***Caution***: Paypal Users
 

Those who use Paypal may of been recently sent a suspicious looking email.

The title of this email may say:- 'User agreement has been changed [16532]'

And the beginning of the email starts with:-

You may notice that 'several important changes' has been hyperlinked, hovering over this link you will see that it links to an ip address and gallery/items/.1/ proceeds the IP. Other links in the email link to this location.

Warning: Do not click any of the links contained in this email. Please do not enter any personal or financial information into this website. The link(s) in this email are not a registered URL authorized or used by PayPal. Paypal have been notified and have confirmed that such an email was not sent by them and they are currently investigating this incident fully.

For further information regarding the security of your paypal account visit:-

https://www.paypal.com/cgi-bin/websc...curity-outside

Re: ***Caution***: Paypal Users
 

I got this email, how the hell did they get an email address that I've never given to anyone?

Re: ***Caution***: Paypal Users
 

I just got one as well, good job I noticed the link address :mad:

Re: ***Caution***: Paypal Users
 

That is actually a very good question. :erm:

Re: ***Caution***: Paypal Users
 

one I got was dated 1/1/1970 ?

Re: ***Caution***: Paypal Users
 

Me too. Trashed it straight away.

Re: ***Caution***: Paypal Users
 

I had one and it might have worked if they had managed to get the dates right I noticed that they we saying that
"until they agree to the new User Agreement, or until January 31, 2005, whichever comes first."

That and fact that the from address is Nobody [nobody@vulcan.cybexhost.com]; on behalf of; [service@paypal.com].

Have they been hacked ?

Scarlett.

Re: ***Caution***: Paypal Users
 

I just got it as well - VERY convincing except when you click on the links within the email which go to an IP address and also hang.

Re: ***Caution***: Paypal Users
 

I just got one this morning. All i do is forward them to spoof@paypal.co.uk
Weather it helps or not i don`t know.

Re: ***Caution***: Paypal Users
 

I got one too, but again they made a fatal error. They sent it to an e-mail addy that doesnt have a paypal account and not the one that does. hehe
shame the links didnt work as i was going to give them some bogus data

Re: ***Caution***: Paypal Users
 

got one too...luckily gmail highlighted it in red and said not to open it, so i just deleted it :)

Re: ***Caution***: Paypal Users
 

I sent mine to Paypal and they replied as follows....

Re: ***Caution***: Paypal Users
 

Just got the e-mail this morning........

Re: ***Caution***: Paypal Users
 

Good point. I have my own domain so every time I sign up to a site, I use the name of the site @ mydomain as my e-mail address. This helps me track which sites share my e-mail address when I start receiving spam. When I signed up here, I used nthellworld@<mydomain> as my e-mail address. When I received the paypal e-mail this morning, it was addressed to nthellword@<mydomain>

Has somebody managed to get hold of the nthellworld user database? I have checked my public profile and my e-mail address isn't shown there. Likewise it isn't shown in my posts.

It seems very unlikely that somebody would have guessed the above address!

Mags

Re: ***Caution***: Paypal Users
 

I've been sent the e-mail to the address that I used to register on this forum, & I have no paypal account.

Re: ***Caution***: Paypal Users
 

Nanook, have you used that email account for any other purpose too?

Re: ***Caution***: Paypal Users
 

:erm: Loads :)

Re: ***Caution***: Paypal Users
 

It came to an email address of mine I've only used to register here, which also never had a paypal account registered to it.

