Confirmed: Cheat e-mail from BF2RS is a hoax

[WarGimp]

I supposedly got this e-mail from Admin@bf2rs.com:

Hey everyone, I am writing to inform you all of some very ... Disturbing news. It seems like everyones \"favorite\" hack website ( http://www.**************** ) Has released a BF2 aimbot and the commander hack is back also. There is a way however to spot enemys using the aimbot. If you see a player get 3 or 4 kills in a row with a rifle/pistol, try and watch them very closely. If they are looking through walls and ammasing massive kills its most likely they are hacking. Remember, the only \"perfect\" anti cheat is having a admin present at all times. We all were ignorant for thinking that client hooks and aimbots would not touch BF2, when it has become as popular as it has. This was something that was destined to happen, so Please prepare yourself. There are movies of this aimbot out, so watch them and get familiar with them, so you know what to look for. Here are some links to the movies. http://video.google.com/videoplay?do...15404568905503 http://media.putfile.com/MSX-Video2222 http://media.putfile.com/MSX-Aimbot http://media.putfile.com/MSXVideo23_0002 http://media.putfile.com/pwnage5580 http://video.google.com/videoplay?do...41188840786715 http://files.filefront.com/MSXPJwmv/.../fileinfo.html http://media.putfile.com/MSX-Securit...arma---Video-2 http://rapidshare.de/files/16198731/...XBeta.wmv.html

This doesn't look like something I'd expect to see from an admin here... nore would I expect it to be adressed that way.

Please confirm this is a fake ASAP.

Thanks for posting but we are aware of this e-mail.

1. I got the same e-mail from admin@bf2s.com

2. Our admin e-mail is Admin@bf2rankedservers.com

3. I don't like to see this either its like advertising instead of alerting server admin to these hacks.

Source: http://www.bf2rankedservers.com/foru...ed=1#post32152

Looks like MSX has resorted to identity theft (it's easily proven to be where this came from). That's called a crime folks.

I wonder if they could be nailed for that?

[frazzman]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Yeh i reakon theyve over stepped the mark bigtime with this one.., its one thing to bring out hax for a game but to spoof/forge ones identity to fool others is widely considered as illegal most anywhere in the world.

[johnrambo.ptwars]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

I see all the thing now, they want to suck money from the kids out there and give them a hack that doesn't work at all, lol poor kidies that will fall for that **** :P

[WarGimp]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

To give credit where credit is due, it was -[MDS]-Stormy that cracked this hoax. I just went 'n confirmed his info.

http://www.totalbf2.com/forums/showthread.php?p=869248#post869248

Cheers!

[Bastian]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Wow, people sure got worked up about this.

If people were a little more cautious and thought we would have had a lot less posts about this.

Ask yourself if the admin at BF2S would really send an email to everyone on their email list about "confirmed hack"? - NO

Also, it is very easy to send an email with the "TO:" address spoofed so be cautious and don't jump to conclusions.

As for those who took the opportunity to slam the people at BF2S - shame on you. As for those who decided to download the "aimbot" - He who laughs last laughs the hardest (when you get busted).

[WarGimp]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Man... I tarded it up perty good.
I managed to read the sender as BF2RS rather than BF2s... repeatedly!
:p
Still, it remains true that this is a hoax. Here's the proper link to BF2S stating they did not (and would not) send this e-mail: http://forums.bf2s.com/viewtopic.php?id=21646

Me... I'd better get some sleep. My brain has apparently been off for awhile now without me noticing.

[The Soup Nazi]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

I've got an idea, guys. Does anyone still have the original message that contains the header information? If someone could post a screenshot that displays the exact sender information, routing information, the spoofed email address, I'd appreciate it.

We could then take this up with http://powweb.com. powweb.com is MSX's web hosting company and probably lists that it's against their TOS to spoof email addresses. If we could piece together that information, I think we could get their site shut down- for now. They'd probably just move on to another web host, but at least it would stop them for a while.

[Dooshy]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Very nice find wargimp and -[MDS]-Stormy

[goaliemike]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

I still have the original email in Gmail... I can post stuff when i get back from school

[The Soup Nazi]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

From this page: http://powweb.com/PowWeb/Company/Policy/TOS

No "Spam": UCE/UBE or "Spam" originating from a PowWeb account, or associated with a PowWeb account, is not tolerated. This includes any e-mail that promotes web sites hosted on a PowWeb account but is sent from an e-mail address not associated with that PowWeb account. Client shall not use their PowWeb services for chain letters, junk mail, bulk-email, or any use of distribution lists to any person who has not given specific permission to be included in such a process. PowWeb reserves the right to deactivate or terminate any account(s) upon any indication of such activity without notice. There will be a $150 clean up fee if an account was suspended for policy violation. There is a 1000 Email limit that can be sent out within a 24 hour period.

