Interesting URL in PayPal Phish

OK, I amnot unfamiliar with these ype of scams and was not fooled by the e-mail, however what I am intrigued by is the URL (if thats what it is) for the scammers site. I (and a few others I have asked) have never seen anything like it before. The link in the e-mail takes you to http://3562341948:82/webscrr/index.php now I know all about the colon that indicates which port to connect to before anyone says that, but what kind of address is 3562341948 it is not an IP address that I am familiar, besides if you ping/tracert it resolves to another IP, nor is it any form of URL I am familiar with, I thought they all had to end in some sort of .com/.org/.etc would anyone here be nice enough to tell me what this address is? Also while you are here why not try filling out that page with random details just to waste a little more of the scammers time:-)

Quote:

X-Gmail-Received: 11de23cbc082d5a0e13a8b43d3d6eb647588dd3a
Delivered-To: [email protected]
Received: by 10.36.224.64 with SMTP id w64cs9222nzg;
Sat, 13 May 2006 08:23:37 -0700 (PDT)
Received: by 10.54.140.16 with SMTP id n16mr3602402wrd;
Sat, 13 May 2006 08:23:37 -0700 (PDT)
Return-Path: <[email protected]>
Received: from 192.168.111.10 (210-54-89-248.adsl.xtra.co.nz [210.54.89.248])
by mx.gmail.com with SMTP id 29si10987443wrl.2006.05.13.08.23.23;
Sat, 13 May 2006 08:23:37 -0700 (PDT)
Received-SPF: softfail (gmail.com: domain of transitioning [email protected] does not designate 210.54.89.248 as permitted sender)
Received: from 64.66.55.212 by ; Sat, 13 May 2006 14:07:20 -0100
Message-ID: <[email protected]>
From: "[email protected]" <[email protected]>
Reply-To: "[email protected]" <[email protected]>
To: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Subject: New email address added to your PayPal account !
Date: Sat, 13 May 2006 10:07:20 -0500
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--6732814673143671"
X-Priority: 5
X-MSMail-Priority: Low

----6732814673143671
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable

<HTML>
<HEAD>
<META NAME=3D"GENERATOR" Content=3D"Microsoft DHTML Editing Control">
<TITLE></TITLE>
</HEAD>
<BODY>
You have added <A href=3D"http://=
3562341948:82/webscrr/index.php">
[email protected]</A> as a new em=
ail address for your
PayPal account. 

If you did not authorize this cha=
nge or if you need assistance with
your account, please contact PayPal customer service at: 

<A href=3D"http://3562341948:82/w=
ebscrr/index.php">
https://www.paypal.com/us/cgi-bin/we=
bscr=3D_email-login</A> 
Thank you for using PayPal! 
The PayPal Team 
Please do not reply to this e-mai=
l. Mail sent to this address cannot be
answered. For assistance, log in to your PayPal account and choose the=

"Help" link in the header of any page. 
----------------------------------------------------------------- 
<PRE> PROTECT YO=
UR PASSWORD </PRE>

NEVER give your password to anyon=
e and ONLY log in at 
<A href=3D"http://3562341948:82/webscrr/index.php">
https://www.paypal.com/</A>.<=
FONT face=3D"Courier New" size=3D"2"> Protect yourself against fraudulent =
websites 
by opening a new web browser (e.g. Internet Explorer or Netscape) and =
typing
in the PayPal URL every time you log in to your account. 
----------------------------------------------------------------- 
 
 
PayPal Email ID PP913137</fon=
t>
</BODY>=20

----6732814673143671--

Quote:

Also while you are here why not try filling out that page with random details just to waste a little more of the scammers time:-)

Hi,
Probably not a good idea to go to sites linked to in suspected phishing emails. If you have an unpatched vulnerability or there is a zero-day exploit that they know about and you don't it could mean trouble for you. Going to their site means you're walking on their home ground.

I believe that it is the IP address in decimal notation.

Using the tools found here: http://www.dnsstuff.com/

It appears to resolve to the London Borough of Hillingdon

;)

Interesting.... wget recognizes or translates this as an IP address and the site is still online.

Quote:

C:\temp>wget http://3562341948:82/webscrr/index.php
--22:22:52-- http://3562341948:82/webscrr/index.php
=> `index.php'
Connecting to 3562341948|212.85.6.60|:82... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]

[ <=> ] 16,639 45.96K/s

22:22:53 (45.88 KB/s) - `index.php' saved [16639]

Thanks for the site Nihil.

I pulled the page down and am analyzing it and I'm not finding any URLs in there but a lot of what looks to be encoded addresses. Anyone know what these mean? (spaces inserted to avoid formatting probs)

Quote:

h r e f=(double quote)5v6fw20lpt1t4ypk7o8tjpu1b9h72zgqt8lnak0ficbz392u3fc(double quote)
h r e f=(double quote)?cmd=goiys8qptwgalzkoq7dcapq0w0zwn4z85w2oew3a4tchawq9ltl(double quote)

Hey Hey,

nihil is indeed correct that it's an IP Address in decimal notation.... Check out http://www.iowight.com/iwindex/decimal.php3 for more information

ric-o: These are just links to other pages.... Usually sites like paypal have cmd= or a large session key.... they're just trying to mimic this... because there's no http:// it'll just be appended onto the current site... that's why it looks really messed up... their just trying to make it harder for anti-phishers to investigate... but it's not really bothering anyone except the end-users... but I guess that's the real problem..

You can do something like

Code:

wget http://3562341948:82/webscrr/index.p...w3a4tchawq9ltl

Peace,
HT

Deobfusicated URL: http://212.85.6.60:82/webscrr/index.php
Plain IP: 212.85.6.60
Webserver Port: 82
WHOIS Results: http://www.dnsstuff.com/tools/whois....e.net&email=on
Abuse Email: [email protected]

I've reported it to the abuse address. And signed up with some fake data just to annoy the phisher. ;) Making sure I used my LiveCD with my HDD unplugged on my second computer, just to be safe.

Google Anti-phishing thing in ff works good.

Thanks for the feedback guys, I have never heard of an IP address in decimal notation before, I guess you do learn something new every day. Hmmmm... London thats interesting, you sort of assume these sites are all based in nigera (nothing against nigerians, it just seems to be where all the paypal/ebay/bank scams come from). I suppose I could ring the police and let them know, but then again, I have rang them before when someone had thousands taken from their account and they wasn't interested until the bank contacted them. I am also aware that just because the server is based in london (if thas correct) it doesn't necesarily mean the scammers are there. Once again thanks for the info!

Hi C0br4,

Quote:

London thats interesting, you sort of assume these sites are all based in nigera (nothing against nigerians, it just seems to be where all the paypal/ebay/bank scams come from). I suppose I could ring the police and let them know

Actually the webserver could be anywhere, it just needs to be vulnerable for these guys to use it.

We had a member post only two or three days ago about his games server being compromised in a similar fashion. IIRC he was located in the USA.

I think that these people work in a very similar way to spammers. They would particularly look for .gov (which the Hillingdon borough council will be) and .edu domains, for example, as there is a good chance that they are unmanned and unmonitored over the weekend?

Once the punter has visited the site, and entered the info. the damage has been done.

:(

Quote:

Originally posted here by Chazwazza1337
I've reported it to the abuse address. And signed up with some fake data just to annoy the phisher. ;) Making sure I used my LiveCD with my HDD unplugged on my second computer, just to be safe.

Cool. I reported it to the Fried Phish folks at CastleCops - http://www.castlecops.com/pirt

Hmmmm,

I am tempted to report "The Socialist Republic of Hillingdon" to the "Public Auditor" for this blatant attempt to supplement their local property taxation revenues. :D

:bigpimp: :lildevil:

(the check for my "consultancy fees" bounced)

Quote:

Originally posted here by ric-o
Cool. I reported it to the Fried Phish folks at CastleCops - http://www.castlecops.com/pirt

Wow, didn't know about that service. Thanks.

