RMT Framing

[Kestrel]

Hey thanks so much for looking into the problem we've had and correcting it. I appreciate the problem being rectified but with what occurred I don't want this to happen to anyone else. This all started with a password change to my personal account that I did not do, nor received an email on the password changing. Is there going to be a further investigation on the people that did this in the first place?

All characters and gear/money is being restored, may take up to 24 hours to complete fully. If you do find you are still missing gear/items/gold/characters after 24 hours from now please do let me know.

We will let you know here any new developments in the investigation, or if it stalls out. Do you have a date and/or time window that you know this password change occurred? Specifically the last time you were able to log into your account, and the first time you realized you were locked out and your password was changed.

[Himitori909]

Hey thanks so much for looking into the problem we've had and correcting it. I appreciate the problem being rectified but with what occurred I don't want this to happen to anyone else. This all started with a password change to my personal account that I did not do, nor received an email on the password changing. Is there going to be a further investigation on the people that did this in the first place?

All characters and gear/money is being restored, may take up to 24 hours to complete fully. If you do find you are still missing gear/items/gold/characters after 24 hours from now please do let me know.

We will let you know here any new developments in the investigation, or if it stalls out. Do you have a date and/or time window that you know this password change occurred? Specifically the last time you were able to log into your account, and the first time you realized you were locked out and your password was changed.

Thanks, this incident i believe happened after i logged off at 9:20pm Pacific Standard time , then i logged in around 5:30am Pacific Standard Time and noticed my password was changed without any notification on my email.

[Himitori909]

Hey thanks so much for looking into the problem we've had and correcting it. I appreciate the problem being rectified but with what occurred I don't want this to happen to anyone else. This all started with a password change to my personal account that I did not do, nor received an email on the password changing. Is there going to be a further investigation on the people that did this in the first place?

All characters and gear/money is being restored, may take up to 24 hours to complete fully. If you do find you are still missing gear/items/gold/characters after 24 hours from now please do let me know.

We will let you know here any new developments in the investigation, or if it stalls out. Do you have a date and/or time window that you know this password change occurred? Specifically the last time you were able to log into your account, and the first time you realized you were locked out and your password was changed.

Thanks, this incident i believe happened after i logged off at 9:20pm Pacific Standard time 8/20/26, then i logged in around 5:30am Pacific Standard Time 8/21/26 and noticed my password was changed without any notification on my email.

[Ollie]

The following accounts/characters/forum usernames have been banned for trying to frame another player for RMT. In light of recent posts and public statements this felt appropriate to post here rather than wait for the inevitable appeal.


Account (Forum Name) <character name/level>
TOMPEARL (Tompearl909) <Tompearll/1>
HIMITORI (Himitori909) <Tomspearls/60>
MMOPROVIDER3 (Henry3) <Pqq/5>
STANKLEG (Stankyleg909) <Himi/35>
HIMI (Himishaman) <Blackened/20>

-----------------------------------------------------------------------------------------


How is Himitori909 able to post on the forums if his forum account/name have been banned?

[Clown]

Yeah, Tom Pearl was a Himi joke about a TikTok guy of that name. He has a sound board of the guy on our Discord. There was an ongoing joke about renaming the guild to <Tom Pearl Fan Club> even lol.

This whole situation is really suspicious. His password was changed without a notifying email too, I believe.

Thanks for looking into it more, Kestrel.

[Uggerbugger]

May I suggest again two factor authentication: https://octowow.st/forum/viewtopic.php? ... =2fa#p7963

This might have stopped this issue, and similar issues in the future.

[Kestrel]

We do see a password change (that did not trigger the normal email verification link) that was done with the IP of the same operator who first logged into your account. This PW change was done after they account was already logged into, which in our current system bypasses the need for email verification.

Whomever did this account takeover used your password on the website (at 08:16:10 on the day of the attack), then updated the password presumably to ensure you could not kick them off while they cleaned out the account. Then you discovered this and reset the password again at 12:57:02 essentially reclaiming control of the account.

During our initial setup of this project we had some issues with email services blocking for spam which necessitated using each accounts password as proof of ownership, however now that our email service appears to be in a more stable state we will be shifting that proof of ownership to the registrants email. This means that in the future password changes will all require an email verification.

We will start looking at enabling 2FA as well for those who wish to opt into it, although I don't think it prevents an issue like this as people sharing accounts would not likely want to exchange 2FA codes every time they swapped.

[Icantkite]

interesting....:pregnaros: