136). PayPal - HTML.Phishing.Pay-103

This email targets customers of PayPal.

Message Details

Malware Name:HTML.Phishing.Pay-103
Origin: United States
Date first seen:16/07/2006 01:20:45
Number seen:2
Date last seen:16/07/2006 05:40:51
From:"PayPal" <notifications@support.paypal.com>
Subject:PayPal : Need Your Opinion !

Attacker's URLs

The following table shows the details of the URLs used by the attacker. These could either be the fake website of the attack, or a site which redirects to the attackers fake site. Sometimes the attacker will use an additional site for hosting resources such as images.

The table shows the current status of the site: if it is still reachable (), or if it has been shut down (). If the site has not been confirmed as a phishing site it is shown with the symbol . The time when the site was first observed is shown, together with the time that the site was shut down, if applicable. Do not visit the attackers site as it may contain malware. You can get more details on the site by clicking on the symbol.

StatusFirst observedShut DownInternet AddressURL
13/08/2006 12:23:17 13/08/2006 12:23:17 United States 24.1.190.201 http://24.1.190.201:2121/www.ebaywithpaypal.com/webscrr/index.php   

Message Text

The text below shows the message content, rendered in a safe way. It does not show images or HTML formatting, but the text is the same as that contained in the phishing email. Each clickable link is shown as a reference. You can see the way the URL is presented in the main body of the text, while the actual URL activated by the link is shown below the main body.

Message Display
Enlarge
How the message body looks in an email client.

   As part of our security measures, we regularly screen activity in the
   PayPal system. We recently noticed the following issue on your account:

   We would like to ensure that your account was not accessed by an
   unauthorized third party. Because protecting the security of your
   account is our primary concern, we have limited access to sensitive PayPal
   account features. We understand that this may be an inconvenience but please
   understand that this temporary limitation is for your protection.
   Case ID Number: PP-072-838-482

   [1]https://www.paypal.com/us/cgi-bin/webscr?cmd=complaint-view


   For your protection, we have limited access to your account until
   additional security measures can be completed. We apologize for any
   inconvenience this may cause.

   To review your account and some or all of the information that PayPal
   usedto make its decision to limit your account access, please visit the
   Resolution Center [2]https://www.paypal.com/ . If, after reviewing your
   account information, you
   seekfurther clarification regarding your account access, please contact
   PayPal by visiting the Help Center and clicking "Contact Us".We thank you
   for
   your prompt attention to this matter. Please understand that this is a
   security measure intended to help protect you and your account. We apologize
   for
   any inconvenience.

   Sincerely,
   PayPal Account Review Department

   PayPal Email ID PP645495

References

   1. http://google.com/url?sa=p&pref=ig&pval=2&q=http://24.1.190.201:2121/www.ebaywithpaypal.com/webscrr/index.php
   2. http://google.com/url?sa=p&pref=ig&pval=2&q=http://24.1.190.201:2121/www.ebaywithpaypal.com/webscrr/index.php

Additional Examples

Functions

Advice