Confirmed: Cheat e-mail from BF2RS is a hoax

[SO19Visionaries]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

hmm hard to prove.

they could just claim that someone used the powweb servers in order to send the e-mails no proof they did it.

its happened to my e-mail address aswell people spoof them all the time.

[WarGimp]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Good reply, thanks. I didn't assume it was simple, but PB is there for this very reason. They should be able to develop a counter-measure. I know, I know, then the hackers will mod their cheat and the race will start all over again.

But that's just how it is. PB's function is to detect and destroy these hacks. If it ain't working, or if PB isn't willing to devote the enrgy to come up with a viable solution, then just throw in the towel and give the hackers a free run at it. I'd rather see everyone using the hack, than just a select few..........

-

Don't worry too much. PB will and has busted MSX hacks before and they'll do it again. It might take awhile. As much as 3 weeks. Then they'll sometimes track the cheaters for awhile before mass banning 'em all at the same time.

Some of those vids are from earlier versions of the hack that have already been shut down. Like a long time ago.

Maz doesn't care who gets banned using his hacks either. He likes to claim that they're PB proof, but it's pure BS. He just wants money from stupid kids.

[The Soup Nazi]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

the decoded content from my mail (done by http://www.dillfrog.com/tools/base-64_encode/)

Awesome! Thanks for the link.

[David Champion]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

You know whats really funny is the fact some of those videos have their names in it, not the sharpest pencils in the pencil box now are they :).

Honestly I couldn't even see playing like that all that blue red crap on the screen is just annoying but I guess if you have to resort to that to do well you'd probably do anything... Man how could you feel good about gaining points like that, you can't brag about really, well you could but you'd be in denial. :) Anywho...

[Pilo-II]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Though, he did get his bit of advertising - it's all over th eBF2 forums. With links to videos AND his website - he has acomplishe his goal to get the word across.

[The Soup Nazi]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Okay, Wargimp. I'm putting together an abuse report email for powweb.com. Anyone else want to join in?

[Sir. Shpox]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Don't worry too much. PB will and has busted MSX hacks before and they'll do it again. It might take awhile. As much as 3 weeks. Then they'll sometimes track the cheaters for awhile before mass banning 'em all at the same time.

Some of those vids are from earlier versions of the hack that have already been shut down. Like a long time ago.

Maz doesn't care who gets banned using his hacks either. He likes to claim that they're PB proof, but it's pure BS. He just wants money from stupid kids.

PB apparantly already has members in MSX V.I.P who buy their hacks, or so I've heard, explains why one Msx hack got detected, users demanded the money back. Not to mention of all the adware the Msx hacks have reported to come with.

As for the email, I'm in no surpise, the way in which it was presented was appauling, not to mention not believable.

[The Soup Nazi]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Problem. Go here: http://www.networksolutions.com/whois/ and run a Whois search for m-s-x-security.com.

You'll notice that the nameservers are "NS2.EV1SERVERS.NET" and "NS1.EV1SERVERS.NET". If m-s-x-security.com really was registered with powweb.com, the nameserver would be something like "NS1.POWWEB.COM".

[Pilo-II]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Sir. Shpox: Yes, there are V.I.P members on the PB ban list. I have prove of it too.

[WarGimp]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Sir. Shpox: Yes, there are V.I.P members on the PB ban list. I have prove of it too.

No no... you missed the point.

There's members of Even Balance on the MSX VIP list! They buy the hacks so they can dismatle 'em and add 'em to Punkbuster.

[Pilo-II]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Oh right ok :) got ya lol.

[imported_Deliverance]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

Problem. Go here: http://www.networksolutions.com/whois/ and run a Whois search for m-s-x-security.com.

You'll notice that the nameservers are "NS2.EV1SERVERS.NET" and "NS1.EV1SERVERS.NET". If m-s-x-security.com really was registered with powweb.com, the nameserver would be something like "NS1.POWWEB.COM".

Sorry but thats complete bull....At least research what ur posting

I work for a Domain Registration company....

Those Name Servers (ie NS1.EV1SERVERS.NET) hold the zone record for that domain. That MX record can forward to a web server that could be on the other side of the world and under a completely different name.

The domain may not even have been registered by Pow Web in the first place

[The Soup Nazi]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

http://kb.powweb.com/questions/84/What-is-your-primary-and-secondary-Name-Server-information%3F

[motorboatJones]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

I've got an idea, guys. Does anyone still have the original message that contains the header information? If someone could post a screenshot that displays the exact sender information, routing information, the spoofed email address, I'd appreciate it.

We could then take this up with http://powweb.com. powweb.com is MSX's web hosting company and probably lists that it's against their TOS to spoof email addresses. If we could piece together that information, I think we could get their site shut down- for now. They'd probably just move on to another web host, but at least it would stop them for a while.

X-Gmail-Received: d2998518229111e825116e959b3f180b305ae534
Delivered-To: motorboat.jones@gmail.com
Received: by 10.65.95.4 with SMTP id x4cs80012qbl;
Fri, 21 Apr 2006 00:39:31 -0700 (PDT)
Received: by 10.35.78.13 with SMTP id f13mr1165859pyl;
Fri, 21 Apr 2006 00:39:31 -0700 (PDT)
Return-Path: <msxbackup1co@clust07-www06.powweb.com>
Received: from clust07-www06.powweb.com (clust07-www06.powweb.com [66.152.98.76])
by mx.gmail.com with ESMTP id k13si599051pyf.2006.04.21.00.39.31;
Fri, 21 Apr 2006 00:39:31 -0700 (PDT)
Received-SPF: pass (gmail.com: best guess record for domain of msxbackup1co@clust07-www06.powweb.com designates 66.152.98.76 as permitted sender)
Date: Fri, 21 Apr 2006 00:39:31 -0700 (PDT)
Message-Id: <44488c33.6fb72060.10b4.ffffc325SMTPIN_ADDED@mx.gm ail.com>
Received: by clust07-www06.powweb.com (Postfix, from userid 144944)
id 2CC241B894; Fri, 21 Apr 2006 00:39:31 -0700 (PDT)
To: motorboat.Jones@gmail.com
Subject: WARNING: New MSXSecurity BF2 Aimbot Confirmed legit.
From: admin@bf2s.com

[The Soup Nazi]

Re: Confirmed: Cheat e-mail from BF2RS is a hoax

What do you guys think of this?

To Whom It May Concern,

This morning I received an e-mail that appeared to have originated from the e-mail address "admin@bf2s.com" regarding the existence of a new exploit for the popular online First Person Shooter: Battlefield 2. I was not the only one who received it. Many reports have been flooding the forums at BF2S.com (http://forums.bf2s.com) and TotalBF2.com (http://totalbf2.com/forums) stating that they had received the same exact e-mail. It was at first believed to be a legit e-mail notice sent out to the entire Battlefield 2 community, but the originating e-mail address was later found to have been spoofed by an account within your web hosting community. Many of us believe that this message originated from the popular game exploitation site: http://****************. But, upon further investigation, I found that the nameservers specified through a Whois query at http://networksolutions.com do not match those that your company would use. Their nameservers are NS1.EV1SERVERS.NET and NS2.EV1SERVERS.NET. Your nameserver information I found at: http://kb.powweb.com/questions/84/Wh...information%3F

According to your TOS, it is stated:

No "Spam": UCE/UBE or "Spam" originating from a PowWeb account, or associated with a PowWeb account, is not tolerated. This includes any e-mail that promotes web sites hosted on a PowWeb account but is sent from an e-mail address not associated with that PowWeb account. Client shall not use their PowWeb services for chain letters, junk mail, bulk-e-mail, or any use of distribution lists to any person who has not given specific permission to be included in such a process. PowWeb reserves the right to deactivate or terminate any account(s) upon any indication of such activity without notice. There will be a $150 clean up fee if an account was suspended for policy violation. There is a 1000 e-mail limit that can be sent out within a 24 hour period.

If this is truly the case, the account that this mass e-mail originated from should be immediately suspended and/or deactivated.

The following is the email I received this morning:


---------------------------------------------------
---------------------------------------------------
X-Gmail-Received: 7a94589aeada9bebcf52a157f20944d28babfad0
Delivered-To: -----@gmail.com
Received: by 10.70.54.5 with SMTP id c5cs125108wxa;
Fri, 21 Apr 2006 00:43:21 -0700 (PDT)
Received: by 10.54.84.15 with SMTP id h15mr1062564wrb;
Fri, 21 Apr 2006 00:43:21 -0700 (PDT)
Return-Path: <msxbackup1co@clust07-www06.powweb.com>
Received: from mout.perfora.net (mout.perfora.net [217.160.230.40])
by mx.gmail.com with ESMTP id g7si1408577wra.2006.04.21.00.43.21;
Fri, 21 Apr 2006 00:43:21 -0700 (PDT)
Received-SPF: neutral (gmail.com: 217.160.230.40 is neither permitted nor denied by best guess record for domain of msxbackup1co@clust07-www06.powweb.com)
Received-SPF: none (mxus6: 66.152.98.76 is neither permitted nor denied by domain of clust07-www06.powweb.com) client-ip=66.152.98.76; envelope-from=msxbackup1co@clust07-www06.powweb.com; helo=clust07-www06.powweb.com;
Received: from [66.152.98.76] (helo=clust07-www06.powweb.com)
by mx.perfora.net (node=mxus6) with ESMTP (Nemesis),
id 0MKvMg-1FWqIT0i4M-0007gB for -----@graphicintegrity.net; Fri, 21 Apr 2006 03:43:21 -0400
Received: by clust07-www06.powweb.com (Postfix, from userid 144944)
id BD1941B98D; Fri, 21 Apr 2006 00:43:19 -0700 (PDT)
To: -----@graphicintegrity.net
Subject: WARNING: New MSXSecurity BF2 Aimbot Confirmed legit.
From: admin@bf2s.com
Message-ID: <0MKvMg-1FWqIT0i4M-0007gB@mx.perfora.net>
Date: Fri, 21 Apr 2006 03:43:21 -0400

MIME-Version: 1.0

Content-Type: multipart/alternative; boundary = RDHJLM44488d17b4021

Message-Id: <20060421074319.BD1941B98D@clust07-www06.powweb.com>
Date: Fri, 21 Apr 2006 00:43:19 -0700 (PDT)



This is a MIME encoded message.



--RDHJLM44488d17b4021

Content-Type: text/plain; charset=ISO-8859-1

Content-Transfer-Encoding: base64

Hey everyone, I am writing to inform you all of some very ... Disturbing news. It seems like everyones \"favorite\" hack website ( http://www.**************** ) Has released a BF2 aimbot and the commander hack is back also. There is a way however to spot enemys using the aimbot. If you see a player get 3 or 4 kills in a row with a rifle/pistol, try and watch them very closely. If they are looking through walls and ammasing massive kills its most likely they are hacking. Remember, the only \"perfect\" anti cheat is having a admin present at all times. We all were ignorant for thinking that client hooks and aimbots would not touch BF2, when it has become as popular as it has. This was something that was destined to happen, so Please prepare yourself.


There are movies of this aimbot out, so watch them and get familiar with them, so you know what to look for. Here are some links to the movies.

http://video.google.com/videoplay?docid=-3077715404568905503

http://media.putfile.com/MSX-Video2222

http://media.putfile.com/MSX-Aimbot

http://media.putfile.com/MSXVideo23_0002

http://media.putfile.com/pwnage5580

http://video.google.com/videoplay?docid=-3649141188840786715

http://files.filefront.com/MSXPJwmv/.../fileinfo.html

http://media.putfile.com/MSX-Security---Badkarma---Video-2

http://rapidshare.de/files/16198731/b4dk4rmas_BF2_Video.MSXBeta.wmv.html

---------------------------------------------------
---------------------------------------------------


I believe I speak for the community when I say that we would like for this issue to be resolved and for the perpetrator to be brought to justice.

Thank You,

The Soup Nazi
-----@gmail.com