[Dshield] Another PayPal Account Scam

John Sage jsage at finchhaven.com
Wed Jun 11 13:25:27 GMT 2003


On Tue, Jun 10, 2003 at 03:48:30PM -0700, Kenneth Porter wrote:
> --On Tuesday, June 10, 2003 11:55 AM -0400 "James C. Slora, Jr."
> <Jim.Slora at phra.com> wrote:
> 
> > Another forged PayPal account information request is making the
> > rounds. This 
> > one uses an HTML form in the message to submit the victim's data to
> > ronaldhomepage.port5.com/post.php
> 
> Looks like the ISP took down the page.

I cc'ed the technical contact for the domain name early PDT Sunday;
maybe it had some effect..


"A variant of the PayPal scam I received this AM.

The principle sting seems to work via:

http://ronaldhomepage.port5.com/post.php

whois for port5.com:

Registrant:
Portland Communications Ltd (PORT48-DOM)
   3 Lyon Road
   Walton On Thames, Surrey KT12 3PU
   UK
   Domain Name: PORT5.COM
Administrative Contact, Technical Contact:
      Clements, Justin  (JC31547)sales at PORTLAND.CO.UK
      Portland Communications Ltd
      3 Lyon Road
      Walton On Thames, Surrey KT12 3PU
      UK
      01932 227234 fax: 01932 252569



- John
-- 
"Obviously, we do not want to leave zombies around."

See our exciting, all-new look! http://www.finchhaven.com/




More information about the list mailing list