Phishers Get More and More Crafty

My name's Allen Strider and today I was one step away from having my PayPal account hijacked. I know some stuff about the Internet and always thought phishing scams only ever worked on mid western housewives like my mom. Even if you've eaten some 409's, or just think you're totally 1337 and could never be hit up by one of these scammers read this article and/or pay special attention to the next time you try unsubscribing from something.

I try very hard to never be boastful or arrogant. I'm not the smartest person in the world but I'm fairly smart. I'm not the most technologically savy person in the world but I could teach a lot of people things they don't yet understand about their computers and the Internet. I've built plenty of websites, some even with moderate success, and played host to Internet radio stations and then (when they decided to name them years later) podcasts. I played counter-strike before de maps were invented (and still do.) I've read countless articles on different types of Internet scams, spams, tricks and crimes out of interest and paranoia throughout the years. Perhaps thats why my defense was down, and why I would be cleaning up identity theft issues if these scammers had faster servers.

At this point, I was still clueless. I'm not the least bit surprised to see promotion emails from companies I've authorized to contact me about activity on my account with them. I don't recall receiving spam from PayPal before, but it doesn't seem out of the question.

So, I open the email. As you can see below (like any carefully made phishing scam) it looks the part.

Above you can see that the email was sent through the most convincing means. Gmail hadn't caught it and neither had I yet.

At this point, I figure there has to be a way to not receive emails like this. I scroll down and look for an unsubscribe button. As you can see below I find it and even make sure to check the linking url, which appears to be a paypal.com address.

I was a bit wary when I opened this email and knew I should check things out, but the first glance at the paypal.com address actually eased my mind and I plunge. Click!

This link undoubtedly would have taken me to a page that looked exactly like a paypal site with a place to "log in" and unsubscribe from their newsletter. Below you can see my one and only red flag.

At this point I know with %99.9 accuracy that even PayPal wouldn't hire someone stupid enough to direct me to any paypalsomething.com website. As you see above, my browser is actually tricked into thinking I'm securely on paypal.com.

A google search for paypalobjects.com and phishing confirms it.

Below you can see some ambiguous but clearly unsecured whois information from PayPal, and then from paypalobjects.com which eventually lead me to ebay.com .

So, essentially I was just hacked, and the only saving grace bestowed on me was the fact that their servers weren't fast enough to load without me seeing where I was really going. Granted; I probably would have noticed something once inside their realm, but it was still a little close for comfort.

And deeper into a paranoid, untrusting, defensive, little hole I go....