REPORT SUMMARY
Date Reported
8th January 2004
Apparent Sender
Paypal
Subject
Notification of
PayPal Limited
Account Access
Senders Address
(spoofed)
service@paypal.com
Content
text email with
a cloaked link
to a forged
Paypal web page
(see images)
Spoofed Web page/site?
Yes
Web page/site
content
forged Paypal web
page with web form
requiring
email user
name & password,
name & address
details, credit or
debit card and ATM
PIN numbers, etc, etc
Web page/site origin
URL
this scam utilises
the bug in Internet
Explorer browsers
which will show
https://
www.paypal.com/...
but the true URL is
http://
test200.europe.
webmatrixhosting.
net/
Identity Theft method
Web form
information
is captured by the
scammers while a
forged comfirmation
page opens
More...
Latest
email
scam
Another
Bank Email Scam
See our guide to
phishing scams
Other
Resources...
See our guides to
Free Utilities...
List of
Auction Sites
Notification of PayPal Limited Account Access - Email Scam
8th January 2004
This suspected unauthorised account access is a scam ...
This spoof email takes the form of a text email (see images below) with a cloaked link which utilises a known bug in Internet Explorer browsers. This bug will allow a fake or forged web page to be shown in your browser with the genuine paypal.com URL (web address) shown in the browser's address bar (also known as URL Spoofing).
This bug has been increasingly exploited by email scammers of late, and we eagerly await a patch from Microsoft. The vulnerability will also allow a fake URL to be shown in the status bar of Microsoft Outlook and browser products (while holding the cursor over the cloaked link). We have set up a Browser Test cloaked link which you can use to see if your browser is vulnerable. You can also check links in emails or web pages for cloaking using our Link Checker, and you can check for URL spoofing while at a web page using our URL Checker.
The link opens a forged Paypal page which contains a web form for you to enter all manner of personal information (see image below). By utilising the browser vulnerability, you may see the genuine Paypal URL in your browser's address bar (https://www.paypal.com/...), but you will not be at the genuine
Stay informed of the latest Spoof Email Phishing Scams with either of our FREE alert services...
Email
Alerts
Add your email address to our email alert service...
Subscribe
Privacy Policy
RSS
News Feed
Tap into our Scam Alert service using your News Reader or Aggregator (including
My Yahoo!).
Scam Alert News Feed
You can even put the latest alerts on your own web site.
FORWARD
YOUR EMAIL SCAMS
TO KU.OC.SELIMSRELLIM@FOOPS
and help us to
build awareness and
help others
site
at all. If
your browser is not vulnerable to this exploit, then
you will see the
true URL which is http://test200.europe.webmatrixhosting.
net/..... This clearly has nothing to do with Paypal at all.
If you have received this hoax email, please remember that it is very common for these email scams to be redistributed at a later date with only slightly different content or the same but with the fake page(s) hosted by a different provider. Also, once you have received one of these hoaxes, it is also common place to receive at least another one and usually a day or two after the first, although not necessarily from the same apparent sender.
Take a good look at the following images, because this hoax email scam may be coming to an inbox near you!
The Email ...
 |
 |
 |
 |
 |
 |
The fake web page...
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