Re: ***Caution***: Paypal Users
 

Can someone get the headers from this e-mail and post them here

Re: ***Caution***: Paypal Users
 

Return-path: <nobody@vulcan.cybexhost.com>
Envelope-to: XXXX@XXXX.CO.UK
Delivery-date: Mon, 07 Feb 2005 05:02:47 +0000
Received: from sean by kestrel.i-webserver.co.uk with local-bsmtp (Exim 4.44)
id 1Cy12s-0008UE-Ik
for XXXX@XXXX.CO.UK; Mon, 07 Feb 2005 05:02:46 +0000
Received: from [67.18.153.146] (helo=vulcan.cybexhost.com)
by kestrel.i-webserver.co.uk with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.44)
id 1Cy12s-0008UA-EV
for XXXX@XXXX.CO.UK; Mon, 07 Feb 2005 05:02:46 +0000
Received: from nobody by vulcan.cybexhost.com with local (Exim 4.43)
id 1Cy12p-0002kO-PQ
for XXXX@XXXX.CO.UK; Sun, 06 Feb 2005 23:02:43 -0600
To: XXXX@XXXX.CO.UK
Subject: User agreement has been changed [418757]
From: service@paypal.com
Reply-To: service@paypal.com
Errors-To: service@paypal.com
Date: 2005-02-06 23:02:43
Content-type: text/html; charset=iso-8859-1
Message-Id: <E1Cy12p-0002kO-PQ@vulcan.cybexhost.com>
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - vulcan.cybexhost.com
X-AntiAbuse: Original Domain - XXXX.CO.UK
X-AntiAbuse: Originator/Caller UID/GID - [99 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - vulcan.cybexhost.com
X-Source:
X-Source-Args: /usr/local/apache/bin/httpd -DSSL
X-Source-Dir: chuppasito.org:/public_html
X-Spam-Status: No, score=2.9 required=5.0 tests=FORGED_RCVD_HELO,HTML_30_40,
HTML_MESSAGE,INVALID_DATE,MIME_HEADER_CTYPE_ONLY,M IME_HTML_ONLY,
NORMAL_HTTP_TO_IP,NO_REAL_NAME,URIBL_SBL autolearn=no version=3.0.2
X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on
kestrel.i-webserver.co.uk
X-Spam-Level: **

Re: ***Caution***: Paypal Users
 

__________________

Re: ***Caution***: Paypal Users
 

I also got the Paypal email this morning and it came via a SpamGourmet email address that I only ever used to register on this board as well. I don't think that anyone could have got the email address from anywhere other than the NTHW user database - the email address has never been published online and isn't public in my profile. I emailed the NTHW administrators this morning but I haven't heard anything yet.

Re: ***Caution***: Paypal Users
 

I have also received one today and I do not have a PayPal account.

Church Mouse :shocked: :mad:

Re: ***Caution***: Paypal Users
 

It's been received. We are looking into it ..:)

Re: ***Caution***: Paypal Users
 

Ditto .. I,ve never had a paypal acct and havent logged on here for months. I looks like a phishing scam from somone who has got the ntlhellworld e-mail liost. Could it be the .COM list? of the .co.uk one ?

Barnicle

Re: ***Caution***: Paypal Users
 

This mail...

Re: ***Caution***: Paypal Users
 

Thanks Nemesis.

Re: ***Caution***: Paypal Users
 

No idea, not a question I can answer for sure, I (and I'm sure others) want to find out though.

Re: ***Caution***: Paypal Users
 

I got this too this morning.

Noticed that the PayPal Email ID at the bottom of my email is different to that of SMH.

Re: ***Caution***: Paypal Users
 

No Paypal account here either and it's sent a mail to my work account, although a few million people worldwide also know it.

I've kept a copy in case anybody needs anything from it.

Re: ***Caution***: Paypal Users
 

mine was "PayPal Email ID PP18794"

Re: ***Caution***: Paypal Users
 

I have just made things much easier about this.
I removed my credit card details then cancelled the account.

Re: ***Caution***: Paypal Users
 

Same as mine.

Re: ***Caution***: Paypal Users
 

As one that has several servers located in this datacentre they are very strict about this sort of fraud a quick email to abuse@theplanet.com and it will soon be closed down.
Try and enclose all relevent info eg. headers etc

Re: ***Caution***: Paypal Users
 

Mine was : 'PayPal Email ID PP91817'

Re: ***Caution***: Paypal Users
 

Yours was the same as SMH then. Mine was "PayPal Email ID PP91817".

Re: ***Caution***: Paypal Users
 

Didn't he make pinocchio?? :)

Re: ***Caution***: Paypal Users
 

i pressed the link but didnt enter any data. Is that safe?

