Author Topic: amazing paypal scam - be wary (Read 5646 times)

atog · « **on:** April 17, 2003, 10:40:04 am »

One of the ladies I work with got this today, go ahead and check it out, but obviously dont put in real personal info! The scammer did a pretty good quality job I think. He has a few java errors and his page says its secure when its not, but otherwise its good. I am afraid he is going to scam a lot of unsuspecting people.

Dear PayPal Customer,

This email is to inform you of a recent update we made to our systems,
To avoid service Interruption we require that you confirm
your account as soon as possible.

Please take a moment to confirm your account by going to the following address:

http://paypal.com@transaction-systems.org

Follow these steps:

1: Log in by clicking the link given above.
2: Verify who you are.
3: Your account will now be updated, you may continue using Paypal services with out any interruptions.

*** Please note: If you FAIL to update your account, it will be temporarily disabled.

We apologize for any inconvenience this may cause.
The paypal team is working hard to bring you the best services on the web.

Thank you for your business.

hyiu · « **Reply #1 on:** April 17, 2003, 10:59:55 am »

are you sure its real ??

it does start with paypal.com....

I'd say ask your co-worker to report to paypal.com RIGHT AWAY !!!....

bust those suckers.....

Frostillicus · « **Reply #2 on:** April 17, 2003, 11:05:39 am »

I would say it's a scam because the grammar isn't the best. PayPal isn't used consistently, and it's missing that official privacy crap at the bottom of real messages. Seems sketchy to me....plus the site isn't secure.

Wade · « **Reply #3 on:** April 17, 2003, 11:09:03 am »

This is definitely a SCAM... just look at the web address.

Wade

Brad Lee · « **Reply #4 on:** April 17, 2003, 11:32:53 am »

Social Engineering at it's finest.. If it wasn't such a bastardly thing to do, it's so simple its almost flawless.

Moebius · « **Reply #5 on:** April 17, 2003, 11:36:01 am »

Hmmmm...this could be potentially dangerous. If you try the supplied web address
http://www.transaction-systems.org/

it comes up with a convincing duplicate of the PayPal page.

I'll notify PayPal about it, they should be able to tell us if it is related to them or not. I'll let you know if I hear anything.

Moebius

_Iz- · « **Reply #6 on:** April 17, 2003, 11:42:54 am »

Quote from: atog on April 17, 2003, 10:40:04 am

http://paypal.com@transaction-systems.org

With a URL formatted such as this one, everything before the "@" is either used as login information (proper use) or ignored if the host system doesn't support or require it. The actual url is after the "@", which would be transaction-systems.org. Most people see the paypal.com part and figure it's legit not realizing that is ignored and the address is really transaction-systems.org.

hyiu · « **Reply #7 on:** April 17, 2003, 11:45:04 am »

Quote from: _Iz- on April 17, 2003, 11:42:54 am

Quote from: atog on April 17, 2003, 10:40:04 am
http://paypal.com@transaction-systems.org

With a URL formatted such as this one, everything before the "@" is either used as login information (proper use) or ignored if the host system doesn't support or require it. The actual url is after the "@", which would be transaction-systems.org. Most people see the paypal.com part and figure it's legit not realizing that is ignored and the address is really transaction-systems.org.

I see.... thank you... learning something new from this site everyday !!!

mkdevo · « **Reply #8 on:** April 17, 2003, 11:47:51 am »

yeah, if you guys even have to question this....

i put in a bunch of stuff for the heck of it just to mess with them.. bastages...

rampy · « **Reply #9 on:** April 17, 2003, 11:48:01 am »

paypal ALWAYS shows up as https

Anytime you go to paypal it'll be on a secure server.

Anyone claiming to take you to a http address on behalf of paypal is a scam...

*shrug*

rampy

Chris · « **Reply #10 on:** April 17, 2003, 11:48:30 am »

Reported to their Web host, about.com.

--Chris

intv · « **Reply #11 on:** April 17, 2003, 11:50:04 am »

That is a clever one - I got it about 6 weeks ago I think, so it's kind of old. I forwarded the email to PayPal as fraud, including the headers. The guy actually replied that it was safe because it had the PayPal logo and 'secure' tag line!! I'll post the email when I get home if anyone is interested. I replied and pointed out the origin of the email in the headers and told the guy they need to warn users - hell he even gave me the go ahead to submit the info! Anyway, I guess they felt it wasn't a problem...

MameFan · « **Reply #12 on:** April 17, 2003, 11:56:47 am »

Lets make it even easier... PAYPAL is a scam itself.

It's a hugely flawed system that seems to allow massive abuse by theiving buyers and theiving sellers, leaving the good buyers and good sellers left without money or product because it was stolen by the others using their system as intended.

www.paypalwarning.com www.nopaypal.com

Dave_K. · « **Reply #13 on:** April 17, 2003, 12:01:04 pm »

Nice trojan horse. And very smart way to trick people with the username (before the @) confusing people to think its actually paypal.com domain. I'm sure this won't be up for long as its clearly illegal.

