Database Info

FRAUD PAYPAL EMAIL SAMPLE: BE CAREFUL !!!!!

I have a Paypal account and I buy a lot of stuff from eBay. My account is connected to my Yahoo email; it used to be with my office email but sometimes our firewall treats Paypal emails as spam.
Anyway, I checked my Yahoo account yesterday and there was a notice that I sent payment of 395.85USD to someone for buying an Omega Constellation Watch (must've been a fake watch that one ). Scrolling down the message there was an area which asked if this transaction is not authorized; I should click on the Problem Resolution Center. I clicked on it and the website appeared which definitely looked like Paypal. It asked me to log in; which I did. The next step was that it asked for my First Name, Last Name, Credit Card info, etc. This actually struck me as being strange. Since I had a Paypal account, logging in automatically tells the website who I am and what my personal details are.
What I did was immediately logged out. I then logged in again and changed my password and secret question (when you forget your password this one prompts you). Logged out again, then logged in and checked my history or activity. It showed that there was no purchase done on the said date (when I supposedly bought a watch). I forwarded the suspect email to: 'sp[email protected]' for them to clarify and investigate for me. I also checked with my credit card company and thankfully they said that there was no activity related to the case I described.
This morning I checked my Yahoo email and Paypal responded saying that they have verified the email to be a fake. The first point is that Paypal will never address you as "Dear Member or Dear Paypal Member". The second point is that there was a difference in the URL used by the fraud link. For those of you who use Paypal; please take some time off and read a little more on this. There's a "Contact Us" section, from there you can type "Fraud" in the search field. A topic saying "How do I differentiate between a fake and authentic email from Paypal" (or something like that).
Lastly, Paypal said that if I did fill out the information requested by the fraud URL; chances are my credit card info would have been obtained and who knows what can happen. I'm sending you a copy of the email I received. PLEASE TREAT THIS AS REFERENCE ONLY. DO NOT COPY OR CLICK ON ANY LINKS.
Cheers
Rob
------------------------------------------------------------------------
--------------------------------------------------------------------------
PayPal <[email protected]>" <[email protected]> Add to Address Book Add Mobile Alert
Subject:
Your payment has been sent to [email protected]
Date:
Tue, 10 Jan 2006 20:20:01 -0700
Dear PayPal Member,
This email confirms that you have paid OMEGAMOVE ([email protected]) $395.85 USD using PayPal.
This credit card transaction will appear on your bill as "PAYPAL OMEGAMOVE".
--------------------------------------------------------------------------------
PayPal Shopping Cart Contents
Item Name:
Omega Constellation Men Watch - mint
Quantity:
1
Total:
$380.85 USD
Cart Subtotal:
$380.85 USD
Sales Tax:
$15.00 USD
Cart Total:
$395.85 USD
--------------------------------------------------------------------------------
Shipping Information
Shipping Info:
James Dickinson
184 Hadley Dr.
Chicago, IL 60614
United States
Address Status:
Unconfirmed
--------------------------------------------------------------------------------
If you haven't authorized this charge, click the link below to cancel the payment and get a full refund.
Dispute Transaction
--------------------------------------------------------------------------------
Thank you for using PayPal!
The PayPal Team

First: check on which domain you are checked.
Most fraud email don't link to real sites.
However: you see good link for example http://www.paypal.com/authorize.html in email, but when you hover over the link, below your good email client you can see real link in status bar, for example http://paypal.proof.nu/auth/login.php or so. Or strange ipnumber http://12.31.78.2/paypal/auth.html.
(links are not real - just for example, no need to clicking!!!!)
Yes, don't look blindly on words on the email. Look always behind the emails: which real links are here used? Is there not extra words used, is grammar okay, and looks altijd first on official sites if there is indeed happens. If there is indeed such information available then you can look further. If there is warning about fake emails, trash the email immediately or forward to paypal site for examining fraud links.
Such strange links are not linked to www.paypal.com. That is why you must always check the real links where you going to.
And when the fraud email links real to www.paypal.com site, then is fraud email useless.
Full image fraud emails are almost fake. You can always trash them.