Re: ***Caution***: Paypal Users
 

Perhaps the mail lists source they got the addresses from?

Re: ***Caution***: Paypal Users
 

As safe as following any other link, as long as you didn't enter any data.

Re: ***Caution***: Paypal Users
 

Nah, that was Walt Disney :)

Re: ***Caution***: Paypal Users
 

Nope - but it lists the sending server.

Re: ***Caution***: Paypal Users
 

Just out of curiousity, is NTHW Ltd registered under the DPA?

Re: ***Caution***: Paypal Users
 

I got this and I use a e-mail i never give out so why the goddam hell have they got it.

Re: ***Caution***: Paypal Users
 

I dunno, but have any Admin been on holiday or bought any new cars recenty...? :jk:

Re: ***Caution***: Paypal Users
 

i got one to. e mail id pp92713

Re: ***Caution***: Paypal Users
 

oops:
What an idiot.
I forgot that this is how I pay for my I-web account so it got em both cancelled... lol
I bet KP & Caspar are laughing thier socks of at this idiot...:D :D

Re: ***Caution***: Paypal Users
 

i have recieved this email too, but its not the address i registered with paypal, its the one i have used on here and nowhere else :erm:

in fact, i have recieved two diffarent types of paypal spam :erm:

Re: ***Caution***: Paypal Users
 

I got this as well. again to an address that does not have a paypal account, also get a lot about Halifax accounts but again I do not have an account there. so really obviously dodgy

Re: ***Caution***: Paypal Users
 

I have 2 email addresses, one hotmail that gets everything sent to (and I mean everything, all the spam under the sun).
And an ntlworld one wich has only been used once to register for ebay (Not paypal, that is on my hotmail address).
I only noticed it because they emailed the wrong account though I am a little confused that they managed to miss my hotmail account.

Re: ***Caution***: Paypal Users
 

Was the email delivered to the address listed under your profile here?

Re: ***Caution***: Paypal Users
 

I was going to say no but come to think of it thats where all my emails regarding post replies etc get sent to so yes it must be registered here.

Re: ***Caution***: Paypal Users
 

Ive got the email to!!! Just wondering could a mod add a poll so we can see if there is anyone on the forum thats has not had this email!!

Cheers

Re: ***Caution***: Paypal Users
 

I got the email as well, to the address that I use for this forum.

Re: ***Caution***: Paypal Users
 

Just to reassure anyone's curiosity, the team has nothing to do with this email and we do not share your details with anyone.

Re: ***Caution***: Paypal Users
 

I've had 3 over the last month

Re: ***Caution***: Paypal Users
 

I'm sure nobody assumes that our details have been shared willingly (I certainly don't), but from what I use of MySQL & Cpanel, I can't see (without guessing the Cpanel or database username and password) how they'd have got our details (which clearly they have somehow) unless there's some form of worm that affects MySQL/Apache, I know there's one that propogates via windows using system dll's but I've not seen one that'll do the business under Apache.

Re: ***Caution***: Paypal Users
 

it looks like its something to do with this forum!!! the mail came to cableforum@my domain, and i have only used that address to register here :( :(

Re: ***Caution***: Paypal Users
 

We're looking in to this as we speak.

Re: ***Caution***: Paypal Users
 

I used to have a account here with mac (which i have since changed to gmail) anyway i set up aliases with this account for each site i joined. I got a item of spam/phising (i honestly cant remember) from the CF email....

Although i have had much worse on other forums

Although i seriously do not belive it has anything to do with anyone on the staff or hhosting :)

Re: ***Caution***: Paypal Users
 

All signs do point towards this forum having unintentionally been the source for them obtaining our mail addresses. Although, I'm sure everyone would agree that this happened unlawfully and that no admin would have willingly made these details available.

Re: ***Caution***: Paypal Users
 

I've got two of them,one to my Gmail addy which I have never used with my Paypal account because there was NO Gmail when I set up the Paypal account.Gmail picked it out a a suspect phishing exercise and invite me to report it which I did.Excellent service at Gmail.

