I've gotten a couple of these in the past several weeks. Additional
observations about them:
a. The hyperlink itself (most browsers show the actual URL on the bottom
bar of the window) is set up to have the appearance of a legitimate link to
PayPal with the actual numeric IP address obscured in hexidecimal. Seeing
an internet address or portions of a URL in hex sets off alarm bells for
me. Only one reason to do it . . . to obscure something and make it very
difficult for The Masses to understand or translate.
b. The entire message with embedded GIF is designed to make it very
difficult to forward the original message in its entirety to
PayPal. There's hidden plain text past the GIF that looks like contents
from some innocuous, frivolous email totally unrelated to PayPal. On top
of that, the hex string with IP for the fraud site and the rest of the
email (including hidden text) exceeded the number of text characters their
report form allowed.
c. PayPal asked me to forward it to an email address. Their email server
filtered out the GIF and html when I sent it there! Took a couple email
exchanges with them to get them to see what I had received.
Whoever created it (latest one came from somewhere in Korea) intimately
knows the Achilles Heels in PayPal's fraud reporting system, both on-line
form and their email server, and is leveraging on them to prevent the
reports from containing the damning evidence or revealing the source.
-- John
At 02:56 PM 11/19/03, Jim Caldwell wrote:
There is another 'clever' variation of this fake message that puts the
email text into a graphic (however, it looks just like a regular text
message). The link in the 'text' is the actual link to PayPal, but when
you click on it, since the entire message is an embedded graphic with a
hyperlink, the link actually goes to a fake PayPal site where your
information is forwarded to the author.
I just reported this new one to PayPal.
Jim Caldwell
< This message was delivered via the Olympus Mailing List >
< For questions, mailto:owner-olympus@xxxxxxxxxxxxxxx >
< Web Page: http://Zuiko.sls.bc.ca/swright/olympuslist.html >
|