Identity theft & Phishing

I just wanted to remind everyone about such vulns. Just today I almost got my identity and all my information stolen. I got an email from I thought paypal, it even said it was from [email protected]. Which really anyone can easily do. It had a file attached (.htm, webpage) and I opened it and it was a form that had official paypal stuff on it. I looked at the source and saw that the form was being submitted NOT to a paypal site, but to a different site(In the "action" attribute). I went to the website minus the w.php at the end of the url so I could view the directory, and sure enough there was a .txt file and I opened it and it had the guy's tests and then a bunch of other people's information (SS#, CC#, Mother's Maiden name, etc.. everything that was in the form). I have already reported it to US-CERT and google.

Just wanted to remind everyone to ALWAYS check the URL of their webbrowser when entering a password or sensitive information. And know that it COULD happen to you.

Yup, I get these fairly often. I always forward them to [email protected], to help them track down the culprits.

Even if I think it might be real (and you can usually spot when it isn't), there's no reason not to open a new browser tab and go to www.paypal.com directly to log in. I do this even when I think the notice is legit; no reason to click the link.

Don't use paypal.

Glad to see it didn't go any further for you.