u/osint_matter

A user receives Uber OTP codes via WhatsApp every day since August 5. The sender shows up as Uber with a verified business account. The user has never registered an Uber account.

Context first: Uber does deliver OTPs over WhatsApp, so the channel alone proves nothing. These look are real codes, from Uber legitimate WhatsApp Business account, not smishing.

Technical hypothesis. The OTP trigger on the WhatsApp channel doesn’t seem to have effective per-recipient rate limiting, while SMS appears to be capped. That would explain the channel choice, you hammer where there’s no limit. The trigger also seems independent of account state, it fires whether the number is registered or not.

I checked for a link to a separate exposure. The user’s email shows up in infostealer and combolist data, but the phone number is not present in that data. The two look unrelated.

What I can’t place is the threat actor’s objective. Only the victim receives the code, so either a contact will eventually ask them to forward it, which puts us in social engineering, or the code is irrelevant and this is harassment, noise, or number enumeration. So far no one has reached out asking for a code.

Thanks to anyone willing to weigh in.

A user receives Uber OTP codes via WhatsApp every day since August 5. The sender shows up as Uber with a verified business account. The user has never registered an Uber account.

Context first: Uber does deliver OTPs over WhatsApp, so the channel alone proves nothing. These look are real codes, from Uber legitimate WhatsApp Business account, not smishing.

Technical hypothesis. The OTP trigger on the WhatsApp channel doesn’t seem to have effective per-recipient rate limiting, while SMS appears to be capped. That would explain the channel choice, you hammer where there’s no limit. The trigger also seems independent of account state, it fires whether the number is registered or not.

I checked for a link to a separate exposure. The user’s email shows up in infostealer and combolist data, but the phone number is not present in that data. The two look unrelated.

What I can’t place is the threat actor’s objective. Only the victim receives the code, so either a contact will eventually ask them to forward it, which puts us in social engineering, or the code is irrelevant and this is harassment, noise, or number enumeration. So far no one has reached out asking for a code.

Thanks to anyone willing to weigh in.

A user receives Uber OTP codes via WhatsApp every day since August 5. The sender shows up as Uber with a verified business account. The user has never registered an Uber account.

Context first: Uber does deliver OTPs over WhatsApp, so the channel alone proves nothing. These look are real codes, from Uber legitimate WhatsApp Business account, not smishing.

Technical hypothesis. The OTP trigger on the WhatsApp channel doesn’t seem to have effective per-recipient rate limiting, while SMS appears to be capped. That would explain the channel choice, you hammer where there’s no limit. The trigger also seems independent of account state, it fires whether the number is registered or not.

I checked for a link to a separate exposure. The user’s email shows up in infostealer and combolist data, but the phone number is not present in that data. The two look unrelated.

What I can’t place is the threat actor’s objective. Only the victim receives the code, so either a contact will eventually ask them to forward it, which puts us in social engineering, or the code is irrelevant and this is harassment, noise, or number enumeration. So far no one has reached out asking for a code.

Thanks to anyone willing to weigh in.

I track my collection in ManaBox, but tracking it never actually told me what to do with it so I built this free tool.

Drop your collection export (ManaBox, Deckbox Archidekt, Moxfield or TCGplayer or whatever you already use to track) and it checks it against real decks pulled from EDHREC/Archidekt/MTGGoldfish, showing completion %, exactly which cards you're missing, format legality, and an aggregated shopping list for what's left to buy across everything you're close to finishing.

Basically: your collection stops being a spreadsheet and becomes a list of "here's what you can actually build right now."

Free, no signup needed to try a few searches, no paywall behind it (shared monthly cap for everyone, optional Ko-fi support just adds a bonus on top).

MTGDECKSCOUT

Curious what collection trackers people here use most want to make sure DeckScout picks up whatever format you're exporting.

I got tired of exporting my ManaBox collection and manually cross-checking it against EDHREC pages to see what I was missing, so over the last few weeks I built a small web tool for it. You upload your collection export (works with ManaBox, Moxfield, Archidekt, Deckbox, TCGplayer, whatever you already use to track), it pulls real decklists from EDHREC/Archidekt/MTGGoldfish, and tells you which ones you're actually closest to finishing. It's free, you can try it: https://mtgdeckscout.uk/

I turned my collection tracking into something actionable. free tool that shows which decks you can already build from it

I track my collection in ManaBox, but tracking it never actually told me what to do with it so I built this free tool.

Drop your collection export (ManaBox, Deckbox Archidekt, Moxfield or TCGplayer or whatever you already use to track) and it checks it against real decks pulled from EDHREC/Archidekt/MTGGoldfish, showing completion %, exactly which cards you're missing, format legality, and an aggregated shopping list for what's left to buy across everything you're close to finishing.

Basically: your collection stops being a spreadsheet and becomes a list of "here's what you can actually build right now."

Free, no signup needed to try a few searches, no paywall behind it (shared monthly cap for everyone, optional Ko-fi support just adds a bonus on top).

MTGDECKSCCOUT

Curious what collection trackers people here use most want to make sure DeckScout picks up whatever format you're exporting.

I finished the game and was overwhelmed by the depth and beauty of the concept behind the true meaning of the game and its ending. I don't have any tattoos, but I thought I'd get my first one to depict the wonderful final bonfire scene. I need inspiration: I've already searched online, but I'd like to see if anyone has any ideas on how to represent the emotion of that final scene in a tattoo. Any ideas are welcome to stimulate thought!

I’ve just finished the game and I found a couple of enigma in the end quite impossible to solve without some hints, am I stupid ?