Fake MacRumors Update Emails This Afternoon

NY Guitarist

macrumors 65816
Original poster
Mar 21, 2011
1,228
779
Fake MacRumors Update Emails This Afternoon

I just got an email from "Macrumors" for a post to a thread I'm subscribed to that hasn't been posted on for some days. The link goes to a fakemacrumors-dot-com?

WTH is that?
 

lelisa13p

macrumors 68000
Mar 6, 2009
1,914
30
Atlanta, GA USA
I just got an email from "Macrumors" for a post to a thread I'm subscribed to that hasn't been posted on for some days. The link goes to a fakemacrumors-dot-com?

WTH is that?
I just posted a thread about those. I got 3 of them. They were made to look like the Forum updates that I receive daily after midnite.
 

Comeagain?

macrumors 68020
Feb 17, 2011
2,190
44
Spokane, WA
Just for fun, I typed in a random username (like sfd) and password (like ••••••) and when you click enter, it just flashes white, and has the dialog box again. Kinda fun.
 

NY Guitarist

macrumors 65816
Original poster
Mar 21, 2011
1,228
779
Got this today too. You were more brave than I by following that link.

Damn thieves.

BTW I reported this to MacRumors but no idea if they saw my message yet.
 

lelisa13p

macrumors 68000
Mar 6, 2009
1,914
30
Atlanta, GA USA
I'll also add that my AV (Trend Micro) blocked & categorized it as a repetitive web threat (3 blocks at 1 click.)

And I just discovered another fabulous side-effect of marking those 3 emails as Spam is that all of the legit MacRumors update emails sent out at midnite went into my Spam folder, too.

The fake emails used legit emails from yesterday and changed only the main forum link inside of the message (the link shown before thread links.) Gmail "learned" the sender (MacRumors) was Spam, hence the auto-sort into Spam instead of Inbox. Ugh.
 
Last edited:

Macman45

macrumors G5
Jul 29, 2011
13,199
133
Somewhere Back In The Long Ago
What irked me the most was how they slid their nasty link inside of a real forum email. :mad:
It's becoming far more common in the Mac community now...We are not attacked by all and sundry like Windows users are, but with more and more Macs being sold, the "Niche" aspect of our machines is rapidly disappearing. In some ways it's a good thing, particularly for those who are fond of gaming, but don't want to bootcamp....More and more titles are appearing in the App store now ad it's good to see. We have to be careful, but we are still in a far safer environment than those using PC's.
 

Knox

Administrator
Staff member
Jul 1, 2002
1,267
1
UK
I haven't spoken to arn yet, but after a little digging it looks like it's just a password-protected test copy of the forum. I suspect whoever was testing forgot that real users would receive emails from it :)
 
  • Like
Reactions: keysofanxiety

SandboxGeneral

Moderator emeritus
Sep 8, 2010
25,739
8,676
Detroit
I decided to disable the 'receive email from members' option in my profile. Though I haven't received any spam through that link, I'd prefer to keep it that way.
 

Dr McKay

macrumors 68040
Aug 11, 2010
3,419
41
Kirkland
Good lord I hope Arn owns it... I thought my stupid work computer was just prompting me for my password again (it often does when browsing the web) and used my Air Force login details.... :eek:

I should really read more...
 

NY Guitarist

macrumors 65816
Original poster
Mar 21, 2011
1,228
779
I decided to disable the 'receive email from members' option in my profile. Though I haven't received any spam through that link, I'd prefer to keep it that way.
I did the same thing.

Does anyone have a copy of the original email? I deleted mine and perhaps the long header info can be of some help.

Or is it confirmed that this was a "test" that originated form MacRumors?
 

Comeagain?

macrumors 68020
Feb 17, 2011
2,190
44
Spokane, WA
I did the same thing.

Does anyone have a copy of the original email? I deleted mine and perhaps the long header info can be of some help.

Or is it confirmed that this was a "test" that originated form MacRumors?
Ask Knox, or wait for Arn. From what Knox said, you don't need to worry, it was just a mistake.
 

NY Guitarist

macrumors 65816
Original poster
Mar 21, 2011
1,228
779
Ask Knox, or wait for Arn. From what Knox said, you don't need to worry, it was just a mistake.
Seems like a mistake, but I just got an email minutes ago from MR asking me for a copy of the email that was sent to me. Unfortunately I had already deleted it, so thought maybe someone who has a copy can forward it to MR in case they still need it.
 

arn

macrumors god
Staff member
Apr 9, 2001
14,500
1,784
Just received 3 of these, looking exactly like the real emails, except for the address, This is one of the addresses: http://forums.fakemacrumors.com/forumdisplay.php?f=137

Link goes to a password sign in box.

Emails arrived at a peculiar time of day, not the regular time.

Just a heads-up. Maybe they're after passwords.
Yep, trying to steal passwords:
Just for fun, I typed in a random username (like sfd) and password (like ••••••) and when you click enter, it just flashes white, and has the dialog box again. Kinda fun.
Got this today too. You were more brave than I by following that link.

Damn thieves.

BTW I reported this to MacRumors but no idea if they saw my message yet.
It's becoming far more common in the Mac community now...We are not attacked by all and sundry like Windows users are, but with more and more Macs being sold, the "Niche" aspect of our machines is rapidly disappearing. In some ways it's a good thing, particularly for those who are fond of gaming, but don't want to bootcamp....More and more titles are appearing in the App store now ad it's good to see. We have to be careful, but we are still in a far safer environment than those using PC's.
I haven't spoken to arn yet, but after a little digging it looks like it's just a password-protected test copy of the forum. I suspect whoever was testing forgot that real users would receive emails from it :)
Or was that a post from Knox's account that had it's password stolen?

*the moon landing was also faked*
I decided to disable the 'receive email from members' option in my profile. Though I haven't received any spam through that link, I'd prefer to keep it that way.
Good lord I hope Arn owns it... I thought my stupid work computer was just prompting me for my password again (it often does when browsing the web) and used my Air Force login details.... :eek:

I should really read more...
I did the same thing.

Does anyone have a copy of the original email? I deleted mine and perhaps the long header info can be of some help.

Or is it confirmed that this was a "test" that originated form MacRumors?

Sorry about that. "fakemacrumors.com" is ours and is a staging area. We recently restored it to a recent backup of the real forums, which is why you started getting these emails.

nothing to fear. We'll try to stop it from sending out those emails.

arn

----------

Actually, if anyone does have a copy of those emails, could you send them to me

arn@normalkid.com

thanks
arn