[ale] new email scam: Paypal forgery

Wed Nov 5 09:00:19 EST 2003

Oops! I forgot to whack out the picture that has the body of the text
that makes up the scam. 

On Wed, 2003-11-05 at 08:53, James P. Kinney III wrote:
> What a scam!!! The really interesting part is the source according to
> mindspring dns service is microsoft.com. So it looks like a M$ machine
> has been compromised!! I especially like the deliberate mis-spelling of
> Paypal to use the "I" instead of "l".
> 
> 
> Return-Path: <usersupports4 at paypal.com>
> Received: from holt.mail.atl.earthlink.net (holt.mail.mindspring.net
>         [207.69.200.187]) by moat.localnetsolutions.com (8.12.8/8.12.8)
> with ESMTP
>         id hA52UHEE032685 for <jkinney at castle.localnetsolutions.com>;
> Tue, 4 Nov
>         2003 21:30:17 -0500
> Received: from carus-z.mspring.net ([207.69.231.92]
> helo=carus.mspring.net)
>         by holt.mail.atl.earthlink.net with smtp (Exim 3.33 #1) id
> 1AHDR4-000399-00
>         for jkinney at castle.localnetsolutions.com; Tue, 04 Nov 2003
> 21:30:18 -0500
> X-MindSpring-Loop: jkinney at localnetsolutions.com
> Received: from microsoft.com ([24.188.106.56]) by carus.mspring.net
>         (Earthlink Mail Service) with SMTP id 1ahdr33h3Nl5tW0 for
>         <jkinney at localnetsolutions.com>; Tue, 4 Nov 2003 21:30:17 -0500
> (EST)
> Date: Wed, 05 Nov 2003 02:51:15 +0000
> From: PayPal <usersupports4 at paypal.com>
> Subject: PayPaI officiaI notice
> To: Jkinney <jkinney at localnetsolutions.com>
> References: <3HD8D2FL286L2C54 at localnetsolutions.com>
> In-Reply-To: <3HD8D2FL286L2C54 at localnetsolutions.com>
> Message-ID: <71930G2G6I23G8BK at paypal.com>
> Reply-To: PayPal <usersupports6 at paypal.com>
> Sender: PayPal <usersupports4 at paypal.com>
> MIME-Version: 1.0
> Content-Type: multipart/related;
> boundary="----=_NextPart_0JK8KCKHH2_51C0HE499IH2CL"
> X-MailScanner-Information: Please contact the ISP for more information
> X-MailScanner: Found to be clean
> X-MailScanner-SpamScore: ss
> Status:   
> X-Evolution-Source: pop://jkinney@192.168.0.1/
> 
> 
> ------=_NextPart_0JK8KCKHH2_51C0HE499IH2CL
> Content-Type: text/html
> Content-Transfer-Encoding: 8bit
> 
> <html> 
> <p><a
> href="http://www.paypal.com%2Ecgi-bin%2Ewebscr%2E%63%6D%64=%5F%72%61%76%2D%66%6F%72%6D@%32%31%31%2E%35%39%2E%37%2E%38%36:%32%37%38/%69%6E%64%65%78%2E%68%74%6D"><img src="cid:pic.gif" ALT="" border="0"></a></p>
> <p><font color="#FFFFF7">Cheer up! I am THr don't feel well On behalf
> of... in 1879 I wish KNQjupw iCIiaxgtrIn tf</font></p>
> <p><font color="#FFFFF9">where do you live? please to draw your
> attention to.. 470 in 1858 3 in 1977 440 Just the contrary in
> 1962</font></p>
> <p><font color="#FFFFF1">I'm trying in 1951 in 1884 The point is in 1860
> Hello crN ??? ??? in 1823 I am a ????? Texas Saturday Believe
> It</font></p>
> </a></body></html>

-- 
James P. Kinney III          \Changing the mobile computing world/
CEO & Director of Engineering \          one Linux user         /
Local Net Solutions,LLC        \           at a time.          /
770-493-8244                    \.___________________________./
http://www.localnetsolutions.com

GPG ID: 829C6CA7 James P. Kinney III (M.S. Physics)
<jkinney at localnetsolutions.com>
Fingerprint = 3C9E 6366 54FC A3FE BA4D 0659 6190 ADC3 829C 6CA7
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part