Interesting URL in PayPal Phish

**c0br4** · May 13th, 2006, 11:45 PM

OK, I amnot unfamiliar with these ype of scams and was not fooled by the e-mail, however what I am intrigued by is the URL (if thats what it is) for the scammers site. I (and a few others I have asked) have never seen anything like it before. The link in the e-mail takes you to http://3562341948:82/webscrr/index.php now I know all about the colon that indicates which port to connect to before anyone says that, but what kind of address is 3562341948 it is not an IP address that I am familiar, besides if you ping/tracert it resolves to another IP, nor is it any form of URL I am familiar with, I thought they all had to end in some sort of .com/.org/.etc would anyone here be nice enough to tell me what this address is? Also while you are here why not try filling out that page with random details just to waste a little more of the scammers time:-)

Sat, 13 May 2006 08:23:37 -0700 (PDT)
Received: by 10.54.140.16 with SMTP id n16mr3602402wrd;
Sat, 13 May 2006 08:23:37 -0700 (PDT)
Return-Path: <service@paypal.com>
Received: from 192.168.111.10 (210-54-89-248.adsl.xtra.co.nz [210.54.89.248])
by mx.gmail.com with SMTP id 29si10987443wrl.2006.05.13.08.23.23;
Sat, 13 May 2006 08:23:37 -0700 (PDT)
Received-SPF: softfail (gmail.com: domain of transitioning service@paypal.com does not designate 210.54.89.248 as permitted sender)
Received: from 64.66.55.212 by ; Sat, 13 May 2006 14:07:20 -0100
Message-ID: <TQRSTWUQFKGAIOTUHNWV@aol.com>
From: "service@paypal.com" <service@paypal.com>
Reply-To: "service@paypal.com" <service@paypal.com>
To: jameslicious@gmail.com, jamestech@gmail.com, jan.gralle@gmail.com, janice@gmail.com, jank_fenter@gmail.com, jarod.pulo@gmail.com, jarod.talmont@gmail.com, jasninder@gmail.com, jasonlf@gmail.com
Subject: New email address added to your PayPal account !
Date: Sat, 13 May 2006 10:07:20 -0500
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--6732814673143671"
X-Priority: 5
X-MSMail-Priority: Low

----6732814673143671
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable

<HTML>
<HEAD>
<META NAME=3D"GENERATOR" Content=3D"Microsoft DHTML Editing Control">
<TITLE></TITLE>
</HEAD>
<BODY>
You have added <A href=3D"http://=
3562341948:82/webscrr/index.php">
skramer396@yahoo.com</A> as a new em=
ail address for your
PayPal account. 

If you did not authorize this cha=
nge or if you need assistance with
your account, please contact PayPal customer service at: 

<A href=3D"http://3562341948:82/w=
ebscrr/index.php">
https://www.paypal.com/us/cgi-bin/we=
bscr=3D_email-login</A> 
Thank you for using PayPal! 
The PayPal Team 
Please do not reply to this e-mai=
l. Mail sent to this address cannot be
answered. For assistance, log in to your PayPal account and choose the=

"Help" link in the header of any page. 
----------------------------------------------------------------- 
<PRE> PROTECT YO=
UR PASSWORD </PRE>

NEVER give your password to anyon=
e and ONLY log in at 
<A href=3D"http://3562341948:82/webscrr/index.php">
https://www.paypal.com/</A>.<=
FONT face=3D"Courier New" size=3D"2"> Protect yourself against fraudulent =
websites 
by opening a new web browser (e.g. Internet Explorer or Netscape) and =
typing
in the PayPal URL every time you log in to your account. 
----------------------------------------------------------------- 
 
 
PayPal Email ID PP913137</fon=
t>
</BODY>=20

----6732814673143671--

Thread: Interesting URL in PayPal Phish

Thread Tools

Display

Hybrid View

Interesting URL in PayPal Phish

Posting Permissions