New RMT method of account hijacking?

AneyuS · 10-12-2008, 04:16 PM

ADMIN: IF YOU GET YOUR ACCOUNT STOLEN BY GOING TO THAT URL YOU DESERVE LOSING IT

I just got this tell about 5 minutes ago, and as you can see from the chat log, so have other people.

Has this happened on other servers besides Garuda yet?

Cairthenn · 10-12-2008, 04:19 PM

This isn't new.

AneyuS · 10-12-2008, 04:19 PM

Not new as in "This has never happened before" but new as in "Don't go to this specific URL if you get this tell" new

Shuemue · 10-12-2008, 04:20 PM

Old as the hills

Shuemue · 10-12-2008, 04:20 PM

This method isn't new, regardless of url, and anyone that falls for it deserves to lose their shit.

Tubbers · 10-12-2008, 04:22 PM

These never get to me, I think they usually get banned after H or so. They happen fairly often though.

VivixKujata · 10-12-2008, 04:43 PM

Now that I think about it, I got one of these a long time ago.. like 2-3 months probably. Old.

Sonomaa · 10-12-2008, 04:52 PM

olde as ye olde, this is how makochild lost his account eons ago

edit: when I say olde, I mean like, CoP was new olde

Thistle · 10-12-2008, 06:15 PM

I never get these messages. Guess they get banned long before they get to the T-names.

zoobernut · 10-12-2008, 06:23 PM

I have never gotten one of these messages... guess they never feel like mixing it up and starting from the bottom of the alphabet.

Chuyu · 10-12-2008, 06:30 PM

Didn't visit a link either sent to me back in 2006. Person sent out messages while /away and was swiftly dealt with

Supertim13 · 10-12-2008, 06:37 PM

This happened to my friend a little over a year ago. My friend got a tell from someone with a url, and was stupid enough to check it out. Then the next day his mule, which i knew was his, was sending out the /tells.

Kaisha · 10-12-2008, 07:58 PM

Do you figure we'll see these becoming more and more common as they start to exploit the free trials for throw-away ad-bots/gil-mules?

evilpaul · 10-12-2008, 08:16 PM

In before a mod finally removes the keylogger URL from the OP.

vagus · 10-12-2008, 08:35 PM

Someone needs to do a reverse on this thing and hack some rmT accounts. lol.

Kriz · 10-12-2008, 08:52 PM

Found inside the app:

ffxiserver77.no-ip.org which resolves to 70.16.103.165

Dezzimal · 10-12-2008, 10:32 PM

Quote:

Originally Posted by Sonomaa

olde as ye olde, this is how makochild lost his account eons ago

edit: when I say olde, I mean like, CoP was new olde

Olde like I was still playing olde. Totien lost his account like that as well.

Badkarma · 10-13-2008, 12:02 AM

I got 2 in 2 days before lol.
My name starting with B yeah >.>

Not Kuno · 10-13-2008, 12:34 AM

Quote:

Originally Posted by Sonomaa

olde as ye olde, this is how makochild lost his account eons ago

edit: when I say olde, I mean like, CoP was new olde

He was just testing to make sure it was safe for everyone.

Uryuu · 10-13-2008, 12:58 AM

Quote:

Originally Posted by Not Kuno

He was just testing to make sure it was safe for everyone.

lol...

Calina · 10-13-2008, 01:00 AM

I got these a bunch of times over the years just blist and ignor them dont even I waste time calling GM anymore lol

anyone dumb enough to fall for it deserves it lol

Darkyrm · 10-13-2008, 07:11 AM

Bluring part of the URL in the image would make it idiot proof while still keeping the warning. I remember getting those a couple of times 2 years ago.

Rya · 10-13-2008, 07:21 AM

Completely OT : but i find it quite annoying that someone on Odin is using my char name to price fix items ><, i used to be able to search my name on ffxiah and it would go straight to me but now theres 2 others. Anyone else noticed their name being used for this also ?

I need to raise one of those STF reports but havent got around to it yet.

bebeci · 10-13-2008, 08:09 AM

Quote:

Originally Posted by Rya

Completely OT : but i find it quite annoying that someone on Odin is using my char name to price fix items ><, i used to be able to search my name on ffxiah and it would go straight to me but now theres 2 others. Anyone else noticed their name being used for this also ?

