Confirmed: Cheat e-mail from BF2RS is a hoax

**frazzman** · 04-21-2006, 06:21 AM

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Yeh i reakon theyve over stepped the mark bigtime with this one.., its one thing to bring out hax for a game but to spoof/forge ones identity to fool others is widely considered as illegal most anywhere in the world.

**johnrambo.ptwars** · 04-21-2006, 06:24 AM

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

I see all the thing now, they want to suck money from the kids out there and give them a hack that doesn't work at all, lol poor kidies that will fall for that **** :P

**WarGimp** · 04-21-2006, 06:29 AM

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

To give credit where credit is due, it was -[MDS]-Stormy that cracked this hoax. I just went 'n confirmed his info.

http://www.totalbf2.com/forums/showthread.php?p=869248#post869248

Cheers!

**Bastian** · 04-21-2006, 06:53 AM

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Wow, people sure got worked up about this.

If people were a little more cautious and thought we would have had a lot less posts about this.

Ask yourself if the admin at BF2S would really send an email to everyone on their email list about "confirmed hack"? - NO

Also, it is very easy to send an email with the "TO:" address spoofed so be cautious and don't jump to conclusions.

As for those who took the opportunity to slam the people at BF2S - shame on you. As for those who decided to download the "aimbot" - He who laughs last laughs the hardest (when you get busted).

**WarGimp** · 04-21-2006, 07:22 AM

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Man... I tarded it up perty good.
I managed to read the sender as BF2RS rather than BF2s... repeatedly!
:p
Still, it remains true that this is a hoax. Here's the proper link to BF2S stating they did not (and would not) send this e-mail: http://forums.bf2s.com/viewtopic.php?id=21646

Me... I'd better get some sleep. My brain has apparently been off for awhile now without me noticing.

**The Soup Nazi** · 04-21-2006, 07:26 AM

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

I've got an idea, guys. Does anyone still have the original message that contains the header information? If someone could post a screenshot that displays the exact sender information, routing information, the spoofed email address, I'd appreciate it.

We could then take this up with http://powweb.com. powweb.com is MSX's web hosting company and probably lists that it's against their TOS to spoof email addresses. If we could piece together that information, I think we could get their site shut down- for now. They'd probably just move on to another web host, but at least it would stop them for a while.

**Dooshy** · 04-21-2006, 07:28 AM

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Very nice find wargimp and -[MDS]-Stormy

**goaliemike** · 04-21-2006, 07:32 AM

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

I still have the original email in Gmail... I can post stuff when i get back from school

**The Soup Nazi** · 04-21-2006, 07:35 AM

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

From this page: http://powweb.com/PowWeb/Company/Policy/TOS

No "Spam": UCE/UBE or "Spam" originating from a PowWeb account, or associated with a PowWeb account, is not tolerated. This includes any e-mail that promotes web sites hosted on a PowWeb account but is sent from an e-mail address not associated with that PowWeb account. Client shall not use their PowWeb services for chain letters, junk mail, bulk-email, or any use of distribution lists to any person who has not given specific permission to be included in such a process. PowWeb reserves the right to deactivate or terminate any account(s) upon any indication of such activity without notice. There will be a $150 clean up fee if an account was suspended for policy violation. There is a 1000 Email limit that can be sent out within a 24 hour period.

**[BIA]Flakstar** · 04-21-2006, 07:36 AM

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Code:

