Latest Phishing Expedition

email | 4/28/06

[pabianice]

This is a pretty elaborate one. You are invited to use your phone to access PayPal. The Phish takes you through a series of well-faked screens to a point where you have to enter your PayPal ID and password so as to be able to use the "new service."

[pabianice]

Caveat emptor.

[Gordongekko909]

Alert noted. Glad I don't have a PayPal account.

[pabianice]

Return-Path:

Received: from mxsf02.cluster1.charter.net ([10.20.201.202]) by mtai04.charter.net (InterMail vM.6.01.05.04 201-2131-123-105-20051025) with ESMTP id

<20060428181659.GCDF28761.mtai04.charter.net@mxsf02.cluster1.charter.net>

for ; Fri, 28 Apr 2006 14:16:59 -0400

Received: from mxip34a.cluster1.charter.net (mxip34a.cluster1.charter.net [209.225.28.249]) by mxsf02.cluster1.charter.net (8.12.11/8.12.11) with ESMTP id k3SIGbKg031700 for ; Fri, 28 Apr 2006 14:16:58 -0400

Received: from email-83.paypal.com ([206.165.246.83]) by mxip34a.cluster1.charter.net with ESMTP; 28 Apr 2006 14:16:56 -0400 DomainKey-Signature: a=rsa-sha1; h=Date:From:Subject:To:X-Header-CompanyDBUserName:Errors-To:List-Unsubscribe:Reply-To:X-Header-MasterId:X-Header-Versions:Message-ID:MIME-Version:Content-Type; b=MMQWWDmge+CAPIO+wd8/cbwYMQoCRoxdP7b8VGKyl2sh52jlreo3IQzzjkmsum65ZQBDV6RRZO6gxXc1RHPbTfonw1HeW+Fyig9QdA6D5UNfSekYd8jS7Evc0+/SNxgN; c=nofws; d=email.paypal.com; q=dns; s=yesmail1

Date: Fri, 28 Apr 2006 11:16:50 PDT

From: PayPal

Subject: New Chargeback Education Center at PayPal

To:

X-Header-CompanyDBUserName: paypal Errors-To: paypal@email.paypal.com List-Unsubscribe:

Reply-To: paypal@email.paypal.com X-Header-MasterId: 904738 X-Header-Versions: PayPal.6nmr41tfg.h0@email.paypal.com Message-ID: MIME-Version: 1.0 Content-Type: text/html; charset=us-ascii

[ExcursionGuy84]

I only use PayPal for eBAY purchases; nothing else.

[Frank_Discussion]

Actually, I've gotten two of these. What give it away, at least in Windows XP apps with HTML on, if you slide your pointer over the "PayPal" URL, you can see the actual URL is given as something entirely different.

If I am getting this, does it mean I have some malware pinging someone out there?

[Supernatural]

Pay Pal? Why would anyone be dumb enough to use that method of payment?

Let the dummies beware.

[Former Fetus]

Thanks. I got one just like it this morning. I've forwarded it to spoof@paypal.com

[toddlintown]

"Why would anyone be dumb enough to use that method of payment?"

Maybe because it's fast and reliable?

[happilymarriedmom]

Got a new one today...someone claiming to be the lawyer of someone with my same last name (don't know how they knew my last name) and he was handling this person's estate. He has been looking for the next of kin for 3 years and if I agree to be the next of kin we can share the 10.5 million dollar estate. I was suppose to reply if interested. I didn't exactly jump right on it! Beware.

[newgeezer]

Just curious... How do you know this one's not legit? I ask because I just now received it, too.

1. It contains my real name.

2. Every embedded link resolves to paypal.com.

3. Hotmail confirms it originated from paypal.com.

Of course, I would still never click an embedded link to go to PayPal (if I was interested, I'd log in at https://www.paypal.com and find the promotion from there). But, PayPal does send out promotional emails to those of us who have not opted out.

[RikaStrom]

Went out to https://www.paypal.com and it looks like paypal really is doing a mobile thing.

That's kind of scary.

[newgeezer]

The headers on mine are somewhat different...

Received: from email-83.paypal.com ([206.165.246.83]) by bay0-mc7-f13.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.1830); Fri, 28 Apr 2006 11:50:26 -0700
X-Message-Info: LsUYwwHHNt1mxM2Un6DN+uGtqhQMgwJeaxrpsMG6bNY=
DomainKey-Signature: a=rsa-sha1; h=Date:From:Subject:To:X-Header-CompanyDBUserName:Errors-To:List-Unsubscribe:Reply-To:X-Header-MasterId:X-Header-Versions:Message-ID; b=Y9dLxkXDlHM99AvSIpgqHvlSCTK2C6ic43UBKxqKdL3CAmkO3NX+Yz712FhS/SUYpOlt7+rqwdtYcZ+47fx+LYhGs5uZe2IMvrKjk5+3JR7xtwJseLbHusL1wfuqV+cY; c=nofws; d=email.paypal.com; q=dns; s=yesmail1
X-Header-CompanyDBUserName: paypal
Errors-To: paypal@email.paypal.com
List-Unsubscribe:
X-Header-MasterId: 904738
X-Header-Versions: PayPal.6v4r3fgn2.h0@email.paypal.com
Return-Path: paypal@email.paypal.com
X-OriginalArrivalTime: 28 Apr 2006 18:50:26.0938 (UTC) FILETIME=[9D3F65A0:01C66AF4]

But, like I said, I still wouldn't take any chances.

[floridaobserver]

I just receieved an email from some diplomat in Nigeria who needs help bringing in $100,000 to the United States.

He will split it with me if I give him some of my bank account info. Does anyone know if this is legit?

[floridaobserver]

just kidding.

[Yo-Yo]

Pay Pal? Why would anyone be dumb enough to use that method of payment?

Because they provide fraud protection on eBay purchases. I'd never use it for any other purpose. Better than sending cash, money order or (!) credit card number so some eBay seller.

[chs68]

Wait just a minute, there!!

Some attorney in Nigeria contacted me about a relative of mine that died recently in a car accident!

[freeangel]

Saving for my pay pal friends.

[newgeezer]

I suggest you hold out for at least a million.

[Corin Stormhands]

I have a Paypal account, but I haven't received this one yet.

Still, as a rule I never open an email that says it's from Paypal. I'll go to the actually site and log in to see what they're offering, but not from an email link.

[newgeezer]

Pay Pal? Why would anyone be dumb enough to use that method of payment? Let the dummies beware.

What, pray tell, is so "dumb" about using PayPal?

FWIW, I've used it for hundreds of eBay transactions over the past 5 or 6 years without any trouble whatsoever.