New Coinbase Spam

[cableiso]

I'm recently getting spam from coinbase pretending to be from this forum.  Is this the result of the recent hack?  Anyone else getting it?  Poorly worded, asking for donations or to sign up for gambling sites?

[1714153606]

1714153606

[rampalija]

i didnt get any of that messages

[Mitchell]

I keep getting those kinds of e-mails too. They do not originate from CoinBase but from someone spoofing that.

[MoneyGod]

I saw someone also made a post about this in General Discussion. It seems to be a phishing scam.

I have never message like this may some scammer trying to do something here

[gwoplock]

i got 3 eamils the full content is (my address removed for protection)

Return-Path: <donate@coinbase.com>
Received: from smtp02-forward-0.daemonmail.net (smtp02-forward-0.daemonmail.net [216.104.163.150]) by sm03.internetmailserver.net with SMTP;
   Sun, 27 Oct 2013 21:13:41 -0700
Received: from mxw04.daemonmail.net (unknown [216.104.161.14])
   by smtp02-forward-0.daemonmail.net (Postfix) with ESMTP id 2D1628132E
   for <*@appropriatesystems.com>; Sun, 27 Oct 2013 20:57:52 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1])
   by mxw04.daemonmail.net (Postfix) with ESMTP id 2F8B52A71E6
   for <*@garrettbattaglia.info>; Sun, 27 Oct 2013 20:57:51 -0700 (PDT)
X-Virus-Scanned: Debian amavisd-new at mxw04.daemonmail.net
X-Spam-Flag: NO
X-Spam-Score: 0.496
X-Spam-Level:
X-Spam-Status: No, score=0.496 tagged_above=-20 required=4
   tests=[BAYES_40=-0.001, MISSING_MID=0.497] autolearn=no
Received: from mxw04.daemonmail.net ([127.0.0.1])
   by localhost (mxw04.daemonmail.net [127.0.0.1]) (amavisd-new, port 10024)
   with ESMTP id Kz2rsgXq+feO for <*@garrettbattaglia.info>;
   Sun, 27 Oct 2013 20:57:49 -0700 (PDT)
Received: from netgains11422.netgainstechnologies.com (netgains11422.netgainstechnologies.com [180.179.114.22])
   by mxw04.daemonmail.net (Postfix) with ESMTP id 3FF452A71E5
   for <*@garrettbattaglia.info>; Sun, 27 Oct 2013 20:57:47 -0700 (PDT)
Received: from home-91e15d0351.user.nevalink.net (UnknownHost [89.223.47.197]) by netgains11421.netgainstechnologies.com with SMTP;
   Mon, 28 Oct 2013 09:25:58 +0530
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: Bitcoin Awaiting your order confirmation
To: *@garrettbattaglia.info
From: donate@coinbase.com
Date: Mon, 28 Oct 2013 07:57:28 +0400
Reply-To: donation@coinbase.com
Return-receipt-to: donation@coinbase.com
X-Rcpt-To: <*@appropriatesystems.com>
Message-ID: <72dbdc94e0764e08a510a668727fb45c@com>
X-SmarterMail-Spam: SPF_Fail, SpamAssassin 0 [raw: 0], DK_None, DKIM_None
X-SmarterMail-TotalSpamWeight: 5


Donate to the Bitcoin Forum

Donation =


Bitcoin address:   1KaEvEH1eWf8EXnrUCdsMNt9TucYGXwTZU

Litecoin address:   LXHR3ThQz2qrJqEXJrce2GsTzEdh5JCZG2

The Bitcoin Forum is a website meant to host free discussion of Bitcoin and=
 related topics. It is operated as a service to the community, and all prof=
it is reinvested into the forum. It was started in 2009 by Satoshi Nakamoto=
, the original creator of Bitcoin. It is now managed by Malmi Martti (Siriu=
s), Stefan Thomas (justmoon), and Michael Marquardt (theymos). Donated fund=
s are managed by theymos.

Private Internet Access provides free hosting for the forum. Check them out=
 for anonymous VPN tunnels. They accept Bitcoin!

