Paypal 'tech support' fraud email.. READ

[metaltim]

I got an email from [email protected].
everything looks authentic, the body of the message reads:
Dear Paypal User,
We are currently performing regular maintenance of our Security Measures. Your account has been randomly selected for this maintenance, and you will now be taken through a series of identity verification pages.
Protecting the security of your Paypal account is our primary concern, and we apologize for any inconvenience this may cause.
Please confirm your account ownership by entering the information in one of the sections below and take a moment to confirm your account. To avoid service interruption we require that you confirm your account as soon as possible.

Please Visit:

https://www.paypal.com/cgi-bin/webscr/?cmd=_login-run

Thanks for making PayPal the world's #1 online payment service.
Thank you,
The Paypal Staff


even in this email itself, it has the standard things on the right side saying, paypal will never ask you for password.. blah blah
paypal webpages will always begin with https://www.paypal.com
and it will be secure..

HOWEVER, when I click the link it goes to:
http://paypal-cgi13.com/webscr7cmd/_login-run

if I go to paypal.com and click login it goes to:
https://www.paypal.com/cgi-bin/webscr?cmd=_login-run
you can see these are very close, but the one in the email doesn't have https:// and it isn't paypal.com, it is that paypal-cgi13.com.

very deceiving because the link in the email reads as though it is going to paypal.com, but it doesn't when you acutally click it.


anyone else with this.. beware people, we have very evil minded people out there. I reported this to paypal so it will be brought to their attention.

[Captain_Pants]

id be interested in the followup email as well...
please post when you know!
Thanks,
=-Ben

[Drive d]

Hey, We get like a dozen of these a week between PayPal and E-Bay. I treid to report them each time but all I get is a form letter from them saying that the Email was a fraud. ( Duh!) You have to look for for the "S" in the http address bar. that will denote a secure site and the hackers can't make that happen and make it work for them... Just know that E-Bay and Paypal will NEVER ask you that info, EVER! and don't give that info to anyone - EVER and you'll be safe. It is scary to know that scum like that can take advantage of some unsuspecting person and still live and be happy with themselves. Hopfully PayPal and E-Bay will find a way to put an end to it soon. Good Hunting and Be Safe!
D- [img]images/icons/grin.gif[/img]

[thr0ttles]

If you're using a web-based email program or your email reader can display HTML or rich text (Outlook, Outlook Express, etc.), then its very easy to display 'www.something.com' but it really goes to 'www.elsewhere.com'.

It's just a simple hyperlink, like a HTML anchor tag for hyperlinks, <a href="www.elsewhere.com">'www.something.com'</a>.
You see, the underlined and highlighted link says it's going to 'www.something.com', but it's really going to 'www.elsewhere.com'.

so yes, beware, always ignore these emails. internet fraud is growing exponentially and the uninformed are being ripped-off easily.

[tele_player]

Drive d:

Actually, hackers CAN get the 'https:' in there, it just means to connect using an SSL server - which isn't that hard to set up.

You really have to watch out for URL's embedded in emails...

[Bermaster]

This is fraud. I am a webdesigner, I looked into the source code and it is using a generic form mail cgi script, which is a little program that sends form data to an email address. Obviously the way paypal has theirs set up is not like this. If you fill this information in, it will be sent to some idiot.

[arcarsenal]

its rather funny, i noticed you cant right click to view the source, you have to hit view>source, which tells you something is up, and also if you go to http://paypal-cgi13.com/ you can easily see its nothing but a scam. its scary what goes on out there.

[metaltim]

yeh i knew at first glance it was crap.. i mean they weren't asking for anything in particular.. just to go to the site and log in and it would do some routine maintanence crap.. but the website addy is what I noticed wasn't right.
I decided to go to paypal.com and log in, figuring whatever I needed to do, it would tell me there, but it obviously didn't.

I mean i picture somone like my mom, who would probably never have noticed the peculiarness to this email, like the web addy, or the link being hyperlinked to somewhere else..
it's sickening.

If i would have logged in, they'd instantly have my password, could log me in on their side and send as much money as they wanted to them from my credit card or bank account..

why don't these people get a life.. and a JOB

tim

[Bermaster]

if you look up the domain name in a WHOIS, it reveals the guy's name, phone number, address, email address, etc.

it's pretty funny how stupid he is

[rogerhavoc]

Registrar Record

Domain Name.......... paypal-cgi13.com
Creation Date........ 2003-02-23
Registration Date.... 2003-02-23
Expiry Date.......... 2004-02-23
Organisation Name.... Jack Edwards
Organisation Address. 4630 Logan C Cir
Organisation Address.
Organisation Address. Valdosta
Organisation Address. 31605
Organisation Address. GA
Organisation Address. UNITED STATES

Admin Name........... Jack Edwards
Admin Address........ 4630 Logan C Cir
Admin Address........
Admin Address........ Valdosta
Admin Address........ 31605
Admin Address........ GA
Admin Address........ UNITED STATES
Admin Email.......... [email protected]
Admin Phone.......... +1.2292448815
Admin Fax............

Tech Name............ YahooDomains TechContact
Tech Address......... 701 First Ave.
Tech Address.........
Tech Address......... Sunnyvale
Tech Address......... 94089
Tech Address......... CA
Tech Address......... UNITED STATES
Tech Email........... [email protected]
Tech Phone........... +1.6198813096
Tech Fax............. +1.6198813010
Name Server.......... yns1.yahoo.com
Name Server.......... yns2.yahoo.com


Frigging Scammer....

[img]images/icons/mad.gif[/img] [img]images/icons/mad.gif[/img] [img]images/icons/mad.gif[/img]