Closer examination revealed that the entire message was a GIF image, and clicking anywhere on it would invoke the following:

http://www.paypal.com.cgi-bin.webscr.cmd=_rav-form@211.47.191.125:199/cgi/index.htm

(Don't try it!) The important thing here is that it's not really sending anything to PayPal. There is a machine somewhere with an IP address of 211.47.191.125 waiting to collect your credit card data on port 199.

If you need to check the status of your PayPal or Ebay account, the best thing to do is to go dierectly to PayPal.com or Ebay.com and log in. Don't trust an email to give you a "shortcut" into those systems.

This scam was pretty clever - it took me a while to figure out what was going on. Don't be fooled. The weakest link in any scam is a willing victim.

------------------
               Bobby Lee
-b0b-   quasar@b0b.com

I have received a few policy updates, but they always say to log in and see what they are.

If you get such a message, delete it!!

I hope nobody here is foolish enough to click into one of these.

I get over 300 emails a day because I do a lot of internet business. I set up a JUNK folder in Outlook Express with about 200 keywords to separate the spam as it comes in. It works pretty good... snags about 75% of the crap. The eBay and PayPal "spoofs" still download into the regular Inbox however. I guess there's no way to prevent that.

------------------
My Site - Instruction | Doug's Free Tab | Steels and Accessories

------------------
My Website..... www.cmedic.net/~almarcus/

This one said I needed to open an attachment in order to renew my account information ...

A legitimate PayPal notice 'always' addresses you you by your full name (Dear MR.John Smith) and 'never' asks you to give them info via an email link. The same for Ebay.

When in doubt just forward the suspect email to spoof@paypal.com or spoof@ebay.com. You will recieve an anwer usually within 10 or 15 minutes confirming your suspicion that this email was not sent by PayPal or Ebay.

WHOIS results for 211.47.191.125
Generated by www.DNSstuff.com

Country: KOREA-KR

ARIN says that this IP belongs to APNIC; I'm looking it up there.

APNIC says that this IP belongs to KRNIC; I'm looking it up there.

Using 0 day old cached answer (or, you can get fresh results).
Displaying E-mail address (use sparingly -- this will make it more likely that you will trigger our rate limiting system).

Çѱ¹ÀÎÅͳÝÁ¤º¸¼¾ÅÍ(www.nic.or.kr)¿¡¼­ Á¦°øÇÏ´Â Whois ¼­ºñ½º ÀÔ´Ï´Ù.

query: 211.47.191.125

# ENGLISH

KRNIC is not a ISP but a National Internet Registry similar to APNIC.
The followings are information of the organization that is using the IPv4 address.

IPv4 Address : 211.47.191.96-211.47.191.127
Network Name : HANINTERNET-LLINE-VISIONGRA
Connect ISP Name : HANINTERNET
Connect Date : 20040220
Registration Date : 20040220

[ Organization Information ]
Organization ID : ORG380591
Org Name : VISIONGRA
State : SEOUL
Address : Pil-dong 1(il)-ga , Jung-gu
Zip Code : 100-271

[ Admin Contact Information]
Name : BADA JUNG
Org Name : VISIONGRA
State : SEOUL
Address : Pil-dong 1(il)-ga , Jung-gu
Zip Code : 100-271
Phone : +82-2-2272-6872
E-Mail : webmaster@yoonfont.co.kr

[ Technical Contact Information ]
Name : BADA JUNG
Org Name : VISIONGRA
State : SEOUL
Address : Pil-dong 1(il)-ga , Jung-gu
Zip Code : 100-271
Phone : +82-2-2272-6872
E-Mail : webmaster@yoonfont.co.kr

--------------------------------------------------------------------------------

If the above contacts are not reachable, please see the following ISP contacts
for further information or network abuse.

[ ISP IPv4 Admin Contact Information ]
Name : ipadministrator
Phone : +82-2-860-8143
Fax : +82-2-852-8535
E-Mail : iservice@haninternet.co.kr

[ ISP IPv4 Tech Contact Information ]
Name : ipmanager
Phone : +82-2-860-8144
Fax : +82-2-852-8535
E-Mail : ip@haninternet.co.kr

[ ISP Network Abuse Contact Information ]
Name : Sangwon So
Phone : +82-2-860-8002
Fax : +82-2-852-8535
E-Mail : support@haninternet.co.kr

Wiz

[This message was edited by Wiz Feinberg on 08 January 2005 at 01:40 PM.]

Er, well,...maybe.

quote:

---

Er, well,...maybe.

Probably more likely is it's one of our own stateside pillars of society, who's just using that Korean server to proffer his junk.

---

Reporting addresses:
abuse@haninternet.co.kr

------------------
Bobby D. Hunter
Security for SGF
Hunting down Slimeball Game

[This message was edited by Bobby D. Hunter on 10 January 2005 at 09:54 PM.]