[Full-Disclosure] [Full-Disclosure]: Attempt to steal paypal password

[Michael Linke]

There seams to be a new faked Email on the way since today morning, with the
subject "PayPal User Agreement 9". 
The Email is in html form and content a Hyperlink named

https://www.paypal.com/cgi-bin/webscr?cmd=login-run 
But under this hyperlink is not paypal, it is: 

http://[EMAIL PROTECTED]/.


So someone is going to collect paypal passwords. Using this password an
attacker can send money from there. The whole action seams to be a spamming
attempt sent to random email addresses, because the receiver Email Address
[EMAIL PROTECTED] is not registered at paypal.


According ARIN Whois the IP Search 64.191.16.16 belongs to:


OrgName:    Network Operations Center Inc.
OrgID:      NOC
Address:    PO Box 591
City:       Scranton
StateProv:  PA
PostalCode: 18501-0591
Country:    US

The Email comes from 68.77.201.24.
(X-RBL-Warning: (dialup.bl.kundenserver.de) this mail has been received from
a dialup host.)


Email Header below. The Email Msg is attached to this email.

---------------------------------------------
Return-path: <[EMAIL PROTECTED]>
Envelope-to: [EMAIL PROTECTED]
Delivery-date: Tue, 11 Nov 2003 02:46:25 +0100
Received: from [68.77.201.24]
(helo=adsl-68-77-201-24.dsl.milwwi.ameritech.net)
        by mxng14.kundenserver.de with smtp (Exim 3.35 #1)
        id 1AJNbg-0005Xc-00
        for [EMAIL PROTECTED]; Tue, 11 Nov 2003 02:46:17 +0100
Received: from paypal.com (smtp2.sc5.paypal.com [64.4.244.75])
        by adsl-68-77-201-24.dsl.milwwi.ameritech.net (Postfix) with ESMTP
id D7A073BEBC
        for <[EMAIL PROTECTED]>; Mon, 10 Nov 2003 19:46:12 -0600
From: Support <[EMAIL PROTECTED]>
To: Michael <[EMAIL PROTECTED]>
Subject: PayPal User Agreement 9
Date: Mon, 10 Nov 2003 19:46:12 -0600
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
X-Priority: 1 (Highest)
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook, Build 10.0.2616
Importance: High
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
X-RBL-Warning: (dialup.bl.kundenserver.de) This mail has been received from
a dialup host.
-------------------------------------------------------

Title: PayPal

Von: Support [EMAIL PROTECTED] Gesendet: Dienstag, 11. November 2003 02:46 An: Michael Betreff: PayPal User Agreement 9 Wichtigkeit: Hoch User Agreement Dear PayPal User. Due to concerns we have for the safety and integrity of the PayPal community we have issued this warning. Per the User Agreement, Section #9, we may immediately issue a warning, temporarily suspend, indefinitely suspend or terminate your membership and refuse to provide our services to you if we believe that your actions may cause financial loss or legal liability for you, our users or us. We may also take these actions if we are unable to verify or authenticate any information you provide to us! Please follow the link below: https://www.paypal.com/cgi-bin/webscr?cmd=login-run and update your account information now. Please note that this is not a complete list of all our products and features. All products, features, and policies are subject to change. Be sure to log in to your PayPal account on a regular basis to view the "Policy Updates" page which can be found in the "What's New" box. Please do not reply to this e-mail. Mail sent to this address cannot be answered. For assistance, log in to your PayPal account and choose the "Help" link in the footer of any page. To receive email notifications in plain text instead of HTML ;update your preferences here. News: Community Page Learn about the PayPal Community Fight Against Leukemia and Lymphoma Click the button to make a donation to the Leukemia & Lymphoma Society. Protect Your Password You should never give your PayPal password to anyone.