You will notice this fraudulent email contains the hidden use of google
in the fraud.
On the original email, you do not see that the paypal link is really
a google link.
The underlying link is the fraudulent hook here.
We have emboldened that one specific line for your ease of finding
the false hook.
First, here is what the email looks like without full headers on showing
below it.
Please understand, this is a fraudulent email, with full proofs showing
in the email paths in the full headers on section.
It looks like it is real, and from PayPal.
It is not.
~~~~~~
Subject: Protect Your Paypal Account
From: service@paypal.com
Date: Thu, November 11, 2004 4:47 am
To: lexigram@goodworksonearth.org
Priority: Normal
Dear goodworksonearth
We recently reviewed your account, and suspect that your PayPal
account may
have been accessed by an unauthorized third party. Protecting
the security
of your account and of the PayPal network is our primary concern.
Therefore, as a prevention measure, we have temporarely limited
access to
sensitive PayPal account features.
Please click on the link below to confirm your information :
The visible link you see on the email they sent us is this :
https://www.paypal.com/cgi-bin/webscrun?USER=atgoodworksonearth
Underlying that apparently vaild looking link, is the real link, designed
so it does not show on the bottom of your screen the real destination it
will take you to which is this :
http://www.google.com/url?q=_%6874%7470%3261.33.179.58/.paypal/.verifiction/log1.htm
https://www.paypal.com/cgi-brun?USER=atgoodworksonearth
Both links above have been edited a bit to break the usage validity
and still show you what the links look like and how you might still see
PayPal, or any other secure site's address showing on the bottom of
your screen, and yet the real link is taking you elsewhere.
Below is the full header email:
~~~~~~~~~~~~~~~~~~~~~~~~
RFC822 Message body
Return-Path: nobody@alpha.ezysupport.com
Delivered-To: lexigram@goodworksonearth.org
Received: (qmail 30691 invoked by uid 1010); 11 Nov 2004 04:44:18 -0800
Received: from nobody@alpha.ezysupport.com by clark by uid 1007 with
qmail-scanner-1.22-st-qms
(spamassassin: 2.64. Clear:RC:0(67.18.187.42):SA:0(4.5/5.0):.
Processed in 1.316925 secs); 11 Nov 2004 12:44:18 -0000
X-Spam-Status: No, hits=4.5 required=5.0
X-Spam-Level: ++++
X-Antivirus-MYDOMAIN-Mail-From: nobody@alpha.ezysupport.com via clark
X-Antivirus-MYDOMAIN: 1.22-st-qms (Clear:RC:0(67.18.187.42):SA:0(4.5/5.0):.
Processed in
1.316925 secs Process 30682)
Received: from 42.67-18-187.reverse.theplanet.com (HELO alpha.ezysupport.com)
(67.18.187.42)
by mail.opn.org with AES256-SHA encrypted SMTP; 11 Nov 2004 04:44:16
-0800
Received: from nobody by alpha.ezysupport.com with local (Exim 4.43)
id 1CSEMh-0006qP-SN
for lexigram@goodworksonearth.org; Thu, 11 Nov 2004 12:47:51 +0000
To: lexigram@goodworksonearth.org
Subject: Protect Your Paypal Account
From: service@paypal.com
Content-Type: text/html;
charset=iso-8859-1;
Message-Id: <E1CSEMh-0006qP-SN@alpha.ezysupport.com
Date: Thu, 11 Nov 2004 12:47:51 +0000
X-AntiAbuse: This header was added to track abuse, please include it
with any abuse report
X-AntiAbuse: Primary Hostname - alpha.ezysupport.com
X-AntiAbuse: Original Domain - goodworksonearth.org
X-AntiAbuse: Originator/Caller UID/GID - [99 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - alpha.ezysupport.com
X-Source:
X-Source-Args: /usr/local/apache/bin/httpd -DSSL
X-Source-Dir: stimatiasx.us:/public_html/mail
X-Antivirus-MYDOMAIN-1.22-st-qms: added fake MIME-Version header
MIME-Version: 1.0
Dear lexigram@goodworksonearth.org,
We recently reviewed your account, and suspect that your PayPal account
may
have been accessed by an unauthorized third party. Protecting the security
of your account and of the PayPal network is our primary concern.
Therefore, as a prevention measure, we have temporarely limited access
to
sensitive PayPal account features.
Please click on the link below to confirm your information:
<a href=http://www.google.com/url?q=684%7460%361.33.179.58/.paypal/.verification/log1.htm>
PLEASE NOTE : THE
ABOVE IS THE UNDERLYING LINK
and THE BELOW LINK
IS THE ADDRESS THAT WILL SHOW ON THE SURFACE OF THE FRAUDULENT EMAIL
BOTH LINKS HAVE
BEEN ALTERED TO PREVENT USAGE
https://www.paypal.com/cgi-bin/webscr?cmd=_loginrun?USER=Lexigramatgoodworksonearth
For more information about how to protect your account, please visit
PayPal's Security Center, accessible via the "Security Center" link
located
at the bottom of each page of the PayPal website.
We apologize for any inconvenience this may cause, and appreciate your
assistance in helping us maintain the integrity of the entire PayPal
system. Thank you for your prompt attention to this matter.
Sincerely,
The PayPal Fraud Management Team