[[BIA]Flakstar]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

X-Virus-Flag: no
X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on xxx
X-Spam-Level: **
X-Spam-Status: No, score=2.4 required=5.0 tests=AWL,TRACKER_ID autolearn=no 
	version=3.1.0
X-Virus-Flag: no
X-Virus-Flag: no
Return-path: <msxbackup1co@clust07-www07.powweb.com>
Delivery-date: Fri, 21 Apr 2006 09:42:20 +0200
Received: from [194.97.50.136] (helo=mx3.freenet.de)
	by mbox70.freenet.de with esmtpa (ID exim) (Exim 4.61-RC1 #1)
	id 1FWqHU-000754-0o
	for xxx@01019freenet.de; Fri, 21 Apr 2006 09:42:20 +0200
Received: from clust07-www07.powweb.com ([66.152.98.77])
	by mx3.freenet.de with esmtp (Exim 4.61-RC1 #1)
	id 1FWqHT-0003QJ-Ky
	for xxx@freenet.de; Fri, 21 Apr 2006 09:42:19 +0200
Received: by clust07-www07.powweb.com (Postfix, from userid 144944)
	id B73086F1E4; Fri, 21 Apr 2006 00:42:18 -0700 (PDT)
To: xxx@freenet.de
Subject: WARNING: New MSXSecurity BF2 Aimbot Confirmed legit.
From: admin@bf2s.com
MIME-Version: 1.0
Content-Type: multipart/alternative;
  boundary = RDHJLM44488cdaacfd5
Message-Id: <20060421074218.B73086F1E4@clust07-www07.powweb.com>
Date: Fri, 21 Apr 2006 00:42:18 -0700 (PDT)
Delivered-To: xxx@freenet.de
Envelope-to: xxx@freenet.de
X-purgate-ID: 149285::060421094220-6A574000-0AF29681
Delivered-To: xxx@01019freenet.de
X-Length: 5268
X-UID: 645
Status: RO
X-Status: RC
X-KMail-EncryptionState: N
X-KMail-SignatureState: N
X-KMail-MDN-Sent:  



This is a MIME encoded message.



