Is this a phishing website?

General discussion that is not related to Grimrock goes here.
Post Reply
pizzahut
Posts: 4
Joined: Wed Aug 13, 2014 9:27 pm

Is this a phishing website?

Post by pizzahut »

I received a topic reply notification, almost everything is correct, like my user id number, thread number etc.
However it uses a different domain, the forum structure slightly differs and a different number of people are browsing the forum. Also the supposed new post is located in a different thread. So I'm thinking this is a phishing website, just asking for confirmation before I report it.

Message text:

Code: Select all

Hello pizzahut,

You are receiving this notification because you are watching the topic, "Is
there a way to escape level 12 to complete achievements?" at "Grimrock".
This topic has received a reply since your last visit. You can use the
following link to view the replies made, no more notifications will be sent
until you visit the topic.

If you want to view the newest post made since your last visit, click the
following link:
http://grimrock-forum.evermade.fi/viewtopic.php?f=13&t=6732&p=74658&e=74658

If you want to view the topic, click the following link:
http://grimrock-forum.evermade.fi/viewtopic.php?f=13&t=6732

If you want to view the forum, click the following link:
http://grimrock-forum.evermade.fi/viewforum.php?f=13

If you no longer wish to watch this topic you can either click the
"Unsubscribe topic" link found at the bottom of the topic above, or by
clicking the following link:


http://grimrock-forum.evermade.fi/viewtopic.php?uid=7393&f=13&t=6732&unwatch=topic

-- 
Thanks, The Management
Headers:

Code: Select all

From - Wed Jan 07 17:05:43 2015
X-Account-Key: account3
X-UIDL: 1195817629.160268
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:                                                                                 
Return-Path: <0000014ac3987524-9ece5b36-654a-4239-84b6-7a5447120334-000000@amazonses.com>
Received: from mailin57.aul.t-online.de ([172.20.27.6])
	by ehead902.aul.t-online.de (Dovecot) with LMTP id tdSYEdvzrFQqqwAAUDv/bw;
	Wed, 07 Jan 2015 09:52:43 +0100
Received: from mx.expurgate.net ([194.145.224.20]) by mailin57.aul.t-online.de
	with esmtp id 1Y8mM2-1Z1Vtg0; Wed, 7 Jan 2015 09:52:38 +0100
Received: from mx.expurgate.net (helo=localhost)
	by mx.expurgate.net with esmtp
	id 1Y8mM1-0007Ti-L4
	for MY-EMAIL-ADDRESS; Wed, 07 Jan 2015 09:52:37 +0100
Received: from [54.240.8.60] (helo=a8-60.smtp-out.amazonses.com)
	by mx.expurgate.net with ESMTP (eXpurgate 4.0.3)
	(envelope-from <0000014ac3987524-9ece5b36-654a-4239-84b6-7a5447120334-000000@amazonses.com>)
	id 54acf3d5-39d8-36f0083c93ab-1
	for <MY-EMAIL-ADDRESS>; Wed, 07 Jan 2015 09:52:37 +0100
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
	s=224i4yxa5dv7c2xz3womw6peuasteono; d=amazonses.com; t=1420620756;
	h=Subject:To:From:Reply-To:Sender:MIME-Version:Message-ID:Date:Content-Type:Content-Transfer-Encoding:Feedback-ID;
	bh=8LdXTKIRSaVeQLbeNcjT+A1jhJ8mQO3FnOtamO2m8H0=;
	b=mHG9Tiu9cOB1ipV38h/SiAn4Po+Ik0l2GPSF48MAOi83fV+eLb6eBMcaTVIj7lpi
	xypRfBwWppYE0ABeOysK3BtFEHi17Ve9U7SW14tiUIR5xCT4uN8I+XxKaPGFc5X5pSN
	9E7Hr3WMiCdmuuTad//WYBeLi7BIQhXV8GD9eP/A=
Subject: =?UTF-8?B?VG9waWMgcmVwbHkgbm90aWZpY2F0aW9uIC0gIklzIHRoZXJlIGEgd2F5IHRv?=
 =?UTF-8?B?IGVzY2FwZSBsZXZlbCAxMiB0byBjb21wbGV0ZSBhY2hpZXZlbWVudHM/Ig==?=
To: =?UTF-8?B?cGl6emFodXQ=?= <MY-EMAIL-ADDRESS>
From: <forum@almosthumangames.com>
Reply-To: <forum@almosthumangames.com>
Sender: <forum@almosthumangames.com>
MIME-Version: 1.0
Message-ID: <0000014ac3987524-9ece5b36-654a-4239-84b6-7a5447120334-000000@email.amazonses.com>
Date: Wed, 7 Jan 2015 08:52:36 +0000
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: phpBB3
X-MimeOLE: phpBB3
X-phpBB-Origin: phpbb://grimrock-forum.evermade.fi
X-SES-Outgoing: 2015.01.07-54.240.8.60
Feedback-ID: us-east-1.Zm9ydW1AYWxtb3N0aHVtYW5nYW1lcy5jb20=:AmazonSES
X-purgate-ID: expurgator-f7f1b8/1420620757-000039D8-EF695594/9/41107
X-purgate-type: clean
X-purgate-size: 1044
X-purgate-Ad: Categorized by eleven eXpurgate (R) http://www.eleven.de
X-purgate: This mail is considered clean (visit http://www.eleven.de for further information)
X-purgate: clean
X-CAR-SPAM: u;0;2015-01-07T08:52:43Z
X-CAR-VIRUSSCAN: unchecked
X-CAR-MSGID: f798eeb5-1ff9-48d9-9c3a-e1f9e3235128
X-Seen: false
X-ENVELOPE-TO: <MY-EMAIL-ADDRESS>
X-Antivirus: avast! (VPS 150107-0, 07.01.2015), Inbound message
X-Antivirus-Status: Clean
User avatar
JohnWordsworth
Posts: 1397
Joined: Fri Sep 14, 2012 4:19 pm
Location: Devon, United Kingdom
Contact:

Re: Is this a phishing website?

Post by JohnWordsworth »

Heh, how weird. It looks like http://grimrock-forum.evermade.fi is a backup of the forum from around the time that the website switched over to the new site for the release of Grimrock 2.

I'm guessing that Evermade (the company who did the new Grimrock website) copied the old site/forum to a back-up server "just incase". Perhaps you were subscribed to a topic back in the day, around the time this copy was made (6 months ago)? Now a spam-bot has possibly stumbled across that site (or a real person) and posted in that old thread - hence you are getting emailed a link to an old forum thread.

Either way - pretty certain it's nothing malicious or bad. Just a hang-over from the website upgrade.
My Grimrock Projects Page with links to the Grimrock Model Toolkit, GrimFBX, Atlas Toolkit, QuickBar, NoteBook and the Oriental Weapons Pack.
User avatar
Isaac
Posts: 3172
Joined: Fri Mar 02, 2012 10:02 pm

Re: Is this a phishing website?

Post by Isaac »

JohnWordsworth wrote:Heh, how weird. It looks like http://grimrock-forum.evermade.fi is a backup of the forum from around the time that the website switched over to the new site for the release of Grimrock 2.

I'm guessing that Evermade (the company who did the new Grimrock website) copied the old site/forum to a back-up server "just incase". Perhaps you were subscribed to a topic back in the day, around the time this copy was made (6 months ago)? Now a spam-bot has possibly stumbled across that site (or a real person) and posted in that old thread - hence you are getting emailed a link to an old forum thread.

Either way - pretty certain it's nothing malicious or bad. Just a hang-over from the website upgrade.
This is the gist of what Antti said to me via PM from this morning.
pizzahut
Posts: 4
Joined: Wed Aug 13, 2014 9:27 pm

Re: Is this a phishing website?

Post by pizzahut »

JohnWordsworth wrote:Perhaps you were subscribed to a topic back in the day, around the time this copy was made (6 months ago)?
Yes I was subscribed to the topic, however the supposed new post was in a different thread and older, too. I guess something went wrong.

Anyway this thread can be closed or deleted, apparently it was just an old backup and it has been deleted now or moved elsewhere.
Post Reply