***Caution***: Paypal Users - Page 8

ian@huth · 07-02-2005, 23:11

Quote:

Originally Posted by danielf

Just a thought: The second newsletter was sent out on 24-01-05. Could this have been compromised in any way to show the recipient list?

That's what I was wondering too. I gather that the second newsletter was emailed in batches to members. With members reporting different email IDs at the bottom of the PayPal email could it be that the email IDs related to the batches of newsletters sent out?

From what has been posted in this thread it would appear that the spammers have either got a list of email addys from the site server or from a source after newsletter emails have left the site server. Could another system that handled the newsletter emails be compromised and logging email addys going through it?

**Paul** · 07-02-2005, 23:32

Quote:

Originally Posted by danielf

Just a thought: The second newsletter was sent out on 24-01-05. Could this have been compromised in any way to show the recipient list?

Quote:

Originally Posted by ianathuth

That's what I was wondering too. I gather that the second newsletter was emailed in batches to members. With members reporting different email IDs at the bottom of the PayPal email could it be that the email IDs related to the batches of newsletters sent out?

No - vBulletin sends the e-mail seperately to each user, i.e. each one has only one addressee - that's why it's done in batches - because it floods the smtp process with 100's of e-mails.

Quote:

Originally Posted by ianathuth

From what has been posted in this thread it would appear that the spammers have either got a list of email addys from the site server or from a source after newsletter emails have left the site server. Could another system that handled the newsletter emails be compromised and logging email addys going through it?

That's an interesting thought - not likely once they have left the server as they are transferred direct to the receiving mail systems - but the servers mail system logs them - it's another thing to check.

It's unlikely we will ever know how - but a number of possibilities have been investigated and some changes made as a result.

nffc · 08-02-2005, 00:22

I still can't see [mind you I'm pretty suspicious anyway] how people fall for scam mails in massive quantities. It doesn't make sense to me.

Surely the common sense approach would be to load your own window and log in directly.

Gareth · 08-02-2005, 00:27

i can see how people would click a link instead of opening a new window, and that's one reason why phishing pays off and these people make so much money from the few hits they get.

nffc · 08-02-2005, 00:49

Quote:

Originally Posted by Gareth

i can see how people would click a link instead of opening a new window, and that's one reason why phishing pays off and these people make so much money from the few hits they get.

Yes, I understand that. But surely if the bank rang you and asked for your credit card details you wouldn't give them?

It's exactly the same concept, the common sense approach is to close the email, load up FF / IE etc- and log in manually.

Same as ringing the bank back or going in in person. Common sense to me.

At a loss · 08-02-2005, 00:58

Hello all

Right I got one of those mails and what seems strange to me is this

I use e-bay, I do not and have never had anything to do with paypal.
The mail account that is used for e-bay is not my primary one (main account)

I do not use the primary ntl e-mail account for anything HAS IN ANYTHING and my ebay mail account has no tyings with my ntl primary mail account.

So how the hell did this spam mail regarding pay pal come through my ntl primary mail box????????????????????????????

Richard M · 08-02-2005, 00:59

Just FYI, we are making some real progress on our own internal investigation.
As soon as we know the facts, we'll let you guys know asap.
Thanks for being so supportive.

Gareth · 08-02-2005, 01:00

yep, you & I would do that, bit I fear some users wouldn't be as naturally aware of the dangers (can't think of the right word to use.... beer is making my brain go all wobbly).

Similarly, Social Engineering shouldn't happen, but it does all too frequently.

nffc · 08-02-2005, 01:09

Quote:

Originally Posted by Gareth

yep, you & I would do that, bit I fear some users wouldn't be as naturally aware of the dangers (can't think of the right word to use.... beer is making my brain go all wobbly).

Similarly, Social Engineering shouldn't happen, but it does all too frequently.

don't worry, I feel hung over except two things:
- I've not touched alcohol for 1-2 weeks
- it's 1 am
:o

Shaun · 08-02-2005, 01:22

Just to add my name to the list of recipients, got it on a non paypal address thats only been used here.

SMHarman · 08-02-2005, 02:06

Quote:

Originally Posted by Gareth

yep, you & I would do that, bit I fear some users wouldn't be as naturally aware of the dangers (can't think of the right word to use.... beer is making my brain go all wobbly).

Similarly, Social Engineering shouldn't happen, but it does all too frequently.

I nearly fell for it, though if the pages had loaded I would probably have been suspicious of the address bar. Why? It went to my work email address, and that is changing soon, so in a carpe diem moment I was going to change my paypal email address and agree to the new terms. Clicking the link reminded me that this was something else that goes to this address.

etccarmageddon · 08-02-2005, 07:40

I just got an email offering a paypal atm/debit card paying 1.5% cashback - could be genuine but it has a link on it where you go to apply.

nffc · 08-02-2005, 08:18

Quote:

Originally Posted by etccarmageddon

I just got an email offering a paypal atm/debit card paying 1.5% cashback - could be genuine but it has a link on it where you go to apply.

Probably not genuine then.

banjo · 08-02-2005, 09:26

I received this e-mail and clicked on the link, I'm glad it did not work, so thank you for the info about this being a hoax, strange thing is I do not have a paypal account so where did they get my address from ?

Andy E · 08-02-2005, 10:37

I have received one ...sent to the email addy i use for registering on here and other forums.

Andy E
ntl pirate