If you donate some BTC, you can get a special "Donator" title and a green "=
who's online" color. If you donate 1 BTC, you get VIP status and the abilit=
y to create a custom title for yourself. Both Donators and VIPs also get ac=
cess to an exclusive forum section. You must prior to donating if you want =
to take advantage of this offer: you will be given a unique donation addres=
s.

Big Thanx For Help situation and sent for our donate this right now
Thank you for your interest in donate!
we do and develop an interest for many people and the system in general, it=
 makes it all bolie popular and we try for you
if ever we need your help we hope you will be able to help us and send some=
 of your coins for us
we need money for maintenance and we invite you to support us and make a do=
nation to help us

We very much appreciate and thank you a lot

Return-Path: <activation@coinbase.com>
Received: from smtp01-forward-0.daemonmail.net (smtp01-forward-0.daemonmail.net [216.104.162.150]) by sm03.internetmailserver.net with SMTP;
   Tue, 29 Oct 2013 04:05:43 -0700
Received: from mxw02.daemonmail.net (unknown [216.104.161.12])
   by smtp01-forward-0.daemonmail.net (Postfix) with ESMTP id 2A7D181BB7
   for <*@appropriatesystems.com>; Tue, 29 Oct 2013 03:49:11 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1])
   by mxw02.daemonmail.net (Postfix) with ESMTP id 2D589282541
   for <*@garrettbattaglia.info>; Tue, 29 Oct 2013 03:49:11 -0700 (PDT)
X-Virus-Scanned: Debian amavisd-new at mxw02.daemonmail.net
X-Spam-Flag: NO
X-Spam-Score: -0.002
X-Spam-Level:
X-Spam-Status: No, score=-0.002 tagged_above=-20 required=4
   tests=[BAYES_05=-0.5, MISSING_MID=0.497, URIBL_BLOCKED=0.001]
   autolearn=no
Received: from mxw02.daemonmail.net ([127.0.0.1])
   by localhost (mxw02.daemonmail.net [127.0.0.1]) (amavisd-new, port 10024)
   with ESMTP id H0RToO-gmIJL for <*@garrettbattaglia.info>;
   Tue, 29 Oct 2013 03:49:05 -0700 (PDT)
Received: from smtp.2164.v.tld.pl (v2164.rev.tld.pl [195.149.231.64])
   by mxw02.daemonmail.net (Postfix) with ESMTP id C4B6028254B
   for <*@garrettbattaglia.info>; Tue, 29 Oct 2013 03:49:04 -0700 (PDT)
Received: (qmail 313 invoked by uid 2164007); 29 Oct 2013 10:49:02 -0000
X-clamdmail: clamdmail 0.18a
Received: from 89.223.47.197 (HELO home-91e15d0351.user.nevalink.net) (ewa.szymanska@fcmtravel.pl@89.223.47.197)
  by 195.149.231.64 with ESMTPA; 29 Oct 2013 10:49:02 -0000
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: Activation your new account 2013
To: *@garrettbattaglia.info
From: activation@coinbase.com
Date: Tue, 29 Oct 2013 14:49:07 +0400
Reply-To: activation@coinbase.com
Return-receipt-to: activation@coinbase.com
X-Rcpt-To: <*@appropriatesystems.com>
Message-ID: <c7d000f84abb413d80215a33359b447a@com>
X-SmarterMail-Spam: SPF_Fail, SpamAssassin 9 [raw: 3], DK_None, DKIM_None
X-SmarterMail-TotalSpamWeight: 14

Activation your new account 2013

Here Yes

This individual invite for you


https://www.switchpoker.com/?rid=3D4145&link=3D7


The referral bonus will be added to your account automatically

Return-Path: <bonus@bitcoin.org>
Received: from smtp02-forward-0.daemonmail.net (smtp02-forward-0.daemonmail.net [216.104.163.150]) by sm03.internetmailserver.net with SMTP;
   Tue, 29 Oct 2013 06:13:44 -0700
Received: from mxw01.daemonmail.net (unknown [216.104.161.11])
   by smtp02-forward-0.daemonmail.net (Postfix) with ESMTP id 94E7081212
   for <*@appropriatesystems.com>; Tue, 29 Oct 2013 05:54:54 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1])
   by mxw01.daemonmail.net (Postfix) with ESMTP id 3CF29240951
   for <*@garrettbattaglia.info>; Tue, 29 Oct 2013 05:54:53 -0700 (PDT)
X-Virus-Scanned: Debian amavisd-new at mxw01.daemonmail.net
X-Spam-Flag: NO
X-Spam-Score: -1.889
X-Spam-Level:
X-Spam-Status: No, score=-1.889 tagged_above=-20 required=4
   tests=[BAYES_00=-1.9, T_MANY_HDRS_LCASE=0.01, URIBL_BLOCKED=0.001]
   autolearn=ham
Received: from mxw01.daemonmail.net ([127.0.0.1])
   by localhost (mxw01.daemonmail.net [127.0.0.1]) (amavisd-new, port 10024)
   with ESMTP id 6z3xe3NWF61J for <*@garrettbattaglia.info>;
   Tue, 29 Oct 2013 05:54:50 -0700 (PDT)
Received: from mail.qatar.net.qa (cactus4.qatar.net.qa [82.148.101.71])
   by mxw01.daemonmail.net (Postfix) with ESMTPS id 3785B240EAD
   for <*@garrettbattaglia.info>; Tue, 29 Oct 2013 05:54:49 -0700 (PDT)
MIME-version: 1.0
Content-transfer-encoding: 7BIT
Content-type: text/plain; CHARSET=US-ASCII
Received: from home-91e15d0351.user.nevalink.net ([89.223.47.197])
 by cactus4.qatar.net.qa
 (Oracle Communications Messaging Exchange Server 7u4-18.01 64bit (built Jul 15
 2010)) with ESMTPA id <0MVF00L3JKMOVQ10@cactus4.qatar.net.qa> for
 *@garrettbattaglia.info; Tue, 29 Oct 2013 15:50:36 +0300 (AST)
Message-id: <0MVF00LZLL0BVQ30@cactus4.qatar.net.qa>
Content-description: Mail message body
Subject: Bitcoin Your [Procedure Right Now]
To: *@garrettbattaglia.info
From: bonus@bitcoin.org
Date: Tue, 29 Oct 2013 16:54:51 +0400
Reply-to: bonus@bitcoin.org
Return-receipt-to: bonus@bitcoin.org
X-Rcpt-To: <*@appropriatesystems.com>
X-SmarterMail-Spam: SPF_None, SpamAssassin 0 [raw: 0], DK_None, DKIM_None
X-SmarterMail-TotalSpamWeight: 0

Bitcoin is a website in which you earn small amounts of Bitcoins in exchange for visiting websites for a designated period of time. You may be required to spend anywhere from one minute, up to five minutes or more on the sponsored website. You must spend the full amount of required time on the website in order to recieve payment.

N1

http://minefield.bitcoinlab.org/?r=tjG2tHzTPhhKmkjo

N2

http://www.bitcoinget.com/?r=1Akps1g2LETZ2SSB2HZKw5si46quj6WxH8

N3

http://satoshi36.com/ofn


Want more free bitcoins? Check out these site

N4

https://www.switchpoker.com/?rid=4145&link=7

Get Your Bitcoins Stable Bonus This
Start Right Now

it would seem that this is a poor phishing scam. it you go to where the message was received from daemonmail.net you get this

DaemonMail is a mail sorter and mail handler shared by several ISPs.

If you have reached this web page by examining headers found in an unwanted email, please email us the entire message: abuse@daemonmail.net. Be sure to include a full copy of the email headers. You will receive a prompt, personalized response.

Our AUP is provided below:
DaemonMail Acceptable Use Policy

These servers and hosted domains may not be the source, intermediary, or destination address involved in the transmission of junk email, nor may they be listed in any junk email message. The use of these servers to send or relay junk email is prohibited, and will result in a fine.

