Phishing E-Mails?

I received an email seemingly from EP today, but Thunderbird warned me it might be phishing and lo-and-behold it actually seems like it. Full e-mail contents below:

Code:

Delivered-To: MY-EMAIL-ADDRESS Received: by 10.80.186.162 with SMTP id x31csp903344ede; Sat, 26 Nov 2016 17:16:28 -0800 (PST) X-Received: by 10.55.141.199 with SMTP id p190mr10343874qkd.232.1480209387930; Sat, 26 Nov 2016 17:16:27 -0800 (PST) Return-Path: <01000158a35ace64-836aba35-1a42-4fa1-bf24-b95924f439e8-000000@amazonses.com> Received: from a9-114.smtp-out.amazonses.com (a9-114.smtp-out.amazonses.com. [54.240.9.114]) by mx.google.com with ESMTPS id c14si21526622qtc.42.2016.11.26.17.16.27 for <MY-EMAIL-ADDRESS> (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sat, 26 Nov 2016 17:16:27 -0800 (PST) Received-SPF: pass (google.com: domain of 01000158a35ace64-836aba35-1a42-4fa1-bf24-b95924f439e8-000000@amazonses.com designates 54.240.9.114 as permitted sender) client-ip=54.240.9.114; Authentication-Results: mx.google.com; dkim=pass [email protected]; dkim=pass [email protected]; spf=pass (google.com: domain of 01000158a35ace64-836aba35-1a42-4fa1-bf24-b95924f439e8-000000@amazonses.com designates 54.240.9.114 as permitted sender) smtp.mailfrom=01000158a35ace64-836aba35-1a42-4fa1-bf24-b95924f439e8-000000@amazonses.com; dmarc=pass (p=NONE dis=NONE) header.from=epforums.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; ; d=epforums.org; t=1480209387; h=Date:To:From:Reply-to:Subject:Message-ID:List-Unsubscribe:MIME-Version:Content-Type; bh=KKQm3RmDagOAUqDMjrGOCGA3S5t8cxF0DiXqC1Lkzb4=; b=TjTSkQ9pMIdlpd47QwiJYTj/HddFwSGtYxsucgx6+/psxySGnCCRGPX8qkhOxW3T tapBCCeLg1q2kBf03mWHDM3fBfw8HdLAZoJ4XBK1DRHuwSYWQ2t9bSkNZdwzCbPYbJj c6n/dOYtZxubbNsfCCWTy5Wdp2Qk8fzog68m+o+Q= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; ; d=amazonses.com; t=1480209387; h=Date:To:From:Reply-to:Subject:Message-ID:List-Unsubscribe:MIME-Version:Content-Type:Feedback-ID; bh=KKQm3RmDagOAUqDMjrGOCGA3S5t8cxF0DiXqC1Lkzb4=; b=uRX005u4TJI7kePEl66GjtL7e5lPGrtuxxc7EmR/AyFtzuV/MqpJiGFCe06CM05d +Xd7LfOzRyLD71iAKJiYy+a8dubpPP+5SFBqR6j0mv+skP+a3zfigpixx+V2daQVNNu LscwTZz0d5HDn4URwvHs9FPM6iUYyXfPt/IThEO8= Date: Sun, 27 Nov 2016 01:16:27 +0000 To: Tauwasser MY-EMAIL-ADDRESS From: EPForums <[email protected]> Reply-to: EPForums <[email protected]> Subject: Tauwasser - We miss you at EPForums Message-ID: <01000158a35ace64-836aba35-1a42-4fa1-bf24-b95924f439e8-000000@email.amazonses.com> X-Priority: 3 X-Mailer: Sendy (https://sendy.co) List-Unsubscribe: <http://sendy.mprd.se/unsubscribe/StRHaU9E763X8GJ80kgbos892AnG3UQc0uai7hH4Y8927S5P4/763nXAXK2wQFxXWQIlx80crA/GKIg5IwrjDs892Lb13kETUJg> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="b1_8e2ba8f2c32667bd2bcee626b0a73150" X-SES-Outgoing: 2016.11.27-54.240.9.114 Feedback-ID: 1.us-east-1.2V8V0Fr9FxRVs7gf3UEibwIJVZr2hygG38RiX++4xo0=:AmazonSES --b1_8e2ba8f2c32667bd2bcee626b0a73150 Content-Type: text/plain; charset = "UTF-8" Content-Transfer-Encoding: 8bit HiÂ Tauwasser I am MasJ, the creator of EmuParadise. I started this website over 16 years ago so that gamers all over the world had a place to play and talk about their favorite retro games. You signed up for EPForumsÂ (EmuParadise Forums) to be a part of the largest emulation and retrogaming community in the world. We haven't seen you there in almost a year. We have lots of games, discussions, and great stuff going on at the forums and would love to have you back! Here are some of the things we've been talking about: Your favorite Nintendo system http://sendy.mprd.se/l/imcFveS7GnHzmi9YiNMu3g/D3892LhkGlwCX66DqU0gLHyg/GKIg5IwrjDs892Lb13kETUJg/showthread.php?106881 We all have one. Although there are some systems that we fondly remember, there are others that we'd rather forget. Don't forget to take into account the endless car rides with the Gameboy or the button mashing action with the SNES. What game haveÂ youÂ recently beaten? http://sendy.mprd.se/l/imcFveS7GnHzmi9YiNMu3g/D3892LhkGlwCX66DqU0gLHyg/GKIg5IwrjDs892Lb13kETUJg/showthread.php?35570 DidÂ youÂ finally make it through Gradius? AreÂ youÂ almost at the end of Minish Cap? Come share with us! I just finished Limbo which was available on Steam for free.