I need to raise one of those STF reports but havent got around to it yet.

Probably just pure luck, since your name is so short.

If you default your ffxiah website to a certain server, you shouldn't have issues getting results from another server.

Dazusu · 10-13-2008, 08:42 AM

The IP Address posted above as found inside the app resolves to:

Name: pool-70-16-103-165.port.east.verizon.net
Address: 70.16.103.165

American RMT. Never!

Suppose it could be someone running as a server unknowingly (malware). Still, you never know these days.

Hellfury · 10-13-2008, 09:19 AM

Quote:

Originally Posted by evilpaul

In before a mod finally removes the keylogger URL from the OP.

No, please don't.
Natural selection is good! This is darwinism in the works, let it stay!

(<3 whatever mod made that red texted comment in the OP)

Gulkeeva · 10-13-2008, 11:32 AM

Wow.. they still doing that, last time I saw that was 4 years ago... when the "bots" n hacks n stuff started becoming widespread (or was it 5 years ago now before cop)

Its some trojan that steals an account.. then PM's server wide till it gets booted.. every single person possible. I rememb

10-12-2008, 04:16 PM	#1 (permalink)
AneyuS Melee Summoner Join Date: May 2008 Posts: 18	New RMT method of account hijacking? ADMIN: IF YOU GET YOUR ACCOUNT STOLEN BY GOING TO THAT URL YOU DESERVE LOSING IT I just got this tell about 5 minutes ago, and as you can see from the chat log, so have other people. Has this happened on other servers besides Garuda yet? __________________ Last edited by Sonomaa; 10-13-2008 at 12:52 AM.

10-12-2008, 04:19 PM	#2 (permalink)
Cairthenn Sea Torques Join Date: Jun 2007 Location: Whimsic Posts: 572	This isn't new. __________________ what is this shit? an lj update? gtfo.

10-12-2008, 04:19 PM	#3 (permalink)
AneyuS Melee Summoner Join Date: May 2008 Posts: 18	Not new as in "This has never happened before" but new as in "Don't go to this specific URL if you get this tell" new __________________

10-12-2008, 04:20 PM	#4 (permalink)
Shuemue Black Belt Join Date: Mar 2006 Posts: 5,823	Old as the hills __________________ Shue's IRC channel - come say hi if I don't hate you

10-12-2008, 04:20 PM	#5 (permalink)
Shuemue Black Belt Join Date: Mar 2006 Posts: 5,823	This method isn't new, regardless of url, and anyone that falls for it deserves to lose their shit. __________________ Shue's IRC channel - come say hi if I don't hate you

10-12-2008, 04:22 PM	#6 (permalink)
Tubbers Sea Torques Join Date: Jan 2007 Location: Under a bridge, where all trolls live Posts: 525	These never get to me, I think they usually get banned after H or so. They happen fairly often though. __________________ [+] LJ [+] LS RDM DRK BRD NIN WAR ---- Magic Accuracy tl;dr : Picture courtesy of Nevex

10-12-2008, 04:43 PM	#7 (permalink)
VivixKujata Hydra Join Date: Mar 2008 Posts: 128	Now that I think about it, I got one of these a long time ago.. like 2-3 months probably. Old. __________________ www.superbestfriendsls.freeforums.org/

10-12-2008, 04:52 PM	#8 (permalink)
Sonomaa Modzilla The Anti-anti-Spider Join Date: Apr 2005 Location: Hudson, FL Posts: 4,783	olde as ye olde, this is how makochild lost his account eons ago edit: when I say olde, I mean like, CoP was new olde

10-12-2008, 06:15 PM	#9 (permalink)
Thistle Relic Shield Join Date: May 2006 Posts: 1,788	I never get these messages. Guess they get banned long before they get to the T-names. __________________ Thistle: Leather 100 +3 + moglification, bone/gold/cloth +1 Chaser: Gold 95 + 3 / Fishingbot: Wood 98 + 2 / Catsoup: Alchemy 100 +2 / Katerwaul: Bone 78 + 2 Total guild points turned in: 1,870,000 / Blog Sig image made more "piratey" by Veloxe! Thanks!