They have also done a great job at concealing their identity, by using some dumba$$ Austrailian register who obviously doesn't care about who registers domain names.
Here is the whois information about transaction-systems.org

Domain ID:D96728996-LROR
Domain Name:TRANSACTION-SYSTEMS.ORG
Created On:14-Apr-2003 22:51:15 UTC
Expiration Date:14-Apr-2004 22:51:15 UTC
Sponsoring Registrar:R52-LROR
Status:TRANSFER PROHIBITED
Registrant ID:52-C
Registrant Name:SEE SPONSORING REGISTRAR
Registrant Street1:Whois Server:whois.melbourneit.com
Registrant Street2:Referral URL:www.melbourneit.com
Registrant City:N/A
Registrant Postal Code:N/A
Registrant Country:CA
Registrant Email:not@available.org
Admin ID:52-C
Admin Name:SEE SPONSORING REGISTRAR
Admin Street1:Whois Server:whois.melbourneit.com
Admin Street2:Referral URL:www.melbourneit.com
Admin City:N/A
Admin Postal Code:N/A
Admin Country:CA
Admin Email:not@available.org
Billing ID:52-C
Billing Name:SEE SPONSORING REGISTRAR
Billing Street1:Whois Server:whois.melbourneit.com
Billing Street2:Referral URL:www.melbourneit.com
Billing City:N/A
Billing Postal Code:N/A
Billing Country:CA
Billing Email:not@available.org
Tech ID:52-C
Tech Name:SEE SPONSORING REGISTRAR
Tech Street1:Whois Server:whois.melbourneit.com
Tech Street2:Referral URL:www.melbourneit.com
Tech City:N/A
Tech Postal Code:N/A
Tech Country:CA
Tech Email:not@available.org
Name Server:NS1.GLOBAL-SERVERS.COM
Name Server:NS2.GLOBAL-SERVERS.COM

_Iz- · « **Reply #14 on:** April 17, 2003, 12:02:19 pm »

Quote from: intv on April 17, 2003, 11:50:04 am

That is a clever one - I got it about 6 weeks ago I think, so it's kind of old. I forwarded the email to PayPal as fraud, including the headers. The guy actually replied that it was safe because it had the PayPal logo and 'secure' tag line!! I'll post the email when I get home if anyone is interested. I replied and pointed out the origin of the email in the headers and told the guy they need to warn users - hell he even gave me the go ahead to submit the info! Anyway, I guess they felt it wasn't a problem...

Are you sure you actually forwarded it to paypal and not the scam artists? Where did you get the e-mail addy?

intv · « **Reply #15 on:** April 17, 2003, 12:19:09 pm »

Quote

Are you sure you actually forwarded it to paypal and not the scam artists? Where did you get the e-mail addy?

Yeah, I had to go to PPs site to find the email for suspected fraud. I was shocked that they told me it was legit. I wonder how many people have fallen for it?

Dave_K. · « **Reply #16 on:** April 17, 2003, 12:23:06 pm »

Quote from: intv on April 17, 2003, 11:50:04 am

That is a clever one - I got it about 6 weeks ago I think, so it's kind of old.

Well this domain was created on Monday (as shown in the whois report I posted). Could be the same people I supposed who just found another lame DNS registar.

Sasquatch! · « **Reply #17 on:** April 18, 2003, 12:24:04 am »

Quote from: hyiu on April 17, 2003, 11:45:04 am

I see.... thank you... learning something new from this site everyday !!!

For example, I learned today that if I wish to register a ---That which is odiferous and causeth plants to grow--- site, melbourneit.com is the way to go!

Moebius · « **Reply #18 on:** April 18, 2003, 06:55:13 am »

I've received the following reply from PayPal. Verdict - stay away from this site.

Thank you for contacting PayPal.

Thank you for taking the time to pass this information along. We will
continue to investigate this situation. You are right to be
suspicious. This email is not from PayPal.

If you logged into this site you should log onto your PayPal account
and change your password as soon as possible.

If you have any further questions, please feel free to contact us
again.

mkdevo · « **Reply #19 on:** April 18, 2003, 08:54:54 am »

look kids! it's....

Chris · « **Reply #20 on:** April 18, 2003, 09:08:36 am »

I got this response from the Web host, About.com:

"Hello,

Thank you for reporting to our Abuse Department. We have removed the site from our servers for violation to our Acceptable Use Policy. We appreciate visitors that help us police our sites. If we can assist you further please feel free to contact us again.

Abuse Department
About Web Services"


Main	Restorations	Software	Audio/Jukebox/MP3	Everything Else	Buy/Sell/Trade
Project Announcements	Monitor/Video	GroovyMAME	Merit/JVL Touchscreen	Meet Up	Retail Vendors
Driving & Racing	Woodworking	Software Support Forums	Consoles	Project Arcade	Reviews
Automated Projects	Artwork	Frontend Support Forums	Pinball	Forum Discussion	Old Boards
Raspberry Pi & Dev Board	controls.dat	Linux	Miscellaneous Arcade	Wiki Discussion	Old Archives
Lightguns	Arcade1Up	Try the site in https mode		Site News


Unread posts \| New Replies \| Recent posts \| Rules \| Chatroom \| Wiki \| File Repository \| RSS \| Submit news

Author Topic: amazing paypal scam - be wary (Read 5646 times)

MameFan