New RMT method of account hijacking?

[Calina]

I got these a bunch of times over the years just blist and ignor them dont even I waste time calling GM anymore lol

anyone dumb enough to fall for it deserves it lol

[Darkyrm]

Bluring part of the URL in the image would make it idiot proof while still keeping the warning. I remember getting those a couple of times 2 years ago.

[Rya]

Completely OT : but i find it quite annoying that someone on Odin is using my char name to price fix items ><, i used to be able to search my name on ffxiah and it would go straight to me but now theres 2 others. Anyone else noticed their name being used for this also ?

I need to raise one of those STF reports but havent got around to it yet.

[bebeci]

Completely OT : but i find it quite annoying that someone on Odin is using my char name to price fix items ><, i used to be able to search my name on ffxiah and it would go straight to me but now theres 2 others. Anyone else noticed their name being used for this also ?

I need to raise one of those STF reports but havent got around to it yet.

Probably just pure luck, since your name is so short.

If you default your ffxiah website to a certain server, you shouldn't have issues getting results from another server.

[Dazusu]

The IP Address posted above as found inside the app resolves to:

Name: pool-70-16-103-165.port.east.verizon.net
Address: 70.16.103.165

American RMT. Never!

Suppose it could be someone running as a server unknowingly (malware). Still, you never know these days.

[Hellfury]

In before a mod finally removes the keylogger URL from the OP.

No, please don't.
Natural selection is good! This is darwinism in the works, let it stay! :D
(<3 whatever mod made that red texted comment in the OP)

[Gulkeeva]

Wow.. they still doing that, last time I saw that was 4 years ago... when the "bots" n hacks n stuff started becoming widespread (or was it 5 years ago now before cop)

Its some trojan that steals an account.. then PM's server wide till it gets booted.. every single person possible. I remember getting like 5-10 of those messages per 2-3 hours ;/

They should try something new like... "Want your friends to play with you forever? Download this to unlock your 14 day trial to be full version at http://www.????.???.com, it worked for me!"

[The Stig]

Hello!

Can I have your POL ID(s) and Password(s)? thanks!

Post here*, I shall check back.




*I hope this works. I favour natural selection.

[Ragns]

That file in the /tell is a downloader. It downloads from the ftp hosted on ffxiserver77.no-ip.org / 70.16.103.165 with user/pw Download/W5QG7ccE which contain a file named FFXITeleporter.exe. That file is an encrypted rar sfx (to not get detected by an anti-virus I suppose?) which contains a trojan-ed NPC.exe by a certain 'bhmahler'.

Short version: DO NOT DOWNLOAD THIS

[Mafai]

looks like an ircbot by the name of spybot.

secretly joins an irc channel in the background where the person who made the exe can login thru the chat and send commands to you. some of the custom commands include ddos attacks, and gaming passwords. commonly used to steal cd keys and passwords for major games.

[Turbotwo]

Why dont these people realize that the owner will just lock the acct. And the hacker will be shit outta luck in the end.

[Senoska]

Found inside the app:

ffxiserver77.no-ip.org which resolves to 70.16.103.165

OrgName: FAIRPOINT COMMUNICATIONS, INC.
OrgID: FAIRPO-3
Address: 908 Frontview ST
City: Dodge City
StateProv: KS
PostalCode: 67801
Country: US

OrgTechHandle: JN222-ARIN
OrgTechName: Nowack, John C
OrgTechPhone: +1-309-353-8817
OrgTechEmail: [email protected]

Eh, an American, I'm shocked. Anyway, isn't this a breech of like every server agreement ever? Just report abuse and get his shit shut down.

[Turbotwo]

Someone give this dude a dose of his own medicine, we should have a blacklist made for discovered hackers like this in a new topic or site or something...

[Aksannyi]

I love the mod edit. Genius!

[alabamahotpocket]

Eh, an American, I'm shocked...

He's probably trying to fund a relic or something ^^

[Gulkeeva]

Why dont these people realize that the owner will just lock the acct. And the hacker will be shit outta luck in the end.

From posts I've seen of people getting hijacked accounts... it takes like.. a month to get your account back or something. if I was in a HNMLS and or really enjoying the game, I'd want to kill people if I got locked out for 30 days practically

[Drphill]

well dunno about you guys, but i moved to cerberus like a week aggo, and the moment i joined the server, i got a Message(not a /tell) from some "Unnamedplayer" offering me mass discounts on RMT gil :S Like wtf?

My new LS told me that they send those to players who are in their database who bought gil. I changed my name to Wubbo when i moved so its kinda weird cuz ive always hated rmt's lol.

So yeh, i didnt bother to report it, but is it a risk for me if a GM sees them sending me offers? if so, then im reporting it.

Anyone else get those messages?

[Gulkeeva]

Every 7 days to a month when I played.. I got "omg downlaod this file for hacks" or... "sell me your account" or... "Hi I'm a GM, take our ffxi survey at http:/www.?????.com"

They pretty much do the same through forum e-mails but asking stuff like 'account verification" or "take a survey" or "buy this go here" or" hacks here go here" or "your accounts been hacked go ehre to verify"

its all .. pretty much the same stuff.... all the time, they just waiting for some sucker to click their links.

[Woozie]

The first time I got a tell like that, my first thought was "This tactic is going to die out soon lol. Nobody's going to be stupid enough to go to the site and when the hackers realize it's not working, they'll stop".


....lol

[Saisio]

waitwaitwait let me get this straight



you got a GM response in 7 minutes?