Title: New Coinbase Spam Post by: cableiso on October 29, 2013, 10:59:46 AM I'm recently getting spam from coinbase pretending to be from this forum. Is this the result of the recent hack? Anyone else getting it? Poorly worded, asking for donations or to sign up for gambling sites?
Title: Re: New Coinbase Spam Post by: rampalija on October 29, 2013, 01:12:17 PM i didnt get any of that messages
Title: Re: New Coinbase Spam Post by: Mitchell on October 29, 2013, 01:14:25 PM I keep getting those kinds of e-mails too. They do not originate from CoinBase but from someone spoofing that.
Title: Re: New Coinbase Spam Post by: MoneyGod on October 29, 2013, 01:40:24 PM I saw someone also made a post about this in General Discussion. It seems to be a phishing scam. I have never message like this may some scammer trying to do something here Title: Re: New Coinbase Spam Post by: gwoplock on October 29, 2013, 02:08:09 PM i got 3 eamils the full content is (my address removed for protection)
Quote Return-Path: <donate@coinbase.com> Received: from smtp02-forward-0.daemonmail.net (smtp02-forward-0.daemonmail.net [216.104.163.150]) by sm03.internetmailserver.net with SMTP; Sun, 27 Oct 2013 21:13:41 -0700 Received: from mxw04.daemonmail.net (unknown [216.104.161.14]) by smtp02-forward-0.daemonmail.net (Postfix) with ESMTP id 2D1628132E for <*@appropriatesystems.com>; Sun, 27 Oct 2013 20:57:52 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mxw04.daemonmail.net (Postfix) with ESMTP id 2F8B52A71E6 for <*@garrettbattaglia.info>; Sun, 27 Oct 2013 20:57:51 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at mxw04.daemonmail.net X-Spam-Flag: NO X-Spam-Score: 0.496 X-Spam-Level: X-Spam-Status: No, score=0.496 tagged_above=-20 required=4 tests=[BAYES_40=-0.001, MISSING_MID=0.497] autolearn=no Received: from mxw04.daemonmail.net ([127.0.0.1]) by localhost (mxw04.daemonmail.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kz2rsgXq+feO for <*@garrettbattaglia.info>; Sun, 27 Oct 2013 20:57:49 -0700 (PDT) Received: from netgains11422.netgainstechnologies.com (netgains11422.netgainstechnologies.com [180.179.114.22]) by mxw04.daemonmail.net (Postfix) with ESMTP id 3FF452A71E5 for <*@garrettbattaglia.info>; Sun, 27 Oct 2013 20:57:47 -0700 (PDT) Received: from home-91e15d0351.user.nevalink.net (UnknownHost [89.223.47.197]) by netgains11421.netgainstechnologies.com with SMTP; Mon, 28 Oct 2013 09:25:58 +0530 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Description: Mail message body Subject: Bitcoin Awaiting your order confirmation To: *@garrettbattaglia.info From: donate@coinbase.com Date: Mon, 28 Oct 2013 07:57:28 +0400 Reply-To: donation@coinbase.com Return-receipt-to: donation@coinbase.com X-Rcpt-To: <*@appropriatesystems.com> Message-ID: <72dbdc94e0764e08a510a668727fb45c@com> X-SmarterMail-Spam: SPF_Fail, SpamAssassin 0 [raw: 0], DK_None, DKIM_None X-SmarterMail-TotalSpamWeight: 5 Donate to the Bitcoin Forum Donation = Bitcoin address: 1KaEvEH1eWf8EXnrUCdsMNt9TucYGXwTZU Litecoin address: LXHR3ThQz2qrJqEXJrce2GsTzEdh5JCZG2 The Bitcoin Forum is a website meant to host free discussion of Bitcoin and= related topics. It is operated as a service to the community, and all prof= it is reinvested into the forum. It was started in 2009 by Satoshi Nakamoto= , the original creator of Bitcoin. It is now managed by Malmi Martti (Siriu= s), Stefan Thomas (justmoon), and Michael Marquardt (theymos). Donated fund= s are managed by theymos. Private Internet Access provides free hosting for the forum. Check them out= for anonymous VPN tunnels. They accept Bitcoin! If you donate some BTC, you can get a special "Donator" title and a green "= who's online" color. If you donate 1 BTC, you get VIP status and the abilit= y to create a custom title for