Â WeÂ love talking about games, new and old. Your best gaming moment http://sendy.mprd.se/l/imcFveS7GnHzmi9YiNMu3g/D3892LhkGlwCX66DqU0gLHyg/GKIg5IwrjDs892Lb13kETUJg/showthread.php?107561 Gaming memories of times gone past often warm our hearts. I personally had a lot of fun with TMNT 2 on the NES and also beating a buddy multiple times in Soul Calibur. What are some of your favorite gaming moments? I'd love it if you return and join the conversation at EPForums. We're eager to have you back! If you've forgotten your account details, you can reset your password here: http://sendy.mprd.se/l/imcFveS7GnHzmi9YiNMu3g/D3892LhkGlwCX66DqU0gLHyg/GKIg5IwrjDs892Lb13kETUJg/login.php?do=lostpw Looking forward to seeing you there! Regards, MasJ http://sendy.mprd.se/l/imcFveS7GnHzmi9YiNMu3g/D3892LhkGlwCX66DqU0gLHyg/GKIg5IwrjDs892Lb13kETUJg You are receiving this email because you have an account at EPForums.org - the largest retrogaming community in the world. If you would not like to receive similar emails in the future pleaseÂ unsubscribe: http://sendy.mprd.se/unsubscribe/StRHaU9E763X8GJ80kgbos892AnG3UQc0uai7hH4Y8927S5P4/763nXAXK2wQFxXWQIlx80crA/GKIg5IwrjDs892Lb13kETUJg --b1_8e2ba8f2c32667bd2bcee626b0a73150 Content-Type: text/html; charset = "UTF-8" Content-Transfer-Encoding: 8bit <html> <head> <title></title> </head> <body> Hi Tauwasser I am MasJ, the creator of EmuParadise. I started this website over 16 years ago so that gamers all over the world had a place to play and talk about their favorite retro games. You signed up for <a href="http://sendy.mprd.se/l/imcFveS7GnHzmi9YiNMu3g/D3892LhkGlwCX66DqU0gLHyg/GKIg5IwrjDs892Lb13kETUJg">EPForums</a> (EmuParadise Forums) to be a part of the largest emulation and retrogaming community in the world. We haven't seen you there in almost a year. We have lots of games, discussions, and great stuff going on at the forums and would love to have you back! Here are some of the things we've been talking about: <a href="http://sendy.mprd.se/l/imcFveS7GnHzmi9YiNMu3g/f5Dlb5PldZFWs7AzMC7izQ/GKIg5IwrjDs892Lb13kETUJg">Your favorite Nintendo system</a> We all have one. Although there are some systems that we fondly remember, there are others that we'd rather forget. Don't forget to take into account the endless car rides with the Gameboy or the button mashing action with the SNES. <a data-saferedirecturl="https://www.google.com/url?q=http://sendy.mprd.se/l/c2gr763V3WUUBvmfR5HoVqWA/SkmjKAJVYidkLhPT76326d2w/AzgJSU47PkJL3Zs8otw3vQ&source=gmail&ust=1479461975732000&usg=AFQjCNFUj_nmBQy6gXC_Y0qhguK35EdJ0g" href="http://sendy.mprd.se/l/imcFveS7GnHzmi9YiNMu3g/Sp17wbGJpCIQZ9E2aBZGzg/GKIg5IwrjDs892Lb13kETUJg" target="_blank" title="What game have you recently beaten">What game have you recently beaten?</a> Did you finally make it through Gradius? Are you almost at the end of Minish Cap? Come share with us! I just finished Limbo which was available on Steam for free. We love talking about games, new and old. <a href="http://sendy.mprd.se/l/imcFveS7GnHzmi9YiNMu3g/Wbfmj3U381WKWwFfBri763ZA/GKIg5IwrjDs892Lb13kETUJg">Your best gaming moment</a> Gaming memories of times gone past often warm our hearts. I personally had a lot of fun with TMNT 2 on the NES and also beating a buddy multiple times in Soul Calibur. What are some of your favorite gaming moments? I'd love it if you return and join the conversation at EPForums. We're eager to have you back! If you've forgotten your account details, you can reset your password here: <a href="http://sendy.mprd.se/l/imcFveS7GnHzmi9YiNMu3g/YvEhZt3gVx3p6ieBTgFSpw/GKIg5IwrjDs892Lb13kETUJg">http://www.epforums.org/login.php?do=lostpw</a> If you'd like to share your feedback directly with me, please just hit reply to this email and send me a note. Looking forward to seeing you at EPForums once again! Best Regards, MasJ <a href="http://sendy.mprd.se/l/imcFveS7GnHzmi9YiNMu3g/D3892LhkGlwCX66DqU0gLHyg/GKIg5IwrjDs892Lb13kETUJg">EPForums.org</a>     You are receiving this email because you signed up for an account at EPForums.org - the largest retrogaming community in the world. If you would not like to receive similar emails in the future please <a href="http://sendy.mprd.se/unsubscribe/StRHaU9E763X8GJ80kgbos892AnG3UQc0uai7hH4Y8927S5P4/763nXAXK2wQFxXWQIlx80crA/GKIg5IwrjDs892Lb13kETUJg" >unsubscribe here</a>. </body> </html> <img src="http://sendy.mprd.se/t/GKIg5IwrjDs892Lb13kETUJg/imcFveS7GnHzmi9YiNMu3g" alt="" style="width:1px;height:1px;"/> --b1_8e2ba8f2c32667bd2bcee626b0a73150--

