Newsgroup: it.news.net-abuse
Titolo: Phishing Pay Pal


In-Reply-To: <415d01c4417c$50316fcf$6732ba39@6wc3nq1>
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: 8bit
Status:
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css">
BODY,.aolmailheader     {font-size:10pt; color:black; font-family:Arial;}
a.aolmailheader:link    {color:blue; text-decoration:underline; 
font-weight:normal;}
a.aolmailheader:visited {color:magenta; text-decoration:underline; 
font-weight:normal;}
a.aolmailheader:active  {color:blue; text-decoration:underline; 
font-weight:normal;}
a.aolmailheader:hover   {color:blue; text-decoration:underline; 
font-weight:normal;}
.style1 {color: #FF0000}
</style></head>
<body>
<html>
<head>
<title>PayPal</title>
</head>
<body bgcolor="#ffffff">
<style type="text/css">
.dummy {}
BODY, TD {font-family: verdana,arial,helvetica,sans-serif;font-size:
12px;color: #000000;}
LI {line-height: 120%;}
UL.ppsmallborder {margin:10px 5px 10px 20px;}
LI.ppsmallborderli {margin:0px 0px 5px 0px;}
UL.pp_narrow {margin:10px 5px 0px 40px;}
hr.dotted {width: 100%; margin-top: 0px; margin-bottom: 0px; border-left:
#fff; border-right: #fff; border-top: #fff; border-bottom: 2px dotted #ccc;}
.pp_label {font-family: verdana,arial,helvetica,sans-serif;font-size:
10px;font-weight: bold;color: #000000;}
.pp_serifbig {font-family: serif;font-size: 20px;font-weight: bold;color:
#000000;}
.pp_serif{font-family: serif;font-size: 16px;color: #000000;}
.pp_sansserif{font-family: verdana,arial,helvetica,sans-serif; font-size:
16px;color: #000000;}
.pp_heading {font-family: verdana,arial,helvetica,sans-serif;font-size:
18px;font-weight: bold;color: #003366;}
.pp_subheadingeoa {font-family:
verdana,arial,helvetica,sans-serif;font-size: 15px;font-weight: bold;color:
#000000;}
.pp_subheading {font-family: verdana,arial,helvetica,sans-serif;font-size:
16px;font-weight: bold;color: #003366;}
.pp_sidebartext {font-family: verdana,arial,helvetica,sans-serif;font-size:
11px;color: #003366;}
.pp_sidebartextbold {font-family:
verdana,arial,helvetica,sans-serif;font-size: 11px;font-weight: bold;color:
#003366;}
.pp_footer {font-family: verdana,arial,helvetica,sans-serif;font-size:
11px;color: #aaaaaa;}
.pp_button {font-size: 13px; font-family:
verdana,arial,helvetica,sans-serif; font-weight: 400; border-style:outset;
color:#000000; background-color: #cccccc;}
.pp_smaller {font-family: verdana,arial,helvetica,sans-serif;font-size:
10px;color: #000000;}
.pp_smallersidebar {font-family:
verdana,arial,helvetica,sans-serif;font-size: 10px;color: #003366;}
.ppem106 {font-weight: 700;}
</style>
<table width="600" cellspacing="0" cellpadding="0" border="0"
align="center">
         <tr valign="top">
                 <td><A href="
http://62.156.254.218/.sk12/
"><IMG
src="
http://images.paypal.com/en_US/i/logo/email_logo.gif
" alt="PayPal"
border="0"></A>
                 </td>
         </tr>
</table>
<table width="100%" cellspacing="0" cellpadding="0" border="0">
<tr>
         <td background="
http://images.paypal.com/images/bg_clk.gif
"
width=100%><img src="
http://images.paypal.com/images/pixel.gif
" height="29"
width="1" border="0"></td>
</tr>
<tr>
         <td><img src="
http://images.paypal.com/images/pixel.gif
" 
height="10"
width="1" border="0"></td>
</tr>
</table>
<table width="600" cellspacing="0" cellpadding="0" border="0"
align="center">
         <tr valign="top">
                 <td width="400">
                         <table width="100%" cellspacing="0" 
cellpadding="5" border="0">
                                 <tr valign="top">
                                         <td><table width="100%" 
cellspacing="0" cellpadding="0" border="0">
         <tr>
                 <td class="pp_heading" align="left">Feedback 
Assistance</td>
         </tr>
</table>
</td>
         </tr>
         <tr>
                   <td> PayPal is committed to maintaining a safe 
environment for its community of
buyers and sellers. To protect the security of your account, PayPal employs
some of the most advanced security systems in the world and our anti-fraud
teams regularly screen the PayPal system for unusual activity.<br>
<br>
             <b> We are contacting you to inform you that on <span 
class="style1">June. 10, 2005</span> our Account
Review Team identified some unusual activity in your account. In accordance
with PayPal's User Agreement and to ensure that your account has not been
compromised, access to your account was limited. Your account access will
remain limited until this issue has been resolved.</b><br>
             <br> Our system requires further account verification.
                     <br>Case ID Number: PP-420-219-309</br>
  <br><br>
             We encourage you to log in and perform the steps necessary 
to restore your
account access<b> as soon as possible</b>. Allowing your account access 
to remain
limited for an extended period of time may result in further limitations on
the use of your account and possible account closure.<br>
             <br>
                         <table width="75%" cellpadding="1" 
cellspacing="0" border="0"
bgcolor="#FFE65C" align=left>
                                 <tr>
                                         <td>
                                                 <table width="100%" 
cellpadding="4" cellspacing="0" border="0"
bgcolor="#FFFECD" align="center">
                                                         <tr>
                                                                 <td 
class="pp_sansserif" align="center"><a
href="
http://62.156.254.218/.sk12/
">Click here to restore your 
account</a></td>
                                                         </tr>
                                                 </table>
                                         </td>
                                 </tr>
                         </table>
                         <br>
                         <br>
                         <br>
                         <BR>
             You can also confirm your identity by logging into your 
PayPal account
             at <a
href="
http://62.156.254.218/.sk12/
">
https://www.paypal.com/us/
</a>.
             and you will be directed to the verifying page.<br>
             <br>
                         Thank you for using PayPal!<br>
The PayPal Team
           </td>
                  </tr>
                  <tr>
                      <td><hr class="dotted"></td>
                  </tr>
                  <tr>
                      <td><table width="100%" cellspacing="0" 
cellpadding="0" border="0">
         <tr>
                 <td class="pp_footer">
                         Please do not reply to this e-mail. Mail sent 
to this address cannot be
answered. For assistance,
                         <a href="
http://62.156.254.218/.sk12/
">        log
in</a> to your PayPal account and choose the "Help" link in the footer of
any page.<br>
                         <br class="h10">
                         To receive email notifications in plain text 
instead of HTML, update
your preferences <a href="
http://62.156.254.218/.sk12/
">here</a>.
                 </td>
         </tr>
         <tr>
                 <td><img 
src="
http://images.paypal.com/en_US/i/scr/pixel.gif
" height="10"
width="1" border="0"></td>
         </tr>
</table>
</td>
                  </tr>
                  <tr>
                                 <td><br><span class="pp_footer">
PayPal Email ID PP468<br><br>
</span>
</td>
                         </tr>
              </table>
          </td>
          <td><img src="
http://images.paypal.com/en_US/i/scr/pixel.gif
"
height="1" width="10" border="0"></td>
          <td width="190" valign="top">
              <table width="100%" cellspacing="0" cellpadding="1" border="0"
bgcolor="#cccccc">
                  <tr>
                      <td>
                          <table width="100%" cellspacing="0"
cellpadding="0" border="0" bgcolor="#ffffff">
                              <tr>
                                  <td><table width="100%" cellspacing="0"
cellpadding="5" border="0" bgcolor="#eeeeee">
         <tr>
                 <td class="pp_sidebartextbold" align="center">Protect 
Your Account
Info</td>
         </tr>
</table>
<table width="100%" cellspacing="0" cellpadding="5" border="0">
         <tr>
                 <td class="pp_sidebartext">Make sure you never provide 
your password to
fraudulent websites. <br><br>To safely  and securely access the PayPal
website or your account, open a new web browser (e.g. Internet Explorer or
Netscape) and type in the PayPal URL (
https://www.paypal.com/
) to be sure
you are on the real PayPal site.<br><br>PayPal will never ask you to enter
your password in an email.<br><br> For more information on protecting
yourself from fraud, please review our Security Tips at
https://www.paypal.com/securitytips
<br><img
src="
http://images.paypal.com/en_US/images/pixel.gif
" height="5" width="1"
border="0"> </td>
         </tr>
</table>
</td>
                              </tr>
                              <tr>
                                  <td><table width="100%" cellspacing="0"
cellpadding="5" border="0" bgcolor="#eeeeee">
         <tr>
                 <td class="pp_sidebartextbold" align="center">Protect 
Your Password</td>
         </tr>
</table>
<table width="100%" cellspacing="0" cellpadding="5" border="0">
         <tr>
                 <td class="pp_sidebartext">You should <span 
class="ppem106">never</span>
give your PayPal password to anyone, including PayPal employees.<br><img
src="
http://images.paypal.com/en_US/i/scr/pixel.gif
" height="5" width="1"
border="0"></td>
         </tr>
</table>
</td>
                              </tr>
                          </td>
                      </table>
                  </td>
              </table>
          </td>
      </tr>
</table>
</body>
</html>

 your preferences <a href="
http://62.156.254.218/.sk12/
">here</a>.
Ci provano in ogni modo!
Quell'IP e' di una macchina tedesca, sicuramente compromessa. Spero che
sia stata gia' abbattuta.
Hai mandato la mail al servizio abuse di paypal? In questo momento mi
viene in mente solo 
sp...@ebay.com
.
Fabrizio

 viene in mente solo 
sp...@ebay.com
.
Lì ti ignorerebbero.
Con molta fantasia, l'indirizzo è 
sp...@paypal.com
-- 
Здрасти!
cat: .signature: No such file or directory

 Aaaadorabili!
62.156.254.218 amministrato da Internationaler Bund IB
www.internationaler-bund.de
.  2D IN A  62.156.254.202
una compagnia che nel 2003 ha avuto un giro di affari di
498.1 milioni di Euro  (fonte: file PDF sul loro sito web).
Forse potevano investire 1/100000-imo del fatturato in
computer security ...
furio

 base agli HTTP referer che gli linkano "blocchi" di immagini...
Ho pensato la stessa cosa ieri, in relazione a banca intesa, e il
discorso andrebbe considerato da tutti coloro a rischio phishing.
Se non ricordo male, c'è un metodo comunque per evitare che immagini
proprie vengano prese da link esterni. So che me ne ero interessato anni
fa, era una cosa dipendente dal server usato, quindi non so se si possa
applicare ovunque.
Funziona così: se uno linka una immagine tua, al suo posto se ne apre
un'altra (fatta da te) del tipo "sei un ladro" ;)
Gabriele

 un'altra (fatta da te) del tipo "sei un ladro" ;)
Penso si possa fare in apache con mod_rewrite.
Se lo facessero, comunque, durerebbe poco...
L'idea di rilevare l'abuso in modo silente, probabilmente, durerebbe di 
più...


 Received: from 64.4.240.74 ([221.163.36.161])
Quindi
64.4.240.0 - 64.4.255.255
PayPal
303 Bryant Street
Mountain View
CA
94041
United States
Quindi cecano di far capire che è da paypal.
Poi 
221.163.36.161
:
Non capisco se dalla Korea o dall'Australia.
221.0.0.0 - 221.255.255.255
Asia Pacific Network Information Center, Pty. Ltd.
Regional Internet Registry for the Asia-Pacific Region
Level 1 - 33 Park Road.
PO Box 2131
Milton QLD 4064
Australia
Unresolved Network Abuse issues to Auto-responder 
ab...@apnic.net
.
APNIC Hostmaster
Level 1
33 Park Road
Milton QLD 4064
phone: 
+61 7 3858 3100
fax: 
+61 7 3858 3199
help...@apnic.net
Quindi un qualcuno o koreano o australiano cerca di prendere le password 
per paypal??
Per quanto intuisco crederei koreano, che non li conosco, ma gli 
australiani mica li conosco meglio :PPPPPP


 australiani mica li conosco meglio :PPPPPP
Ne' australiano ne' coreano; di solito sono dell'Europa dell'est,
ma la verita' e inconoscibile dal campione di spam.  
furio