yourself. Both Donators and VIPs also get ac= cess to an exclusive forum section. You must prior to donating if you want = to take advantage of this offer: you will be given a unique donation addres= s. Big Thanx For Help situation and sent for our donate this right now Thank you for your interest in donate! we do and develop an interest for many people and the system in general, it= makes it all bolie popular and we try for you if ever we need your help we hope you will be able to help us and send some= of your coins for us we need money for maintenance and we invite you to support us and make a do= nation to help us We very much appreciate and thank you a lot Quote Return-Path: <activation@coinbase.com> Received: from smtp01-forward-0.daemonmail.net (smtp01-forward-0.daemonmail.net [216.104.162.150]) by sm03.internetmailserver.net with SMTP; Tue, 29 Oct 2013 04:05:43 -0700 Received: from mxw02.daemonmail.net (unknown [216.104.161.12]) by smtp01-forward-0.daemonmail.net (Postfix) with ESMTP id 2A7D181BB7 for <*@appropriatesystems.com>; Tue, 29 Oct 2013 03:49:11 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mxw02.daemonmail.net (Postfix) with ESMTP id 2D589282541 for <*@garrettbattaglia.info>; Tue, 29 Oct 2013 03:49:11 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at mxw02.daemonmail.net X-Spam-Flag: NO X-Spam-Score: -0.002 X-Spam-Level: X-Spam-Status: No, score=-0.002 tagged_above=-20 required=4 tests=[BAYES_05=-0.5, MISSING_MID=0.497, URIBL_BLOCKED=0.001] autolearn=no Received: from mxw02.daemonmail.net ([127.0.0.1]) by localhost (mxw02.daemonmail.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H0RToO-gmIJL for <*@garrettbattaglia.info>; Tue, 29 Oct 2013 03:49:05 -0700 (PDT) Received: from smtp.2164.v.tld.pl (v2164.rev.tld.pl [195.149.231.64]) by mxw02.daemonmail.net (Postfix) with ESMTP id C4B6028254B for <*@garrettbattaglia.info>; Tue, 29 Oct 2013 03:49:04 -0700 (PDT) Received: (qmail 313 invoked by uid 2164007); 29 Oct 2013 10:49:02 -0000 X-clamdmail: clamdmail 0.18a Received: from 89.223.47.197 (HELO home-91e15d0351.user.nevalink.net) (ewa.szymanska@fcmtravel.pl@89.223.47.197) by 195.149.231.64 with ESMTPA; 29 Oct 2013 10:49:02 -0000 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Description: Mail message body Subject: Activation your new account 2013 To: *@garrettbattaglia.info From: activation@coinbase.com Date: Tue, 29 Oct 2013 14:49:07 +0400 Reply-To: activation@coinbase.com Return-receipt-to: activation@coinbase.com X-Rcpt-To: <*@appropriatesystems.com> Message-ID: <c7d000f84abb413d80215a33359b447a@com> X-SmarterMail-Spam: SPF_Fail, SpamAssassin 9 [raw: 3], DK_None, DKIM_None X-SmarterMail-TotalSpamWeight: 14 Activation your new account 2013 Here Yes This individual invite for you https://www.switchpoker.com/?rid=3D4145&link=3D7 The referral bonus will be added to your account automatically Quote Return-Path: <bonus@bitcoin.org> Received: from smtp02-forward-0.daemonmail.net (smtp02-forward-0.daemonmail.net [216.104.163.150]) by sm03.internetmailserver.net with SMTP; Tue, 29 Oct 2013 06:13:44 -0700 Received: from mxw01.daemonmail.net (unknown [216.104.161.11]) by smtp02-forward-0.daemonmail.net (Postfix) with ESMTP id 94E7081212 for <*@appropriatesystems.com>; Tue, 29 Oct 2013 05:54:54 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mxw01.daemonmail.net (Postfix) with ESMTP id 3CF29240951 for <*@garrettbattaglia.info>; Tue, 29 Oct 2013 05:54:53 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at mxw01.daemonmail.net X-Spam-Flag: NO X-Spam-Score: -1.889 X-Spam-Level: X-Spam-Status: No, score=-1.889 tagged_above=-20 required=4 tests=[BAYES_00=-1.9, T_MANY_HDRS_LCASE=0.01, URIBL_BLOCKED=0.001] autolearn=ham Received: from mxw01.daemonmail.net ([127.0.0.1]) by localhost (mxw01.daemonmail.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6z3xe3NWF61J for <*@garrettbattaglia.info>; Tue, 29 Oct 2013 05:54:50 -0700 (PDT) Received: from mail.qatar.net.qa (cactus4.qatar.net.qa [82.148.101.71]) by mxw01.daemonmail.net (Postfix) with ESMTPS id 3785B240EAD for <*@garrettbattaglia.info>; Tue, 29 Oct 2013 05:54:49 -0700 (PDT) MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: text/plain; CHARSET=US-ASCII Received: from home-91e15d0351.user.nevalink.net ([89.223.47.197]) by cactus4.qatar.net.qa (Oracle Communications Messaging Exchange Server 7u4-18.01 64bit (built Jul 15 2010)) with ESMTPA id <0MVF00L3JKMOVQ10@cactus4.qatar.net.qa> for *@garrettbattaglia.info; Tue, 29 Oct 2013 15:50:36 +0300 (AST) Message-id: <0MVF00LZLL0BVQ30@cactus4.qatar.net.qa> Content-description: Mail message body Subject: Bitcoin Your [Procedure Right Now] To: *@garrettbattaglia.info From: bonus@bitcoin.org Date: Tue, 29 Oct 2013 16:54:51 +0400 Reply-to: bonus@bitcoin.org Return-receipt-to: bonus@bitcoin.org X-Rcpt-To: <*@appropriatesystems.com> X-SmarterMail-Spam: SPF_None, SpamAssassin 0 [raw: 0], DK_None, DKIM_None X-SmarterMail-TotalSpamWeight: 0 Bitcoin is a website in which you earn small amounts of Bitcoins in exchange for visiting websites for a designated period of time. You may be required to spend anywhere from one minute, up to five minutes or more on the sponsored website. You must spend the full amount of required time on the website in order to recieve payment. N1 http://minefield.bitcoinlab.org/?r=tjG2tHzTPhhKmkjo N2 http://www.bitcoinget.com/?r=1Akps1g2LETZ2SSB2HZKw5si46quj6WxH8 N3 http://satoshi36.com/ofn Want more free bitcoins? Check out these site N4 https://www.switchpoker.com/?rid=4145&link=7 Get Your Bitcoins Stable Bonus This Start Right Now it would seem that this is a poor phishing scam. it you go to where the message was received from daemonmail.net you get this Quote DaemonMail is a mail sorter and mail handler shared by several ISPs. If you have reached this web page by examining headers found in an unwanted email, please email us the entire message: abuse@daemonmail.net. Be sure to include a full copy of the email headers. You will receive a prompt, personalized response. Our AUP is provided below: DaemonMail Acceptable Use Policy These servers and hosted domains may not be the source, intermediary, or destination address involved in the transmission of junk email, nor may they be listed in any junk email message. The use of these servers to send or relay junk email is prohibited, and will result in a fine. "Junk email" is defined as "any mass unsolicited or unwanted message in any medium." Violation will result in immediate termination of all services without refund. Fines and legal action may be imposed. Any customer who is repeatedly flamed/mail-bombed or attracts such behavior will be asked to leave. Mailing list services are provided for use as discussion forums only, and may not be used to distribute unsolicited email. All users on a list must have personally subscribed to that list. Title: Re: New Coinbase Spam Post by: waltermot321 on October 29, 2013, 02:11:08 PM I get all kinds of emails almost same like this but not from coinbase. So just don't fall into it :)
Title: Re: New Coinbase Spam Post by: gwoplock on October 29, 2013, 03:29:42 PM we could try to email abuse@daemonmail.net and see what happens. Well do that. These kinds of emails need to be stopped.Luckily I'm not getting them. Maybe sign him up on a few gay websites. [/quote] who? Title: Re: New Coinbase Spam Post by: Gemminyc on October 29, 2013, 03:36:01 PM I only receiving Coinbase newsletters. I dont know what is inside becaue I delete these and I cant sign out for newsletters because I lost login info to Coinbase.
