Full Disclosure mailing list archives
[Full-Disclosure] [Full-disclosure]: Attempt to steal paypal password
From: "Michael Linke" <ml () intract org>
Date: Tue, 11 Nov 2003 10:04:56 +0100
There seams to be a new faked Email on the way since today morning, with the subject "PayPal User Agreement 9". The Email is in html form and content a Hyperlink named https://www.paypal.com/cgi-bin/webscr?cmd=login-run But under this hyperlink is not paypal, it is: http://www.paypal.com@64.191.16.16/. So someone is going to collect paypal passwords. Using this password an attacker can send money from there. The whole action seams to be a spamming attempt sent to random email addresses, because the receiver Email Address Michael () smiley-power de is not registered at paypal. According ARIN Whois the IP Search 64.191.16.16 belongs to: OrgName: Network Operations Center Inc. OrgID: NOC Address: PO Box 591 City: Scranton StateProv: PA PostalCode: 18501-0591 Country: US The Email comes from 68.77.201.24. (X-RBL-Warning: (dialup.bl.kundenserver.de) this mail has been received from a dialup host.) Email Header below. The Email Msg is attached to this email. --------------------------------------------- Return-path: <support () paypal com> Envelope-to: michael () smiley-power de Delivery-date: Tue, 11 Nov 2003 02:46:25 +0100 Received: from [68.77.201.24] (helo=adsl-68-77-201-24.dsl.milwwi.ameritech.net) by mxng14.kundenserver.de with smtp (Exim 3.35 #1) id 1AJNbg-0005Xc-00 for michael () smiley-power de; Tue, 11 Nov 2003 02:46:17 +0100 Received: from paypal.com (smtp2.sc5.paypal.com [64.4.244.75]) by adsl-68-77-201-24.dsl.milwwi.ameritech.net (Postfix) with ESMTP id D7A073BEBC for <michael () smiley-power de>; Mon, 10 Nov 2003 19:46:12 -0600 From: Support <support () paypal com> To: Michael <michael () smiley-power de> Subject: PayPal User Agreement 9 Date: Mon, 10 Nov 2003 19:46:12 -0600 Message-ID: <110001c3a7f5$1fe9490f$e212810a () paypal com> MIME-Version: 1.0 Content-Type: text/html Content-Transfer-Encoding: quoted-printable X-Priority: 1 (Highest) X-MSMail-Priority: High X-Mailer: Microsoft Outlook, Build 10.0.2616 Importance: High X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-RBL-Warning: (dialup.bl.kundenserver.de) This mail has been received from a dialup host. -------------------------------------------------------
Current thread:
- Symbol Technologies Default WEP KEYS Vulnerability Michael Scheidell (Nov 10)
- [Full-Disclosure] [Full-disclosure]: Attempt to steal paypal password Michael Linke (Nov 11)