Phishing email from DNF

[Nick]

Hi guys,

Something strange happened right now. Today I sold a domain to one of DNF members. Everything is ok. I left positive TR and just logged in and got on my email the message:

Dear TwoMoon,

You have received a new private message at www.dnforum.com from (member's nickname), entitled "iTrader Rating Notification".

To read the original version of the message that was sent, to respond to the message, or to delete the message, you must log in here:
www.dnforum.com/private.php

This is the message that was sent:
***************
You have received a new (member's nickname) rating or comment from http://www.dnforum.com.

Details about this transaction can be found *on your iTrader page* (http://64267/itrader.php?u=134947).

Note: This is an automated message.
***************

Please remember, if you click reply to this email, the intended recipient WILL NOT get your message. You must log into the DNForum website to reply to private messages.

Warm wishes,
Welcome to DNF.com™ - Domain Sales, Domain Forum, Domain Appraisals, Domain Registrars
______________________________________________________________________________________

Everything is as usual, but email is marked as "possibly phishing". I have this message in my PM here, but actually there is no any TR from this member.
Plus look at his link: (http://64267/itrader.php?u=134947 usually it's for example like this: http://www.dnforum.com/itrader.php?u=134947)
I clicked on that link - and nothing.

What do you think about all this?

Thanks, Nick

 

[Theo]

Can you post the headers?

 

[silentg]

This could be just a bug. Did you contact Adam before posting this?

 

[Theo]

Adam's at TRAFFIC, leave the man alone

 

[Nick]

Sure:

Return-path: <[email protected]>
Envelope-to: [email protected]
Delivery-date: Sat, 06 Oct 2012 15:00:21 +0100
Received: from dnf-web2.dnforum.com ([204.109.62.132])
by mail76.extendcp.com with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.77)
id 1TKUvV-0001oz-0k
for [email protected]; Sat, 06 Oct 2012 15:00:21 +0100
Received: from dnf-web2.dnforum.com (localhost.localdomain [127.0.0.1])
by dnf-web2.dnforum.com (8.13.8/8.13.8) with ESMTP id q96E0Iwo029018
for <[email protected]>; Sat, 6 Oct 2012 10:00:19 -0400
Received: (from apache@localhost)
by dnf-web2.dnforum.com (8.13.8/8.13.8/Submit) id q96E0IFp029017;
Sat, 6 Oct 2012 10:00:18 -0400
Date: Sat, 6 Oct 2012 10:00:18 -0400
To: [email protected]
Subject: =?UTF-8?q?New_Private_Message_at_Welcome_to_DNF=2Ecom=E2=84=A2__-_Domain_Sales=2C_Domain_Forum=2C_Domain_Appraisals=2C_Domain_Registrars?=
From: =?UTF-8?q?Welcome_to_DNF=2Ecom=E2=84=A2__-_Domain_Sales=2C_Domain_Forum=2C_Domain_Appraisals=2C_Domain_Registrars?= <[email protected]>
Auto-Submitted: auto-generated
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
X-Priority: 3
X-Mailer: vBulletin Mail via PHP
Content-Transfer-Encoding: quoted-printable
X-MIME-Autoconverted: from 8bit to quoted-printable by dnf-web2.dnforum.com id q96E0Iwo029018


P.S. No didn't contact Adam - he is at Traffic
Maybe a bug, but it's the first time I got such email so wanted to ask

 

[Theo]

Looks legit and apparently it's a misconfiguration of the vBulletin software that sends out the notices.

 

[Nick]

Looks legit and apparently it's a misconfiguration of the vBulletin software that sends out the notices.

Ok, thanks Theo

 

[draggar]

Looks like a bug.

http://0.0.251.11/itrader.php?u=134947

If you replace the IP address with dnforum.com you get this:

http://www.dnforum.com/itrader.php?u=134947

Which is your iTrader.

Edit: I'll shoot a PM to the admins about this.

 

[Nick]

Looks like a bug.

http://0.0.251.11/itrader.php?u=134947

If you replace the IP address with dnforum.com you get this:

http://www.dnforum.com/itrader.php?u=134947

Which is your iTrader.

Edit: I'll shoot a PM to the admins about this.

Thanks Draggar!
Actually there is no feedback from the member who seems to left it. But feedback it's not so important - just wanted to be sure everything is okay.

BTW the email that informed me about your post was also "suspected phishing message"

 

[Gerry]

Legit. Get these all the time. To be honest, you can opt out of the email option getting these responses or getting an email like this.

 

[Biggie]

But feedback it's not so important -

on the contrary


though some may dismiss iTrader ratings as meaningless for what ever reason.

it can be seen in comparison to, your "Angie's List" review, or a BB rating, etc.

what else is there for you to check about a member, if only to see if they will follow thru on a deal...

twitter, their fb page, linkedn?



if you show respect for the rating system, then others will respect it too

particularly, when it's used to log the number of valid transactions performed by each respective member and the efficiency and professionalism, in how those parties involved completed the deal.


imo...

 

[Nick]

on the contrary


though some may dismiss iTrader ratings as meaningless for what ever reason.

it can be seen in comparison to, your "Angie's List" review, or a BB rating, etc.

what else is there for you to check about a member, if only to see if they will follow thru on a deal...

twitter, their fb page, linkedn?



if you show respect for the rating system, then others will respect it too

particularly, when it's used to log the number of valid transactions performed by each respective member and the efficiency and professionalism, in how those parties involved completed the deal.


imo...

Probably you got me wrong a bit.

I meant that i opened this thread because of the some problem - email marked phishing.

This was the problem but not that I didn't receive a TR.

As for the TR - I love TR and think it's very important.

 

[katherine]

I've received some paypal phishing mails lately, and they include headers that make them look legitimate, like they were actually sent by paypal themselves. But the URL is a spoof. Scammers are becoming more sophisticated (up to a certain extent of course, clever scammer is an oxymoron).