help.artaro.eu

Content

Real-life phishing example

Tip: keyboard shortcut Ctrl+F searches in the page contents

Do not visit any IP-address or web addresses shown here, you might fall victim of information and money stealing! This article just shows how legitimate phishing e-mails and websites may seem!

For those who do not know - PayPal is a large international online payment system that helps people shop safer online. You can read more about them at their website.
PayPal is not in any way related to the phishing e-mail described below.

It was 18th of June, 2009 when a phishing e-mail passed all spam filters and landed in my mailbox.

At first it seemed absolutely legitimate, it had correct PayPal logos and no spelling errors (spam and phishing e-mails often use spelling mistakes to pass spam filters). The content was also professional and it warned me that there had been attempts to access my PayPal account and that I have to verify my account now.
Here's a picture of the e-mail (as Outlook does not download pictures automatically for security reasons, you cannot see the PayPal logo here):

As the e-mail sounded a bit alarming, I was about to click on the account verification link. But then something more alarming caught my eye - the link was not pointing to www.paypal.com, but to an IP-address! This is always a sign that should make everyone suspicious - all companies have their own website names (such as www.paypal.com) and they never link to an IP-address or different website name in any customer e-mails.
So always check the links in e-mails, usually you just have to stop your mouse pointer on the link for a second or two to see the destination address in a popup or Status bar.

I moved my mouse pointer down to www.paypal.com link below to confirm my doubts. And yes, it did not point to www.paypal.com at all! That assured me that this was nothing but a phishing attempt to find out my PayPal account name and password!

And the links at the bottom of the e-mail pointed to a wrong address again:

So I opened command prompt and ran nslookup 96.10.219.74 to confirm that the IP-address is not PayPal-related. And sure enough, it was probably some ADSL-client's address, not something like www.paypal.com or server.paypal.com!

So it was confirmed - a phishing e-mail that looked legitimate at first sight!

Do not try this part at home ever!

To prove my point, I did some security mumbo-jumbo and opened Google Chrome web browser in Incognito mode (this is something like safe mode to protect your computer from malware and other malicious stuff) and visited the link.
Oh boy, the site looked exactly like PayPal looks! If I had entered my e-mail address and password there, that information would have been stolen and my PayPal account would have been emptied and maybe used for some criminal activities!

Other common web browsers - Mozilla Firefox 3 and Internet Explorer 8 blocked the site automatically. Here is a reminder to you - always enable SmartScreen Filter in Internet Explorer 8 Advanced Settings and protections under Mozilla Firefox 3 Security Options.

How to enable automatic protection in Internet Explorer 8

Here's how Internet Explorer 8's new feature called SmartScreen Filter blocked the phishing site:

Here's how Internet Explorer 8's SmartScreen Filter blocked an unsafe download:

To enable SmartScreen Filter in Internet Explorer 8, open its Tools menu and click Internet Options. Select Advanced tab and scroll all the way down until you see the Enable SmartScreen Filter checkbox. Check it and click OK to close Internet Options.

 Comments? Suggestions? Ideas? Let us know! 

Your name (public):

Your e-mail (will not be displayed):

Title:

Notify me of new comments to this page:

Your comments/suggestions/ideas (no HTML code!)
By adding a comment you agree that help.artaro.eu owners are not responsible in any way for your comment's contents. You take the full responsibility for your comments.
help.artaro.eu owners reserve the right to remove comments that they find unacceptable because of strong language, inappropriate contents, advertising or spamming.
Our Privacy Policy