Paypal scam #1

You may be a victim in a new phishing scam. You may get this email:

Dear PayPal member,

At PayPal, we value the trust you have placed in us by using our service to conduct your transactions online. Because our relationship with you is financial in nature, the protection of your privacy is particularly important to us.

We are sending this verification notice due to small technical failure in PayPal's safeguard system, members who does not verify their account within one week will have their PayPal account freezed until they have successfully verified, and this applies to both personal users and businesses. The full terms of PayPal's privacy policy are available on the PayPal website, which you are welcome to review at any time.

Please verify your account and financial information by clicking on the link below:
https://www.paypal.com/cgi-bin/webscr?cmd=verify&id=FDES1F4DD9

*** DO NOT REPLY TO THIS EMAIL ***

This looks real doesn't it?

Just to make it more real lets send it with styles and logos stolen from Paypal. Here's the code of the message (note: we use Parentheses instead of angle-brackets so you can see it).

(table border="0" width="100%" cellspacing="0" cellpadding="3")(tr)(td)
(x)

(link rel="stylesheet" type="text/css" href="http://www.paypal.com/css/pp_styles_ns6_111402.css")

(x)
(img src="http://www.paypal.com/images/paypal_logo.gif")
(table cellSpacing="0" cellPadding="0" width="100%" border="0")

(tbody)
(tr)
(td width="100%" background="http://www.paypal.com/images/bg_clk.gif")
(img height="29" src="http://www.paypal.com/images/pixel.gif" width="1" border="0")(/td)(/tr)
(tr)
(td)(img height="10" rc="http://www.paypal.com/images/pixel.gif" width="1" border="0")
(/td)(/tr)(/tbody)(/table)

(br)
(font class="pptext")
Dear PayPal member,(br)
At PayPal, we value the trust you have placed in us by using our service to conduct your transactions(br)online. Because our relationship with you is financial in nature, the protection of your privacy is particularly
important to us.

(br)(br)

We are sending this verification notice due to small technical failure in PayPal's safeguard system,(br)
members who does not verify their account within one week will have their PayPal account freezed until they(br)
have successfully verified, and this applies to both personal users and businesses. The full terms of PayPal's(br)
privacy policy are available on the PayPal website, which you are welcome to review at any time. (br)(br)

(b)Please verify your account and financial information by clicking on the link below:(/b)(br)
(a target=newwin href="http://202.124.128.11/verify/https://www.paypal.com/cgi-bin/webscr?cmd=verify&id=FDES1F4DD9(/a)

(br)(br) (b)*** DO NOT REPLY TO THIS EMAIL ***(/b)

(/font)
(br)(br)(br)
(center)
Copyright© 2003 PayPal, Inc. All rights reserved. Designated trademarks and brands are the property(br)
of their respective owners.
(/center)

(x)
(x)
(! )

You may notice that the text is deliberately broken up (using "br" the Break symbol) and does not flow in a paragraph as a normal email would. Now look closely at the link. Its actually two URL's; the first actual url being the "http://202.124.128.11/verify/". Since the next is an error it is ignored by the browser when you click on it.

Where does this go?

Registration information gives us the following:

202.124.128.11

Record Type: IP Address
IP Location: Philippines - Manila - Manila - Cybernet Solutions Inc
Reverse IP: No websites hosted using this IP address
% [whois.apnic.net node-2]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.php

inetnum: 202.124.128.0 - 202.124.143.255
netname: CSI
descr: Cybernet Solutions Inc.
descr: Wireless Internet/ Value Added Service Provider
country: PH
admin-c: RJ44-AP
tech-c: JF74-AP
mnt-by: APNIC-HM
mnt-lower: MAINT-PH-CYBERNET-SOLTN
changed: hostmaster@apnic.net 20010717
changed: hostmaster@apnic.net 20010718
status: ALLOCATED PORTABLE
source: APNIC

person: Reynald Jaspe
address: 14/F Ayala Life Building
address: Madrigal Business Park
address: Muntinlupa City
address: Philippines
country: PH
phone: +63-2-807-9772
fax-no: +63-2-807-9545
e-mail: reyjas@cybees.com
nic-hdl: RJ44-AP
mnt-by: MAINT-NEW
changed: reyjas@cybees.com 20010620
source: APNIC

person: Jonathan A. Forneas
address: 14/F Ayala Life Building,
address: Madrigal Business Park,
address: Alabang, Muntinlupa City
country: PH
phone: +63-2-807-9772
fax-no: +63-2-807-95-45
e-mail: jaf@cybees.com
nic-hdl: JF74-AP
mnt-by: MAINT-NEW
changed: jaf@cybees.com 20010620
source: APNIC
Notice? NO websites hosted using this IP address. but you go to one because it specified the IP address and not an URL. More searching finds this:

CYBEES.COM

Website Title: CyberNet Solutions, Incorporated
IP Address: 202.124.128.18 (ARIN & RIPE IP search)
IP Location: Philippines - Manila - Manila - Cybernet Solutions Inc
Record Type: Domain Name
Monitor: Monitor or Backorder
Wildcard search: 'cybees' or 'bees' in all domains.
Other TLDs: .com .net .org .info .biz .us [5 available domains]
Name Server: DNS1.EGLOBALREACH.NET DNS2.EGLOBALREACH.NET
ICANN Registrar: NETWORK SOLUTIONS, INC.
Created: 26-nov-1998
Expires: 25-nov-2008
Status: ACTIVE
Registrant:
Data Solutions Inc. (CYBEES-DOM)
29 Buencamino St.
Las Pinas MM
PH

Domain Name: CYBEES.COM

Administrative Contact:
Narcelles, Reynaldo (RN2531) rsn@DNS.GLOBALINK.COM.PH
Data Solutions Inc.
29 Buencamino Street
Las Pinas, MM n/a
PHL
(632) 807-4432 fax: (632) 807-4434
Technical Contact:
Forneas, Jonathan (KBBVPTWTYI) jaforneas@EGLOBALREACH.NET
Globalreach
14/F AYALA FGU CENTER ALABANG
MAGRIGAL BUSINESS PARK ALABANG
MUNTINLUPA
METRO MANILA 1770
Metro Manila 1770
PHL
+632-807-9772 fax: 999 999 9999

Record expires on 26-Nov-2007.
Record created on 26-Nov-1998.

Domain servers in listed order:

DNS1.EGLOBALREACH.NET 202.124.128.2
DNS2.EGLOBALREACH.NET 202.124.128.3

These are the names given by the people who are stealing your information.