PayPal-secure SCAM! BEWARE!

[SirDante]

wow...

 

[boris78]

ah, ok... so, I guess I'll just act like the sysadmin I'm paid to pretend to be ....

*cough* poking around *cough* their site, I can tell you a few things:

Open ports on the server... 21, 22, 23 (amateurs), 25, 80, 110, 2000, 3306, 8007, 8009, 8080

It's also running an early 2.4.x linux kernel.

Seeing some odd ports open, one might be tempted to see what they are...

(/home/jeff) # telnet paypal-secure.com 25
Trying 64.6.247.233...
Connected to paypal-secure.com.
Escape character is '^]'.
220 george.frogspace.net ESMTP Exim 3.02 #1 Tue, 18 Dec 2001 01:14:52 -0800
^]


Oh lookie here... Oops, their smtp server uses their real hostname... Frogspace.net .

So, going from there ...

Registrant:
Digital Space, Corp. (FROGSPACE2-DOM)
1593 E. Chestnut Ave.
Lompoc, CA 93436
US

Domain Name: FROGSPACE.NET

Administrative Contact, Technical Contact, Billing Contact:
Dirgo, Landon (LD2085) digitalspace@DIGITALSPACE.NET
Digital Space, Corp.
1593 E. Chestnut Ave.
Lompoc, CA 93436
805 740 1999 (FAX) 508 448 1259

and a whois on digitalspace.net shows:

Registrant:
Digital Space, Corp.
1593 E. Chestnut Ave
Lompoc, CA 93436
US

Domain Name: DIGITALSPACE.NET

Sponsoring Reseller; for Technical Support
with respect to this domain contact:
Digital Space Corp, support@digitalregistrar.com
805 740 1999

Administrative Contact:
Dirgo, Landon dom.reg@digitalspace.net
1593 E. Chestnut Ave
Lompoc, CA 93436
US
805-740-1999

Technical Contact:
Dirgo, Landon dom.reg@digitalspace.net
1593 E. Chestnut Ave
Lompoc, CA 93436
US
805-740-1999

Billing Contact:
Dirgo, Landon dom.reg@digitalspace.net
1593 E. Chestnut Ave
Lompoc, CA 93436
US
805-740-1999

So, It's pretty safe to assume that Mr. Landon Dirgo is either the person running the little scam, or an innocent hosting agency. Lompoc is 150 miles outside of LA, in Santa Barbara county .... So anyone wishing to turn these fine fellows in might want to pick an address from here or just submit a tip here, or, just call (805) 737-7737 , and let the sherriff sort out the guilty from those who host them (if it really is an innocent host, and from digitalspace.net's website, it appears that way, then they'll have contact information for paypal-secure.com).


Hope someone turns them in ...

 

[Lore]

Problem with your information is that digitalspace.net is a (seemingly) legitimate webhost -- and probably assigns second-level domain names to the account holders. That would also explain why all those ports are open - to allow the account holders easy access to their site.

The first thing to do is probably report the paypal-secure account to digitalspace admins, and then report this to paypal.

 

[boris78]

I just noticed, and edited accordingly.

 

[dogberry]

ya hold on there Boris...Digital Space may just be offering the hosting to the crook. ARIN shows that they have that netblock. Be kinda dumb to hang your arse out there when it's so easy to trace. My guess is that DS doesn't know about this...but I'm sure they will in the morning....

KNOCK..KNOCK...OPEN UP!! This is the FBI!

 

[nnnyyy]

ttt becareful people

 

[Jono182]

i submitted my updated info for all 4 of my paypal accounts! whoo! $20 for nothing! this is definetly a hot deal!

 

[markgm]

2 things that actually made me laugh out loud at work this morning...

"Every account insured against unauthorized transactions up to ,000"

And the yellow secure transaction icon that they have on the page.

Ahhh, thanks guys!

 

[sbpd]

When I click on the "insured up to....." link, it brings me to the login page and RECOGNIZES me! It has my email address in the login box and asking for my password. If this isn't legit then howcome it recognizes me?!

 

[telstar1]

You should forward this to PayPal.
They can have it shut down if it's fake.

 

[sbpd]

When you check, properties, it shows it's not encrypted, and no security certificate. Looks like they have hacked that page from paypal.

Looks like they have used paypal's html for part of the page and added their own for the CC info. Therefore the links do work and go to paypal, but the CC info doesn't!

 

[ChurchOfSubgenius]

When I click on the "insured up to....." link, it brings me to the login page and RECOGNIZES me! It has my email address in the login box and asking for my password. If this isn't legit then howcome it recognizes me?!

Maybe the can read your cookie?

 

[Sockmonkey4]

<< When I click on the "insured up to....." link, it brings me to the login page and RECOGNIZES me! It has my email address in the login box and asking for my password. If this isn't legit then howcome it recognizes me?! >>



Because all of the links on the page point to the REAL Paypal site. It's the real site that is recognizing you.

If you still think it's legit, though, go for it. The $5 is worth it. Really.

 

[geekender]

HA HA!

Check out the root.....didn't even put a placeholder page.

 

[Mannyman]

Yeah, it's definitely a scam... www.paypal-secure.com doesn't seem so secure if you try to view the root folder... you can actually see the directory tree and there's nothing in it!

 

[Dekaner]

Nice find BenCJedi. I got that email too and just deleted it as I thought it was an ad for Paypal. Lets try to keep this one on top for awhile.

Bump!!

 

[xp1800]

yea, thanks for the tip guys, i was saw this deal as well but wasn't sure about it. now i know!

 

[Dead3ye]

When logging into paypal and anywhere you go after logging in, if you see anything other than https:// (the "s" means secure) it's not paypal's site. They explain this in there information they put out.

 

[ddiccico]

<< Domain servers in listed order:
NS1.FROGSPACE.NET 216.65.12.140
NS2.FROGSPACE.NET 216.65.12.150 >>

They use the same web hosting co. that I use. If you want to complain to their ISP go here:
http://www.digitalspace.net/contactus/.

 

[JJordan]

Aw, Man, I just updated my CC information and now I learn this is a scam ... Damn It -- Now they will charge F#ck You's pay pal account (JoeF#ckoff@F#off.com) VISA account number 4444333322221111

What a crock of crapolla.

 

[Morpheux]

<< I received the below e-mail today from 'PayPal' regarding a bonus. It is a sham. look at the domain registry information. DO NOT LOGON!
Administrative Contact:
Secure, PayPal 123@cook.isl
1 First Ave
Paypal, SE 123 456
CK
456-789-1234

Quite a bit different isn't it? Anyway, do not allow yourself to be tricked by this e-mail if you get it. >>



Nice, really nice. I wonder how many people they will actually get from this. Thank for sharing your info. I just wish this was on the front page of MSN, Yahoo, and AOL for others who need it.

 

[LurkingInNC]

Here's the PayPal offer I got today; wonder if the scam is a take off on this:


Introducing the PayPal Visa!

$5 credit the first time you use your card*

1.9% Intro APR* on purchases

When you Send Money through PayPal using this credit card, you have no PayPal sending limits?

Cool, new look with clear, see-through card!

You'll have an online response in about 30 seconds.

? Use of the PayPal Visa is subject to the credit and cash limits on your credit card.
* The intro APR on purchases is for 2 or 3 billing periods after account opening,
depending upon account type.
For complete pricing information and important terms & conditions click here.

This PayPal notification for XXXX@YYYY.COM was sent because you selected to receive the PayPal Periodical newsletter and Product Updates. Members may specify the types of optional notifications they would like to receive from PayPal by logging in to their account and selecting "Preferences" under the Profile subtab. Please note changes in notification preferences may take several days to be reflected in our emailings. Replies to this email will not be processed.

If you previously asked to be excluded from Providian product offerings and solicitations, they apologize for this e-mail. Every effort was made to ensure that you were excluded from this e-mail. If you do not wish to receive promotional e-mail from Providian, go to http://removeme.providian.com.

Copyright© 2001 PayPal Inc. All rights reserved. Designated trademarks and brands are the property of their respective owners.

 

[Demonic]

This guy was close to pulling a well planned scam. Had he filled out the DNS lookup information with info that matches paypal he wouldn't have been cought for a long while.

 

[pecel]

Thanks.

Time to remind everybody about paypal.

 

[DanFungus]

I guess this is the NEW trend:


<< geezz... quite a scam... thanks for looking out! >>


Thanks for the info, and sleepyE will probably find out that the Mods are a little more strict than allowing people to use up the bandwith...lol