ROLEXROLEXROLEXROLEXROLEXROLEXROLEXROLEXROLEXROLEXROLEXROLEX

ArtNouveau · 9 February 2018, 12:21 AM

I have received two emails this morning from two different TRF'ers, both say "no message." No PM's received. Is something weird going on?

fishingbear · 9 February 2018, 01:09 AM

I got nothing on my end.

watchwatcher · 9 February 2018, 01:22 AM

Hmm...no, but thanks for the heads up.

ArtNouveau · 9 February 2018, 01:27 AM

Who is the moderator here? I don't know if I should list the two users I got the emails from...but they may be the ones in trouble.

fishingbear · 9 February 2018, 04:27 AM

Mods

Tools · 9 February 2018, 05:54 AM

Quote:

Originally Posted by ArtNouveau

Who is the moderator here? I don't know if I should list the two users I got the emails from...but they may be the ones in trouble.

If you are receiving unwanted pm's, use the report function (triangle in the upper blue band) so that we have access to the pm and sender.

Otherwise we don't have any way to see the pm in question

ArtNouveau · 9 February 2018, 06:41 AM

Larry, these weren't PM's, they were emails from two different members with no message. Seemed like maybe they were hacked and an autobot sending random emails.

ArtNouveau · 9 February 2018, 06:56 AM

More information...these emails were from TapaTalk, which I don't have. Pretty sure the "senders" have no idea this is going on. Soliciting for their service I guess.

Welshwatchman · 9 February 2018, 07:34 AM

Someone send you an email with a link.

You click the link and "login" to some website screen made to look like our front screen.

If you follow the bait, they have your password.

No hack, just a ploy.

sleddog · 9 February 2018, 08:36 AM

Yep.^

No site hack, you were hacked!
By falling for the fake link, and signing in, your password was hacked.. So many warnings on this have been issued!

Quote:

Originally Posted by ArtNouveau

Who is the moderator here? I don't know if I should list the two users I got the emails from...but they may be the ones in trouble.

Name the two accounts that sent you PM’s through the forum message system.

If both these members sent only links, and no text, then most likely they are scammer accounts, or have also been comprised in the same manner you were.

ArtNouveau · 9 February 2018, 09:29 AM

I stay logged into here on my phone and Ipad, I've never followed a log in link anywhere. I'm baffled. I sent Tools the users I got emails from.

sleddog · 9 February 2018, 10:01 AM

Quote:

Originally Posted by ArtNouveau

I stay logged into here on my phone and Ipad, I've never followed a log in link anywhere. I'm baffled. I sent Tools the users I got emails from.

Only way for your login to be accessed, is if you either gave someone your password, or you connected through a fake link to TRF. There is no other way for someone to get your password and access.

Staying logged in while clicking a link, is also a sure fire way to be compromised.

You say emails? Are these PM’s through the forum, or actual emails?

77T · 9 February 2018, 10:21 AM

Rob
In post #7 he said email (not PM)

But also he said Tapatalk. Let’s all recall Tapatalk acts as agent for users and logs into forums for that user. So a weakness in security at Tapatalk servers can expose user ID & Password.

And then the emails can appear to come from legit users who may not know others have logged into their account.

Sent from my iPhoneX using Tapatalk

ArtNouveau · 9 February 2018, 10:40 AM

This morning I got two emails from TRF members saying they had sent me a message....but there was no message in the body of the email, nor did I have any private messages here. After I started this thread, I got an email AND PM from a third user here. I responded and after a couple of messages back and forth it seemed he had gotten an email/PM from my username responding to HIS message about a "watch I was selling." Unfortunately I wasn't selling said watch. I then went to my "threads started" page and found in addition to the Ennebi I was trying to sell starting over a week ago, there was two more ads in my username, one for an AP and one for a BLNR. I looked at them and they were both stolen text and pictures from ads I'd seen here from other users. An email was given for contact and it used a similar email name to mine but to a Gmail account, not my true email. I clicked the warning symbol on both and they were taken down quickly. If Rob or Larry wants the names of all of the other users involved I have them, via PM, email, or post here if you think I should.
I'm not a newbie internet user, I honestly cannot recall ever logging into TRF except via my own devices. I had what I thought was a long enough, unusual enough password and I wasn't using it anywhere else. There was however one kind of weird event earlier in the week.
Someone emailed me with questions about the Ennebi I had listed for sale. He sent a link with RolexForums in the URL showing me his collection allegedly but I couldn't pull it up. I mentioned that and asked what his username was and he never gave it. I did send him some additional information and pictures of the watch, but again nothing that I can imagine would have helped him tap into my account here. After several back and forths, he no longer continued the conversation....but again I've had that in proposed sales before. I'm really freaked out about this. I'm new to posting here much but have been on a couple of other watch sites as regulars for as long as 20+ years. Don't want my good name sullied by some scammer. Again if any of the mods want more information that what I have given here, please contact me offline.

