- Apr 12, 2002
- 5,434
- 20
- 81
Got an e-mail tonight, that was supposedly from PayPal, asking me to verify my info. After seeing multiple warnings here about bogus e-mails that look like they're coming from PayPal, I checked the message headers and found this:
Status: U
Return-Path: <service@paypal.com>
Received: from rsc2.gspuniver.ru ([213.24.31.2])
by meadowlark (EarthLink SMTP Server) with SMTP id 19Z20J1wY3NZFl60
for <xxxxxxx@earthlink.net>; Mon, 15 Sep 2003 15:39:48 -0700 (PDT)
Received: from umich.edu [242.175.25.206] by rsc2.gspuniver.ru (Postfix) with ESMTP id A5643ACBC7D6 for <xxxxxxx@earthlink.net>; Tue, 16 Sep 2003 06:39:51 +0000
Date: Tue, 16 Sep 2003 06:39:51 +0000
From: Service <service@paypal.com>
Subject: PayPal Account Security Measures
To: xxxxxxx <xxxxxxx@earthlink.net>
References: <30063A305F15D2A1@earthlink.net>
In-Reply-To: <30063A305F15D2A1@earthlink.net>
Message-ID: <646C996543C1963C@paypal.com>
Reply-To: User <user@some.com>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
That's originating from Russia, if I'm reading it right? Also, there was a link to click in the message, that sent you here:
http://www.paypal.com/@211.113.186.42/pp/processing.htm
That's a dead giveaway. Even if you type www.paypal.com into your browser, it redirects to a secure server, or, in other words, https://www.paypal.com.
Oh, the "from" line in outlook express also showed it as coming from "Service", and nothing about paypal, which is also bogus.
So.........forwarned is forarmed........be wary!!
Status: U
Return-Path: <service@paypal.com>
Received: from rsc2.gspuniver.ru ([213.24.31.2])
by meadowlark (EarthLink SMTP Server) with SMTP id 19Z20J1wY3NZFl60
for <xxxxxxx@earthlink.net>; Mon, 15 Sep 2003 15:39:48 -0700 (PDT)
Received: from umich.edu [242.175.25.206] by rsc2.gspuniver.ru (Postfix) with ESMTP id A5643ACBC7D6 for <xxxxxxx@earthlink.net>; Tue, 16 Sep 2003 06:39:51 +0000
Date: Tue, 16 Sep 2003 06:39:51 +0000
From: Service <service@paypal.com>
Subject: PayPal Account Security Measures
To: xxxxxxx <xxxxxxx@earthlink.net>
References: <30063A305F15D2A1@earthlink.net>
In-Reply-To: <30063A305F15D2A1@earthlink.net>
Message-ID: <646C996543C1963C@paypal.com>
Reply-To: User <user@some.com>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
That's originating from Russia, if I'm reading it right? Also, there was a link to click in the message, that sent you here:
http://www.paypal.com/@211.113.186.42/pp/processing.htm
That's a dead giveaway. Even if you type www.paypal.com into your browser, it redirects to a secure server, or, in other words, https://www.paypal.com.
Oh, the "from" line in outlook express also showed it as coming from "Service", and nothing about paypal, which is also bogus.
So.........forwarned is forarmed........be wary!!