tkyim - SCAMMER DO NOT CLICK LINK IN EMAIL

[HunterST]

Careful - this guy is sending malicious links asking for references for sellers here on the forum.

This is what he sends:

"Hey there,

I'm emailing regarding my first big purchase a Rolex GMT-Master II 126710blnr from a TRF member, The seller indicate that you can vouch for him.
Price is very well below market price and seller has some past history posting on the forum, So i was curious and thought it would be worth the due diligence.

He gave me two references email to contact, the other is very positive about seller. Here's the listing, If you're curious about it on TRF.

MALICIOUS LINK HERE

Your reply is highly appreciated!

Thanks.

[srvrf]

Okay I just got the same thing. Besides the obvious grammar clues (although I understand that English isn't everyone's primary language on TRF), there should be no need to get references for DavidSW. I did buy a Speedmaster from him maybe 5 years ago (thumbs up) but there's no chance I would be on his list of references.

Interestingly, when I went to the TRF website I could not find that user so I'm wondering if somehow TRF was hacked enough to get my email (it was the one I used to register for the forum). Be careful!

[Knappo 1307]

Mods were aware of this guy/gal yesterday. I wonder why they weren't banned?

https://www.rolexforums.com/showthread.php?t=839335

[HunterST]

User profile now stays Banned. The link he sent me was actually somewhat sophisticated to appear as though it led to an in-forum post.

[YoyoGift8]

Originally Posted by srvrf

Okay I just got the same thing. Besides the obvious grammar clues (although I understand that English isn't everyone's primary language on TRF), there should be no need to get references for DavidSW. I did buy a Speedmaster from him maybe 5 years ago (thumbs up) but there's no chance I would be on his list of references.

Interestingly, when I went to the TRF website I could not find that user so I'm wondering if somehow TRF was hacked enough to get my email (it was the one I used to register for the forum). Be careful!

I got exactly the same e-mail. Be careful out there everyone.

[Droolex]

Just got this same scam PM from user: K7Baixo2. Stay frosty folks, read URLs and use 2FA.

[ZOOK]

Originally Posted by Droolex

Just got this same scam PM from user: K7Baixo2. Stay frosty folks, read URLs and use 2FA.

You should return to the PM and click the red triangle at the top right. This is a much quicker way to get this member banned. It alerts all mods and the admin of his activity. They don't read every post here.

[Droolex]

Originally Posted by ZOOK

You should return to the PM and click the red triangle at the top right. This is a much quicker way to get this member banned. It alerts all mods and the admin of his activity. They don't read every post here.

Oh def. That is the first thing I did.

[BNA/LION]

Careful out there everyone!

[DLRIDES]

Originally Posted by Droolex

Just got this same scam PM from user: K7Baixo2. Stay frosty folks, read URLs and use 2FA.

Originally Posted by ZOOK

You should return to the PM and click the red triangle at the top right. This is a much quicker way to get this member banned. It alerts all mods and the admin of his activity. They don't read every post here.

I personally know K7Baixo2, and he is not a scammer. I spoke to him today, and it seems his account here has been hacked.

[77T]

Originally Posted by ZOOK

You should return to the PM and click the red triangle at the top right. This is a much quicker way to get this member banned. It alerts all mods and the admin of his activity. They don't read every post here.

I believe that was a good strategy in the past for most users, Dave.

But scammers who send a PM could be spoofing (having built a script for that red triangle ) and voilà one lands in East Malware.

In other words, clicking “Report” would offer up a webpage looking like a TRF report form. Then after all the info was added it would prompt an honest TRF’er into verifying their identity via UID/Password. At that point, any non-2FA member could be compromised.

You and I might be safe because we are 2FA enabled - but the majority of accounts are still vulnerable…

Please - anyone reading this - if you haven’t enabled 2FA, do it now.


Sent from my iPhone using Tapatalk Pro

[K7Baixo2]

Originally Posted by Droolex

Just got this same scam PM from user: K7Baixo2. Stay frosty folks, read URLs and use 2FA.

It’s amazing how fast a user, registered here since 2013, can be labeled a scammer and banned. Let me say this:



I am not a crook!

Thankfully, there’s a process to contact the admins, pay a $20 fee, have my ID somewhat validated and get access reinstated. I didn’t want my username tarnished by someone searching for K7baixo2 and finding the comment above. My reputation means a lot. Thanks DLRIDES for your assistance!

[Knappo 1307]

Originally Posted by K7Baixo2

It’s amazing how fast a user, registered here since 2013, can be labeled a scammer and banned. Let me say this:



I am not a crook!

Thankfully, there’s a process to contact the admins, pay a $20 fee, have my ID somewhat validated and get access reinstated. I didn’t want my username tarnished by someone searching for K7baixo2 and finding the comment above. My reputation means a lot. Thanks DLRIDES for your assistance!

Then stop clicking on phishing scam emails and entering your TRF log in info....

[K7Baixo2]

Originally Posted by Knappo 1307

Then stop clicking on phishing scam emails and entering your TRF log in info....

I didn’t. When I got access restored, I had eight or nine PM’s from four different people. Those were the first PM received since 2020 when I thought about selling my BLNR. All were deleted without opening or clicking on the links.

I suspect there was a data breech. Apple’s password process on my iPad indicated that weeks ago but I hadn’t changed the password yet. That’s been done and 2FA enabled.

Are there any other accusations you’d like to throw my way?

[Knappo 1307]

Originally Posted by K7Baixo2

I didn’t. When I got access restored, I had eight or nine PM’s from four different people. Those were the first PM received since 2020 when I thought about selling my BLNR. All were deleted without opening or clicking on the links.

I suspect there was a data breech. Apple’s password process on my iPad indicated that weeks ago but I hadn’t changed the password yet. That’s been done and 2FA enabled.

Are there any other accusations you’d like to throw my way?

Nope, that's it. If you didn't log in on a phishing site, you most likely are the first person this has happened too. Good luck in the future.
Maybe a moderator, can throw some light on the situation? Because if this is "just" happening, TRF has a big issue.

[K7Baixo2]

Originally Posted by Knappo 1307

Nope, that's it. If you didn't log in on a phishing site, you most likely are the first person this has happened too. Good luck in the future.
Maybe a moderator, can throw some light on the situation? Because if this is "just" happening, TRF has a big issue.

Thanks. IIRC, my username and password appeared as part of a data breech. Getting any site to admit there was such an event is difficult for good reason. I’m sure they could, if they wanted to, check the logs and confirm I hadn’t access my PMs prior to today for months. Running a site like this is time-consuming and difficult so I understand why banning someone is easier than trying to investigate and mitigate the impact to any one particular user, like me.

Enjoy your day!

[Knappo 1307]

Originally Posted by K7Baixo2

Thanks. IIRC, my username and password appeared as part of a data breech. Getting any site to admit there was such an event is difficult for good reason. I’m sure they could, if they wanted to, check the logs and confirm I hadn’t access my PMs prior to today for months. Running a site like this is time-consuming and difficult so I understand why banning someone is easier than trying to investigate and mitigate the impact to any one particular user, like me.

Enjoy your day!

Sorry if I offended you. My first response was not the best. Many come on here and swear they never logged in elsewhere and it's usually disproven. Sorry about your data breach, hope it doesn't compromise anything else for you.

[m92110]

Phishing