X-Virus-Flag: no
X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on xxx
X-Spam-Level: **
X-Spam-Status: No, score=2.4 required=5.0 tests=AWL,TRACKER_ID autolearn=no 
	version=3.1.0
X-Virus-Flag: no
X-Virus-Flag: no
Return-path: <msxbackup1co@clust07-www07.powweb.com>
Delivery-date: Fri, 21 Apr 2006 09:42:20 +0200
Received: from [194.97.50.136] (helo=mx3.freenet.de)
	by mbox70.freenet.de with esmtpa (ID exim) (Exim 4.61-RC1 #1)
	id 1FWqHU-000754-0o
	for xxx@01019freenet.de; Fri, 21 Apr 2006 09:42:20 +0200
Received: from clust07-www07.powweb.com ([66.152.98.77])
	by mx3.freenet.de with esmtp (Exim 4.61-RC1 #1)
	id 1FWqHT-0003QJ-Ky
	for xxx@freenet.de; Fri, 21 Apr 2006 09:42:19 +0200
Received: by clust07-www07.powweb.com (Postfix, from userid 144944)
	id B73086F1E4; Fri, 21 Apr 2006 00:42:18 -0700 (PDT)
To: xxx@freenet.de
Subject: WARNING: New MSXSecurity BF2 Aimbot Confirmed legit.
From: admin@bf2s.com
MIME-Version: 1.0
Content-Type: multipart/alternative;
  boundary = RDHJLM44488cdaacfd5
Message-Id: <20060421074218.B73086F1E4@clust07-www07.powweb.com>
Date: Fri, 21 Apr 2006 00:42:18 -0700 (PDT)
Delivered-To: xxx@freenet.de
Envelope-to: xxx@freenet.de
X-purgate-ID: 149285::060421094220-6A574000-0AF29681
Delivered-To: xxx@01019freenet.de
X-Length: 5268
X-UID: 645
Status: RO
X-Status: RC
X-KMail-EncryptionState: N
X-KMail-SignatureState: N
X-KMail-MDN-Sent:  



This is a MIME encoded message.



