Fake R18.com scam e-mail

[dafuck]

.

 

[Casshern2]

I received it as well. IP is from France. So, R18 either got hacked or they sold our info.

WHOIS search results
Domain Name: JAVNICHE.COM
Registry Domain ID: 2282755825_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.gandi.net
Registrar URL: http://www.gandi.net
Updated Date: 2019-05-10T11:07:29Z
Creation Date: 2018-07-06T03:26:13Z
Registry Expiry Date: 2020-07-06T03:26:13Z
Registrar: Gandi SAS
Registrar IANA ID: 81
Registrar Abuse Contact Email: abuse@support.gandi.net
Registrar Abuse Contact Phone: +33.170377661
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Name Server: NS-102-A.GANDI.NET
Name Server: NS-207-C.GANDI.NET
Name Server: NS-239-B.GANDI.NET
DNSSEC: unsigned
URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of whois database: 2020-02-14T03:11:46Z <<<

 

[Blade Runner]

I received it on 2/11/2020.

I thought it was too good to be true. Didn't respond.

 

[princeali692]

Hmm, well that is concerning. I haven't received one myself. Somehow the mailing list got out it would seem.

I am going to change my r18 password. I recommend everyone do the same. It doesnt appear they have access to our accounts since they are phishing for login credentials but if they know your email it will be easier for them to guess if your password is weak. So make a strong password.

 

[Inertia]

The site itself looks like R18's design (pretty slick).

Perhaps it is legit and is something new they are working on?

 

[CoolKevin]

if changing your passwords use a different one from the one you use here

 

[Casshern2]

Well heck now the link in the email eventually lands on the R18 login page...

 

[CoolKevin]

I would not use the link

 

[R18.com]

javniche.com

This is not an email from R18.com
This seems to be an email from an affiliate trying to make some money of it.

I will appreciate if you could paste the full email with the link also so we can do further investigation.

Our servers has not get hacked and we had not sell any information.
This emails must be coming from some other JAV source.

We would like to investigate further about this.

Regards,

 

[Casshern2]

This is not an email from R18.com
This seems to be an email from an affiliate trying to make some money of it.

I will appreciate if you could paste the full email with the link also so we can do further investigation.

Our servers has not get hacked and we had not sell any information.
This emails must be coming from some other JAV source.

We would like to investigate further about this.

Regards,

The link used to go to another site, now it redirects to R18 apparently?

Dear R18 member,
This is Aimi from R18's social team.


We wanted to let you know that you may be one of the lucky ones to have received two movies from selected studios, as a token of our appreciation to the R18 community.


To find out, please sign in to your account following the link below:
R18 - Sign in to your library


If you don't see them in your library, stay tuned for the next round coming soon!


Best,
Aimi from R18.

This is what the link is originally in the email: http://mail.javniche.com/l/n0JV892LM9m1bfm0Gd52R3NA/lxXAtJeUiKV2w4hx7L9LAg/FnqcEH5L7o18763mSV0PYDKg

 

[R18.com]

The link used to go to another site, now it redirects to R18 apparently?

Dear R18 member,
This is Aimi from R18's social team.


We wanted to let you know that you may be one of the lucky ones to have received two movies from selected studios, as a token of our appreciation to the R18 community.


To find out, please sign in to your account following the link below:
R18 - Sign in to your library


If you don't see them in your library, stay tuned for the next round coming soon!


Best,
Aimi from R18.

This is what the link is originally in the email: http://mail.javniche.com/l/n0JV892LM9m1bfm0Gd52R3NA/lxXAtJeUiKV2w4hx7L9LAg/FnqcEH5L7o18763mSV0PYDKg

Thank you for the help. We have found the affiliate sending this emails.
If you add that mail.javniche.com link here (https://redirectdetective.com/ ) you can see all the redirects that the link is doing. It seems is going directly to R18.com but it does some redirects first using his affiliate code to get some revenue from this.

 

[Casshern2]

So, is that actually a member of R18's "social team" or is that person wrongfully misrepresenting themselves?

 

[R18.com]

So, is that actually a member of R18's "social team" or is that person wrongfully misrepresenting themselves?

It is NOT a member of R18.com social team or anyone working for us.