Gossamer Forum: General: Internet Technologies: Paypal ... duh!

Dec 17, 2004, 9:06 AM

Andy

Veteran / Moderator (18441 posts)

Dec 17, 2004, 9:06 AM

Post #1 of 6

Shortcut

Paypal ... duh!

Did anyone else get an email telling them to goto a given URL (which showed correctly, but just pointed to their root URL).

They ask you to validate your account... but I can't see the link. Anyone else got this problem? I just spent the last 30 minutes looking for the correct page, and I still can't :(

The email appears to be genuine, and points to the real PP site.

TIA

Andy (mod)
andy@ultranerds.co.uk

Dec 17, 2004, 10:04 AM

dan

Enthusiast (760 posts)

Dec 17, 2004, 10:04 AM

Post #2 of 6

Shortcut

Re: [Andy] Paypal ... duh! In reply to

Not me. What is the URL, and can you quote the email? Sounds phishy.

----
Cheers,

Dan
Founder and CEO

LionsGate Creative
GoodPassRobot
Magelln

Jan 7, 2005, 2:03 AM

Andy

Veteran / Moderator (18441 posts)

Jan 7, 2005, 2:03 AM

Post #3 of 6

Shortcut

Re: [dan] Paypal ... duh! In reply to

Yeah, just got another one :/

Here's the headers;

Quote:

X-Gmail-Received: aa62e4908b987ce4014619c004bc7e3c5bd5649b
Delivered-To: andy.newby@gmail.com
Received: by 10.54.18.45 with SMTP id 45cs17282wrr;
Fri, 7 Jan 2005 01:58:31 -0800 (PST)
Received: by 10.54.20.27 with SMTP id 27mr601941wrt;
Fri, 07 Jan 2005 01:58:31 -0800 (PST)
Return-Path: <service@paypal.com>
Received: from east.nmsrv.com (east.nmsrv.com [64.69.64.30])
by mx.gmail.com with ESMTP id 67si766007wra.2005.01.07.01.58.30;
Fri, 07 Jan 2005 01:58:31 -0800 (PST)
Received-SPF: softfail (gmail.com: domain of transitioning service@paypal.com does not designate 64.69.64.30 as permitted sender)
Received: (qmail 14100 invoked by uid 1002); 7 Jan 2005 09:58:12 -0000
X-AntiVirus: Clean
Delivered-To: webmaster@ace-installer.com
Received: (qmail 22051 invoked from network); 7 Jan 2005 09:58:10 -0000
X-AntiVirus: Clean
Received: from unknown (HELO paisa-dnplcr75z) (69.140.19.142)
by east.nmsrv.com with SMTP; 7 Jan 2005 09:57:57 -0000
From: "service@paypal.com" <service@paypal.com>
Subject: Notification of PayPal Limited Account Access
To: webmaster@ace-installer.com
Content-Type: text/html;iso-8859-1
Reply-To: service@paypal.com
Date: Fri, 7 Jan 2005 04:56:55 -0800
X-Priority: 1
X-Library: Indy 8.0.25

Mmmm...

Andy (mod)
andy@ultranerds.co.uk

Jan 7, 2005, 3:16 PM

Watts

Veteran (1141 posts)

Jan 7, 2005, 3:16 PM

Post #4 of 6

Shortcut

Re: [Andy] Paypal ... duh! In reply to

do a tracert and see what this comes out to:
69.140.19.142

Looks to me like this is where it originated from (but these headers always make my vision blurry). Crazy

Jan 7, 2005, 5:06 PM

Alex

Administrator (9387 posts)

Jan 7, 2005, 5:06 PM

Post #5 of 6

Shortcut

Re: [Watts] Paypal ... duh! In reply to

Quote:

(but these headers always make my vision blurry).

Try going to spamcop.net and paste in the full headers. It does a thorough analysis and gives you the proper email addresses.

Cheers,

Alex
--
Gossamer Threads Inc.

Jan 8, 2005, 1:01 AM

Andy

Veteran / Moderator (18441 posts)

Jan 8, 2005, 1:01 AM

Post #6 of 6

Shortcut

Re: [Alex] Paypal ... duh! In reply to

Hi,

Turned out it was invalid. It was sent to my gmail.com account, so I just clicked on "view original", and it showed me the headers and HTML code <G> I then just looked at the link area, and it seems that the use a window.status javascript effect, and then redirect to a totally non-paypal directed site. So many people must fall for these kind of scams :/

Cheers

Andy (mod)
andy@ultranerds.co.uk