Someone tried to retrieve my mtgox password

[ploum]

I received a mail from MtGox saying that I tried to reset my password.

This was not me (this is obvious, the request is coming from a Windows PC  )

But the strangest thing is that if you try to reply to the mail (as they told you to do if you haven't requested the reset), the mail is sent to :
Mt.Gox@w001.mo.us.xta.net

Do you smell that?

[1714598876]

1714598876

[1714598876]

1714598876

[nosfera2]

No way! They hacked Mt Gox again and changed the domain name!

[Dirt Rider]

I received the same email.  Looks like some form of phishing attempt.

[Dirt Rider]

No way! They hacked Mt Gox again and changed the domain name!

No.  Anyone can send you an email and set the reply-to address to be anything they want.

[Vince Torres]

I think this is a conspiracy. We need some answers.

[ploum]

With the list of users and their email address having been made public, I'm astonished we are not receiving more of those 

[Dirt Rider]

I think this is a conspiracy. We need some answers.

Oh give me a break.  Have you never received spam and/or phishing emails?

[EricJ2190]

All of Mt. Gox's mail originates from the server w001.mo.us.xta.net. Just check the headers on your account recovery emails. The fact that is shows up in the From address of the password reset email is probably just a mistake on their part.

[twobitcoins]

I received such an email.  I determined it was most likely from Mt. Gox because I had recently changed my email address on Mt. Gox to a new, unique one and the email came to that address.  The strange From field is disconcerting, but I think it is a misconfiguration rather than an attack in this case.

[LightRider]

I have received a similar message, although I had not made such a request. The IP address the request originated from is a tor server in Germany. Someone is definitely trying to break back into the accounts.

[Dirt Rider]

All of Mt. Gox's mail originates from the server w001.mo.us.xta.net. Just check the headers on your account recovery emails. The fact that is shows up in the From address of the password reset email is probably just a mistake on their part.

So confirm that the address is real by looking at the header of the suspect email?

Sure, I suppose it's possible that MtGox just goofed on the reply-to, which of course means that someone requested password recovery for my account and also ploum's (and it wasn't us).

[nosfera2]

No way! They hacked Mt Gox again and changed the domain name!

No.  Anyone can send you an email and set the reply-to address to be anything they want.

Whooshitywhoo!  

[Dirt Rider]

I have received a similar message, although I had not made such a request. The IP address the request originated from is a tor server in Germany. Someone is definitely trying to break back into the accounts.

Ok so someone is for some reason triggering password recovery requests.  I am not sure what they have to gain from that, unless they think they can somehow intercept the outbound email messages from MtGox, that's a scary thought.

[Seraphim401]

I got the same e-mail,be careful guys.
 

[dacoinminster]

I got it too. I'm relieved that lots of people got this - I thought maybe someone had hacked my email and they were trying to reset my password because they knew they had access to my email.

Of course, I don't have enough BTC to be worth stealing, so they would be disappointed even if it worked

[Vinnie]

I got it, too.

[kwukduck]

too, as have 2 of my friends.

[Rogue Star]

at first i thought it was someone trying to reset my password because the IP was off. then I thought it was a phishing attempt when i saw the reply to address was weird after responding. i don't know what to think now, but i'm still leaning toward phishing :-/

in any case i forward it to mtgox which triggered the support site to create a ticket, hopefully i'll hear back from them.

[dacoinminster]

They replied to my support ticket as follows:

Ticket #****: Re: [Mt.Gox] Password recovery

Your request (#****) has been deemed solved.

To review, comment and reopen the request, follow the link below:
http://support.mtgox.com/tickets/****


Jiraiya, Jun-28 18:33 (JST):

Hello,

We have identified an issue with our password reset system that caused many users to receive unsolicited password reset emails. It is likely this was the cause of you receiving this email.

We would, however, like to remind you that having the same password for multiple online accounts is not secure.

Thanks,
Regards,
Jiraiya

MtGox.com Team

[Mousepotato]

No.  Anyone can send you an email and set the reply-to address to be anything they want.

I'm pretty sure he was being sarcastic