From: Jeff Henry (j3ff_at_comcast.net)
Date: Mon Aug 30 2004 - 21:08:42 PDT
> In a previous message, Dan typed vigorously:
>
> >The worst part is these scamers have ways of making the "easy link" look
> >like it does go to the companies site, AND even has the address in the
> >browser when you click on it. But in reality though use of certain HTML
> >codes they fake this information that before was used to determine if a
> >site was fake or not.
Here is a example of one I got recently from "paypal".
---
Once you have updated your account records, your PayPal account service will
not be interrupted and will continue as normal. Please follow the link
below, login to your account and renew your account information:
<p><img src="http://www.paypal.com/en_US/i/scr/trans_arrow.gif"><A
target="_blank"
href="http://www.marian-d1966.go.ro/httpswwwpaypalcomcgi-binwebscrcmd=_login
-runhttpswwwpaypalcomcgi-binwebscr" ><FONT face=Verdana
size=2>http://www.paypal.com/cgi-bin/webscr?cmd=_login-run></A></P>
<p>Sincerely,<br>
Paypal Department
---
For those who do not know what this means. you will see this link
http://www.paypal.com/cgi-bin/webscr?cmd=_login-run
however it will actually take you to this link
http://www.marian-d1966.go.ro/httpswwwpaypalcomcgi-binwebscrcmd=_login-runhttpswwwpaypalcomcgi-binwebscr
Which is NOT on paypals servers. First thing I do upon noticing one of these
is save the email to the filesystem (outside of my mail client), change it
to text, then paste that into a email to spoof_at_paypal.com. The reason I do
this is it gets all the headers and where the spoofed site lives at. After
that I go to their site and put in a bunch of CRAP to fill their database
with useless info :) I have been meaning to dig out the old credit card
number generator to really fill it up but have not had a chance to look for
that yet.
Jeff
--
This is the NewtonTalk list - http://www.newtontalk.net/ for all inquiries
Official Newton FAQ: http://www.chuma.org/newton/faq/
WikiWikiNewt for all kinds of articles: http://tools.unna.org/wikiwikinewt/
This archive was generated by hypermail 2.1.5 : Mon Aug 30 2004 - 21:30:02 PDT