[PLUG] A New (to me) phishing attack

[Rich Shepard]

On Fri, 24 Feb 2006, Richard C. Steffens wrote:

> Am I correct in assuming that this link goes to someplace within Yahoo? I
> sent the entire e-mail off to abuse at yahoo.com, but they think I'm
> complaining about the e-mail coming from yahoo mail, I'm on my third
> exchange with them to get them to look at the link, and not the spoofed (is
> that the right term for it?) e-mail header.

Dick,

   Yes, it's at yahoo. What you want to do is turn on full headers, then
forward the entire message to 'abuse at paypal.com'; since they're owned by
eBay I also copy 'spoof at ebay.com' to the address line. Let eBay and PayPal
talk with the yahoo yahoos.

   I've been getting these (from supposedly both ebay.com and paypal.com) for
months. As soon as I turn on the full headers I can see the actual IP address
of their link. It's almost always in Asia.

Rich

-- 
Richard B. Shepard, Ph.D.               |   Author of "Quantifying Environmental
Applied Ecosystem Services, Inc. (TM)   |  Impact Assessments Using Fuzzy Logic"
<http://www.appl-ecosys.com>     Voice: 503-667-4517         Fax: 503-667-8863