Title: Re: New Coinbase Spam Post by: gwoplock on October 29, 2013, 04:01:51 PM I only receiving Coinbase newsletters. I dont know what is inside becaue I delete these and I cant sign out for newsletters because I lost login info to Coinbase. do you have one that you can open. if you have it, can post the raw text (like i did above) of the message so i can look at it? edit: talking about the newsletters Title: Re: New Coinbase Spam Post by: Mitchell on October 29, 2013, 04:05:35 PM I only receiving Coinbase newsletters. I dont know what is inside becaue I delete these and I cant sign out for newsletters because I lost login info to Coinbase. do you have one that you can open. if you have it, can post the raw text (like i did above) of the message so i can look at it? -snip- Title: Re: New Coinbase Spam Post by: cableiso on October 29, 2013, 04:43:16 PM So did the emails only start after the hack? Mine did, and are sent to an email I only use for this forum so it seems related. Might be a path back to the hackers, by determining who they sold lists to.
Title: Re: New Coinbase Spam Post by: gwoplock on October 29, 2013, 04:58:19 PM So did the emails only start after the hack? Mine did, and are sent to an email I only use for this forum so it seems related. Might be a path back to the hackers, by determining who they sold lists to. it seems to be linked to the hack. the "person" this seems to be linked to http://home-91e15d0351.user.nevalink.net/Title: Re: New Coinbase Spam Post by: ekiro on October 29, 2013, 11:24:07 PM I'm not pleased with the amount of sketch activity about bitcoins. Just gives it a bad rep. So uncool when we all want for it to grow.
I say we get the US's backing and have them bomb all threats. Title: Re: New Coinbase Spam Post by: rampalija on October 30, 2013, 10:28:19 AM I guess it is a trick to take your money
Title: Re: New Coinbase Spam Post by: gwoplock on October 30, 2013, 12:29:25 PM I guess it is a trick to take your money this is a poor phishing attempt. do not fall for it. Title: Re: New Coinbase Spam Post by: rigel on October 30, 2013, 12:41:17 PM These messages fail SPF test: http://www.openspf.org/Project_Overview
Your mailserver should perform this test automatically and reject them Title: Re: New Coinbase Spam Post by: gwoplock on October 30, 2013, 01:08:58 PM These messages fail SPF test: http://www.openspf.org/Project_Overview Your mailserver should perform this test automatically and reject them some don't fail. (from what i posted above) Quote X-SmarterMail-Spam: SPF_None, SpamAssassin 0 [raw: 0], DK_None, DKIM_None also spf alone is not going to kick the email out.Title: Re: New Coinbase Spam Post by: rigel on October 30, 2013, 01:38:17 PM These messages fail SPF test: http://www.openspf.org/Project_Overview Your mailserver should perform this test automatically and reject them some don't fail. (from what i posted above) Quote X-SmarterMail-Spam: SPF_None, SpamAssassin 0 [raw: 0], DK_None, DKIM_None also spf alone is not going to kick the email out.Well it depends on the sender domain: coinbase.com has SPF record with fail (-all) default. Messages failing SPF test should be rejected. bitcoin.org has no SPF record, the test makes no sense. Title: Re: New Coinbase Spam Post by: gwoplock on October 30, 2013, 03:21:40 PM These messages fail SPF test: http://www.openspf.org/Project_Overview Your mailserver should perform this test automatically and reject them some don't fail. (from what i posted above) Quote X-SmarterMail-Spam: SPF_None, SpamAssassin 0 [raw: 0], DK_None, DKIM_None also spf alone is not going to kick the email out.Well it depends on the sender domain: coinbase.com has SPF record with fail (-all) default. Messages failing SPF test should be rejected. bitcoin.org has no SPF record, the test makes no sense. then somethings not working because i'm getting them. edit1: i was correct the first time. spf is causing a score of ~ .4 and a score of 5 is required to kick it out (on my email). edit2:i a word Title: Re: New Coinbase Spam Post by: Phinnaeus Gage on November 15, 2013, 03:55:36 AM I just received the same email.
|