I Need Help In Deciphering a Scam

UncleJoe

This link was in the message of the PayPal account limited scam. Even though it has www.paypal.com in it where does it really go?

https://www.paypal.com/cgi-bin/webscr?cmd=_login-run


In addition, the following was the header info. Can someone decipher this for me?

Return-Path: <www@host11.apollohosting.com>
Received: from rly-xm02.mx.aol.com (rly-xm02.mail.aol.com [172.20.83.103]) by air-xm04.mail.aol.com (v98.10) with ESMTP id MAILINXM42-5f9405107a42c8; Thu, 11 Mar 2004 19:43:44 -0500
Received: from host11.apollohosting.com (host11.apollohosting.com [209.239.42.154]) by rly-xm02.mx.aol.com (v98.5) with ESMTP id MAILRELAYINXM29-5f9405107a42c8; Thu, 11 Mar 2004 19:43:16 -0500
Received: (from www@localhost)by host11.apollohosting.com (8.12.10/8.12.10) id i2C0hGus029569;Thu, 11 Mar 2004 19:43:16 -0500
Date: 3/11/2004 7:43:16 PM Eastern Standard Time
Message-Id: <200403120043.i2C0hGus029569@host11.apollohosting.com>
To: UncleJoe
Subject: UncleJoe -PayPal Limited Account Access
From: service@paypal.com
Content-Type: text/html;charset=iso-8859-1;

Thanks. Joe.

MadMarty

If you take the E-Mail and right click and "view source code" you should be able to see where you really are being sent to.

kranky

The link as displayed in the email is probably not where it actually links to. That's just another of the many reasons why HTML email should be banned as the abomination it is.

The email headers show that the email originated from the apollohosting.com domain.