Western Union/EBay/Paypal Scam Email

GtPrOjEcTX

Lifer
Jul 3, 2001
10,784
6
81
Copy of email from "service@westernunion.com"

Dear Western Union User,

Please log into your Western Union account using the following link to confirm you are still an active Western Union user asap.

This is our new yearly checkup process to screen any inactive accounts.

http://www.westernunion.com/validation/requser.cgi

Thankyou for your co-operation.

Regards
Western Union Support

Just out of curiousity I checked the site www.westernunion.com and it looks legit, but going to this link brings up a blank page. Tried it again and a screen popped up for an 1/8 of a second and had a status indicator bar deal that zipped right through.

Anyone have any ideas about this?

edit: I've now received 4 of this same email...

got another one from "paypal"...

Dear PayPal Member,

Please log into your PayPal account using the following link to confirm you are still an active PayPal user asap.

We are now requesting the password to the e-mail address you signed up to PayPal with. This is so our systems can confirm the confirmation e- mails off PayPal stay in your account because there has been a rise in the amount of fraudsters getting access to users e-mail addresses and deleting the Paypal confirmations. This is to protect you and ourselves. PayPal will use this information for fraud protection only.

Please do not edit any details.

This is our new yearly checkup process to screen any inactive accounts.

https://www.paypal.com/cgi-bin/webscr?cmd=_login- run

Thankyou for your co-operation.


Regards
PayPal Support


----

the link takes you to http://213.122.4.120. Be aware
 

So

Lifer
Jul 2, 2001
25,921
14
81
[magic 8 ball]Signs point to yes[/magic 8 ball]

I would be suspicious - does the link really go to the Western Union website when you click it?
 

GtPrOjEcTX

Lifer
Jul 3, 2001
10,784
6
81
alright, got another one, from westernunion again...

Dear Ebay User,

If your feedback is 1000+ and you still use ebay please log into your Ebay account using the following link to confirm you are still an active Ebay user.

This is a security measure due to people fraudulently using high feedback account.

http://cgi3.ebay.co.uk/aw-cgi/eBayISAPI.dll?SignIn

Thankyou for your co-operation.

Regards
Stu Brown
eBay, UK

 

gopunk

Lifer
Jul 7, 2001
29,239
2
0
wth that's hella weird... why would they send you a legit link? it is a plain text email, right?
 

MrBond

Diamond Member
Feb 5, 2000
9,911
0
76
Originally posted by: GtPrOjEcTX
update, not a plain text email, I thought it was, looked at the source and found it sending me to http://213.122.4.120.
This is what I found doing a whois lookup on that IP:

inetnum: 213.122.0.0 - 213.122.255.255
netname: BT-IMSNET
descr: BT-IMSNET
country: GB
admin-c: BS1474-RIPE
tech-c: BS1474-RIPE
status: ASSIGNED PA
remarks: Please send abuse notification to abuse@btinternet.com
mnt-by: BTNET-MNT
mnt-lower: BTNET-MNT
mnt-routes: BTNET-MNT
changed: support@bt.net 20000711
changed: preston.dialip@bt.com 20010523
changed: preston.dialip@bt.com 20010628
changed: preston.dialip@bt.com 20020907
source: RIPE

route: 213.120.0.0/14
descr: BT Public Internet Service
origin: AS2856
remarks: Please send abuse notification to abuse@bt.net
remarks: PLEASE DIRECT ALL QUERIES TO support@bt.net
mnt-by: BTNET-MNT
changed: support@bt.net 20000607
source: RIPE

role: BTnet Support
address: 154 St Albans Rd
address: Sandridge
address: St Albans
address: Hertfordshire
address: AL4 9NH
address: GB
phone: +44 1189 512313
e-mail: support@bt.net
trouble: support@bt.net
admin-c: FLS15-RIPE
tech-c: BS1474-RIPE
nic-hdl: BS1474-RIPE
remarks: For all queries contact support@bt.net
mnt-by: BTNET-MNT
changed: preston.dialip@bt.com 20010613
changed: support@bt.net 20011112
changed: preston.dialip@bt.com 20020430
source: RIPE



 

TNTrulez

Banned
Aug 3, 2001
2,804
0
0
Anyone who gives out the password to his email/financial institutions on an email request deserves to be scammed.