--RDHJLM44488cdaacfd5

Content-Type: text/plain; charset=ISO-8859-1

Content-Transfer-Encoding: base64




SGV5IGV2ZXJ5b25lLCBJIGFtIHdyaXRpbmcgdG8gaW5mb3JtIHlvdSBhbGwgb2Ygc29tZSB2ZXJ5

IC4uLiBEaXN0dXJiaW5nIG5ld3MuIEl0IHNlZW1zIGxpa2UgZXZlcnlvbmVzIFwiZmF2b3JpdGVc

IiBoYWNrIHdlYnNpdGUgKCBodHRwOi8vd3d3Lm1zeHNlY3VyaXR5LmNvbSApIEhhcyByZWxlYXNl

ZCBhIEJGMiBhaW1ib3QgYW5kIHRoZSBjb21tYW5kZXIgaGFjayBpcyBiYWNrIGFsc28uIFRoZXJl

IGlzIGEgd2F5IGhvd2V2ZXIgdG8gc3BvdCBlbmVteXMgdXNpbmcgdGhlIGFpbWJvdC4gSWYgeW91

IHNlZSBhIHBsYXllciBnZXQgMyBvciA0IGtpbGxzIGluIGEgcm93IHdpdGggYSByaWZsZS9waXN0

b2wsIHRyeSBhbmQgd2F0Y2ggdGhlbSB2ZXJ5IGNsb3NlbHkuIElmIHRoZXkgYXJlIGxvb2tpbmcg

dGhyb3VnaCB3YWxscyBhbmQgYW1tYXNpbmcgbWFzc2l2ZSBraWxscyBpdHMgbW9zdCBsaWtlbHkg

dGhleSBhcmUgaGFja2luZy4gUmVtZW1iZXIsIHRoZSBvbmx5IFwicGVyZmVjdFwiIGFudGkgY2hl

YXQgaXMgaGF2aW5nIGEgYWRtaW4gcHJlc2VudCBhdCBhbGwgdGltZXMuIFdlIGFsbCB3ZXJlIGln

bm9yYW50IGZvciB0aGlua2luZyB0aGF0IGNsaWVudCBob29rcyBhbmQgYWltYm90cyB3b3VsZCBu

b3QgdG91Y2ggQkYyLCB3aGVuIGl0IGhhcyBiZWNvbWUgYXMgcG9wdWxhciBhcyBpdCBoYXMuIFRo

aXMgd2FzIHNvbWV0aGluZyB0aGF0IHdhcyBkZXN0aW5lZCB0byBoYXBwZW4sIHNvIFBsZWFzZSBw

cmVwYXJlIHlvdXJzZWxmLg0KDQoNClRoZXJlIGFyZSBtb3ZpZXMgb2YgdGhpcyBhaW1ib3Qgb3V0

LCBzbyB3YXRjaCB0aGVtIGFuZCBnZXQgZmFtaWxpYXIgd2l0aCB0aGVtLCBzbyB5b3Uga25vdyB3

aGF0IHRvIGxvb2sgZm9yLiBIZXJlIGFyZSBzb21lIGxpbmtzIHRvIHRoZSBtb3ZpZXMuDQoNCmh0

dHA6Ly9tZWRpYS5wdXRmaWxlLmNvbS9NU1gtVmlkZW8yMjIyDQpodHRwOi8vbWVkaWEucHV0Zmls

ZS5jb20vTVNYLUFpbWJvdA0KaHR0cDovL21lZGlhLnB1dGZpbGUuY29tL01TWFZpZGVvMjNfMDAw

Mg0KaHR0cDovL3ZpZGVvLmdvb2dsZS5jb20vdmlkZW9wbGF5P2RvY2lkPS0zMDc3NzE1NDA0NTY4

OTA1NTAzDQpodHRwOi8vbWVkaWEucHV0ZmlsZS5jb20vcHduYWdlNTU4MA0KaHR0cDovL3ZpZGVv

Lmdvb2dsZS5jb20vdmlkZW9wbGF5P2RvY2lkPS0zNjQ5MTQxMTg4ODQwNzg2NzE1DQpodHRwOi8v

ZmlsZXMuZmlsZWZyb250LmNvbS9NU1hQSndtdi87NDkwNjMwODs7L2ZpbGVpbmZvLmh0bWwNCmh0

dHA6Ly9tZWRpYS5wdXRmaWxlLmNvbS9NU1gtU2VjdXJpdHktLS1CYWRrYXJtYS0tLVZpZGVvLTIN

Cmh0dHA6Ly9yYXBpZHNoYXJlLmRlL2ZpbGVzLzE2MTk4NzMxL2I0ZGs0cm1hc19CRjJfVmlkZW8u

TVNYQmV0YS53bXYuaHRtbCA=

--RDHJLM44488cdaacfd5

Content-Type: text/html; charset=ISO-8859-1

Content-Transfer-Encoding: base64




SGV5IGV2ZXJ5b25lLCBJIGFtIHdyaXRpbmcgdG8gaW5mb3JtIHlvdSBhbGwgb2Ygc29tZSB2ZXJ5

IC4uLiBEaXN0dXJiaW5nIG5ld3MuIEl0IHNlZW1zIGxpa2UgZXZlcnlvbmVzIFwiZmF2b3JpdGVc

IiBoYWNrIHdlYnNpdGUgKCBodHRwOi8vd3d3Lm1zeHNlY3VyaXR5LmNvbSApIEhhcyByZWxlYXNl

ZCBhIEJGMiBhaW1ib3QgYW5kIHRoZSBjb21tYW5kZXIgaGFjayBpcyBiYWNrIGFsc28uIFRoZXJl

IGlzIGEgd2F5IGhvd2V2ZXIgdG8gc3BvdCBlbmVteXMgdXNpbmcgdGhlIGFpbWJvdC4gSWYgeW91

IHNlZSBhIHBsYXllciBnZXQgMyBvciA0IGtpbGxzIGluIGEgcm93IHdpdGggYSByaWZsZS9waXN0

b2wsIHRyeSBhbmQgd2F0Y2ggdGhlbSB2ZXJ5IGNsb3NlbHkuIElmIHRoZXkgYXJlIGxvb2tpbmcg

dGhyb3VnaCB3YWxscyBhbmQgYW1tYXNpbmcgbWFzc2l2ZSBraWxscyBpdHMgbW9zdCBsaWtlbHkg

dGhleSBhcmUgaGFja2luZy4gUmVtZW1iZXIsIHRoZSBvbmx5IFwicGVyZmVjdFwiIGFudGkgY2hl

YXQgaXMgaGF2aW5nIGEgYWRtaW4gcHJlc2VudCBhdCBhbGwgdGltZXMuIFdlIGFsbCB3ZXJlIGln

bm9yYW50IGZvciB0aGlua2luZyB0aGF0IGNsaWVudCBob29rcyBhbmQgYWltYm90cyB3b3VsZCBu

