Strange email from FR (vanity)

Free Republic | 09/16/13 | Me

[Bob]

If gleaned password is correct, beware you have a keystroke logger attached to your computer and need to clean your computer and reset all your passwords.

Since the password was sent by FR's software, I'd hope that it would be correct. It would be kind of useless for FR to send out incorrect passwords when people want to confirm their passwords.

[Bob]

Go to whatismyip.com and check what your IP address is.

If it is 138.162.0.42 then you most likely accidently sent yourself a password hint/reminder (clicked forgot my password link.)

Because your username is bob it’s more likely that it was some robot (or human) trying to access your account.

I would certainly know if I were posting from an NNIC IP address. Since I don't work for the Navy and I'm 3000 miles away from their offices, that's not a possibility.

[EBH]

I don’t think FR sends out unsecured email password confirmations...

You can reset a password,

[PieterCasparzen]

I would

nslookup freerepublic.com

or at least

ping freerepublic.com

and see what IP address you get for freerepublic.com ...

[PieterCasparzen]

The IP address your PC thinks freerepublic is at should be 209.157.64.200

[Red Badger]

Just the NSA checking in................

[MestaMachine]

Follow it all the way through and I’ll see y’all later.
http://whois.arin.net/rest/rdns/162.138.in-addr.arpa.
Delegation Name 162.138.in-addr.arpa.
Nameservers UPBD0FDA02.CSD.DISA.MIL
UPHB0FDA06.CSD.DISA.MIL
GUV10M01.MONT.DISA.MIL
UPHB0FDA05.CSD.DISA.MIL
UPBD0FDA01.CSD.DISA.MIL
UTINDO02.CSD.DISA.MIL
GUV10M02.MONT.DISA.MIL
Last Updated 2012-09-25
RESTful Link http://whois.arin.net/rest/rdns/162.138.in-addr.arpa.
See Also Networks with authority over this delegation.

[WilliamofCarmichael]

I just received an email about the domain names I have registered. Nothing to do with FR.

It contained the names and strings of gobbledygook about WHOIS and international such-and-such; I must correct any erroneous information in my account it warned. (what other kind of data will be there? I wondered) A link was provided which was not where I have the account.

But the information it had is public. I have not paid extra to keep it private. Obviously the FR data should be private.

So from time to time I get crap like that.

[RitaOK]

I think we’re missing the point. The question wasn’t to respond or not, but of who, why and how it occurred.

[miliantnutcase]

Bob, you’ve got a common username that someone just clicked the recover password tool. Jim is correct on this. If I were you I would change your associated email address password to something more secure while you’re at it. /Tin foil hat mode - whoever triggered the password tool on the site might already have access to your email and wanted access to your FR account. /end tin foil hat mode.

[PieterCasparzen]

Are you familiar with DNS cache poisoning / man-in-the-middle attacks ?

Unrequested solicitations regarding login info are a classic sign of attacks.

Your pc may already be compromised; time to make sure all is ok, IMHO.

[ruesrose]

I got one earlier when I tried to respond to a posting but now I am allowed to post. ???

[Boogieman]

The real story here is that FR was even able to send you your password. That means they are storing everyone’s passwords in an unencrypted format. So, if anyone was able to hack their way in to admin-level access, they could probably download the passwords for every user, in plain text.

[Cyber Liberty]

Jim answered. I think he knows his software.

[Irish Eyes]

no, but I get a lot of Porn sites that look like they come from FR, what’s up with that????

[SatinDoll]

I strongly suggest you change your user name to Sue, Jill, or Cathy.

[Dysart]

What’s wrong with Francine?

[SatinDoll]

Nothing. Go for it!

[freeandfreezing]

My guess is the someone involved uses “Bob” as a handle on other sites and he was looking to see if he’s already registered here with that name.

The interesting part is that the person doing the checking just so happens to be accessing the internet via gate2-norfolk.nmci.navy.mil which lives at 138.162.0.42, or they forged their address to match the navy gateway server's IP address - a fairly tricky operation to pull off.

Sending passwords by email in response to user requests does risk interception of those emails in the outbound path from the FR server to the user, but normally that should be a fairly small risk.

[Jim Robinson]

Nothing unusual about the military address to me. We have lots of readers and posters with military addresses.