OKPAY is scam (probably not)

[jwzguy]

Whoever wrote it certainly didn't lend themselves any credibility by faking the return address.

[1713442923]

1713442923

[1713442923]

1713442923

[1713442923]

1713442923

[1713442923]

1713442923

[1713442923]

1713442923

[Maged]

Got it also, from support@okpay.com.

The email wording made it sound like someone who was pissed about the account being frozen, but it's very possible it was frozen for legitimate reasons. And definitely hacking their email server is not cool... so I'd reserve judgement either way in this case.

Not hacked, just impersonating. If they have a good SPF record, most filters will catch it and delete it.

Code:

> okpay.com
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Non-authoritative answer:
okpay.com       text =

        "v=spf1 a:mail.regall.net mx:mail.regall.net +all"
>

^That tells mail server to ignore email purporting to be from okpay.com, UNLESS it comes from "mail.regall.net". However, many servers ignore this option, since it was tacked on to the protocol after SMTP was initially created.

Actually, because of that +all, it says that all mail servers are valid senders for okpay.com. NEVER put +all in your spf record. That alone says that you should avoid OKPAY at all costs, since their security is likely just as bad.

[rjk]

Actually, because of that +all, it says that all mail servers are valid senders for okpay.com. NEVER put +all in your spf record. That alone says that you should avoid OKPAY at all costs, since their security is likely just as bad.

Now that you point it out, that is very lame. + is only for testing, and as you noted it allows all senders. They should be using - or ~ which either fails hard or fails soft respectively. Someone should email them and tell them they are doing it wrong.

[dooglus]

the question is: where did they got my email from (ok thats not that hard): but how did they know i have a login there?

maybe its just a pissed employee

I got the email too and don't have an OKPAY account.  Maybe it was sent to every address from the MtGox and/or Intersango email list leaks.

Here's how my copy looked.  It was CC'ed to me, and sent to myadultweb@gmail.com.

Code:

Received: by 10.112.1.41 with SMTP id 9csp144016lbj;
        Wed, 11 Apr 2012 06:30:37 -0700 (PDT)
Received: by 10.101.72.11 with SMTP id z11mr4048862ank.25.1334151036931;
        Wed, 11 Apr 2012 06:30:36 -0700 (PDT)
Return-Path: <support@okpay.com>
Received: from okpay.com ([69.194.161.228])
        by mx.google.com with SMTP id z65si2441973yhl.65.2012.04.11.06.30.35;
        Wed, 11 Apr 2012 06:30:36 -0700 (PDT)
Received-SPF: pass (google.com: domain of support@okpay.com designates 69.194.161.228 as permitted sender) client-ip=69.194.161.228;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of support@okpay.com designates 69.194.161.228 as permitted sender) smtp.mail=support@okpay.com
Message-ID: <CC273857.CE4024EE@okpay.com>
Date: Wed, 11 Apr 2012 14:09:34 +0100
Reply-To: "OKPAY" <support@okpay.com>
From: "OKPAY" <support@okpay.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.8.1.14) Gecko/20080421 Thunderbird/2.0.0.14
X-Accept-Language: en-us
MIME-Version: 1.0
To: "AOL Users" <myadultweb@gmail.com>
Cc: "AOL Users" <dooglus@[me]>
Subject: OKPAY is SCAM!
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

Hello,

I want to warn you that OKPay is scam payment processor.

They were fine while I was making small transfers, but as soon as my
balance reached 11000 USD, they blocked it.

And it's blocked since August last year.

Stay away from OKPAY!

[BombaUcigasa]

Please explain this to me:

OKPAY.COM DNS RECORDS
Record    Type    TTL    Priority    Content
forum.okpay.com    CNAME    1 hour       racoon.regall.net
mail.okpay.com    MX    1 hour    10    mail.regall.net
okpay.com    A    1 hour       67.227.182.219 (Wilmington, DE, US)
okpay.com    MX    1 hour    10    mail.regall.net
okpay.com    NS    1 hour       ns2.regall.net
okpay.com    NS    1 hour       ns1.regall.net
okpay.com    SOA    1 hour       ns.regall.net. kostya.regall.net. 2012011702 3600 7200 12960000 36000
okpay.com    TXT    1 hour       v=spf1 a:mail.regall.net mx:mail.regall.net +all
www.okpay.com    A    1 hour       67.227.182.219 (Wilmington, DE, US)

REGALL.NET DNS RECORDS
Record    Type    TTL    Priority    Content
mail.regall.net    A    1 hour       173.224.112.179 ()
ns1.regall.net    A    1 hour       173.224.112.179 ()
ns2.regall.net    A    1 hour       188.138.40.123 ()
racoon.regall.net    A    1 hour       173.224.112.179 ()
regall.net    A    1 hour       173.224.112.179 ()
regall.net    MX    1 hour    10    mail.regall.net
regall.net    NS    1 hour       ns2.regall.net
regall.net    NS    1 hour       ns1.regall.net
regall.net    SOA    1 hour       ns.regall.net. kostya.regall.net. 2011102601 3600 7200 129600 36000
regall.net    TXT    1 hour       v=spf1 a:mail.regall.net mx:mail.regall.net ?all
www.regall.net    CNAME    1 hour       racoon.regall.net

Received: from okpay.com ([69.194.161.228])
        by mx.google.com with SMTP id z65si2441973yhl.65.2012.04.11.06.30.35;
        Wed, 11 Apr 2012 06:30:36 -0700 (PDT)
Received-SPF: pass (google.com: domain of support@okpay.com designates 69.194.161.228 as permitted sender) client-ip=69.194.161.228;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of support@okpay.com designates 69.194.161.228 as permitted sender) smtp.mail=support@okpay.com

[defxor]

Got this to an email address that was specifically used for MtGox and has never been used anywhere else.

It's from the MtGox hack. Similar emails have been sent to that list before.

[rjk]

Please explain this to me:

OKPAY.COM DNS RECORDS
Record    Type    TTL    Priority    Content
forum.okpay.com    CNAME    1 hour       racoon.regall.net
mail.okpay.com    MX    1 hour    10    mail.regall.net
okpay.com    A    1 hour       67.227.182.219 (Wilmington, DE, US)
okpay.com    MX    1 hour    10    mail.regall.net
okpay.com    NS    1 hour       ns2.regall.net
okpay.com    NS    1 hour       ns1.regall.net
okpay.com    SOA    1 hour       ns.regall.net. kostya.regall.net. 2012011702 3600 7200 12960000 36000
okpay.com    TXT    1 hour       v=spf1 a:mail.regall.net mx:mail.regall.net +all
www.okpay.com    A    1 hour       67.227.182.219 (Wilmington, DE, US)

REGALL.NET DNS RECORDS
Record    Type    TTL    Priority    Content
mail.regall.net    A    1 hour       173.224.112.179 ()
ns1.regall.net    A    1 hour       173.224.112.179 ()
ns2.regall.net    A    1 hour       188.138.40.123 ()
racoon.regall.net    A    1 hour       173.224.112.179 ()
regall.net    A    1 hour       173.224.112.179 ()
regall.net    MX    1 hour    10    mail.regall.net
regall.net    NS    1 hour       ns2.regall.net
regall.net    NS    1 hour       ns1.regall.net
regall.net    SOA    1 hour       ns.regall.net. kostya.regall.net. 2011102601 3600 7200 129600 36000
regall.net    TXT    1 hour       v=spf1 a:mail.regall.net mx:mail.regall.net ?all
www.regall.net    CNAME    1 hour       racoon.regall.net

Received: from okpay.com ([69.194.161.228])
        by mx.google.com with SMTP id z65si2441973yhl.65.2012.04.11.06.30.35;
        Wed, 11 Apr 2012 06:30:36 -0700 (PDT)
Received-SPF: pass (google.com: domain of support@okpay.com designates 69.194.161.228 as permitted sender) client-ip=69.194.161.228;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of support@okpay.com designates 69.194.161.228 as permitted sender) smtp.mail=support@okpay.com

That indicates that some noob didn't set up SPF correctly, and so gmail is allowing the mail to pass normally because of the error.

[max in montreal]

I got the same email but never had an account there. Probably from the leaked info from MT Gox last year.

[Stephen Gornick]

Probably from the leaked info from MT Gox last year.

Yes, that is what happened. That is confirmed by the information provided by dexfor.

There have been other leaks as well, (e..g, pool that had its user database list stolen), so the sender might have sent to additional addresses than just the nearly 40,000 email addresses leaked durign the June 2011 Mt. Gox breach but at least this indicates that it wasn't a new breach that somehow identified specifically who is using OK Pay.

[Transisto]

I bet had he wrote the same one the forum, he would have had help getting his money back and OKpay would have been in much worst situation.

Must me some 13yo kid ... with 11000$ ? well whatever.