b3QgdG91Y2ggQkYyLCB3aGVuIGl0IGhhcyBiZWNvbWUgYXMgcG9wdWxhciBhcyBpdCBoYXMuIFRo

aXMgd2FzIHNvbWV0aGluZyB0aGF0IHdhcyBkZXN0aW5lZCB0byBoYXBwZW4sIHNvIFBsZWFzZSBw

cmVwYXJlIHlvdXJzZWxmLg0KDQoNClRoZXJlIGFyZSBtb3ZpZXMgb2YgdGhpcyBhaW1ib3Qgb3V0

LCBzbyB3YXRjaCB0aGVtIGFuZCBnZXQgZmFtaWxpYXIgd2l0aCB0aGVtLCBzbyB5b3Uga25vdyB3

aGF0IHRvIGxvb2sgZm9yLiBIZXJlIGFyZSBzb21lIGxpbmtzIHRvIHRoZSBtb3ZpZXMuDQoNCmh0

dHA6Ly9tZWRpYS5wdXRmaWxlLmNvbS9NU1gtVmlkZW8yMjIyDQpodHRwOi8vbWVkaWEucHV0Zmls

ZS5jb20vTVNYLUFpbWJvdA0KaHR0cDovL21lZGlhLnB1dGZpbGUuY29tL01TWFZpZGVvMjNfMDAw

Mg0KaHR0cDovL3ZpZGVvLmdvb2dsZS5jb20vdmlkZW9wbGF5P2RvY2lkPS0zMDc3NzE1NDA0NTY4

OTA1NTAzDQpodHRwOi8vbWVkaWEucHV0ZmlsZS5jb20vcHduYWdlNTU4MA0KaHR0cDovL3ZpZGVv

Lmdvb2dsZS5jb20vdmlkZW9wbGF5P2RvY2lkPS0zNjQ5MTQxMTg4ODQwNzg2NzE1DQpodHRwOi8v

ZmlsZXMuZmlsZWZyb250LmNvbS9NU1hQSndtdi87NDkwNjMwODs7L2ZpbGVpbmZvLmh0bWwNCmh0

dHA6Ly9tZWRpYS5wdXRmaWxlLmNvbS9NU1gtU2VjdXJpdHktLS1CYWRrYXJtYS0tLVZpZGVvLTIN

Cmh0dHA6Ly9yYXBpZHNoYXJlLmRlL2ZpbGVzLzE2MTk4NzMxL2I0ZGs0cm1hc19CRjJfVmlkZW8u

TVNYQmV0YS53bXYuaHRtbCA=





--RDHJLM44488cdaacfd5--

but kmail just showed my the encoded stuff, like in the code block.

**WarGimp** · 04-21-2006, 07:36 AM

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Nice. Go get 'em guys.

I got it sent to my hotmail, so I don't have any header access (stupid hotmail).

**The Soup Nazi** · 04-21-2006, 07:41 AM

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Okay, thanks guys. If we can get this exact information from multiple sources showing that it was sent to different addresses but originating from the same sender, I think we may have something here.

According to their TOS, they're not allowed to send more than 1000 emails in a 24 hour period.

I'm wondering how they got our email addresses. I'm thinking that they found a way to grab them from the Battlefield 2 accounts (via EA) themselves. A guy at BF2S.com said that he received the email before registering there- so that means that they got it from another source- most likely from EA.

If this is the case, they sent out MANY more than 1000 emails in a 24 hour period.

I'm willing to bet that powweb.com will remove that account if enough people report the same abuse.

**Rambo** · 04-21-2006, 07:43 AM

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

why did i get 3 emails from bf2.com??? who has my address?totalbf2 or ea?:hmm:

**The Soup Nazi** · 04-21-2006, 07:44 AM

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

I'm thinking we'll need the email as it was received by Outlook/Outlook Express. Gmail doesn't like the MIME encoded message- I get a bunch or garbled code, too.

So, if you have the message in a email client like Outlook/Outlook Express please post a SCREENSHOT of the message and header information. I think the text body is just as important.

Confirmed: Cheat e-mail from BF2RS is a hoax

Confirmed: Cheat e-mail from BF2RS is a hoax

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment