« Cheese and beef | Main | Musical additions to The Double »

Ooh, this is a good one

You all know the fake paypal spams that arrive in your email boxes. They usually have alarming messages about your account being screened or suspended because of an "incident". Just now I got a version that's a little more devious:

From: "service@paypal.com" We added an additional email address to your PayPal account.

But we are not done yet!

You must click the link below and enter your old email adress and your
password on the following page to confirm this email address.
[link to http://219.95.218.123/index/... disguised as a real Paypal support link]

Case ID Number: PP-072-838-482

You can also confirm your email address by logging into your PayPal account at
http://www.paypal.com Click on the "Confirm email" link in the Activate Account box
and then enter this confirmation number: 0756-7515-8945-8936-3223

This email is sent to you by the contracting entity to your User Agreement, either PayPal Inc or PayPal (Europe) Limited.
Thank you for using PayPal!
The PayPal Team

PayPal Email ID PP059

In other words, if you haven't actually added an email address yourself just now, it will look like Paypal is innocently reporting the results of an "incident" in progress, which you will have to stop right now. If you have, it will be a message you've been waiting for. And like terrorists, phishers only have to be lucky once. You, on the other hand, have to be on your guard at all times.
Also, filtering messages like this will without also filtering out real Paypal messages.

Whois information on this spammer. They're at:


Server Used: [ whois.apnic.net ]

http://219.95.218.123/ = [ tm.net.my ]


inetnum: 219.95.128.0 - 219.95.255.255
netname: ADSL-STREAMYX-TMNET
descr: TMNET
country: MY
admin-c: MH91-AP
tech-c: MH91-AP
remarks: abuse@tm.net.my


remarks: streamyx@tm.net.my


remarks: tmcops@tm.net.my


mnt-by: TM-NET-AP
changed: anieayop@tm.net.my

20040415
status: ASSIGNED NON-PORTABLE
source: APNIC
person: Mahadi Harun
address: Level 26 (North)
address: Menara Telekom
address: Jalan Pantai Baru
address: 50672 Kuala Lumpur.
country: MY
phone: 603-2240-3089
fax-no: 603-7956 0211
e-mail: mahadi@telekom.com.my


nic-hdl: MH91-AP
mnt-by: TM-NET-AP
changed: anieayop@tm.net.my

20041109
source: APNIC

About

This page contains a single entry from the blog posted on August 7, 2005 10:10 PM.

The previous post in this blog was Cheese and beef.

The next post in this blog is Musical additions to The Double.

Many more can be found on the main index page or by looking through the archives.

Creative Commons License
This weblog is licensed under a Creative Commons License.
Powered by
Movable Type 3.34