Similar thing happened to me with an Amazon spoof site. Of course, the email was in HTML and the link redirected me to another site that asked me to sign in and then give credit card details. It looked very convincing indeed. This was the first time I'd ever received such a thing and it nearly caught me off guard but luckily I realised at the last moment that it was illegal 'phishing' activity. I'm not sure who to report this to though, Amazon, or a more authorative body like the police? See the attached images for what the site/email looked like.
Regards,
Neil.

thanks for the info

PayPal Example
mrdummy - You had some great points.
I just came across an interesting example of a PayPal fraud email.
The email had this from header...
"From: [email protected] ([email protected]) "
If you look at the domain name... [email protected] "ACCOUNTS-PAYPAL.COM", you can see that it's not from paypal.com. That's the best way to determine whether or not it's spam email.
GMail does a great job of helping you determine this. This email wouldn't have even showed up in your spam box since GMail wouldn't have accepted it because it's claiming to be from "paypal.com" and it's actually from "accounts-paypal.com".
Other good email fraud tips.
GMail will also put a little key next to the sender's name if it is a legitamate email... atleast in PayPal's case.

[Q] Email From Android Team - Your New Nexus S?

I received the following email from the Android Team:
Code:
Google and Samsung have partnered to bring you Nexus S, a pure Google experience phone. Learn more:
Register your Nexus S for access to premium support from Samsung
Visit our Nexus S Help page for a full list of help resources
Watch Nexus S on our YouTube channel
Once registered, you can contact Samsung directly at +1 855-EZ2NEXUSS (+1 855-392-6398) for support.
Sign up to to receive updates and promotions about Nexus S.
Enjoy!
The Android Team at Google
Google, Inc.
1600 Amphitheatre Parkway
Mountain View, CA 94043
We sent you this one-time welcome message because you recently purchased a Nexus S phone.
Headers as follows:
Code:
Delivered-To: ***@gmail.com
Received: by 10.204.51.67 with SMTP id c3cs366621bkg;
Wed, 29 Dec 2010 18:20:40 -0800 (PST)
Received: by 10.213.4.11 with SMTP id 11mr13393881ebp.3.1293675637217;
Wed, 29 Dec 2010 18:20:37 -0800 (PST)
Return-Path: <[email protected]>
Received: from smtp-out.google.com (hpaq9.eem.corp.google.com [172.25.149.9])
by mx.google.com with ESMTPS id w12si37783344eeh.80.2010.12.29.18.20.37
(version=TLSv1/SSLv3 cipher=RC4-MD5);
Wed, 29 Dec 2010 18:20:37 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 172.25.149.9 as permitted sender)
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 172.25.149.9 as permitted sender) [email protected]
Received: from hpaq13.eem.corp.google.com (hpaq13.eem.corp.google.com [172.25.149.13])
by smtp-out.google.com with ESMTP id oBU2KapI023716
for <***@gmail.com>; Wed, 29 Dec 2010 18:20:36 -0800
Received: from iye7 (iye7.prod.google.com [10.241.50.7])
by hpaq13.eem.corp.google.com with ESMTP id oBU2KZTL013972
for <***@gmail.com>; Wed, 29 Dec 2010 18:20:36 -0800
Date: Wed, 29 Dec 2010 18:20:35 -0800
Message-Id: <[email protected]>
Received: by iye7 with SMTP id 7so15419857iye.0
for <***@gmail.com>; Wed, 29 Dec 2010 18:20:35 -0800 (PST)
Received: by 10.231.206.17 with SMTP id fs17mr5593034ibb.8.1293675635443;
Wed, 29 Dec 2010 18:20:35 -0800 (PST)
To: <***@gmail.com>
Content-Type: multipart/alternative; boundary="===============0361350100952046111=="
MIME-Version: 1.0
Subject: Welcome to Nexus S
From: Android Team <[email protected]>
I have not ordered a Nexus S, as I don't think it works on AT&T right now. I currently have a Samsung Captivate. I was wondering if I should try to call the number listed in the email to ask about it.

Could be wrong, but looks dodgy to me??

hmm... is hard to tell, but it's suspicious indeed

I don't think it's suspicious, just a glitch. I got this same exact email shortly after activating my Nexus S.
Probably what happened was Samsung gave your Captivate an IMEI from the same block they were using for the Nexus S. At some point Google auto-generated the email thinking you had a Nexus S.