"Junk email" is defined as "any mass unsolicited or unwanted message in any medium." Violation will result in immediate termination of all services without refund. Fines and legal action may be imposed. Any customer who is repeatedly flamed/mail-bombed or attracts such behavior will be asked to leave.

Mailing list services are provided for use as discussion forums only, and may not be used to distribute unsolicited email. All users on a list must have personally subscribed to that list.

we could try to email abuse@daemonmail.net and see what happens.

[waltermot321]

I get all kinds of emails almost same like this but not from coinbase. So just don't fall into it

[gwoplock]

we could try to email abuse@daemonmail.net and see what happens.

Well do that. These kinds of emails need to be stopped.
Luckily I'm not getting them.

Maybe sign him up on a few gay websites.
[/quote]

who?

[Gemminyc]

I only receiving Coinbase newsletters. I dont know what is inside becaue I delete these and I cant sign out for newsletters because I lost login info to Coinbase.

[gwoplock]

I only receiving Coinbase newsletters. I dont know what is inside becaue I delete these and I cant sign out for newsletters because I lost login info to Coinbase.

do you have one that you can open. if you have it, can post the raw text (like i did above) of the message so i can look at it?

edit: talking about the newsletters

[Mitchell]

I only receiving Coinbase newsletters. I dont know what is inside becaue I delete these and I cant sign out for newsletters because I lost login info to Coinbase.

do you have one that you can open. if you have it, can post the raw text (like i did above) of the message so i can look at it?

I can give you a ton of e-mails:
-snip-

[cableiso]

So did the emails only start after the hack?  Mine did, and are sent to an email I only use for this forum so it seems related.  Might be a path back to the hackers, by determining who they sold lists to.

[gwoplock]

So did the emails only start after the hack?  Mine did, and are sent to an email I only use for this forum so it seems related.  Might be a path back to the hackers, by determining who they sold lists to.

it seems to be linked to the hack. the "person" this seems to be linked to http://home-91e15d0351.user.nevalink.net/

[ekiro]

I'm not pleased with the amount of sketch activity about bitcoins. Just gives it a bad rep. So uncool when we all want for it to grow.

I say we get the US's backing and have them bomb all threats.

[rampalija]

I guess it is a trick to take your money

[gwoplock]

I guess it is a trick to take your money

this is a poor phishing attempt. do not fall for it.

[rigel]

These messages fail SPF test: http://www.openspf.org/Project_Overview

Your mailserver should perform this test automatically and reject them

[gwoplock]

These messages fail SPF test: http://www.openspf.org/Project_Overview

Your mailserver should perform this test automatically and reject them

some don't fail. (from what i posted above)

X-SmarterMail-Spam: SPF_None, SpamAssassin 0 [raw: 0], DK_None, DKIM_None

also spf alone is not going to kick the email out.

[rigel]

These messages fail SPF test: http://www.openspf.org/Project_Overview

Your mailserver should perform this test automatically and reject them

some don't fail. (from what i posted above)

X-SmarterMail-Spam: SPF_None, SpamAssassin 0 [raw: 0], DK_None, DKIM_None

also spf alone is not going to kick the email out.

Well it depends on the sender domain:

coinbase.com has SPF record with fail (-all) default. Messages failing SPF test should be rejected.

bitcoin.org has no SPF record, the test makes no sense.

[gwoplock]

These messages fail SPF test: http://www.openspf.org/Project_Overview

Your mailserver should perform this test automatically and reject them

some don't fail. (from what i posted above)

X-SmarterMail-Spam: SPF_None, SpamAssassin 0 [raw: 0], DK_None, DKIM_None

also spf alone is not going to kick the email out.

Well it depends on the sender domain:

coinbase.com has SPF record with fail (-all) default. Messages failing SPF test should be rejected.

bitcoin.org has no SPF record, the test makes no sense.

then somethings not working because i'm getting them.

edit¹: i was correct the first time. spf is causing a score of ~ .4 and a score of 5 is required to kick it out (on my email).
edit²:i a word

[Phinnaeus Gage]

I just received the same email.