[MagicalTux]

Please explain this to me:

OKPAY.COM DNS RECORDS
Record    Type    TTL    Priority    Content
forum.okpay.com    CNAME    1 hour       racoon.regall.net
mail.okpay.com    MX    1 hour    10    mail.regall.net
okpay.com    A    1 hour       67.227.182.219 (Wilmington, DE, US)
okpay.com    MX    1 hour    10    mail.regall.net
okpay.com    NS    1 hour       ns2.regall.net
okpay.com    NS    1 hour       ns1.regall.net
okpay.com    SOA    1 hour       ns.regall.net. kostya.regall.net. 2012011702 3600 7200 12960000 36000
okpay.com    TXT    1 hour       v=spf1 a:mail.regall.net mx:mail.regall.net +all
www.okpay.com    A    1 hour       67.227.182.219 (Wilmington, DE, US)

v=spf1 a:mail.regall.net mx:mail.regall.net +all

+all means "everybody welcome"

[zer0]

Typical black PR. 'I got scammed, here is zero proof'
I know a few WMZ and LR exchangers that use OKpay bank accounts as their own for receiving wires and sending funds in huge amounts and no indication they've been scammed everything biz as usual

[Stephen Gornick]

Nice, now the disgruntled customer (or scammer or whatever) is claiming "OKPAY is closing".  Got this email:

From: "OKPAY" <support@okpay.com>
To: [me]
Subject: OKPAY Closing
Date: Fri, 13 Apr 2012 17:58:02 +0100


Dear partners,

Due to legal issues OKPay will close all operations by May 1. 2012.

Please use this time to withdraw your available balance.

Sincerely yours,
Konstantin Romanovsky
OKPay CEO
http://www.okpay.com
D x O

Nice try!

[rjk]

Nice, now the disgruntled customer (or scammer or whatever) is claiming "OKPAY is closing".  Got this email:

From: "OKPAY" <support@okpay.com>
To: [me]
Subject: OKPAY Closing
Date: Fri, 13 Apr 2012 17:58:02 +0100


Dear partners,

Due to legal issues OKPay will close all operations by May 1. 2012.

Please use this time to withdraw your available balance.

Sincerely yours,
Konstantin Romanovsky
OKPay CEO
http://www.okpay.com
D x O

Nice try!

Wow, what a dick move.

[OKPAY]

Why can I encounter with the “OKPAY is scam” information?

As we have already stated our policy in relation to any illegal activity (scam, fraud, phishing, money laundering) is very strict. We value and protect our honest and decent customers; we do not tolerate the violation of the safety and rights of the OKPAY Community.

Therefore all sorts of hackers, scammers and fraudsters that got banned by the Security Service are trying to compromise and falsify the information and spreading various rumors about "okpay is scam", "okpay is closing", etc. These rumors are without any foundation and are aimed only at discrediting the name of the Company.

https://www.okpay.com/en/company/news/okpay-aml-scam-prevention.html

The situation is exactly as described. Security department found illegal activity (fake documents and money laundering case) in order to resolve the situation and clear the transaction a scammer was asked to complete verification steps.

[Stephen Gornick]

spreading various rumors about "okpay is scam", "okpay is closing", etc. These rumors are without any foundation and are aimed only at discrediting the name of the Company.

Well, at least now you have your DNS configured with SPF properly (and thus the next attempt if there is one will likely go to my spam box):

"v=spf1 a:mail.regall.net mx:mail.regall.net ~all"  (reportedly was +all before, per MagicalTux above).

 - http://en.wikipedia.org/wiki/Sender_Policy_Framework

[OKPAY]

Well, at least now you have your DNS configured with SPF properly (and thus the next attempt if there is one will likely go to my spam box):

Yep, thank you!

[Raoul Duke]

Only the fact that they list an A record followed by a MX record that resolves to the same IP as the A on their SPF says everything. The +all at the end is just the icing on the cake lol

[rjk]

Only the fact that they list an A record followed by a MX record that resolves to the same IP as the A on their SPF says everything. The +all at the end is just the icing on the cake lol

It's possible for both values to be different, and happens often with large installations.

[Raoul Duke]

Only the fact that they list an A record followed by a MX record that's exactly the same hostname as the A on their SPF says everything. The +all at the end is just the icing on the cake lol

It's possible for both values to be different, and happens often with large installations.

That would be true if they used IP addresses or different hostnames. Given that they are using a hostname, using the same value on both is redundant, even if the hostname resolves to 10 different IP addresses (which isn't the case).
I didn't word it correctly, sorry about that. I fixed my statement on the above quote.