--RDHJLM44488cdaacfd5

Content-Type: text/plain; charset=ISO-8859-1

Content-Transfer-Encoding: base64




SGV5IGV2ZXJ5b25lLCBJIGFtIHdyaXRpbmcgdG8gaW5mb3JtIHlvdSBhbGwgb2Ygc29tZSB2ZXJ5

IC4uLiBEaXN0dXJiaW5nIG5ld3MuIEl0IHNlZW1zIGxpa2UgZXZlcnlvbmVzIFwiZmF2b3JpdGVc

IiBoYWNrIHdlYnNpdGUgKCBodHRwOi8vd3d3Lm1zeHNlY3VyaXR5LmNvbSApIEhhcyByZWxlYXNl

ZCBhIEJGMiBhaW1ib3QgYW5kIHRoZSBjb21tYW5kZXIgaGFjayBpcyBiYWNrIGFsc28uIFRoZXJl

IGlzIGEgd2F5IGhvd2V2ZXIgdG8gc3BvdCBlbmVteXMgdXNpbmcgdGhlIGFpbWJvdC4gSWYgeW91

IHNlZSBhIHBsYXllciBnZXQgMyBvciA0IGtpbGxzIGluIGEgcm93IHdpdGggYSByaWZsZS9waXN0

b2wsIHRyeSBhbmQgd2F0Y2ggdGhlbSB2ZXJ5IGNsb3NlbHkuIElmIHRoZXkgYXJlIGxvb2tpbmcg

dGhyb3VnaCB3YWxscyBhbmQgYW1tYXNpbmcgbWFzc2l2ZSBraWxscyBpdHMgbW9zdCBsaWtlbHkg

dGhleSBhcmUgaGFja2luZy4gUmVtZW1iZXIsIHRoZSBvbmx5IFwicGVyZmVjdFwiIGFudGkgY2hl

YXQgaXMgaGF2aW5nIGEgYWRtaW4gcHJlc2VudCBhdCBhbGwgdGltZXMuIFdlIGFsbCB3ZXJlIGln

bm9yYW50IGZvciB0aGlua2luZyB0aGF0IGNsaWVudCBob29rcyBhbmQgYWltYm90cyB3b3VsZCBu

b3QgdG91Y2ggQkYyLCB3aGVuIGl0IGhhcyBiZWNvbWUgYXMgcG9wdWxhciBhcyBpdCBoYXMuIFRo

aXMgd2FzIHNvbWV0aGluZyB0aGF0IHdhcyBkZXN0aW5lZCB0byBoYXBwZW4sIHNvIFBsZWFzZSBw

cmVwYXJlIHlvdXJzZWxmLg0KDQoNClRoZXJlIGFyZSBtb3ZpZXMgb2YgdGhpcyBhaW1ib3Qgb3V0

LCBzbyB3YXRjaCB0aGVtIGFuZCBnZXQgZmFtaWxpYXIgd2l0aCB0aGVtLCBzbyB5b3Uga25vdyB3

aGF0IHRvIGxvb2sgZm9yLiBIZXJlIGFyZSBzb21lIGxpbmtzIHRvIHRoZSBtb3ZpZXMuDQoNCmh0

dHA6Ly9tZWRpYS5wdXRmaWxlLmNvbS9NU1gtVmlkZW8yMjIyDQpodHRwOi8vbWVkaWEucHV0Zmls

ZS5jb20vTVNYLUFpbWJvdA0KaHR0cDovL21lZGlhLnB1dGZpbGUuY29tL01TWFZpZGVvMjNfMDAw

Mg0KaHR0cDovL3ZpZGVvLmdvb2dsZS5jb20vdmlkZW9wbGF5P2RvY2lkPS0zMDc3NzE1NDA0NTY4

OTA1NTAzDQpodHRwOi8vbWVkaWEucHV0ZmlsZS5jb20vcHduYWdlNTU4MA0KaHR0cDovL3ZpZGVv

Lmdvb2dsZS5jb20vdmlkZW9wbGF5P2RvY2lkPS0zNjQ5MTQxMTg4ODQwNzg2NzE1DQpodHRwOi8v

ZmlsZXMuZmlsZWZyb250LmNvbS9NU1hQSndtdi87NDkwNjMwODs7L2ZpbGVpbmZvLmh0bWwNCmh0

dHA6Ly9tZWRpYS5wdXRmaWxlLmNvbS9NU1gtU2VjdXJpdHktLS1CYWRrYXJtYS0tLVZpZGVvLTIN

Cmh0dHA6Ly9yYXBpZHNoYXJlLmRlL2ZpbGVzLzE2MTk4NzMxL2I0ZGs0cm1hc19CRjJfVmlkZW8u

TVNYQmV0YS53bXYuaHRtbCA=

--RDHJLM44488cdaacfd5

Content-Type: text/html; charset=ISO-8859-1

Content-Transfer-Encoding: base64




SGV5IGV2ZXJ5b25lLCBJIGFtIHdyaXRpbmcgdG8gaW5mb3JtIHlvdSBhbGwgb2Ygc29tZSB2ZXJ5

IC4uLiBEaXN0dXJiaW5nIG5ld3MuIEl0IHNlZW1zIGxpa2UgZXZlcnlvbmVzIFwiZmF2b3JpdGVc

IiBoYWNrIHdlYnNpdGUgKCBodHRwOi8vd3d3Lm1zeHNlY3VyaXR5LmNvbSApIEhhcyByZWxlYXNl

ZCBhIEJGMiBhaW1ib3QgYW5kIHRoZSBjb21tYW5kZXIgaGFjayBpcyBiYWNrIGFsc28uIFRoZXJl

IGlzIGEgd2F5IGhvd2V2ZXIgdG8gc3BvdCBlbmVteXMgdXNpbmcgdGhlIGFpbWJvdC4gSWYgeW91

IHNlZSBhIHBsYXllciBnZXQgMyBvciA0IGtpbGxzIGluIGEgcm93IHdpdGggYSByaWZsZS9waXN0

b2wsIHRyeSBhbmQgd2F0Y2ggdGhlbSB2ZXJ5IGNsb3NlbHkuIElmIHRoZXkgYXJlIGxvb2tpbmcg

dGhyb3VnaCB3YWxscyBhbmQgYW1tYXNpbmcgbWFzc2l2ZSBraWxscyBpdHMgbW9zdCBsaWtlbHkg

dGhleSBhcmUgaGFja2luZy4gUmVtZW1iZXIsIHRoZSBvbmx5IFwicGVyZmVjdFwiIGFudGkgY2hl