Though not popular with anyone other than the nasty folks on the net, IP addresses can be represented in:

1) Binary
2) Hex
3) decimal

Of course dotted quad is used and is the most widely recognized format.

For some fun with this, see this site.
http://www.kloth.net/services/iplocate.php

--TH13

PS
Sending this to the PIRT team was an excellent move. I get to review their reports each day so I'll look for this one.

ooh aren't I the lucky one, I have just got another one... I have never had one of these emails...ever since that last one and I have been using various email providers for nearly 4 years, and now I have two in the same month... something seems phishy to me (bad pun intended)... anyway I'll go ahead and report this... don't worry I won't be posting every single spam email I get here:-) this will be the last

LMAO I Just Love The Fake Address Bar!
http://img417.imageshack.us/my.php?image=phish3br.jpg

Quote:

X-Gmail-Received: a9bc6fd8e61949c7a44801322e67a0a73513d784
Delivered-To: [email protected]
Received: by 10.36.224.43 with SMTP id w43cs50501nzg;
Thu, 18 May 2006 09:40:49 -0700 (PDT)
Received: by 10.35.8.1 with SMTP id l1mr781550pyi;
Thu, 18 May 2006 09:40:48 -0700 (PDT)
Return-Path: <[email protected]>
Received: from clust10-www03.powweb.com (clust10-www03.powweb.com [66.152.98.103])
by mx.gmail.com with ESMTP id m78si671347pye.2006.05.18.09.40.47;
Thu, 18 May 2006 09:40:48 -0700 (PDT)
Received-SPF: pass (gmail.com: best guess record for domain of [email protected] designates 66.152.98.103 as permitted sender)
Received: by clust10-www03.powweb.com (Postfix, from userid 179687)
id 9C0B3158AA3; Thu, 18 May 2006 09:40:47 -0700 (PDT)
To: [email protected]
Subject: PayPal Security Notice No:16914
From: PayPal Alert <[email protected]>
Content-Type: text/html
Message-ID: <1675903695.JavaMail.16914@on-Mail009>
X-PayPal-EID:000-336418498
X-PayPal-MailTracker: 10426.191.196.0
X-PayPal-invdate:May 18, 2006
Date: Thu, 18 May 2006 09:40:47 -0700 (PDT)

<HTML>

<table width="600" cellspacing="0" cellpadding="0" border="0"

align="center">

<tr valign="top">

<td><A href="https://www.paypal.com/us"><IMG

src="http://images.paypal.com/en_US/i/logo/email_logo.gif" alt="PayPal"

border="0" width="255" height="35"></A>

</td>

</tr>

</table>

Dear PayPal Member,

 

<div>

You have recived this email as part of a Verified PayPal campaign meant to increase security for 

your credit card against online credit card fraud.

</div>

 

<div>

Verified PayPal has detected that you have been using this email address for online purchases and in 

order to protect yourself against online credit card fraud we would like to introduce you to a new 

system that will protect you against frauds.

</div>

 

<div>

You can associate your email address to your credit card and recive a password that you will use 

for any online purchase. Also you will be notified by Verified PayPal when an online purchase is 

made.

</div>

 

<div>Follow the below and go to Verified PayPal. You can join the Verified PayPal system or learn more 

about this.

 

 Alert code: 1691438328 

<a target=_blank HREF='http://correo.ase.qroo.gob.mx/horde/imp/graphics/Identity.html' target='_self'>

https://www.paypal.com/us/cgi-bin/we...md=_notice=169</a>

PayPal’s Fraud Investigation Team,

</html>

<hr>

<div><tt>Please do not reply to this email as this is only a notification. Mail sent 

to this address cannot be answered.</tt>

<tt>Copyright © 1999-2006 PayPal. All rights reserved.</tt>

Now then... what kind f admin would allow directory listing... tut tut tut http://www.skycar.net.cn/bbs/.../