moyski · 9 February 2018, 10:48 AM

Quote:

Originally Posted by ArtNouveau

He sent a link with RolexForums in the URL showing me his collection allegedly but I couldn't pull it up...

I mentioned that and asked what his username was and he never gave it...

After several back and forths, he no longer continued the conversation....

Big red flag right there!

77T · 9 February 2018, 11:23 AM

I was going to ask ArtNouveau if he has his machine locked down tight enough to block a keylogger bot. But Mods have banned him (prolly temporarily) so this can be sorted out.

I guess the best idea for us is to be alert to any odd incoming messages, either email via TapaTalk or PM.

This will be interesting to watch it get solved.

Sent from my iPhoneX using Tapatalk

Lol-x · 10 February 2018, 10:22 AM

It may have been a keylogging attack or a bookmark download attack.

Never click on links in emails or messages unless you are 100% confident they are legitimate. Even emails/messages from friends or known associates can really be from a scammer that has taken over your friend/associates' account.
If you aren't sure, then err always on the side of caution. That goes for anything about the internet and especially with transactions from people you have never met and know.

9 February 2018, 12:21 AM	#1
ArtNouveau 2024 Pledge Member Join Date: Jan 2013 Location: NWA, USA Watch: BLRO/Daytona/OP41s Posts: 5,392	Site hack going on? I have received two emails this morning from two different TRF'ers, both say "no message." No PM's received. Is something weird going on?

9 February 2018, 07:34 AM	#9
Welshwatchman "TRF" Member Join Date: Apr 2006 Real Name: Paul Location: Wales, UK Posts: 14,578	Someone send you an email with a link. You click the link and "login" to some website screen made to look like our front screen. If you follow the bait, they have your password. No hack, just a ploy. __________________ ..33

9 February 2018, 10:21 AM	#13
77T 2024 SubLV41 Pledge Member Join Date: Dec 2010 Real Name: PaulG Location: Georgia Posts: 42,024	Site hack going on? Rob In post #7 he said email (not PM) But also he said Tapatalk. Let’s all recall Tapatalk acts as agent for users and logs into forums for that user. So a weakness in security at Tapatalk servers can expose user ID & Password. And then the emails can appear to come from legit users who may not know others have logged into their account. Sent from my iPhoneX using Tapatalk __________________ Does anyone really know what time it is?

9 February 2018, 11:23 AM	#16
77T 2024 SubLV41 Pledge Member Join Date: Dec 2010 Real Name: PaulG Location: Georgia Posts: 42,024	Site hack going on? I was going to ask ArtNouveau if he has his machine locked down tight enough to block a keylogger bot. But Mods have banned him (prolly temporarily) so this can be sorted out. I guess the best idea for us is to be alert to any odd incoming messages, either email via TapaTalk or PM. This will be interesting to watch it get solved. Sent from my iPhoneX using Tapatalk __________________ Does anyone really know what time it is?

10 February 2018, 10:22 AM	#17
Lol-x Facilitator Join Date: Nov 2005 Real Name: Steve Location: Omnipresent Posts: 33,593	It may have been a keylogging attack or a bookmark download attack. Never click on links in emails or messages unless you are 100% confident they are legitimate. Even emails/messages from friends or known associates can really be from a scammer that has taken over your friend/associates' account. If you aren't sure, then err always on the side of caution. That goes for anything about the internet and especially with transactions from people you have never met and know. __________________ *Most folks are about as happy as they make up their minds to be.* ~Abraham Lincoln Nothing compares to the simple pleasure of a bike ride. ~John F. Kennedy ROLEXploitation - yeah I'm a victim

9 February 2018, 01:09 AM	#2
fishingbear 2024 SubLV41 Pledge Member Join Date: May 2011 Real Name: George Location: Alabama Watch: GMTsSubLVEx2SDDayt Posts: 4,549	I got nothing on my end.

9 February 2018, 01:22 AM	#3
watchwatcher "TRF" Member Join Date: Jan 2009 Real Name: Larry Location: Kentucky Watch: Yes Posts: 35,047	Hmm...no, but thanks for the heads up.

9 February 2018, 01:27 AM	#4
ArtNouveau 2024 Pledge Member Join Date: Jan 2013 Location: NWA, USA Watch: BLRO/Daytona/OP41s Posts: 5,392	Who is the moderator here? I don't know if I should list the two users I got the emails from...but they may be the ones in trouble.

9 February 2018, 04:27 AM	#5
fishingbear 2024 SubLV41 Pledge Member Join Date: May 2011 Real Name: George Location: Alabama Watch: GMTsSubLVEx2SDDayt Posts: 4,549	Mods

9 February 2018, 06:41 AM	#7
ArtNouveau 2024 Pledge Member Join Date: Jan 2013 Location: NWA, USA Watch: BLRO/Daytona/OP41s Posts: 5,392	Larry, these weren't PM's, they were emails from two different members with no message. Seemed like maybe they were hacked and an autobot sending random emails.

9 February 2018, 06:56 AM	#8
ArtNouveau 2024 Pledge Member Join Date: Jan 2013 Location: NWA, USA Watch: BLRO/Daytona/OP41s Posts: 5,392	More information...these emails were from TapaTalk, which I don't have. Pretty sure the "senders" have no idea this is going on. Soliciting for their service I guess.

9 February 2018, 09:29 AM	#11
ArtNouveau 2024 Pledge Member Join Date: Jan 2013 Location: NWA, USA Watch: BLRO/Daytona/OP41s Posts: 5,392	I stay logged into here on my phone and Ipad, I've never followed a log in link anywhere. I'm baffled. I sent Tools the users I got emails from.

9 February 2018, 10:40 AM	#14
ArtNouveau 2024 Pledge Member Join Date: Jan 2013 Location: NWA, USA Watch: BLRO/Daytona/OP41s Posts: 5,392	This morning I got two emails from TRF members saying they had sent me a message....but there was no message in the body of the email, nor did I have any private messages here. After I started this thread, I got an email AND PM from a third user here. I responded and after a couple of messages back and forth it seemed he had gotten an email/PM from my username responding to HIS message about a "watch I was selling." Unfortunately I wasn't selling said watch. I then went to my "threads started" page and found in addition to the Ennebi I was trying to sell starting over a week ago, there was two more ads in my username, one for an AP and one for a BLNR. I looked at them and they were both stolen text and pictures from ads I'd seen here from other users. An email was given for contact and it used a similar email name to mine but to a Gmail account, not my true email. I clicked the warning symbol on both and they were taken down quickly. If Rob or Larry wants the names of all of the other users involved I have them, via PM, email, or post here if you think I should. I'm not a newbie internet user, I honestly cannot recall ever logging into TRF except via my own devices. I had what I thought was a long enough, unusual enough password and I wasn't using it anywhere else. There was however one kind of weird event earlier in the week. Someone emailed me with questions about the Ennebi I had listed for sale. He sent a link with RolexForums in the URL showing me his collection allegedly but I couldn't pull it up. I mentioned that and asked what his username was and he never gave it. I did send him some additional information and pictures of the watch, but again nothing that I can imagine would have helped him tap into my account here. After several back and forths, he no longer continued the conversation....but again I've had that in proposed sales before. I'm really freaked out about this. I'm new to posting here much but have been on a couple of other watch sites as regulars for as long as 20+ years. Don't want my good name sullied by some scammer. Again if any of the mods want more information that what I have given here, please contact me offline.

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)