Renderosity Forums / Community Center
Welcome to the Community Center Forum
Forum Moderators: wheatpenny Forum Coordinators: Anim8dtoon
Community Center F.A.Q (Last Updated: 2024 Dec 24 5:51 am)
Subject: Has your rosity email been lifted by spammers?
I've been studying the headers - they are almost completely forged. It's not going to do much good tracking the authors.
The real issue is how did they get our addresses.
Yesterday I changed my profile to a new R'osity specific address. I have received over a dozen forum ebots since, but no spam on the new address.
I have received 5 spams on the old address. Remember that one was the address I used when I made my first-ever purchase.
I think those of you who are getting spam should pick a new address, perhaps make one up through spamgourmet.com as I did. Don't make any purchases. If you still get ebots but no spam on the new address, that's going to be interesting. If you intend to make a purchase, try using yet another new address just for the purchase. Then switch back to your #2. If you get spam on #1 and #3 but not on #2, that will be very very interesting.
Personally, I'm not going to make a purchase just to test the behavior, but if you're going to buy something anyway, it might be worth a few extra minutes.
And a question for the admins - when you say you made new accounts, did you make really altogether new renderosity accounts - meaning no way to tell they are administrator accounts? You might even have to do that from new IP addresses.
A smart hacker could have put a back door in your marketplace that collects email notifications of people who have money (i.e. are clearly buying things), but would make some effort not to spam an administrator.
Renderosity forum reply notifications are wonky. If I read a follow-up in a thread, but I don't myself reply, then notifications no longer happen AT ALL on that thread. So if I seem to be ignoring a question, that's why. (Updated September 23, 2019)
Here's one.
I haven't made any purchases at all here..nothing, nada, in about seven years, but I got an email in my Renderosiy Site Mail.
Honestly, I don't know what "Site Mail" is, or how it differs from an IM, but nevertheless, it's there:
Quote -
From Miss Christelle Adams,
christelleadams008@yahoo.com christelleadams0/0/8/at/yahoo/dot/com
This letter may come to you as a surprise due to the fact that we have not yet met,but it should'nt,since we are determined to get what rightly belongs to us anyhow,but soon when every thing goes according to plan.The message could be strange but reality will definitely dawn on you, if you pay some attention to it's content. I would'nt have notified you but for the sake of your integrity and goodwill.Please accept my sincere apologies.
In bringing this message to you, I have to say that I have no intentions of causing you any personal pains or discomfort.My name is Christelle Adams ,23 years of age,living in the company of my junior brother a native of Dabou in Cote D'ivoire.
SNIP
And, of course, it continues along that standard scam.
Note that this was only here, on this site, and was not forwarded to my regular email addy I have registered here.
Note also that I do not have a paid Renderosity email account.
Two questions I have:
- How did I get that here, but not in my normal email?
- Why is it an email, and not an IM?
I figure if I'm getting such stuff, alot of other, more active members here must be, too. I'd repeat, i have boght nothing from the store since 2000 or so, and nothing, ever, with the email address I have now. Totally different ISP.
Quote - And a question for the admins - when you say you made new accounts, did you make really altogether new renderosity accounts - meaning no way to tell they are administrator accounts? You might even have to do that from new IP addresses.
A smart hacker could have put a back door in your marketplace that collects email notifications of people who have money (i.e. are clearly buying things), but would make some effort not to spam an administrator.
The test accounts had no tie to our Renderosity position. I made a few from several different places, my work desktop, my wireless laptop at home and a neighbors desktop. And the other admin did theres from different places as well so they were just "general, generic" accounts like anyone else could set up
Mike,
Since we removed the email feature here we have noticed an increase in members joining then using the sitemail system to send spam. This one you got had already been reported and taken care of. I think the "spammers' used to use the email feature here since you didn't have to be logged in to do that but since we removed it then I think they still think they are sending actual emails but its not, its instant message and if someone replied to one of these, they wouldn't get their email address just username which they had to send the sitemail to begin with.
Mike,
Since we removed the email feature here we have noticed an increase in members joining then using the sitemail system to send spam. This one you got had already been reported and taken care of. I think the "spammers' used to use the email feature here since you didn't have to be logged in to do that but since we removed it then I think they still think they are sending actual emails but its not, its instant message and if someone replied to one of these, they wouldn't get their email address just username which they had to send the sitemail to begin with.
**But the thing I noticed the most was that they got through the filters when a site mail notification was sent.
So my question is not what is site mail, but how do the notifications get sent? Is there anything there that is any different from forum or gallery ebots? Or even the MP or the newsletter?**
The sitemail is like "instant message" so it doesn't have anything to do with an email account. Its just a Renderosity site feature that you have to be registered to send an Instant message from one member to another. There are no spam filters with Instant Message since it doesn't travel to an email account, its internal within the Renderosity site.
