VoyForums
[ Show ]
Support VoyForums
[ Shrink ]
VoyForums Announcement: Programming and providing support for this service has been a labor of love since 1997. We are one of the few services online who values our users' privacy, and have never sold your information. We have even fought hard to defend your privacy in legal cases; however, we've done it with almost no financial support -- paying out of pocket to continue providing the service. Due to the issues imposed on us by advertisers, we also stopped hosting most ads on the forums many years ago. We hope you appreciate our efforts.

Show your support by donating any amount. (Note: We are still technically a for-profit company, so your contribution is not tax-deductible.) PayPal Acct: Feedback:

Donate to VoyForums (PayPal):

[ Login ] [ Contact Forum Admin ] [ Main index ] [ Post a new message ] [ Search | Check update time | Archives: 1, [2], 3, 4 ]

[ Next Thread | Previous Thread | Next Message | Previous Message ]

Date Posted: 20:15:46 05/10/05 Tue
Author: Jumbo
Subject: Paypal Phishing scam

Just barely got a PayPal phish. First, where it came from:

Tracking message source: 209.51.138.194:
Routing details for 209.51.138.194
[refresh/show] Cached whois for 209.51.138.194 : abuse@gnax.net
Using abuse net on abuse@gnax.net
abuse net gnax.net = abuse@above.net, abuse@gnax.net
Using best contacts abuse@above.net abuse@gnax.net

Yum, this spam is fresh!
Message is 0 hours old

And the actual site maintained by the phisher and where, includes
domain name. First site is a IP address only, traces to Alabanza,
Alabanza claims smoking crater.

Tracking link: http://64.177.76.181/paypal/index.htm
[report history]
ISP believes this issue is resolved
http://64.177.76.181/paypal/index.htm
Resolves to 64.177.76.181
Routing details for 64.177.76.181
De-referencing alabanza.com@abuse.net
abuse net alabanza.com = abuse@alabanza.com
Report routing for 64.177.76.181: abuse@alabanza.com

ISP has already taken action against the account:
http://64.177.76.181/paypal/index.htm

And another related site, possibly a backup to try to make the phish
legitimate.

Tracking link: http://www.secureclientupdate.com/paypal/index2.htm
No recent reports, no history available
Resolves to 205.178.145.65
Routing details for 205.178.145.65
[refresh/show] Cached whois for 205.178.145.65 :
mark.salerno@inquent.com
Using last resort contacts mark.salerno@inquent.com

There were also two spoofed PayPal links as well.

[ Next Thread | Previous Thread | Next Message | Previous Message ]
[ Contact Forum Admin ]

Forum timezone: GMT-8
VF Version: 3.00b, ConfDB:
Before posting please read our privacy policy.
VoyForums(tm) is a Free Service from Voyager Info-Systems.
Copyright © 1998-2019 Voyager Info-Systems. All Rights Reserved.