I was kinda excited there for a minute, thinking I would be getting a free phone. But I thought the same thing, that it was some sort of glitch, seeing as I had just got off the phone with Samsung support.

I also got the email. I did notice I received it after flashing a gb rom. Not sure if that has anything to do with it. But it couple be an answer ha
Sent from my Gingerbread HERO200 using XDA App

I got one as well, after flashing the oxygen 2.0 RC4 rom to my Desire

Or your GF might have ordered that as a gift without thinking that u r an ATnT sub

Google and Samsung have partnered to bring you Nexus S, a pure Google experience phone. Learn more:
Register your Nexus S for access to premium support from Samsung
Visit our Nexus S Help page for a full list of help resources
Watch Nexus S on our YouTube channel
Once registered, you can contact Samsung directly at +1 855-EZ2NEXUSS (+1 855-392-6398) for support.
Sign up to to receive updates and promotions about Nexus S.
Enjoy!
The Android Team at Google
Google, Inc.
1600 Amphitheatre Parkway
Mountain View, CA 94043
Click to expand...
Click to collapse
Now this email had a link to "Register your Nexus S", which was dead. Nice.
I click the second "once registered" link, which worked, and brought me to the Samsung registration page. Great, or so I thought. But because the site only acknowledges US addresses, and I'm here in Canada, I couldn't enter my address. Sweet! So I enter a friends US address instead and move on.
Then the registration page asks for the handsets IMEI, so I enter mine, and the site says my IMEI is invalid. I checked it 3 times, and it was right.
Bottom line, I couldn't register my handset, and as a result I feel Samsung may be functionally retarded. Yeah, I guess I could call them, but why the hell should I have to? lol

Ethere said:
I received the following email from the Android Team:
Code:
Google and Samsung have partnered to bring you Nexus S, a pure Google experience phone. Learn more:
Register your Nexus S for access to premium support from Samsung
Visit our Nexus S Help page for a full list of help resources
Watch Nexus S on our YouTube channel
Once registered, you can contact Samsung directly at +1 855-EZ2NEXUSS (+1 855-392-6398) for support.
Sign up to to receive updates and promotions about Nexus S.
Enjoy!
The Android Team at Google
Google, Inc.
1600 Amphitheatre Parkway
Mountain View, CA 94043
We sent you this one-time welcome message because you recently purchased a Nexus S phone.
Headers as follows:
Code:
Delivered-To: ***@gmail.com
Received: by 10.204.51.67 with SMTP id c3cs366621bkg;
Wed, 29 Dec 2010 18:20:40 -0800 (PST)
Received: by 10.213.4.11 with SMTP id 11mr13393881ebp.3.1293675637217;
Wed, 29 Dec 2010 18:20:37 -0800 (PST)
Return-Path: <[email protected]>
Received: from smtp-out.google.com (hpaq9.eem.corp.google.com [172.25.149.9])
by mx.google.com with ESMTPS id w12si37783344eeh.80.2010.12.29.18.20.37
(version=TLSv1/SSLv3 cipher=RC4-MD5);
Wed, 29 Dec 2010 18:20:37 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 172.25.149.9 as permitted sender)
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 172.25.149.9 as permitted sender) [email protected]
Received: from hpaq13.eem.corp.google.com (hpaq13.eem.corp.google.com [172.25.149.13])
by smtp-out.google.com with ESMTP id oBU2KapI023716
for <***@gmail.com>; Wed, 29 Dec 2010 18:20:36 -0800
Received: from iye7 (iye7.prod.google.com [10.241.50.7])
by hpaq13.eem.corp.google.com with ESMTP id oBU2KZTL013972
for <***@gmail.com>; Wed, 29 Dec 2010 18:20:36 -0800
Date: Wed, 29 Dec 2010 18:20:35 -0800
Message-Id: <[email protected]>
Received: by iye7 with SMTP id 7so15419857iye.0
for <***@gmail.com>; Wed, 29 Dec 2010 18:20:35 -0800 (PST)
Received: by 10.231.206.17 with SMTP id fs17mr5593034ibb.8.1293675635443;
Wed, 29 Dec 2010 18:20:35 -0800 (PST)
To: <***@gmail.com>
Content-Type: multipart/alternative; boundary="===============0361350100952046111=="
MIME-Version: 1.0
Subject: Welcome to Nexus S
From: Android Team <[email protected]>
I have not ordered a Nexus S, as I don't think it works on AT&T right now. I currently have a Samsung Captivate. I was wondering if I should try to call the number listed in the email to ask about it.
Click to expand...
Click to collapse
I just received this same email about 30min ago and i have the Droid 4. I did flash the Gummy remodel that is available for the D4 last night but this was my second time doing so. Been going to between the CM9 selfkang ICS 4.0.3 and the ASOP 4.3 Gummy remodel for the last week now.
Just wanna know if anyone knows why i would be getting this email from Google and Samsung?

