Article View: be.comp.security
Article #433Phishing "New security requirements" - PAYPAL
From: Cyrano
Date: Sat, 25 Jun 2005 17:14
Date: Sat, 25 Jun 2005 17:14
87 lines
3779 bytes
3779 bytes
Hi,
via een mail met als headers:
----------------
Subject: New Security Requirements
Content-Type: multipart/alternative;boundary="--424490085081761"
Mime-Version: 1.0
Reply-To: "PayPal" <billing@paypal.com>
From: "PayPal" <billing@paypal.com>
Date: Sat, 25 Jun 2005 03:33:01 +0200
Message-Id: <20050625003608.752D051602@imta26.mta.everyone.net>
Received: from pmta10.mta.everyone.net (bigiplb-dsnat [172.16.0.19])by
imta26.mta.everyone.net (Postfix) with ESMTPid 752D051602; Fri, 24 Jun
2005 17:36:08 -0700 (PDT)
from 209.249.170.32 (219.250.99.97 [219.250.99.97])by
pmta10.mta.everyone.net (EON-PMTA) with SMTPid A1E483CE; Fri, 24 Jun
2005 17:36:08 -0700
-----------------
Krijg ik een aanlogscherm voor Paypal. Alle links schijnen van
signin-paypal-secure.com te komen.
Het is zeker en vast phishing, want het ontvangende emailadres hier
wordt nooit voor PayPal gebruikt en de originating server 219.250.99.97
is in Korea.
wie is signin-paypal-secure.com?
-----------------
-----------------------------------------------
Queried Domain Information as follows
-----------------------------------------------
Domain Name : signin-paypal-secure.com
::Registrant::
Name : Brian J Findlay
Email : fridaysecure@mailz.com
Address : 45B Lazulite Dr.
Zipcode : Y1A 6A5
Nation : CA
Tel : 48916286581
Fax :
::Administrative Contact::
Name : Brian J Findlay
Email : fridaysecure@mailz.com
Address : 45B Lazulite Dr.
Zipcode : Y1A 6A5
Nation : CA
Tel : 48916286581
Fax :
::Technical Contact::
Name : Brian J Findlay
Email : fridaysecure@mailz.com
Address : 45B Lazulite Dr.
Zipcode : Y1A 6A5
Nation : CA
Tel : 48916286581
Fax :
::Name Servers::
ns5393.signin-paypal-secure.com
ns5753.signin-paypal-secure.com
::Dates & Status::
Created Date 2005-06-20 03:59:01 EDT
Updated Date 2005-06-20 03:59:01 EDT
Valid Date 2006-06-20 03:59:01 EDT
Status ACTIVE
----------------------
Schijnbaar is iemand erin geslaagd signin-paypal-secure.com te mogen
registreren...
Input welcome :-)
Technical Details
Message-ID:
<cyrano.mac-66CDF6.19142325062005@europe.isp.giganews.com>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!newsread.com!news-xfer.newsread.com!news-feed01.roc.ny.frontiernet.net!nntp.frontiernet.net!newshosting.com!nx01.iad01.newshosting.com!216.196.98.140.MISMATCH!border1.nntp.dca.giganews.com!nntp.giganews.com!local01.nntp.dca.giganews.com!nntp.scarlet.biz!news.scarlet.biz.POSTED!not-for-mailShow Full Headers
Complete Article Headers
X-Google-Thread: 113446,2106bc475208f9bf,start X-Google-Attributes: gid113446,public X-Google-Language: ENGLISH,ASCII-7-bit Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!newsread.com!news-xfer.newsread.com!news-feed01.roc.ny.frontiernet.net!nntp.frontiernet.net!newshosting.com!nx01.iad01.newshosting.com!216.196.98.140.MISMATCH!border1.nntp.dca.giganews.com!nntp.giganews.com!local01.nntp.dca.giganews.com!nntp.scarlet.biz!news.scarlet.biz.POSTED!not-for-mail NNTP-Posting-Date: Sat, 25 Jun 2005 12:14:23 -0500 From: Cyrano <cyrano.mac@techemail.com> Newsgroups: be.comp.security Subject: Phishing "New security requirements" - PAYPAL Organization: de Bergerac User-Agent: MT-NewsWatcher/3.4 (PPC Mac OS X) Date: Sat, 25 Jun 2005 19:14:23 +0200 Message-ID: <cyrano.mac-66CDF6.19142325062005@europe.isp.giganews.com> Lines: 87 NNTP-Posting-Host: 81.11.192.91 X-Trace: sv3-ryKa3r4aqklizYUZC+RYNWUIUAguO0EXHSVzlplT6C7JgzXTWUAS1r9QD8o8TZvY4fmundudv06EwsD!mown5hvOiC0v62uTVFSZ8dnGEAnIuF33/slQ4Iyso5toIts7//zERdFMSWjHu0QCDQKX1Cmxc++5!rsWDIAlurZTfzDgcXTEfRVa81vM= X-Complaints-To: abuse@scarlet.be X-DMCA-Complaints-To: abuse@scarlet.biz X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly X-Postfilter: 1.3.32