2005-06-10 Another paypal scam
On a whim I decided to follow this one..
It linked to http://www.login-paypal-world.com
Interesting reply from whois:
No match for "LOGIN-PAYPAL-WORLD.COM".
But the gtld nameservers are more helpful:
login-paypal-world.com name server pdomns2.msn.com.
login-paypal-world.com name server pdomns1.msn.com.
And it points at:
www.login-paypal-world.com has address 220.127.116.11
Which is hosted by.. microsoft.
OrgName: Microsoft Corp
Address: One Microsoft Way
NetRange: 18.104.22.168 - 22.214.171.124
NetType: Direct Assignment
Yeah, email@example.com. I'd like a usable answer to my previous queries.
Anyway. Asking for it:
$ lynx -head -dump http://www.login-paypal-world.com
HTTP/1.1 302 Found
Date: Fri, 10 Jun 2005 16:30:50 GMT
P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
Expires: Sat, 01 Jan 2000 08:00:00 GMT
Later the forward stopped, but the page at the redirect is still up.
A nice redirect to 126.96.36.199 where they have built a complete mockup
of the paypal login page, with all the right buttons pointing at the right
places at paypal.
188.8.131.52 is at afrinic..
inetnum: 184.108.40.206 - 220.127.116.11
descr: ISP Cote d'Ivoire
status: ASSIGNED PA
Some ISP in Cote d' Ivoire (sometimes home to a certain kind of people
from Nigeria with interesting financial propositions)
$ lynx -head -dump http://18.104.22.168/www.paypal.com/account/index.html
HTTP/1.0 200 OK
Date: Fri, 10 Jun 2005 17:03:20 GMT
Last-Modified: Thu, 05 Aug 2004 16:15:48 GMT
The submit is to
which redirects to
This page looks like an 'error in your login data' page and asks for the
same login/password again. Funny is that they forgot to copy a pixel from
paypal or forgot to point at the right one, giving 404 errors and a somewhat
distorted page (in firefox).
$ lynx -head -dump http://22.214.171.124/en_US/i/scr/pixel.gif
HTTP/1.0 404 Not Found
Date: Fri, 10 Jun 2005 21:53:46 GMT
Content-Type: text/html; charset=iso-8859-1
The page submits the data to
Which redirects to (this is a pattern..)
Which gives an advert for a new 'immediate Paypal payment' option.
Another 'continue' button, which gets (using an 'onload' form)
with a bit about updated terms and conditions (loads of legalese. I did not
check for 'you just gave us access to all your paypal funds, thank you
very much' hidden in there).
And next comes up a page
(hey, I never clicked on one of those 'yes, I agree'
buttons..) asking for every last detail such as social security number,
mother's maiden name, drivers license, credit card number and pin for the
credit card. They do their identity theft seriously!
Oops, forgot to fill in the form. Wow, there is a real check for a CC number
in it (16 digits) and other checks for pin lenght, the works. I was not
in the mood to find nonsense values for those. So I asked for the handler at
which redirected to
"Your information submitted successfully! Your information will be
And a link to 'paypal home' at the real http://www.paypal.com/
Makes me wonder where all that information is sent..
the form name used is 'mailbomber' and a google search for 'paypal' and
'mailbomber' shows that this is a well-known script for paypal account