New spam email from FAKE phpbb

connorw600 · 2011-12-01 1:06 am

Just thought I would let less knowledgeable people know if you get an email from phpbbaid(at)gmail.com about a new version of phpBB.

It is a scam to get FTP information and insert malicious code into your site.

OnThePike · 2011-12-01 1:12 am

They certainly are persistent little scammers, aren't they?

You can report them to their current host-du-jour.

Katana · 2011-12-01 1:16 am

connorw600 wrote:

Just thought I would let less knowledgeable people know if you get an email from phpbbaid(at)gmail.com about a new version of phpBB.
It is a scam to get FTP information and insert malicious code into your site.

http://www.phpbb.com/community/viewtopi … &t=2111378

^^

connorw600 · 2011-12-01 2:57 am

Obsidian wrote:

connorw600 wrote:
Just thought I would let less knowledgeable people know if you get an email from phpbbaid(at)gmail.com about a new version of phpBB.
It is a scam to get FTP information and insert malicious code into your site.
http://www.phpbb.com/community/viewtopi … &t=2111378
^^

NOTE NO ONE ELSE DO THIS, SOME MAY CALL IT AN IDIOT MOVE. I CALL IT WALKING A THIN LINE
I'm actually gonna reply to the email give them a fresh install of phpbb, and ftp info. and see what they do. Then when I have their IP address it over to my friend and let him sort them out.

Then give them my old paypal address that doesn't work.

Edit: Also there are some people who come here who don't look at phpbb forums.
Edit: Watched them login and start uploading files, files that had nothing to do with phpbb. Stopped them before they could finish uploading.

Last edited by connorw600 (2011-12-01 3:28 am)

zaphod · 2011-12-01 4:11 am

I can't WAIT to see the reverse engineering report!

Make sure you move the whole directory off to a non-url-able one.

Zap

connorw600 · 2011-12-01 10:52 am

zaphod wrote:

I can't WAIT to see the reverse engineering report!
Make sure you move the whole directory off to a non-url-able one.
Zap

I did, and I even made sure that I only allowed my user ssh access. because I know what ftards like them are like.

AvelWorld · 2012-05-08 5:15 am

This person is still at it. Unfortunately for them they had an email trace which I followed to their hosting company (I hope). I've notified them and provided full email and header info. Sadly for them it routed to my GMail account. Google immediately said "possible phishing" and I identified it as such. If they really are using that as a GMail account there is a real chance it will be shut down.

Yes, I registered on this board to report this. I get sick of the spammers. My phpBB board requires registration to even see the team. There is no admin report option given. And the board does not live at the domain top-level, so I wonder where they have been getting this.

angie · 2012-05-22 10:22 am

AvelWorld wrote:

My phpBB board requires registration to even see the team. There is no admin report option given. And the board does not live at the domain top-level, so I wonder where they have been getting this.

You don't even need to have phpBB to get their spammy email. I use a different BB platform and still get that email often and different variants of it.

angie · 2012-11-18 12:25 am

Still at it as of November 11th 2012:

from:    phpbbaid@gmail.com
to:    ********@*****
Received: from epwork.com ([62.113.232.14])
X-PHP-Script: 62.113.232.14/~admin/cc/ccmail/admin.php for 41.236.157.218
date:    11 November 2012 18:44
subject:    phpBB support

phpBB 3.0.11 is now available
updating your forum makes it stable and fixes security bugs

We provide paid support to phpBB forums owners , we are happy to help you in
any issue related to your forum administration or any technical issues if
you are interested in our services , or have any questions , please reply to
us

Thank you

TheTriggerHappyPwner · 2014-01-26 2:28 pm

I am getting these emails too, I own several sites, and several domains, all running phpBB, all up to date with phpBB 3.0.12. I am capable of updating my site myself, so why do they persist after I have told them no less than 100 times where to go? When will GMail shut down the account?

Here are the headers:

Received: (qmail 19489 invoked by uid 30297); 26 Jan 2014 06:58:21 -0000
Received: from unknown (HELO p3pismtp01-022.prod.phx3.secureserver.net) ([10.6.12.27])
(envelope-sender <phpbbaid@gmail.com>)
by p3plsmtp13-05.prod.phx3.secureserver.net (qmail-1.03) with SMTP
for <*****@*******.***>; 26 Jan 2014 06:58:21 -0000
X-IronPort-Anti-Spam-Result: AmsJACew5FIXXi/hdGdsb2JhbABahBqGXJ9KhB+SCASBHQ4BDBUIPIIKVAEpMm9VBAWFOAiCHwEUnE+PZJUwChmBGIUJjiIJEQFthCIEiRAynxiFHTeBNTk
Received: from host.colocrossing.com (HELO phpbb.com) ([23.94.47.225])
by p3pismtp01-022.prod.phx3.secureserver.net with ESMTP; 25 Jan 2014 23:58:21 -0700
Received: (qmail 25319 invoked by uid 48); 26 Jan 2014 05:52:11 -0000
To: *****@*******.***
Subject: phpBB new version
X-PHP-Script: 23.94.47.225/~admin/cc/ccmail/admin.php for 41.37.112.171
Date: Sun, 26 Jan 2014 09:52:11 +0400
From: phpbbaid@gmail.com
Message-ID: <ab4302d8d1d2dced157b558a36fee5ee@23.94.47.225>
X-Priority: 3
X-Mailer: CcMail 1.0 - powered by PHPMailer 1.72
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="iso-8859-1"
X-Nonspam: None

And the email itself:

Hello,
phpBB 3.0.12 is now available , please
be sure to backup your forum before
staring in the update process .
we are happy to help you in updating
your forum safely, please reply to this
email if you are interested in our paid
sevices .
thank you

Old Dragon · 2014-01-26 3:07 pm

I get these sent to "blocked@<my-domain>" which they can only have harvested from my ZB Block 403 page.

carbonize · 2014-01-26 8:22 pm

Add their email to your ZBBlock block messages so it gets added to spammers lists.

Old Dragon · 2014-01-26 11:05 pm

carbonize wrote:

Add their email to your ZBBlock block messages so it gets added to spammers lists.

I like that! I may add a section at the bottom of the 403 page to list all email addresses that have recently spammed me so they can all harvest them. Then the spammers can go and spam each other.

#1 2011-12-01 1:06 am

New spam email from FAKE phpbb

#2 2011-12-01 1:12 am

Re: New spam email from FAKE phpbb

#3 2011-12-01 1:16 am

Re: New spam email from FAKE phpbb

#4 2011-12-01 2:57 am

Re: New spam email from FAKE phpbb

#5 2011-12-01 4:11 am

Re: New spam email from FAKE phpbb

#6 2011-12-01 10:52 am

Re: New spam email from FAKE phpbb

#7 2012-05-08 5:15 am

Re: New spam email from FAKE phpbb

#8 2012-05-22 10:22 am

Re: New spam email from FAKE phpbb

#9 2012-11-18 12:25 am

Re: New spam email from FAKE phpbb

#10 2014-01-26 2:28 pm

Re: New spam email from FAKE phpbb

#11 2014-01-26 3:07 pm

Re: New spam email from FAKE phpbb

#12 2014-01-26 8:22 pm

Re: New spam email from FAKE phpbb

#13 2014-01-26 11:05 pm

Re: New spam email from FAKE phpbb

Board footer