PayPal Phishing Example

Can you tell which is real? 1. 2.

Both appear to be from 1. 2.

Both have the same logo

Both want you to verify your account

Both want to thank you

Both tell you not to reply, and have a log in link

Both tell you how to update your preferences

...and both have an official ID

Did you guess which one is real? 1.2.

Lets take a closer look... 1.

...message

More of message

More of message

Now do you know which is real? 1. 2.

Lets look at the links. Right-click on the message. Select View Source The source code will open in Notepad. Edit -> Find Search for http Message 1 SourceMessage 1 Source Message 2 SourceMessage 2 Source

Link Examples The URL may or may not have quotes around it. It may have other code between <a and http. It may be https instead of just http. It may be a link to an image instead of a page.

If you are using web based ... You may see something like href=/exchweb/bin/redir.asp? before the actual URL. Just ignore that part and look for whats after http. Source code for web-based will have added code.

Results for Message 1 paypal.com/ bin/webscrcmd_login.php (Obviously not the PayPal site.) NOTI (Actually DOES go to the PayPal site.)

Results for Message bin/webscr?cmd=_login-run NOTI

Message 1 is Fake. Click for close up.

Message 2 is Real. Click for close up.

Things to remember... Never click on a link in a suspicious . Instead, type the link into your browser manually.

Other observations... Now you know why spam filters may have a hard time figuring out if a message is spam or not. Many fake messages look just like real messages.

Thank you for listening!