10-12-2008, 06:23 PM	#10 (permalink)
zoobernut Sea Torques Join Date: Jun 2006 Posts: 986	I have never gotten one of these messages... guess they never feel like mixing it up and starting from the bottom of the alphabet. __________________ Chaos, panic, and disorder, my work here is done...

10-12-2008, 06:30 PM	#11 (permalink)
Chuyu Sea Torques Join Date: Nov 2007 Posts: 835	Didn't visit a link either sent to me back in 2006. Person sent out messages while /away and was swiftly dealt with __________________

10-12-2008, 06:37 PM	#12 (permalink)
Supertim13 Melee Summoner Join Date: Jul 2007 Location: Canada Posts: 6	This happened to my friend a little over a year ago. My friend got a tell from someone with a url, and was stupid enough to check it out. Then the next day his mule, which i knew was his, was sending out the /tells.

10-12-2008, 07:58 PM	#13 (permalink)
Kaisha Sea Torques Join Date: Mar 2007 Location: 'eh? Posts: 769	Do you figure we'll see these becoming more and more common as they start to exploit the free trials for throw-away ad-bots/gil-mules?

10-12-2008, 08:16 PM	#14 (permalink)
evilpaul Old Merits Join Date: Jan 2007 Location: in ur base eatin ur piez Posts: 1,270	In before a mod finally removes the keylogger URL from the OP. __________________

10-12-2008, 08:35 PM	#15 (permalink)
vagus Sea Torques Join Date: Dec 2005 Location: Vancity, Canada Posts: 879	Someone needs to do a reverse on this thing and hack some rmT accounts. lol. __________________ Titles : 3/8 Assaults for Captain : 28/50 Assault for Books: 0/50 Alexandrite : 600/30,000 Nyzul Isle : 150,000/150,000 Ampoules : 72,000 / 100,000

10-12-2008, 08:52 PM	#16 (permalink)
Kriz Relic Weapons Join Date: Dec 2005 Posts: 387	Found inside the app: ffxiserver77.no-ip.org which resolves to 70.16.103.165 __________________ I R Kriz

10-13-2008, 01:00 AM	#21 (permalink)
Calina CoP Dynamis Join Date: Aug 2006 Posts: 286	I got these a bunch of times over the years just blist and ignor them dont even I waste time calling GM anymore lol anyone dumb enough to fall for it deserves it lol __________________

10-13-2008, 07:11 AM	#22 (permalink)
Darkyrm Puppetmaster Join Date: Jun 2007 Posts: 71	Bluring part of the URL in the image would make it idiot proof while still keeping the warning. I remember getting those a couple of times 2 years ago.

10-13-2008, 07:21 AM	#23 (permalink)
Rya Hydra Join Date: Oct 2007 Location: Wales Posts: 131	Completely OT : but i find it quite annoying that someone on Odin is using my char name to price fix items ><, i used to be able to search my name on ffxiah and it would go straight to me but now theres 2 others. Anyone else noticed their name being used for this also ? I need to raise one of those STF reports but havent got around to it yet. __________________ Ryauwau - Finale - Phoenix Rng 75 Nin 75 Blm 75 Drk 75

10-13-2008, 08:42 AM	#25 (permalink)
Dazusu Melee Summoner Join Date: Jun 2008 Posts: 16	The IP Address posted above as found inside the app resolves to: Name: pool-70-16-103-165.port.east.verizon.net Address: 70.16.103.165 American RMT. Never! Suppose it could be someone running as a server unknowingly (malware). Still, you never know these days.

10-13-2008, 11:32 AM	#27 (permalink)
Gulkeeva Mithra Ero-Sensei Sex Cat Join Date: Nov 2005 Posts: 2,267	Wow.. they still doing that, last time I saw that was 4 years ago... when the "bots" n hacks n stuff started becoming widespread (or was it 5 years ago now before cop) Its some trojan that steals an account.. then PM's server wide till it gets booted.. every single person possible. I rememb