Hacking an account / security?

[+Lieblweb]

Hey Gang,

 

Just an overall concern -

 

I just received a password reset request for an older account. I haven't done anything or clicked on any links in the email.... the IP address that the request came from appears to be from FRANCE (I'm from U.S.) and I haven't touched that account in months.

 

I was told to forward the e-mail to spam@geocaching.com - but this bounced back and said the e-mail 'does not exist'

 

I probably should login manually and change my password - but perhaps its better off I wait this out and see if there's any activity on this account in the next week or so.

 

Whatta you guys think? I tried searching for spam or hacking and didn't come up with any much. Or perhaps this whole thing is someone having 'dumb thumbs'??

 

Thanks

Jandy

[+Team Batpony]

What exactly is the full text of the e-mail in question?

[+WeightMan]

You might try emailing contact at geocaching dot com

[+kunarion]

Whatta you guys think? I tried searching for spam or hacking and didn't come up with any much. Or perhaps this whole thing is someone having 'dumb thumbs'??

I sent myself a password reset request (the email is below). Compare it to what you received. Someone in France may have forgotten even their user name, and by coincidence, typed yours.

 

Regardless, if you get an email like that, which you did not request (the email happens almost instantly, so you'd know), don't reply with any personal info. There is an old hacker trick, where an email is sent which would lead you to a Spoof URL (which may appear to be the actual web site) designed to capture whatever you type. I'd be interested to know what the Web Domain is that you'd be sent to in this case (but blank out any specifics), but don't click any links. Don't even mess around with it if you think there's a serious issue.

 

It's a good idea to regularly change passwords, but do that within the web sites if possible (by visiting the actual web address, not a link in an email). You may safely ignore the email you received, or forward it to GC as WeightMan mentioned.

 

 

-------------------------------

This is an automated email from Groundspeak in response to a password reset request for user kunarion from IP address XX.XXX.XX.XXX.

 

Please visit the following page to reset your password:

 

http://coord.info/XXXXXXXXXXXXXXXXXXXXXXXX

 

This link will expire in 3 days. If you would like to generate a new password reset request after that time, please visit http://www.geocaching.com/login/password.aspx . No changes will be made to your account if you choose to ignore this email notification.

 

Cheers,

 

The Groundspeak Team

Edited March 24, 2012 by kunarion

[+Lieblweb]

I sent myself a password reset request (the email is below). Compare it to what you received. Someone in France may have forgotten even their user name, and by coincidence, typed yours.

 

Regardless, if you get an email like that, which you did not request (the email happens almost instantly, so you'd know), don't reply with any personal info. There is an old hacker trick, where an email is sent which would lead you to a Spoof URL (which may appear to be the actual web site) designed to capture whatever you type. I'd be interested to know what the Web Domain is that you'd be sent to in this case (but blank out any specifics), but don't click any links. Don't even mess around with it if you think there's a serious issue.

 

It's a good idea to regularly change passwords, but do that within the web sites if possible (by visiting the actual web address, not a link in an email). You may safely ignore the email you received, or forward it to GC as WeightMan mentioned.

 

 

-------------------------------

This is an automated email from Groundspeak in response to a password reset request for user kunarion from IP address XX.XXX.XX.XXX.

 

Please visit the following page to reset your password:

 

http://coord.info/XXXXXXXXXXXXXXXXXXXXXXXX

 

This link will expire in 3 days. If you would like to generate a new password reset request after that time, please visit http://www.geocaching.com/login/password.aspx . No changes will be made to your account if you choose to ignore this email notification.

 

Cheers,

 

The Groundspeak Team

 

And that's almost exactly how the e-mail looks....It looks legit and I inspected the header closer. It has from mail54c40.carrierzone.com and the ip address from Kansas.

 

I'm 'on the same page' and am full aware not to click on anything.

 

Weird thing....If you're not a premium member - does that mean you can't be a part of the 'Friends' ???

I was logged in as Lieblweb and was viewing my old account. Sent a Friend Request to the old account. I received the e-mail notification. I clicked on the link to accept or deny the friend request and the response I got was:

 

"An Error Has Occurred

 

This Friend Request is not for you "

 

The old account is not a premium member.

 

Thanks! I'll forward to geocaching.com and just hope it was a fluke.

[+kunarion]

I clicked on the link to accept or deny the friend request and the response I got was:

 

"An Error Has Occurred

 

This Friend Request is not for you "

I've seen something very similar when clicking little-used links around the site. I'd get an error, spend some time filling out the form to "report this error" which would be right there on the page. And the very next moment I tried it, it worked fine. AND I'd eventually get a reply from GS asking what page I saw the error (go figure, couldn't that be something the error report should automatically include? ).

 

My point is, I have no idea why that would happen.

[knowschad]

"An Error Has Occurred

This Friend Request is not for you "

Sigh... familiar story, and the reason I don't go to the single bars anymore.

[+Harry Dolphin]

"An Error Has Occurred

This Friend Request is not for you "

Sigh... familiar story, and the reason I don't go to the single bars anymore.

 

Umm... Got an e-mail from a customer today requesting their supplier to send us a gallon of paint so someone from the customer's staff could come in to repaint the chips in the paint on the granulators that were damaged by improper use of chains. The granulators are 157" x 110" x 57" and weigh 19000#. Not small machines. Yes. They needed to be chained. The e-mail was to "Mr. Special". Yup. That seems to be his name. "Greg Special." We had quite a chortle over that! Great pickup line in a bar: "Hi. I'm Mr. Special." Hope he lives up to his name!

[+The Cheeseheads]

Moving thread to the correct forum.

[+JoenGPS]

Most likely a mis-typed user name request for a reset. The re-set link would go to the email on file for that account, that's what you probably got.

[+embra]

I know this is an old thread, but it seemed like a good place to report that I just received one of these emails unexpectedly. The IP address is in Germany (I'm in the US).