Did I explain that right? LOL.. You know whats going on with me this weekend Janet so just bear with me if I didn't get that out clearly:)
**I know Stac, and I'm not trying to add to things. Believe me.
I guess what I'm asking about is the notification itself. Is there about those that are different from anything else that comes from Rendo automail?
I just had another get through the filters and with it was a site mail notification. I don't have them get through when there's a gallery ebot or forum ebot or purchase confirmation or even the newsletter. They only get through with the site mail notification.
I do still get those types, but unless there's a site mail notification, the spam filter catches them and junks them. 183 to date just from the last 4 days. 15 more got through.
Psst....She make it there okay?**
Yes she did make it there okay and things went well this morning. I'll fill you in as soon as I can.
Okay now I understand what you are asking. I thought you were asking about the sitemail itself and how it works. You are talking about if you have sitemail notifications turned on to receive an email when you have a new sitemail right?
I am sorry I haven't read all the thread, too many pages, but this is something that has struck me recently.
I wasn't sure about this previously, but being away from the MP & forums here for a few weeks, I did notice my spam was down to 2-3 /day, since I have come back & started posting again, & have made purchases from the MP, my spam has quadrupled.
The best & most beautiful
things in the world cannot be seen nor touched... but felt in the
heart.
Helen Keller
My
Gallery
My
Freebies
My
Store
Hi all - here's another data point. In case you didn't read all the way up to here, I started getting spam when I made my first-ever purchase a couple weeks ago.
9 days ago I changed my rendo email to a new disposable address, and left the old one just counting emails instead of forwarding them.
In the 9 days, my old address has seen 31 spams, while my new address has seen zero spam and 42 legitimate site notifications.
This is not proof by any means, but I am strongly inclined to suspect the marketplace notifications have been compromised. For years before purchasing I never got spam on my rendo address, and since my new address has never made a purchase, I get no spam on it.
Prior to making my first and only purchase, I had received well over 3500 ebots and other emails from rendo without a single spam.
Renderosity forum reply notifications are wonky. If I read a follow-up in a thread, but I don't myself reply, then notifications no longer happen AT ALL on that thread. So if I seem to be ignoring a question, that's why. (Updated September 23, 2019)
Quote - Hmm insteresting but I buy all the time and before July never recieved spam or phising emails, its somewhere but where is the whole point of this thread,
This moring I recieved 4, which means either some of the spammers have been taken offline or they are gearing up for a double whammy
Angela
So is that the general consensus, that it started to be serious in July? A clue as to when the infiltration happened, perhaps? Therefore perhaps a clue to who?
I'm surprised there is not a poll to get data about this. I wonder how many are like myself. I made a purchase after July - got hit with spam. Changed my address and make no purchases, no more hits with spam.
I realize there are probably plenty of people who made a purchase and have NOT received spam. We can't learn anything from that, unless you believe the spammer's system is perfect and that 100% of potential victims are in fact spammed. Then we could dismiss the marketplace as a unique issue.
On the other hand, if everyone who receives spam made a purchase after July, that would be pretty interesting.
Renderosity forum reply notifications are wonky. If I read a follow-up in a thread, but I don't myself reply, then notifications no longer happen AT ALL on that thread. So if I seem to be ignoring a question, that's why. (Updated September 23, 2019)
"For years before purchasing I never got spam on my rendo address, and since my new address has never made a purchase, I get no spam on it.
Prior to making my first and only purchase, I had received well over 3500 ebots and other emails from rendo without a single spam."
That's interesting. I've said a couple or three times that I don't get spam on the address I use here, but then I've never bought anything here. If I do I think I'll change to a different email address, just to be sure (taking off and nuking from orbit would be overdoing it).
;)
Well I have only 4 today so something is up with the dudes in badland, either they have been shutdown or they are ready to begin in earnest tommrow, really they are so annoying, but I live to report, lol. Give me satisfaction to know they will eventually get closed down.
Whats worrying is that this and last week there have been banking malware emails going out, not just spam which I never get but phising and malware banking scams
Angela
Quote - My spam has dropped by 95%, they either found something or closed something whichever I am very great full
Not mine. I've got 112 sitting in my spam box at gmail since November 17th, and that doesn't include about 30 or so which found their way through gmail's spam filter and was forwarded to my outlook. And they are all phising type emails all saying I won something or have some inheritence etc.
"It is good to see ourselves as
others see us. Try as we may, we are never
able to know ourselves fully as we
are, especially the evil side of us.
This we can do only if we are not
angry with our critics but will take in good
heart whatever they might have to
say." - Ghandi
Quote - I do not get spam which sell you things only emails that try to rip your details off
Yep, that's the types of spam emails that come through my renderosity specific email address. I got one today from "The Royal Bank of Canada" or so it said, asking me to update my PIN because it was mismatched, and it was specific to tell that I was to verify my secret question and answer. I don't even deal with the RBC but it's a large bank and I sure hope that someone else who gets that and does deal with RBC doesn't take the email at face value as being from them, because it clearly wasn't if you looked at the properties.