Yesterday I got one with details of my expired card at Paypal to my old NTL addy which I sent to spoof@paypal.com to be told it was real .Last week I sent another to spoof@paypal which was fake.It is going to affect peoples confidence in certain sites and services I'm afraid.

Cloudmarks Safety bar treated this one as Spam so I guess they have sent out too many of them and the Cloudmark community have considered them spam too.

Frankly I'm more than glad to abandon Paypal after reading some of the online info about them.I never used it more than twice anyway.Same goes for Ebay. :mad: I no longer trust them either.

Re: ***Caution***: Paypal Users
 

How could they have gotten into the database? Also if they did what are the chances of them getting my password for this site?

Re: ***Caution***: Paypal Users
 

Pretty much impossible I'd say - not even WE have access to your password.

Re: ***Caution***: Paypal Users
 

passwords usually tend to be stored encrypted, with a one way algorithm, so that when you put your password in, it is encrypted and then checked with the stored one - it's difficult to work your way backwards

Re: ***Caution***: Paypal Users
 

ok, cool. I changed my password on all important sites anyway, had it for over a year :Yikes:

Re: ***Caution***: Paypal Users
 

well i don't have a paypal account and i got one of these emails to my address that is on here :dozey: :confused: :disturbd: :Yikes:

Re: ***Caution***: Paypal Users
 

HE was taking about passwords, not email. It seems someone has gotten the forums email list.

Re: ***Caution***: Paypal Users
 

I haven't had it in any of the umpteen addies I have BTW.

I'm sure, unless it's got hold of a forum list or something [which reading the thread could be possible] they just generate random addies and hit gold sometimes...

Although, if it had got the forum list, I would have got one...? :confused:

BTW, I don't use Paypal, it's too dodgy- too many scams IMO.

Re: ***Caution***: Paypal Users
 

Very curious, it came to my cableforum address, one like Richard I have never given out.

Re: ***Caution***: Paypal Users
 

If it helps. or means anything, I've NOT had one, at least not yet, but I seem to recall reading something about a MySQL exploit which might be relevant - I'll have a sniff round.

Re: ***Caution***: Paypal Users
 

I doubt it, this time it feels different.
__________________

No need, that affected Windows only and we have the MySQL socket closed at the firewall.

Re: ***Caution***: Paypal Users
 

http://www.theregister.co.uk/2005/01/28/mysql_worm/

I think it was this one - but it only affects Windows - is CF hosted on Windows?

[Edit] beat me to it!
__________________

If not already thought of, a warning e-mail to all registered users might be an idea?

Re: ***Caution***: Paypal Users
 

Hi,

I have also received this mail and i do not have a PayPal account!

Re: ***Caution***: Paypal Users
 

I have also been sent the e-mail to the address that I used to register on this forum, & It has no paypal account connected with it.

:Yikes: :confused:

Re: ***Caution***: Paypal Users
 

We need to be sure of the facts first.
We recently hired a security company to do an audit of the server and they found no problems FYI.

Re: ***Caution***: Paypal Users
 

Zero chance - passwords are double encrypted with a one way encryption system.
__________________

It does appear that these were somehow sent to the e-mail addresses that people have on the forum. We have checked the server out and found nothing that would indicate how they might have been obtained. It also does not appear to have gone to everyone, only a select number.

Just in case, I spent some time earlier today changing all our database and server passwords.

Another thing we can't tell is how old the addresses they appear to have used are - it could be that they date from a month or more ago, making it almost impossible to ever know how they may have been obtained.

Basically we have investigated as much as we can, and taken all the measures we can think of. I can 100% assure everyone that we have not willingly, or knowingly, given anyones forum e-mail address out to anyone, nor will we do so in the future.

Re: ***Caution***: Paypal Users
 

my email address is nowt like my CF ID and there's no way a random generator would have come up with it!

so chances are someone got the list by hacking into the database?

Re: ***Caution***: Paypal Users
 

There does appear to be something fishy here, i've never had spam on the e-mail addy i use for this site until now.

