zapcojake

[Log in to get rid of this advertisement]

Hello, I received and email from paypal today that was supposed to have information about my account. It instead contained hundreds of usernames and or emails. I have contacted paypal about this but received no response.

St.Jimmy

are you sure it's from paypal?

zapcojake

The address checks out, the subject line was restore your account and my account had been limited, and the email didn't ask me for any information and there are no links to follow only hundreds of email addresses from legitimate email providers. Hotmail, and hushmail just to name a couple. Over 36,000 characters in all. There are also some linux.org addresses in it.

pixellany

Sounds for sure to be a scam.

When you say "the address checks out", how did you determine that?

zapcojake

Its the same address as they have been using to contact me. Plus the email doesn't ask for any of my information or have any links to follow. I have been checking some of the addresses it contains and they are valid. Some of them are addresses tied to websites.
I would be glad to post a snippet from it if I know its legal/moral to do so. I'm trying to cry wolf here I just want to make people aware of what happened. There are some addresses from places like linux.org and linuxmafia in it. I have googled some of the ones that sounded like websites and they are real.

pixellany

Can you forward the e-mail to me? (Use the address in my website(link below)--in the "about" link at the bottom of each page.)

zapcojake

Its done. I have contacted some of the mail providers but haven't heard back.

masonm

You should probably forward the entire email to Paypal's fraud department.

pixellany

<<Time out while we look at the headers which OP will be sending me>>

zapcojake

1539 addresses.

pixellany

It's a scam alright---OP can publish the details if he chooses.....

zapcojake

Bingo!!--it is a scam. The tipoff is this line:

Received: from server1.ddf.com.br ([67.15.60.8])

Here is the result of a whois search:

mherring@1[grub]$ whois server1.ddf.com.br

% Copyright (c) Nic.br
% The use of the data below is only permitted as described in
% full by the terms of use (http://registro.br/termo/en.html),
% being prohibited its distribution, comercialization or
% reproduction, in particular, to use it for advertising or
% any similar purpose.
% 2007-06-10 10:55:39 (BRT -03:00)

% Query rate limit exceeded. Reduced information.
% Use https://registro.br/cgi-bin/avail/ for domain availability.

domain: ddf.com.br
owner: Daniel de Melo Franqueira ME (682010)

% Security and mail abuse issues should also be addressed to
% cert.br, http://www.cert.br/, respectivelly to cert@cert.br
% and mail-abuse@cert.br
%
% whois.registro.br accepts only direct match queries. Types
% of queries are: domain (.br), ticket, provider, ID, CIDR
% block, IP and ASN.

Going to registro.br confirms that they are in fact in Brazil.

I would definitely pass this on to Paypal (use an address for them that
you know to be good)

jiml8

Stupid phishers can't even get their scam emails constructed properly...

sheesh.

zapcojake

I'd rather deal with a poor attempt than a good one.

Dragineez

Always forward paypal phishing attempts (including full header) to spoof at paypal.com. Nothing may happen in the short term, but it this scumbag ever does come before the bar paypal will make sure he gets the hammer award - or perhaps the sledgehammer award.