Just to be clear, this email is sent out by Google after you log into a Nexus device and activate it for the first time. So it doesn't look like you're getting a free Nexus S, sorry guys
Also, those headers look fine, the email is legit. Probably just a bug on Google's activation servers.

I just don't get why I would get this email when I have the D4.....

This happens when:
The ROM on your phone uses a stock Nexus S build fingerprint (found in system/build.prop). This can be because it actually is stock or because it was deliberately modified.
and...
You log into your Google account on a phone with this build fingerprint. Google apparently associates your account with the build fingerprint and sends you a welcome email message. This is only supposed to occur the first time your account is associated with a particular Nexus build fingerprint.

Blackman_X aka The Mobile panda in hiding?

This is a supposidly a VZW insider. ever since late lastnight his tweets went private. he mentioned some TB stuff the othernight then his twitter account now says private. the twitter is black_man_x is this a common thing? i never looked at his postings till now.
Not to add any fire to things but i was told lastweek the date was feb 28th but got moved to thursday - friday. this is coming from my workplace and supposidly inside emails with our Reps but i have not personally seen those emails.

he has had his tweets set to private for the longest time. he must of made them public and then set them back to private. chill out its not the end of the world. all you have to do is send a request to view all his tweets, via trying to view more of his tweets

Spam Sent via Mobile through GMail

I'm currently running CM7 RC2 with various apps, and I woke up to an inability to log into GMail. When trying to log in via my desktop browser, GMail said my account was blocked due to suspicious activity. After completing the steps to fix this problem, I checked the recent connection activity at my account, and noticed something strange:
Mobile Mexico (189.254.89.190) 9:03 am (5 hours ago)
The time matches with when the spam was sent. The actual spam email contained text and a link that redirects to some online pharmacy site. The text was:
.It�s amazing!!!
Click to expand...
Click to collapse
I will refrain from posting the link unless someone PMs and asks for it.
The message headers include:
MIME-Version: 1.0
Received: by 10.229.222.208 with HTTP; Wed, 9 Mar 2011 06:03:24 -0800 (PST)
Date: Wed, 9 Mar 2011 09:03:24 -0500
Delivered-To: <removed>@gmail.com
Message-ID: <[email protected]>
Subject:
From: <removed>@gmail.com>
To: <removed for privacy>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
.It=EF=BF=BDs amazing!!! <link removed>
Click to expand...
Click to collapse
If anyone can help me figure out what's going on and/or what caused this, it would be appreciated. I'd also be curious if anyone else experienced something similar.
Thanks all!

Sounds like someone got your log it. I would HIGHLY doubt it's related to your Android phone or your Cyanogen Mod ROM. If you were you would of got an E-Mail from Google explaining the app situation.

ive actually read either here on xda or on another android forum
that if you download certain apps illegally and then install them on the phone and grant them permissions they do have the potential to "call home" or send emails or text messages as spam
also could it have something to do with all the malware that google just removed from the market? maybe you got a rogue app
so is it possible you did one of these things?

Freek91 said:
also could it have something to do with all the malware that google just removed from the market? maybe you got a rogue app
so is it possible you did one of these things?
Click to expand...
Click to collapse
Didn't Google push an app to get rid of those? So he would've probably gotten an email if it was that.
Sent from my DeLorean using a Flux Capacitor

[Q] Mighty Text

Does anyone know how to get a hold of the Might Text developers? I have been noticing that it has been skipping or not getting major texts that are coming into my phone. Like I have been texting like mad since Nov 28, 2012 and when I logged on to Mighty Text today December 7th, to view them, they arn't there? When I went to the main page of Might Text to contact the developers and clicked on Contact. It wouldn't open up or allow me too!? Whats up with that?