YXQgaXMgaGF2aW5nIGEgYWRtaW4gcHJlc2VudCBhdCBhbGwgdGltZXMuIFdlIGFsbCB3ZXJlIGln

bm9yYW50IGZvciB0aGlua2luZyB0aGF0IGNsaWVudCBob29rcyBhbmQgYWltYm90cyB3b3VsZCBu

b3QgdG91Y2ggQkYyLCB3aGVuIGl0IGhhcyBiZWNvbWUgYXMgcG9wdWxhciBhcyBpdCBoYXMuIFRo

aXMgd2FzIHNvbWV0aGluZyB0aGF0IHdhcyBkZXN0aW5lZCB0byBoYXBwZW4sIHNvIFBsZWFzZSBw

cmVwYXJlIHlvdXJzZWxmLg0KDQoNClRoZXJlIGFyZSBtb3ZpZXMgb2YgdGhpcyBhaW1ib3Qgb3V0

LCBzbyB3YXRjaCB0aGVtIGFuZCBnZXQgZmFtaWxpYXIgd2l0aCB0aGVtLCBzbyB5b3Uga25vdyB3

aGF0IHRvIGxvb2sgZm9yLiBIZXJlIGFyZSBzb21lIGxpbmtzIHRvIHRoZSBtb3ZpZXMuDQoNCmh0

dHA6Ly9tZWRpYS5wdXRmaWxlLmNvbS9NU1gtVmlkZW8yMjIyDQpodHRwOi8vbWVkaWEucHV0Zmls

ZS5jb20vTVNYLUFpbWJvdA0KaHR0cDovL21lZGlhLnB1dGZpbGUuY29tL01TWFZpZGVvMjNfMDAw

Mg0KaHR0cDovL3ZpZGVvLmdvb2dsZS5jb20vdmlkZW9wbGF5P2RvY2lkPS0zMDc3NzE1NDA0NTY4

OTA1NTAzDQpodHRwOi8vbWVkaWEucHV0ZmlsZS5jb20vcHduYWdlNTU4MA0KaHR0cDovL3ZpZGVv

Lmdvb2dsZS5jb20vdmlkZW9wbGF5P2RvY2lkPS0zNjQ5MTQxMTg4ODQwNzg2NzE1DQpodHRwOi8v

ZmlsZXMuZmlsZWZyb250LmNvbS9NU1hQSndtdi87NDkwNjMwODs7L2ZpbGVpbmZvLmh0bWwNCmh0

dHA6Ly9tZWRpYS5wdXRmaWxlLmNvbS9NU1gtU2VjdXJpdHktLS1CYWRrYXJtYS0tLVZpZGVvLTIN

Cmh0dHA6Ly9yYXBpZHNoYXJlLmRlL2ZpbGVzLzE2MTk4NzMxL2I0ZGs0cm1hc19CRjJfVmlkZW8u

TVNYQmV0YS53bXYuaHRtbCA=





--RDHJLM44488cdaacfd5--

but kmail just showed my the encoded stuff, like in the code block.

[WarGimp]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Nice. Go get 'em guys.

I got it sent to my hotmail, so I don't have any header access (stupid hotmail).

[The Soup Nazi]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Okay, thanks guys. If we can get this exact information from multiple sources showing that it was sent to different addresses but originating from the same sender, I think we may have something here.

According to their TOS, they're not allowed to send more than 1000 emails in a 24 hour period.

I'm wondering how they got our email addresses. I'm thinking that they found a way to grab them from the Battlefield 2 accounts (via EA) themselves. A guy at BF2S.com said that he received the email before registering there- so that means that they got it from another source- most likely from EA.

If this is the case, they sent out MANY more than 1000 emails in a 24 hour period.

I'm willing to bet that powweb.com will remove that account if enough people report the same abuse.

[Rambo]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

why did i get 3 emails from bf2.com??? who has my address?totalbf2 or ea?:hmm:

[The Soup Nazi]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

I'm thinking we'll need the email as it was received by Outlook/Outlook Express. Gmail doesn't like the MIME encoded message- I get a bunch or garbled code, too.

So, if you have the message in a email client like Outlook/Outlook Express please post a SCREENSHOT of the message and header information. I think the text body is just as important.