"Have I been pwned" phish/hack

Forums › Off topic › "Have I been pwned" phish/hack

pauln

55 posts

Master Geek

#188970 11-Dec-2015 22:10

Hi all, apologies if this is the wrong forum. Just checking my gmail account I have an email from Have I been pwned asking me to confirm my registration stating that I, or someone else, has subscribed my email address to their service and asking me to verify my email address. I certainly haven't and subscribed and suspected a phish, a quick google doesn't bring up anything obvious eg it's a known phish. At the bottom of the email it states what the email was sent from someone at a certain IP address, a quick check shows that it is my IP address. I'm checking from my mobile device over Spark using the wap.telecom.co.nz APN.

Any ideas??

Many thanks

Paul

pauln

55 posts

Master Geek

#1448934 11-Dec-2015 22:12

Sorry the email says that it was initiated from someone at my IP address.....

sidefx

3500 posts

Uber Geek

Trusted

#1448937 11-Dec-2015 22:23

So you received an email from this site?

https://haveibeenpwned.com

If so it's probably not phishing or a hack - it's a fairly well known and IMO useful service\site. I've signed up for it. Perhaps you left your device\PC unattended and unlocked and someone signed you up to it to make a point or as a joke?

"I was born not knowing and have had only a little time to change that here and there." | Electric Kiwi | Sharesies
- Richard Feynman

pauln

55 posts

Master Geek

#1448943 11-Dec-2015 22:45

Hi sidefx

email came from noreply@haveibeenpwned.com

I checked my history and it doesn't appear as though someone has been having fun but I guess it's a possibility....

Cheers

Paul

sidefx

3500 posts

Uber Geek

Trusted

#1448946 11-Dec-2015 23:05

Yup, that's where the legit signup email I got after I signed up came from. If you didn't sign up to it just ignore it.

"I was born not knowing and have had only a little time to change that here and there." | Electric Kiwi | Sharesies
- Richard Feynman

freitasm

BDFL - Memuneh
68431 posts

Uber Geek

Administrator

Trusted

Geekzone

Lifetime subscriber

#1448976 11-Dec-2015 23:35

Where an email comes from means nothing - this is easily spoofed. The most important thing is really to check where the link for confirmation takes you - is it the actual site or some other domain?

And yes, it's a double opt-in: you enter your email address and instead of accepting it as a registration it sends out a confirmation with a link to verify the address to subscribe.

The beauty of this is that other people can't sign you up for unwanted mailing lists.

If you didn't do it, ignore. Move along.

These links are referral codes

gzt

11634 posts

Uber Geek

Lifetime subscriber

#1448978 11-Dec-2015 23:52

[Edit: assuming it is genuine as per M's comments:]

That's kind of interesting. How many devices use that ip address? I assume it is dynamic?

sidefx

3500 posts

Uber Geek

Trusted

#1449134 12-Dec-2015 11:46

@gzt The fact the signup request came from the OPs IP address is a bit odd, hence why I asked if someone may have got access to one of his devices and been playing silly buggers. I don't think anything in @freitasm's post was attempting to explain how it may have come from the OPs IP, just that the whole activation through email confirmation is good and that the sender of the reply (noreply@haveibeenpwned.com) can very very very easily be spoofed - though generally decent spam filters are good at picking this up - hence why it's important to verify that any links in the email actually go to the proper\expected site.

Of course if one is using a wifi network at home\work someone every device inside the network may (and probably will) share the one external public IP address, though OP says they were doing it from mobile device so that may be a bit different... though I *think* mobile phones are NAT'd in a similar way?

"I was born not knowing and have had only a little time to change that here and there." | Electric Kiwi | Sharesies
- Richard Feynman

gzt

11634 posts

Uber Geek

Lifetime subscriber

#1449196 12-Dec-2015 14:43

Reboot the mobile device and try again. The mobile device may likely get a new ip address. That will be interesting.

pauln

55 posts

Master Geek

#1449280 12-Dec-2015 18:04

Hi all

Rebooted my phone and still have the same IP, I'm pretty sure the wap APN NATs. Just a bit more info, I got the email at 8.15 last night, from around 6.50 till just after 8pm I was in a graduation and no one had access to my phone barring me

Cheers

Paul