Pay Pal Scam or real email

[Spyrus]

Ok so I recently received an email

<b>from:</b>
arlin albrecht <ibxpmsyt-ompv@yahoo.com>

<b>title of the email was:</b>
PayPal security measures

<b>Email header info:</b>
MIME-Version: 1.0
Received: from mc4-f5.hotmail.com ([65.54.190.141]) by mc4-s18.hotmail.com with Microsoft SMTPSVC(5.0.2195.6824); Wed, 14 Jul 2004 21:57:26 -0700
Received: from CPE0080c6eb36d1-CM014340009094.cpe.net.cable.rogers.com ([24.100.49.157]) by mc4-f5.hotmail.com with Microsoft SMTPSVC(5.0.2195.6824); Wed, 14 Jul 2004 21:56:52 -0700
X-Message-Info: JGTYoYF78jFD0zyHGf6fG9YI1Toa02cM
X-Mailer: The Bat! (v2.01)
Message-ID: <1778329114.20040715044911@>
Return-Path: ibxpmsyt-ompv@yahoo.com
X-OriginalArrivalTime: 15 Jul 2004 04:56:53.0546 (UTC) FILETIME=[259C68A0:01C46A28]

The rogers cable part and the email address had me suspicious from the get go.

<b>Now the part that through me was the email itself</b>

[QUOTEChanging your password is a security measure that will ensure that you are
the only person with access to the account.

Thanks for your patience as we work together to protect your account.

Sincerely,
The PayPal Team

----------------------------------------------------------------
PROTECT YOUR PASSWORD

NEVER give your password to anyone and ONLY log in at
https://www.paypal.com/. Protect yourself against fraudulent websites by
opening a new web browser (e.g. Internet Explorer or Netscape) and typing
in the PayPal URL every time you log in to your account.

----------------------------------------------------------------


Please do not reply to this e-mail. Mail sent to this address cannot be
answered. For assistance, log in to your PayPal account and choose the
"Help" link in the header of any page.

PayPal Email ID PP######

Dear customer,

We recently noticed one or more attempts to log in to your PayPal account
from a foreign IP address:

40.173.51.8
32.43.128.233
145.250.215.155
59.32.21.171
159.15.25.183
157.182.65.73

If you recently accessed your account while traveling, the unusual log in
attempts may have been initiated by you. However, if you did not initiate
the log ins, please visit PayPal as soon as possible to change your
password:

https://www.paypal.com/us/cgi-bin/we...n-run=########[/QUOTE]

Now the first webaddress may say paypal.com but when you hover over it, it wants to go to the following ip address 24.239.139.3

A whois on this IP says that it is an earthlink ip address. Not sure who or what that is

now if you ping paypal or ebay (owner of paypal)
paypal is a 216.109.118.75 ip
ebay is a 66.135.192.87

either way I thought I would throw out this heads up, I am going to attempt to pursue this with paypal, we will see how easy this is to do. Or if I am a complete idiot and someone else has seen this let me know. Either way i am not visiting the links and I'm not going to change anything anytime soon. Any thoughts recommendations?

[MrLinus]

Might want to check here: http://www.antiphishing.org/phishing_archive.html and report it to them. Do you have the plain source of the email? Check it as a non-html email so you can see the code behind the message. It sounds like a "phishing" exercise. I can't imagine that PayPal would use a Rogers address (Canada) when it's located in the US.

[Spyrus]

Interstingly enough I have researched a bit more into the paypal site and am sending them an email on what to do or if this is legit and i came across this

How can I tell the difference between a real PayPal email and a fake one?

The term "spoofing" and "phishing" have been used to describe the act of collecting personal information using a fake email in order to commit identity theft, credit card, and Internet fraud. If you click on a link included in an email you're not sure is from PayPal, make sure the adress at the top of the browser window you're brought to reads exactly www.paypal.com/us. PayPal emails will address you by first name, last name, or business name, and NOT by "Dear PayPal User" or "Dear PayPal Member."

If you are ever uncertain about the validity of the email or the email links, open a new web browser window and type in www.paypal.com/us.

If you think you have received a fraudulent email, forward the entire email to spoof@paypal.com and then delete it from your email account.

So it definitely appears to be no good. If I view the page source on the email msmittens it appears to just point at the right address but I am not sure, this is from my hotmail acct so its a bit harder to do stuff with

[spamdies]

I would also see research who Rogers Cable Inc. Pr is. If their legit, as in not shady, you can report it to their abuse department(assuming they have one) Also depending on your isp you might be able to report the abuse from the sending ip. They might ban them from your entire domain if there are enough reports. This is a scam email. I know people use those accounts on the fly and they have never mentioned any security feature like that.

[cgkanchi]

<b>from:</b>
arlin albrecht <ibxpmsyt-ompv@yahoo.com>

Why would anyone at paypal send an email from yahoo.com? Highly suspicious if you ask me.

Cheers,
cgkanchi

[Spyrus]

Follow up

my newest letter back from Paypal...obviously automated

Dear MY NAME HERE,

Thank you for contacting PayPal.

We appreciate you bringing this incident of spam to our attention. We will
investigate this fully and suspend the account of any PayPal user
who has violated our Anti-Spam policy. PayPal's referral program is meant
to encourage people to introduce the benefits of PayPal to their friends
and family, and to people they transact with online. It is not intended to
encourage spam. We apologize for this inconvenience and appreciate your
report.

If you have any further questions, please feel free to contact us again.

Sincerely,

PayPal Account Review Department

so this time they did address my by my legal name and so on and so forth email came from someone@paypal.com. looks like a another wonderful phising attempt to keep your eyes open paypalers

[Galdron]

Unless you are expecting some sort of corespondance from any "Web Based" service, do not respond. Spoofing adresses is an old and not retired game. (or land based for that matter).

Phishing, is also not a new trade. Duh. Just a new name for being a con-artist.


Comon sense. should be an automatic update while we sleep.


IE:

http://www.antionline.com/showthread...433#post768433

[MrLinus]

I would also see research who Rogers Cable Inc. Pr is. If their legit, as in not shady, you can report it to their abuse department(assuming they have one)

I have Rogers as my ISP. They are very legit. Are they quick and responsive? HA! Slow as ... well, insert euphesium here. In reality I would send out 3 emails:

One to abuse@paypal.com
One to abuse@yahoo.com
One to abuse@rogers.com

Each one of these has a vested interest in dealing with this email.