And then we all seem to be getting this mail.

So - somethings going on.

Re: ***Caution***: Paypal Users
 

My address is the same. It's slightly unusual and I never use it to give it out.

Re: ***Caution***: Paypal Users
 

I received one of these this morning. My email addy has only been active for 36 days and this is the first spam I have received on it. My headers are slightly different:I have tried informing seeitout.com but, so far, there has been no response.

Re: ***Caution***: Paypal Users
 

I suppose if anyone is really worried about this, they can change their email & password in the CP

http://www.cableforum.co.uk/board/pr...o=editpassword

- I know that is 'after the horse has bolted', but for people who have used an address unique to registration on this forum, it should prevent any future phishing attempts using that addy.

My message came through on my cable forum registered addy - but I do use it elsewhere, so no big - I'm glad i forward my mail to gmail, though - it had put the message in the spam folder, marked as a possible problem, just like Incog's :tu:

Re: ***Caution***: Paypal Users
 

It was picked up as spam in OE by Spamnet(best money I've ever spent) and by Gmail an excellent free service.

Re: ***Caution***: Paypal Users
 

Add my name to the list, I just got rid of it via Mailwasher.
The one and only time I have used Paypal is for donations to a certain web site. ;)

Re: ***Caution***: Paypal Users
 

The member posting in post 15 received the email and has joined on 15-01-05 (according to his/her profile), so the list cannot be more than 3 weeks old. If others who joined later and got the email would say so, it may be possible to narrow it down further?

BTW, I got one as well, to the address I used for this site, and I have never had a paypal account.

Re: ***Caution***: Paypal Users
 

I've had two emails as well, one to an email address that I gave to a friend who registered here but has never posted and one that is defo mine that I use here :shrug:

TBH I'm getting right fed up of these emails, if I ever get my hands on the scrote who's doing this :knock: :knock: :knock:

Re: ***Caution***: Paypal Users
 

Just out of interest I thought I would check my hotmail addy which I NEVER use but is in my profile as my MSN messenger name(as is my Yahoo Addy for Yahoo Messenger).I do not thus far have any paypal spam in hotmail. :tu:

It's all hotmail spam instead :D

Re: ***Caution***: Paypal Users
 

Just a thought: The second newsletter was sent out on 24-01-05. Could this have been compromised in any way to show the recipient list?

Re: ***Caution***: Paypal Users
 

I thought I'd add my name to the list of people that have had this email. I got one today and it is the first spam since I came back to ntl.

Re: ***Caution***: Paypal Users
 

I wonder they is a link between the paypal donate feature and the spam

Re: ***Caution***: Paypal Users
 

I haven't got it...
__________________

...nor have I ever registered for e-mail notifications on any threads???

Re: ***Caution***: Paypal Users
 

I've checked with various other people at work with NTL broadband and on the company domain and nobody else has got this e-mail.

Also got other e-mail address on various domains some with associated paypal accounts and some without - none of these got this message.

Header Included
Edit : [EMAIL REMOVED] for my peace of mind and to stay away from more spam :)

Re: ***Caution***: Paypal Users
 

None whatsoever.

Re: ***Caution***: Paypal Users
 

This has just put me off from ever ordering through Ebay or ever using paypal in my life ever again, while that may be overreacting it is keeping my finances sorted and my mind calm, with things like this happening it could soon shove me into trouble financially.

Re: ***Caution***: Paypal Users
 

I don't think you edited out your email addy properly ;)

Re: ***Caution***: Paypal Users
 

Think you must have just caught me in the second round of edits :)

Better now?

Re: ***Caution***: Paypal Users
 

This is a mystery. Why target this forum?

Re: ***Caution***: Paypal Users
 

got one here too first thing this morning

1. looked dodgy anyway
2. and as stated before the date was botched to 1970

me clamav on my mailserver spotted it as a phising attempt too :)

Re: ***Caution***: Paypal Users
 

Because we are a fairly high profile site with a large user base made up of the general population, not just techy people etc - people from all over the UK.

Re: ***Caution***: Paypal Users
 

yes :tu: