Please be sure to read my Spoof/Phishing Scams Home Page

Things I Did, Below

I, personally, receive email in HTML format. Since the email headers could be included, I did not "forward" the email to get the brief headers. The following was received (and looks) like I received it, with the following exceptions:

• Any notes I added in the actual letter are in square brackets ("[" "]"), are bold, red in color, and highlighted. If what I found "behind the links" (email or website) are different than what was displayed, I will include them in this type of note.
• Actual links in the email message have been changed to null (allowing them to still appear as links), have arrows pointing to them ("<=="), have been "named", and appear as one of "my notes" (bold, red in color, and highlighted). They are listed below the email example using the "names".
• All spelling, spacing, line-wrapping, and punctuation errors are the ones that appeared in the original received email. (I may or may not analyze some or all of these.) This email started with the HTML from the email I received. Most of the HTML and the look is original to the email (making this page non-standard HTML 4.01!)

Scam Example
Received 10/20/2007

PLEASE NOTE: PayPal and other online services and banks should NEVER require you to "click a link" in an email to go to their site. They may provide a text link (one you must cut-and-paste), but even these should ALWAYS go to the business' site, and to NO OTHERS. For your own safety, if you are a member of the business (or have an account there):

1. Go directly to the site itself (enter the business link - in this case: http:// www. paypal.com (type or cut-and-paste and remove the spaces))
2. Log in to your account
3. If what the email says is true, there should be some type of notification at either the main page, or on your account's login page.

BE SURE TO CHECK OUT ANY EMAILS LIKE THIS YOU GET!

[Please note: This whole page will not validate HTML 4.01, though it says it will at the bottom. The reason is because I cut-and-pasted the HTML from the email. -wds]

Email Headers

[DO NOT send email to any of the following email addresses]

Notes

Links from email, above: (This information is from the SOURCE of the email.)

• Image Sources:
  • PayPal Logo (header): http:// images.paypal .com/en_US/i/logo/email_logo.gif
  • PayPal Blue Line (below header): http:// images.paypal.com /images/bg_clk.gif and http:// images.paypal.com /images/pixel.gif
  • Blank line below PayPal Blue Line: http:// images.paypal.com /images/pixel.gif
  • Blank line below "... update your preferences here" and below/by "... including PayPal employees.": http:// images.paypal.com /en_US/i/scr/pixel.gif
• Links (behind the words):
  • Behind "https//: www. paypal.com" (2 places): http:// www. omegasante.com/logs/
  • Behind "Click here to update your account": http:// www. omegasante.com/logs/
  • Behind "log in": http:// www. omegasante.com/logs/
  • Behind "... update your links here": https:// www. paypal.com/us/PREFS-NOTI
• Link Behind Image:
  • Behind PayPal Header logo: https://www. paypal.com/us

Things to note in the links:

• Image Sources:
  NOTE: All of these images are located at "images.paypal.com", which is a subdomain of PayPal. I'm sure the spoofers copied an actual PayPal letter and changed the email and link addresses to fit their own needs... That what spoofers do, right?
  • PayPal Logo: Obvious what this is, huh?
  • PayPal Blue Line (below header): This is the banner across the top of the email, below the logo image. It is probably only large enough to hold the color involved (about 1px x 1px), and is used to fill in the space of the table cell. (Yes... These emails still use tables.)
  • Spacer: This is probably a single-pixel transparent GIF. All images can be expanded or shrunken online by defining the height and width. These are used throughout the letter, defined to the height needed at that point.
• Links (behind the words) and Link Behind Image:
  NOTE: ALL the links they WANT you to click are to the same place - http:// www. omegasante.com/logs/, OBVIOUSLY not a PayPal site link. This is why you need to know to where the links ... link. PayPal and other companies and banks you would receive this type of email from, have plenty of servers and would NOT have you link to a domain that was not one of their own. You must also be careful about those links with the name of the site in them, as spoofers will try to obfuscate their own names with the names of the emails they are spoofing. (See other examples.)
• Email link: The email link uses a Netherlands address. PayPal, while I'm sure they have locations and possibly websites in the Netherlands, would NOT be sending emails from there for people in the US.

Other "problems" and things I see:

• PayPal would NOT send an email to ME (in the US) from an obscure Netherlands email address. It would always be directly from their site, and would NOT include clickable links, especailly to a site that is NOT one of theirs.
• From the Email Headers:
  • All of the email addresses appear to be PayPal email addresses, except that in the Message ID field, to me, showng that the headers were spoofed.
  • There is no "TO" email address on this email, and the "BCC" is "showing" meaning it was probably sent to a mailing list. While there may or may not be a problem with my PayPal account (there isn't):
    • First, PayPal would include not only my email address, but my name, in the email to prove that it's from them.
    • Second, they would NOT use a mailing list (or, if they do, it only be used to send out individual/individualIZED emails).
• Speaking of that last point, there's NO WHERE in the email that mentions MY NAME.

As you can see, the email "looks" very official, but with a little checking BEFORE YOU CLICK A LINK OR REPLY, you can find inconsistencies that can save you from a world of hurt! (and empty bank accounts!)

---

Send comments/questions about this page to Bill Sanders at:

Go to Scams - Spoof/Phishing Scams Home page
Go to Scams - Spoof/Phishing Scams Examples Links

Send email to Bill Sanders ()
with questions or comments about this page or site.

This site, all text and graphics (unless otherwise noted) on it
were designed, developed and published by Bill Sanders of Orange Frog Productions.
It and it's CSS was validated and complies with both the: CSS and HTML 4.01 validators from W3C.
NOTE: All CSS validates except the "New Window Buttons" which include some invalid code (ie: hacks),
added PicoSearch Tables, and warnings for using transparent backgrounds when color foregrounds defined.
Copyright © 2003, 2004, 2005, 2006, 2007 by Bill Sanders / Full site last modified: October 21, 2006
Any reproduction, printing, or selling of this content is prohibited without express written consent from William D. Sanders.