This had me wondering for about 10 seconds.

I got an email that looked like a paypal email.


Date: Tue, 06 Jan 2004 23:29:07 +0000
From: PayPal.com
To: XXXXX
Subject: IMPORTANT vozvshas
Parts/Attachments:
1 Shown 13 lines Text
2 14 KB Application
—————————————-

Dear PayPal member,

We regret to inform you that your account is about to be expired in next five
business days. To avoid suspension of your account you have to reactivate it by
providing us with your personal information.

To update your personal profile and continue using PayPal services you have to
run the attached application to this email. Just run it and follow the
instructions.

IMPORTANT! If you ignore this alert, your account will be suspended in next
five business days and you will not be able to use PayPal anymore.

Thank you for using PayPal.

vozvshas

This was good, but not that good. It has an application attached called www.paypal.com.pif. It is probably hoping that I am first of all reading the email on a windows box, second that I don’t have view file extentions switch on. This would make it the attachment appear as www.paypal.com, so a user might click on it to update.
Second it has a whole load of spaces then vozvshas at the end. This is sign of junkmail. They use this to track who replies to the email. That would be hard in this case since the from address is @paypal.com.
Third if you look at the headers you will see

Received: from [4.10.152.172] (helo=localhost)
by punt-3.mail.demon.net with smtp id 1Ae0dE-0003og-4Y
for demon-web@dirk.demon.co.uk; Tue, 06 Jan 2004 23:29:07 +0000

I know that punt-3.mail.demon.net is my isp’s email server so I know the email came from 4.10.152.172, it also said it’s name was localhost. If this was a real email server on the internet it would have said its real name not localhost.
Forth. I have never used this email address for a paypal account.

I am curious to see what virus is in the attachment but I won’t see that till I get home.
Moral of the story don’t trust anything that is asking anything relating to money.

This entry was posted on Tuesday, January 6th, 2004 at 6:37 pm and is filed under Uncategorized. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.

Comments are closed.