004 03:56:37 UTC
Expiration Date:27-Jun-2005 23:28:32 UTC
Sponsoring Registrar:OVH SARL (R135-LROR)
Status:OK
Registrant ID:ZYDFXI8996-OVH
Registrant Name:BARBARELLA
Registrant Organization:
Registrant Street1:141 Route Leon Lachamp
Registrant Street2:
Registrant Street3:
Registrant City:Marseille
Registrant State/Province:
Registrant Postal Code:13009
Registrant Country:FR
Registrant Phone:+33.000000000
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:iglesias_raphael@hotmail.com
Admin ID:SDTKZG566-OVH
Admin Name:BARBARELLA
Admin Organization:
Admin Street1:141 Route Leon Lachamp
Admin Street2:
Admin Street3:
Admin City:Marseille
Admin State/Province:
Admin Postal Code:13009
Admin Country:FR
Admin Phone:+33.000000000
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:iglesias_raphael@hotmail.com
Tech ID:SDTKZG566-OVH
Tech Name:BARBARELLA
Tech Organization:
Tech Street1:141 Route Leon Lachamp
Tech Street2:
Tech Street3:
Tech City:Marseille
Tech State/Province:
Tech Postal Code:13009
Tech Country:FR
Tech Phone:+33.000000000
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:iglesias_raphael@hotmail.com
Name Server:NS.OVH.NET
Name Server:NS.OVH.NET

More available...

 

[Feyd]

but how can they mask the e-mail so that it seems i got it from noreply@goa.com ?

Its pretty simple.
The from field is a plain text field, so you can enter whatever you want in that.
It is only used when the recipient press 'reply'.

However som mail servers do check if the from mail-adress is from the same domain as the mail-server.


(hope this give any sence)

 

[IainC]

Thanks for the heads-up.
As ever, be very careful if you get an unsolicited email like this. We will never ask you for your email password (why would we need it?).
Our password retieval system works very differently too. An email will be sent to your registered emal address containing a link, follow it and you will see your new pasword, you will not be asked to enter your subs password. You should never enter any of your passwords in any webform unless you have reached it from a link on the official site. If you are in any doubt, delete the email and request a new password from the official subscription site. A new request will overwrite any previous one and you should get an email asking you to confirm the request within a few minutes.

 

[Shanaia]

Same typo again as in the last scamemail ... "You will be asked fot them by members of the Dark Age of Camelot - Europe team only in actions against fraud "

Seriously if you're gonna go trough the trouble of bloody scamming people out of their accounts at least have the brain to proofread your e-mail MORONS.

 

[blackshadow]

And it seems they aren't only in need of your game password
also credit card numbers etc seen at

http://www.camelot-europe.info/cc.htm

what Morons tbh , get a life etc

 

[Tesla Monkor]

Someone write an email-generator to spam their form with junk. Or feed them a few emails that are fake, but filled out with believable words.

 

[Awarkle]

denial of service attacks are against the law even if you do target these sorts of people.


Frankly just find out where he lives and do a google search for hitmen im sure they got a website then we all band together and pay to have them taken out

You think a court of law will prosecute about 10000 people

Btw this is a joke and i dont condone hiring hitmen to take out spammers i would rather do it myself

 

[Ctuchik]

Domain Name:CAMELOT-EUROPE.INFO
Created On:13-Jan-2005 11:55:15 UTC
Expiration Date:13-Jan-2006 11:55:15 UTC
Sponsoring Registrar:R139-LRMS
Status:ACTIVE
Status:OK
Registrant ID:C8519847-LRMS
Registrant Name:Kenneth Allen
Registrant Organization:Ford

lol... Ford as in the car company or what???

 

[old.Whoodoo]

I decided to dig a little deeper, and after finding the host comapanies email, i sent them a nice mail explaining. First they sent me a mail stating that "He is a regular and valued customer, we see no reason to suspend his site."

So I wrote back in my usual passive way (if calling them monkey-boy and net-n00b is considered subtle), explaing how this was a physhing scam. Heres todays reply.

Hello, We have suspended the website http://www.camelot-europe.info/form.htm on ourservers. Please let us know if we may assist you further in any way.
Sincerely,
Mac Hall
Customer Support

So justice was served...albeit too late but hey, the systemcan work

 

[Takhasis]

I decided to dig a little deeper, and after finding the host comapanies email, i sent them a nice mail explaining. First they sent me a mail stating that "He is a regular and valued customer, we see no reason to suspend his site."

So I wrote back in my usual passive way (if calling them monkey-boy and net-n00b is considered subtle), explaing how this was a physhing scam. Heres todays reply.
So justice was served...albeit too late but hey, the systemcan work

OMG WHoodoo shut down camelot-europe!!!! so thats why the servers broke!

quick kill him!!!

 

[Fana]

Well done Whoodoo

 

[Tasslehoff]

I decided to dig a little deeper, and after finding the host comapanies email, i sent them a nice mail explaining. First they sent me a mail stating that "He is a regular and valued customer, we see no reason to suspend his site."

So I wrote back in my usual passive way (if calling them monkey-boy and net-n00b is considered subtle), explaing how this was a physhing scam. Heres todays reply.
So justice was served...albeit too late but hey, the systemcan work

That's cool

 

[Shanaia]

Go Whoodoo Go Whoodoo Go Whoodoo Go Whoodoo !

 

[old.Whoodoo]

Go Whoodoo Go Whoodoo Go Whoodoo Go Whoodoo !

Im on a roll today