"It is good to see ourselves as
others see us. Try as we may, we are never
able to know ourselves fully as we
are, especially the evil side of us.
This we can do only if we are not
angry with our critics but will take in good
heart whatever they might have to
say." - Ghandi
Acadia
What you are discribing is called Malware Infected Emails, most people online must know by now that banks do not email customers to update anything via email.
I have been reporting those as well. I have not been online now for 3 days and I only have 13 spam messages so yes its dropped and they have done something.
The ones probably getting through now are the lists of emails that have been sold by the spammers. But I will keep reporting them so they close those portals that they use too.
I have closed down one in my country Australia. My ISP was livid that scammers were using there network to send out phising emails, but this is not the norm for most ISPs they dont care they use filters and what gets through they shrug there shoulders, what I report something gets done with.
Janet no point is saying what was done online as they might be watching. They have all these clever tricks in there bag of goodies which they use to enter websites. I for one am happy they plugged whatever it was.
Quote - Janet no point is saying what was done online as they might be watching. They have all these clever tricks in there bag of goodies which they use to enter websites. I for one am happy they plugged whatever it was.
**True, true. We just say thank you and don't question the small miracles. smiles
Happy to report that in 3 days only 4 junk mails as opposed to over 100 in the same time frame a couple of weeks ago.**
LOL, will do, one thing I cannot stand is online criminals, they think they can hide but if you have an ip address its not possilbe. Sooner or later someone with a special program will come along and no more hiding for these guys.
They need a real job, oh I have one for them they can clean my house, do washing, take my kids to school and do the shopping that should keep them busy LOL
Yesterday I received 9 pieces. Today 3.
I don't know if the spammers have taken a break because there are days where I receive more spam than others or if Renderosity found the leak and plugged it.
Stacey can you give us an update as to what is going on behind the scenes with the programmers? Did they find the problem and fix it?
"It is good to see ourselves as
others see us. Try as we may, we are never
able to know ourselves fully as we
are, especially the evil side of us.
This we can do only if we are not
angry with our critics but will take in good
heart whatever they might have to
say." - Ghandi
Quote - I'll repeat the crucial line here: Members systems are most likely infected with trojans generating spam. So what do you think you prove with above mentioned actions?
What guarantees do you have that the system used by the person you sent an email to is not generating spam (with a possible spoofed alias)!!!
DUDE! Creating an email for Renderosity which you DO NOT SEND EMAIL FROM does not get caught up in someone else's trojan if it's only been entered in the Renderosity Database and NO PLACE ELSE! Learn to Read!
Privacy Notice
This site uses cookies to deliver the best experience. Our own cookies make user accounts and other features possible. Third-party cookies are used to display relevant ads and to analyze how Renderosity is used. By using our site, you acknowledge that you have read and understood our Terms of Service, including our Cookie Policy and our Privacy Policy.
And there you go like I said Nigerian Scammers, forgot it, its usless tracing them and compliaining what we need to do it plug the leak.
% This is the AfriNIC Whois server.
% Note: this output has been filtered.
% Information related to '41.219.192.0 - 41.219.255.255'
inetnum: 41.219.192.0 - 41.219.255.255
netname: SA57-20070717
descr: Provider Local Registry
descr: Starcomms Nigeria (v4 allocation)
country: NG
org: ORG-SA57-AFRINIC
admin-c: NS4-AFRINIC
tech-c: MQ1-AFRINIC
status: ALLOCATED PA
mnt-by: AFRINIC-HM-MNT
mnt-lower: STARCOMMS-MNT
mnt-domains: STARCOMMS-MNT
source: AFRINIC # Filtered
parent: 41.0.0.0 - 41.255.255.255
organisation: ORG-SA57-AFRINIC
org-name: Starcomms
org-type: LIR
country: NG
address: Bishop Kale Close
address: Des Saka Tinubu Street
address: Victoria Island
address: Lagos
phone: +23418048000
e-mail:
admin-c: MQ1-AFRINIC
tech-c: MQ1-AFRINIC
mnt-ref: AFRINIC-HM-MNT
mnt-by: AFRINIC-HM-MNT
source: AFRINIC # Filtered
person: NAVNEET SINGH
address: Plot 1261, Bishop Kale Close, off Saka Tinubu
address: Victoria Island, Lagos, Nigeria
phone: +234-1-804-9370
fax-no: +234-1-811-0301
e-mail:
nic-hdl: NS4-AFRINIC
source: AFRINIC # Filtered
person: Maher Qubain
address: Starcomms Nigeria Limited
address: Plot 1261, Bishop Kale Close, off Saka Tinubu
address: Victoria Island, Lagos Nigeria
phone: +23418048000
e-mail:
nic-hdl: MQ1-AFRINIC
mnt-by: STARCOMMS-MNT
source: AFRINIC # Filtered