To: Ratenow.com, Rackspace.com, NETUS.NET, Federal Trade Commission, Paypal, FBI:
Attention any party involved in this fraud, FBI (through their website tip form) and your local authorities were informed about your paypal fraud. Paypal was informed as well.
Full message with it's full headers is exposed below:
Return-Path:
<
[email protected]>
Delivered-To:
**************
Received:
(cpmta 27247 invoked from network); 12 May 2003 06:07:04
-0700
Received:
from 63.206.133.138 (HELO myserver.comservicesinc.com)
by smtp.c011.snv.cp.net
(209.228.34.208) with SMTP; 12 May 2003 06:07:04 -0700
X-Received:
12 May 2003 13:07:04 GMT
Received:
(from root@localhost) by myserver.comservicesinc.com
(8.10.2/8.10.2) id h4CDCsJ12534; Mon,
12 May 2003 06:12:54 -0700
Date:
Mon, 12 May 2003 06:12:54 -0700
Message-ID:
<
[email protected]>
To:
***********
Subject:
Billing Issues
From:
"
[email protected]"<
[email protected]>
Content-Type:
text/html
Status:
U
X-UIDL:
Pr@cedHkItBqdAE
X-Mozilla-Status:
8000
Dear valued PayPal member:
It has come to our attention that your PayPal billing informations are out of order. If you could please take 5-10 minutes out of your online experience and update your personal records you will not run
into any future problems with the online service. However, failure to update your records will result in account suspension. Please update your records by May 25th.
Once you have updated your account records your PayPal session will not be interrupted and will continue as normal. Failure to update will result in cancellation of service, Terms of Service (TOS) violations or future
problems.
To update your PayPal records click here:
http://cgi1.paypal.com/aw-cgi/paypalISAPI.dll?UPdate
-----------------------------------
OUR NOTICE: ATTENTION! True URL masked under above one is the folllowing:
http://209.61.190.14/.paypalDLLupdate/index.html
----------------------------------
PayPal Update team
http://www.paypal.com
The fraud's I.P. Address traceroute configuration:
3 130.152.80.30 10.070 ms isi-1-lngw2-pos.ln.net [AS226] Los
Nettos origin AS
4 38.118.132.97 9.206 ms DNS error [AS174] Performance
Systems International, Inc
5 66.28.4.201 10.051 ms
p15-1.core01.lax01.atlas.cogentco.com (DNS error)
6 66.28.4.74 15.698 ms
p14-0.core01.sjc01.atlas.cogentco.com (DNS error)
7 154.54.2.234 15.601 ms p5-3.pr01.sjc03.atlas.psi.net
(DNS error)
8 204.255.174.209 16.596 ms DNS error [AS701] Alternet
9 152.63.52.226 16.491 ms 0.so-2-1-0.XL1.SAC1.ALTER.NET
[AS701] Alternet
10 152.63.53.250 38.695 ms 0.so-3-0-0.TL1.SAC1.ALTER.NET
[AS701] Alternet
11 152.63.9.229 64.964 ms 0.so-1-1-0.TL1.DFW9.ALTER.NET
[AS701] Alternet
12 152.63.99.34 69.143 ms 0.so-4-0-0.CL1.SAT1.ALTER.NET
[AS701] Alternet
13 152.63.101.233 61.431 ms 211.ATM6-0.GW2.SAT1.ALTER.NET
[AS701] Alternet
14 157.130.128.150 61.498 ms rackspace-gw.customer.alter.net
(Fake rDNS) [AS701] Alternet
15 64.39.2.33 128.681 ms vl130.core1.sat.rackspace.com
(DNS error) [AS10532] Rackspace.com
16 64.39.2.66 60.244 ms vl901.aggr1.sat.rackspace.com
(DNS error) [AS10532] Rackspace.com
17 209.61.190.14 60.536 ms ratenow.com [AS10532]
Rackspace.com
OrgName: Rackspace.com
OrgID: RSPC
Address: 112 E. Pecan St.
Address: Suite 600
City: San Antonio
StateProv: TX
PostalCode: 78205
Country: US
NetRange: 209.61.128.0 - 209.61.191.255
CIDR: 209.61.128.0/18
NetName: RSPC-NET-2
NetHandle: NET-209-61-128-0-1
Parent: NET-209-0-0-0-0
NetType: Direct Allocation
NameServer: NS.RACKSPACE.COM
NameServer: NS2.RACKSPACE.COM
Comment:
RegDate: 2000-06-05
Updated: 2000-09-05
TechHandle: ZR9-ARIN
TechName: Rackspace, com
TechPhone: +1-210-892-4000
TechEmail:
[email protected]
OrgAbuseHandle: ABUSE45-ARIN
OrgAbuseName: Abuse Desk
OrgAbusePhone: +1-210-892-4000
OrgAbuseEmail:
[email protected]