All links go through hxxp://sendy.mprd.se. I'd expect the regular forum mailer to have links straight to the forums and not some third-party site.

it's a given nowadays, blocked ALL epf outgoing email to my provider, this subject being one reason...
that, and i just don't take kindly to my lines getting unwanted traffic.
here's not the only place, most i'm at have a fish or email spam problem...
mostly public places. :?

That's not a phishing email. It was sent out today. Thunderbird is wrong. The email is signed by the domain (epforums), you can see this in the headers which you have pasted in:

Received-SPF: pass (google.com: domain of [email protected] designates 54.240.9.114 as permitted sender) client-ip=54.240.9.114;
Authentication-Results: mx.google.com;
dkim=pass [email protected];
dkim=pass [email protected];
spf=pass (google.com: domain of [email protected] designates 54.240.9.114 as permitted sender) smtp.mailfrom=01000158a35ace64-836aba35-1a42-4fa1-bf24-b95924f439e8-000000@amazonses.com;
dmarc=pass (p=NONE dis=NONE) header.from=epforums.org

sendy.mprd.se is a domain where we serve all assets from. Several main site assets are loaded from that domain.

If this was a phishing email, what would it be trying to obtain? The login/pass to an emulation forum aren't all that valuable. Plus I doubt many people would feed even pathetic phisher real details if they were pretending to be a piracy forum. My profile here says I'm 110 years old :lol

Regardless, welcome back Tauwasser :lurk:

Quote:

Originally Posted by Ragnar

If this was a phishing email, what would it be trying to obtain? The login/pass to an emulation forum aren't all that valuable. Plus I doubt many people would feed even pathetic phisher real details if they were pretending to be a piracy forum. My profile here says I'm 110 years old :lol

Regardless, welcome back Tauwasser :lurk:

People often reuse email/username and password combinations across websites. So if you steal details of users from one particular site you have a potentially effective attack vector. You can see what leaks your own accounts have been subjected to here:
https://haveibeenpwned.com/

This is why we require frequent password changes. Even if the change you make is minor, the encrypted version we store is very far from the original and makes a breach harder.

Now, if you used the same password from any of those sites on another site your account could potentially be compromised. Of course, what is there to gain from this.. depends on you and how often you share your real details online :P But in general, this attack has been used on people many times.

Hey, that sites handy. I see my junk login is out there, because some Wii iso forum I don't recall signing up for (but probably did) got hacked. It's a useless account, but I use the exact same login details for other places with similar useless accounts :lol There's a high probability my first signup here used the same login info :whistle: