Ian McCall

I've had a mail from Google - appears genuine, links genuinely go to
Google even after inspecting the source. It's asking me to initiate the
process to reset my password.

Which I never asked Google to do. And which I never initiated by
mistake either, since I never use the GMail web site - only IMAP
(previously POP).

Is there some known attempt at Google password nabbing going around at
the moment?


Cheers,
Ian

Andy Hewitt

Ian McCall <ian@eruvia.org> wrote:

> I've had a mail from Google - appears genuine, links genuinely go to
> Google even after inspecting the source. It's asking me to initiate the
> process to reset my password.
>
> Which I never asked Google to do. And which I never initiated by
> mistake either, since I never use the GMail web site - only IMAP
> (previously POP).
>
> Is there some known attempt at Google password nabbing going around at
> the moment?

Could be so. Check it by logging into your account on the web login
(it'll login with the same details as your POP/IMAP account), if it does
need resetting I'd expect it to ask during the login process.

I have two Gmail accounts, and have never seen such a message.

If you suspect it is dicky, send it into Google's abuse/spoof reporting
system

--
Andy Hewitt
<http://web.mac.com/andrewhewitt1/>

Bruce Horrocks

Ian McCall wrote:
> I've had a mail from Google - appears genuine, links genuinely go to
> Google even after inspecting the source. It's asking me to initiate the
> process to reset my password.
>
> Which I never asked Google to do. And which I never initiated by mistake
> either, since I never use the GMail web site - only IMAP (previously POP).
>
> Is there some known attempt at Google password nabbing going around at
> the moment?

Yes. There's a con whereby the scammer sends a URL which is actually the
"I'm feeling lucky" link from a carefully constructed Google search.
This looks just like a genuine Google link because it actually is a
genuine Google link. :-( However, if you click it, it is the same as if
you had clicked the "I'm feeling lucky" button from their search.
Needless to say, "their search" takes you to a web site stuffed to the
gills with malware.

Regards,
--
Bruce Horrocks
Surrey
England
(bruce at scorecrow dot com)

Ian McCall

On 2007-11-27 00:54:13 +0000, Bruce Horrocks <07.013@scorecrow.com> said:

> Ian McCall wrote:
>> I've had a mail from Google - appears genuine, links genuinely go to
>> Google even after inspecting the source. It's asking me to initiate the
>> process to reset my password.
>>
>> Which I never asked Google to do. And which I never initiated by
>> mistake either, since I never use the GMail web site - only IMAP
>> (previously POP).
>>
>> Is there some known attempt at Google password nabbing going around at
>> the moment?
>
> Yes. There's a con whereby the scammer sends a URL which is actually
> the "I'm feeling lucky" link from a carefully constructed Google
> search. This looks just like a genuine Google link because it actually
> is a genuine Google link. :-( However, if you click it, it is the same
> as if you had clicked the "I'm feeling lucky" button from their search.
> Needless to say, "their search" takes you to a web site stuffed to the
> gills with malware.

Interesting - thanks for that. I never did follow the link, but I think
I'll send it off to abuse@gmail.com anyway.


Cheers,
Ian

Pd

Ian McCall <ian@eruvia.org> wrote:

> I've had a mail from Google - appears genuine, links genuinely go to
> Google even after inspecting the source. It's asking me to initiate the
> process to reset my password.
>
> Which I never asked Google to do. And which I never initiated by
> mistake either, since I never use the GMail web site - only IMAP
> (previously POP).
>
> Is there some known attempt at Google password nabbing going around at
> the moment?

Could it not simply be someone's tried to get into your account, failed,
and asked to reset the password?

--
Pd

Ian McCall

On 2007-11-27 11:13:59 +0000, peterd.news@gmail.invalid (Pd) said:

> Ian McCall <ian@eruvia.org> wrote:
>
>> I've had a mail from Google - appears genuine, links genuinely go to
>> Google even after inspecting the source. It's asking me to initiate the
>> process to reset my password.
>>
>> Which I never asked Google to do. And which I never initiated by
>> mistake either, since I never use the GMail web site - only IMAP
>> (previously POP).
>>
>> Is there some known attempt at Google password nabbing going around at
>> the moment?
>
> Could it not simply be someone's tried to get into your account, failed,
> and asked to reset the password?

Could well be - I'm interested to know if there's a spate of that kind
of thing going around, that's all. I doubt it's specifically against
that account because it's an account I never use - maybe three or four
times a year I use it when testing mailserver rules. It has nothing in
it and no contacts associated with it.


Cheers,
Ian

Jochem Huhmann

Ian McCall <ian@eruvia.org> writes:

>> Could it not simply be someone's tried to get into your account, failed,
>> and asked to reset the password?
>
> Could well be - I'm interested to know if there's a spate of that kind
> of thing going around, that's all. I doubt it's specifically against
> that account because it's an account I never use - maybe three or four
> times a year I use it when testing mailserver rules. It has nothing in
> it and no contacts associated with it.

What about someone with a very similar username as you (or someone who
has forgotten his correct username) trying to log in with your username
and when his password didn't work (naturally) he tried to reset the
password? Seems to be the most simple explanation.


Jochem

--
"A designer knows he has arrived at perfection not when there is no
longer anything to add, but when there is no longer anything to take away."
- Antoine de Saint-Exupery

Ian McCall

On 2007-11-27 12:19:44 +0000, Jochem Huhmann <joh@gmx.net> said:

> What about someone with a very similar username as you (or someone who
> has forgotten his correct username) trying to log in with your username
> and when his password didn't work (naturally) he tried to reset the
> password? Seems to be the most simple explanation.

Yeah, but where's the nefarious derring-do in that? No, I require a
more stylish explanation involving international hacker rings please.


Cheers,
Ian