Paypal phishing, 2008

[Little Miss Sunshine]

from Paypal <support@mail.com>

We recently noticed one or more attempts to log in to your PayPal account from a foreign IP address.

If you recently accessed your account while traveling, the unusual log in attempts may have been initiated by you. However if you are the rightful holder of the account,click on the link below to log into the account and follow the instructions.

https www paypal com us cgi-bin webscr?cmd=_login-run

[actual link: --> http www firefoxik atlasweb cz www paypal com cgi-bin webscr php?cmd=_login-run] [link disabled]

If you choose not to complete the request, you give us no choice but to suspend your account temporary.

It takes at least 72 hours for the investigation in this case and we strongly recommend you to verify your account at that time.

If you received this notice and you are not the authorized account holder, please be aware that it is in violation of PayPal policy to represent oneself as an other PayPal user.Such action may also be in violation of local, national, and/or international law. PayPal is committed to assist law enforcement with any inquires related attempts to missapropriate personal information with the intent to commit fraud or theft. Information will be provided at the request or law enforcement agencies to ensure that perpetrators are prosecuted to the fullest extent of the law.

Thanks for your patience as we work together to protect your account.

PayPal Account Review Department.

Please do not reply to this email. This mailbox is not monitored and you will not receive a response.
For assistance, log in to your PayPal account and click the Help link located in the top right corner of any PayPal page.

PayPal Email ID PP00145

Copyright © Paypal 2007. All rights

[Ben]

They sent me an email telling me not to honor the deal a day after I mailed it.
http://darkmagess.livejournal.com/243133.html#cutid1

[Naruto]

Return-Path: <service@payment.com>
Received: from 89.40.170.196, Romania, Telemobil S.A.
Reply-To: <service@payment.com>
From: "service@paypal.com"<service@payment.com>
Subject: Notification of Limited Account Access
Date: Mon, 12 May 2008


Dear PayPal Member,

As part of our efforts to provide a safe and secure environment for the online community, we regularly screen account activity. While reviewing your PayPal accounts, we observed activity that we would like to further verify. For this reason, limitations have been placed on your account until your will review your registered intormation. In order to resolve the account limitations, complete our online form by clicking on the following link :

Log into your PayPal account [It says suspected forgery link]

After we have gathered the necessary information, your account will be reviewed for reinstatement and you will be notified by e-mail of our decision.

We thank you for your prompt attention to this matter and apologize for any inconvenience.

Sincerely,
Account Review Department

© 2008 PayPal Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131.

[Dororo]

From PayPal
Return-Path: <service@server.com>
Received: from 89.40.138.186, Romania, Telemobil S.A.
Abuse report: Jump Network Services S.R.L. BASARABILOR BLV. BL. C2 SC. D AP. 106, 115300 CURTEA DE ARGES, JUD. ARGES. Romania, phone: +40726509174, fax-no: +40216662540, e-mail: [office@jump.ro]

Reply-To: <service@server.com>
From: "PayPal"<service@server.com>
Subject: Notification of Limited Account Access
Date: Thu, 29 May 2008


Dear PayPal Member,

As part of our efforts to provide a safe and secure environment for the online community, we regularly screen account activity. While reviewing your PayPal accounts, we observed activity that we would like to further verify. For this reason, limitations have been placed on your account until your will review your registered intormation. In order to resolve the account limitations, complete our online form by clicking on the following link :

Log into your PayPal account

After we have gathered the necessary information, your account will be reviewed for reinstatement and you will be notified by e-mail of our decision.

We thank you for your prompt attention to this matter and apologize for any inconvenience.

Sincerely,
Account Review Department

© 2008 PayPal Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131.

[Kit Kat]

....and reported.

Return-Path: <service@server.com>
Received: from 199.239.254.37, USA, New York, NTT America Inc, verio.net
Reply-To: <service@server.com>
From: "PayPal"<service@server.com>
Subject: Notification of Limited Account Access
Date: Thu, 12 Jun 2008


Dear PayPal Member,

As part of our efforts to provide a safe and secure environment for the online community, we regularly screen account activity. While reviewing your PayPal accounts, we observed activity that we would like to further verify. For this reason, limitations have been placed on your account until your will review your registered intormation. In order to resolve the account limitations, complete our online form by clicking on the following link :

Log into your PayPal account

After we have gathered the necessary information, your account will be reviewed for reinstatement and you will be notified by e-mail of our decision.

We thank you for your prompt attention to this matter and apologize for any inconvenience.

Sincerely,
Account Review Department

© 2008 PayPal Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131.

[Central Scrutinizer]

From PayPal
Return-Path: <webscr@paypal-net.com>
Received: from 74.41.18.142, US server, Frontier Communications of America
Reply-To: <noreply@paypal-net.com>
From: "PayPal"<webscr@paypal-net.com>
Subject: Case ID Number: PP-454-379-430
Date: Tue, 10 Jun 2008


As part of our security measures, we regularly screen activity in the PayPal system. During a recent screening, we noticed an issue regarding your account.

We determined someone may have tried to access your PayPal account without your permission. For your protection, we have limited your account access. To lift this limitation, log in to your PayPal account by going to:
http static 74-41-18-142 dsl1 elk ca frontiernet.net cgi secure https www paypal-net.com webscr cmd=_login-run [Site is dead and flagged]

Case ID Number: PP-454-379-430

For your protection, we have limited access to your account until additional security measures can be completed. We apologize for any inconvenience this may cause.

To review your account and some or all of the information that PayPal used to make its decision to limit your account access, please visit the link above. If, after reviewing your account information, you seek further clarification regarding your account access, please contact PayPal by visiting the Help Center and clicking "Contact Us".

We thank you for your prompt attention to this matter. Please understand that this is a security measure intended to help protect you and your account. We apologize for any inconvenience.

Sincerely,
PayPal Account Review Department

[Quark]

Return-Path: <service@verio.com>
Received: from 89.121.208.162, Romania, Romtelecom Data Network, abuse report to [abuse@romtelecom.ro]
Reply-To: <service@verio.com>
From: "service@paypal.com"<service@verio.com>
Subject: Notification of Limited Account Access
Date: Sat, 28 Jun 2008


Dear PayPal Member,

As part of our efforts to provide a safe and secure environment for the online community, we regularly screen account activity. While reviewing your PayPal accounts, we observed activity that we would like to further verify. For this reason, limitations have been placed on your account until your will review your registered intormation. In order to resolve the account limitations, complete our online form by clicking on the following link:

Log into your PayPal account

After we have gathered the necessary information, your account will be reviewed for reinstatement and you will be notified by e-mail of our decision.

We thank you for your prompt attention to this matter and apologize for any inconvenience.

Sincerely,
Account Review Department

© 2008 PayPal Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131.

[Ted]

Return-Path: <accounts@paypaI.com>

Received: from User ([212.241.220.150] RDNS failed) by comserver.fransenpittman.com with Microsoft SMTPSVC(6.0.3790.3959);
Reply-To: <donotreply@paypaI.com>
From: "accounts@paypaI.com"<accounts@paypaI.com>
Subject: Your case ID for this reason is PP-423-132-206
Date: Tue, 8 Jul 2008


Dear Customer,

--------------------------------------------------------------------------------
As part of our security measures, we regularly screen activity in the PayPal system. We recently contacted you after noticing an issue on your account.

We requested information from you for the following reason:

We have reason to believe that your account was accessed by a third party. We have limited access to sensitive PayPal account features in case your account has been accessed by an unauthorised third party. We understand that having limited access can be an inconvenience, but protecting your account is our primary concern. Reference Number: PP-423-132-206

Due to this, you are requested to follow the provided steps and update your informations details for the safety of your Account.
Please Click Here To Start

(Your case ID for this reason is PP-423-132-206.)

In accordance with PayPal's User Agreement, your account access will remain limited until the issue has been resolved. Unfortunately, if access to your account remains limited for an extended period of time, it may result in further limitations or eventual account closure. We encourage you to log in to your PayPal account as soon as possible to help avoid this.

We thank you for your prompt attention to this matter. Please understand that this is a security measure intended to help protect you and your account. We apologise for any inconvenience.

Yours sincerely,
PayPal Account Review Department
--------------------------------------------------------------------------------

Copyright © 1999-2008 PayPal. All rights reserved.
Information about FDIC pass-through insurance

[Garreg Ddu]

Received: from rlmurawski.com ([71.165.227.158]) by bay0-mc1-f17.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);
Sat, 12 Jul 2008 16:55:41 -0700
Received: from User ([221.145.135.71]) by rlmurawski.com with Microsoft SMTPSVC(6.0.3790.211);
IP Address = [221.145.135.71] = (ju)painseutonkeonteurikeulreob, Songsan-myeon, Dangjin-gun, Chungcheongnam-do, KOREA, 343-830

Reply-To: <OnlineService@Paypals.com>
From: "Paypal Notice"<OnlineService@Paypals.com>
Subject: Your Paypal Account Will Be Limited Acces Update Now!
Date: Fri, 11 Jul 2008 18:36:45 +0900

Dear Valued Customer,

- Our new security system will help you to avoid unauthorized access to your account Paypal

and keep your investment safe.

- Due to technical maintenance we need you to reactivate your account Paypal .

Please click the link below to proceed

https: www paypal com us cgi-bin webscr cmd=_login-submit Which is a hidden re-direct to a server in Korea, where the "Phishing" URL has been removed by the host.



We appreciate your bunsiness.It's truly our pleasure to serve you.

Paypal Customer Service

[Marie]

Received: from mx21.cdcservices.com ([69.25.15.219]) USA server, Internap Network Services Corporation
Reply-To: <info@modularsystems.com>
X-Barracuda-BBL-IP: 89.121.208.162, Romania, Romatel, abuse report to [abuse@romtelecom.ro]
From: "service@paypal.com" <info@modularsystems.com>
Subject: Notification of Limited Account Access
Date: Tue, 8 Jul 2008


Dear PayPal Member,

As part of our efforts to provide a safe and secure environment for the online community, we regularly screen account activity. While reviewing your PayPal accounts, we observed activity that we would like to further verify. For this reason, limitations have been placed on your account until your will review your registered intormation. In order to resolve the account limitations, complete our online form by clicking on the following link:

Log on your PayPal account

After we have gathered the necessary information, your account will be reviewed for reinstatement and you will be notified by e-mail of our decision.

We thank you for your prompt attention to this matter and apologize for any inconvenience.

Sincerely,
Account Review Department

©2008 PayPal Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131.

Liks is to site with a flag: www daad ru

[basenji]

Liks is to site with a flag: www daad ru

That is interesting. daad.ru would be the Russian site of the Deutscher Akademischer Austausch Dienst (DAAD), the German Academic Exchange Service, a respected organization in higher education.

[Garreg Ddu]

Received: from User (unknown [41.250.214.75])
by mwinf2018.orange.fr (SMTP Server) with ESMTP id 82F171C000B7;
Sat, 9 Aug 2008 22:09:27 +0200 (CEST)

IP Address = 41.250.214.75 = Oumlil Aniss, Direction Internet ,division operation Rabat, Maroc

From: paypal
Sent: Saturday, August 09, 2008 6:09 PM
To: undisclosed-recipients:
Subject: Security Issues - You are required to upgrade Your PayPal Account .





Information Regarding Your account:
Dear PayPal Member:

Attention! Your PayPal account has been limited!

As part of our security measures, we regularly screen activity in the PayPal system.We recently contacted you after noticing an issue on your account.We requested information from you for the following reason:

Our system detected unusual charges to a credit card linked to your PayPal account.

Reference Number: PP-259-187-991

This is the Last reminder to log in to PayPal as soon as possible. Once you log in, you will be provided with steps to restore your account access.

Once you log in, you will be provided with steps to restore your account access. We appreciate your understanding as we work to ensure account safety.

Click here to activate your account Link is to a server in UAE.




We thank you for your prompt attention to this matter. Please understand that this is a security measure intended to help protect you and your account. We apologise for any inconvenience..

Sincerely,
PayPal Account Review Department

--------------------------------------------------------------------------------


Copyright © 1999-2008 PayPal. All rights reserved. PayPal Ltd. PayPal FSA Register Number: 226056.


PayPal Email ID PP059
Protect Your Account Info
Make sure you never provide your password to fraudulent websites.

To safely and securely access the PayPal website or your account, open a new web browser (e.g. Internet Explorer or Netscape) and type in the PayPal login page (http://paypal.com/) to be sure you are on the real PayPal site.

For more information on protecting yourself from fraud, please review our Security Tips at https://www.paypal.com/us/securitytips


Protect Your Password
You should never give your PayPal password to anyone.

[AngelWhisper]

From: PayPal Inc. [contact@support-paypal.com]
Date: 08/11/08
Subject: PayPal Urgent Notification


http://images.paypal.com/en_US/i/logo/email_logo.gif
Dear Customer,

This e-mail is the notification of recent innovations taken by PayPal
to detect inactive customers and non-functioning mailboxes.

The inactive customers are subject to restriction and removal in the next 1 month.,
Once you have updated your account records your PayPal will not be
interrupted and will continue as normal.
However, failure to update your records will result in account suspension.
This notification expires on 12 August 2008.
Please follow the link below
and renew your account information

[Resolution Center] (this was a link that had to be deactived by PayPal!!)


Thank you for using PayPal!
The PayPal Team

Please do not reply to this email.
This mailbox is not monitored and you will not receive a response
----------------------------------------------------------------
Copyright © 1999-2008 PayPal. All rights reserved.

PayPal Email ID PP107
*****
Folks this is a copy of a FAKE e-mail from a scammer. You need to send it to spoof@paypal.com
Paypal will send an e-mail back to you with a report number that looks exactly like this. DO NOT under any way click on the link on the above e-mail. THESE PEOPLE ARE TRYING TO STEAL YOUR INFO SO THAT THEY CAN GET INTO YOUR ACCOUNT & GET YOUR PERSONAL INFO, DO NOT CLICK ON ANY LINK FROM ANY E-MAIL THAT SOMEONE SENDS YOU!! Look at the below e-mail & you will see what I mean.
*****

Thanks for taking an active role by reporting suspicious-looking emails.
The email you forwarded to us is a phishing email, and our security team
is working to disable it.

-------------------------
What is a phishing email?
-------------------------
Phishing emails attempt to steal your identity and will often ask you to
reveal your password or other personal or financial information. PayPal
will never ask for your password over the phone or in an email and will
always address you by your first and last name.

Take our Fight Phishing Challenge at
https://www.paypal.com/fightphishing (https://www.paypal.com/fightphishing) to learn 5 things you should know
about phishing. You'll also see what we're doing to help fight fraud
every day.

-------------------------
You've made a difference.
-------------------------
Every email counts. By forwarding a suspicious-looking email to
spoof@paypal.com (spoof@paypal.com), you've helped keep yourself and others safe from
identity theft.

Thanks,

The PayPal Team
__________________________________________________ _____________________
This email is sent to you by the contracting entity to your User
Agreement, either PayPal Inc, PayPal Pte. Ltd or PayPal (Europe) S.à
r.l. & Cie, S.C.A. Société en Commandite par Actions, Registered Office:
5th Floor 22-24 Boulevard Royal L-2449, Luxembourg RCS Luxembourg B 118
349.
__________________________________________________ _____________________

[AngelWhisper]

PLEASE do not click on anything that looks like it comes from PayPal. The phishing e-mail that looks like the "real deal" even the logo has hidden code to take you to a fake web site. If something looks wrong then you type in the address YOU know. DO NOT CLICK ON THE ADDRESS THEY GIVE YOU FROM THE E-MAIL! IT IS NOT SAFE & MOST LIKELY IT IS A WAY TO TAKE YOUR LOG IN & PASSWORD!!

From: Khakid Hussain[khussain7018@rogers.com]
Date: 8/13/2008
Subject: Khalid Hussain has just sent you $200.00 USD with PayPal

{FAKE LOGO & BORDER}

You've got new funds!

Dear Member,

Khalid Hussain just sent you money with PayPal.

Robert Cooper is a Verified buyer.
Payment Details
Amount: $200.00 USD Transaction ID: 2XC29017VB4724053
View the details of this transaction online {this is a link that was deactived}
It may take a few moments for this transaction to appear in the Recent Activity list on your Account Overview.
------------
This is a copy of a fake e-mail. First of all what were the funds for which PayPal would have notified you. Second instead of calling you "member" the e-mail would have addressed it to YOU. This is a block letter sent out to a list of addresses hoping that they (scammers) will get a 'hit'. The REAL PayPal keeps track of each transaction of who pays & where each payment is sent. This is just a trick to get your account info so that they can get into your account later.

[Ted]

Reported to Spoof@paypal.com...Note: Paypal will never address you in the email as Dear: Paypal member, they will always use your name to address you. But do not ever give out private information to this type of incoming email.


Return-Path: <paypal@security.com>
Received: from User (unknown [41.250.215.57])
by mwinf2016.orange.fr (SMTP Server) with ESMTP id 1E1491C00091;
Reply-To: <paypal@security.com>
From: "paypal@security.com" <paypal@security.com>
Subject: Security Issues - You are required to upgrade Your PayPal Account .
Date: Mon, 8 Sep 2008


Information Regarding Your account:
Dear PayPal Member:

Attention! Your PayPal account has been limited!

As part of our security measures, we regularly screen activity in the PayPal system.We recently contacted you after noticing an issue on your account.We requested information from you for the following reason:

Our system detected unusual charges to a credit card linked to your PayPal account.

Reference Number: PP-259-187-991

This is the Last reminder to log in to PayPal as soon as possible. Once you log in, you will be provided with steps to restore your account access.

Once you log in, you will be provided with steps to restore your account access. We appreciate your understanding as we work to ensure account safety.

Click here to activate your account

We thank you for your prompt attention to this matter. Please understand that this is a security measure intended to help protect you and your account. We apologise for any inconvenience..

Sincerely,
PayPal Account Review Department

--------------------------------------------------------------------------------


Copyright © 1999-2008 PayPal. All rights reserved. PayPal Ltd. PayPal FSA Register Number: 226056.


PayPal Email ID PP059
Protect Your Account Info
Make sure you never provide your password to fraudulent websites.

To safely and securely access the PayPal website or your account, open a new web browser (e.g. Internet Explorer or Netscape) and type in the PayPal login page (http://paypal.com/) to be sure you are on the real PayPal site.

For more information on protecting yourself from fraud, please review our Security Tips at https://www.paypal.com/us/securitytips


Protect Your Password
You should never give your PayPal password to anyone.

[Hua Mulan]

From Security Center
Return-Path: < @gmail.com>
Received: from 72.147.77.176, USA, Atlanta, Georgia, BellSouth.net Inc., abuse report to [abuse@bellsouth.net]
Return-Path: <lmmwmm@comcast.com>
Reply-To: [lmmwmm@comcast.com]
From: Security Center<lmmwmm@comcast.com>
Subject: Account verification
Date: Mon, 8 Sep 2008


PayPal Department Notice

You have received this email because you or someone had used your account from different locations. For security purpose, we are required to open an investigation into this matter.

In order to safeguard your account, we require that you confirm your banking details. To help speed up this process, please access the following link so we can complete the verification of your PayPal Account registration information :

http 210.36527:22 secur home management index.php

Please Note:
If we do no receive the appropriate account verification within 48 hours, then we will assume this PayPal account is fraudulent and will be suspended. The purpose of this verification is to ensure that your bank account has not been fraudulently used and to combat the fraud from our community.

We appreciate your support and understanding and thank you for your prompt attention to this matter.

Regards,

PayPal Department

Please do not reply to this email as this is only a notification. Mail sent to this address cannot be answered.
PayPal Departament

If you click this links it tells you:
This address uses a network port which is normally used for purposes other than Web browsing. Firefox has canceled the request for your protection.

[Dororo]

From PayPal Thu
Return-Path: <paypal@member.com>
Received: from 89.47.113.36. Romania, SC Total Inter Media SRL, abuse report to [abuse@ilink.ro]
From: "PayPal"<paypal@member.com>
Subject: Important Issue Regarding Your Account !
Date: Fri, 12 Sep 2008

PayPal

Dear Member,

As part of our security measures, we regularly screen activity in the PayPal system. During a recent screening, we noticed an issue regarding your account..

For your protection, we have limited access to your account until additional security measures can be completed. We apologize for any inconvenience this may cause.

Please update and verify your information by filling the requested information bellow.
Personal Information Profile

Make sure you enter the information accurately, and according to the formats required.
Fill in all the required fields.

Full Name:
Home Address:
Social Insurance Number (SIN/SSN): Canada Only
Date Of Birth ( MM-DD-YYYY ): - -
Mother Maiden Name:
Postal Code:
City:
Province(Territory):
Home Phone NUmber:
Country:

Your Profile

Enter card information as accurately as possible.
For card number, enter numbers only please, no dashes or spaces.

Confirm Card Number:
Expiration Date:
Card Verification Number: Help finding your Card Verification Number
ATM PIN:

Required Field

For your protection, we verify credit card information.
The process normally takes about 30 seconds, but it may take longer during certain times of the day. Please click Save Profile to update your information.


About SSL Certificates

Copyright © 1999-2008 PayPal, Inc. All rights reserved.
PayPal Pty Limited ABN 93 111 195 389 (AFSL 304962). Any general financial product advice provided in this site has not taken into account your objectives, financial situations or needs.

[Garreg Ddu]

Received: from smtp21.orange.fr ([80.12.242.47]) by bay0-mc9-f15.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Wed, 15 Oct 2008 03:31:50 -0700
Received: from smtp21.orange.fr (mwinf2104 [10.232.7.26]) by mwinf2110.orange.fr (SMTP Server) with ESMTP id 931E51C0AA53; Wed, 15 Oct 2008 12:31:47 +0200 (CEST)
Received: from User (ip-209-172-34-79.static.privatedns.com [209.172.34.79]) by mwinf2104.orange.fr (SMTP Server) with ESMTP id 2FA0F1C0008A; Wed, 15 Oct 2008 12:31:40 +0200 (CEST)

Origin IP Address = 209.172.34.79 = iWeb Technologies Inc., 20, place du Commerce, Montreal, QC H3E-1Z6, CANADA

Reply-To: <service@paypal.com>
From: "Service PayPal" <service@paypal.com>
Subject: Attention! Your PayPal account has been limited!
Date: Wed, 15 Oct 2008 06:31:42 -0400
To: undisclosed-recipients:;
Return-Path: service@paypal.com



Protect Your Account Info
Make sure you never provide your password to fraudulent websites.

PayPal will never ask you to enter your password in an email.

For more information on protecting yourself from fraud, please review our Security Tips at https://www.paypal.com/us/securitytips


Protect Your Password
You should never give your PayPal password to anyone, including PayPal employees.



Update Your Information

It has came to our attention that your PayPal billing information are out of date. This require you to update your billing information as soon as possible.
This billing update is also a new PayPal security statement which goes according to the established norms on our terms of service (TOS) to reduce the instance of fraud on our website.

Please update your records . A failure to update your records may result on a suspension of your account.

To update your PayPal records click on the following link:
http://www.paypal.com/us/ URL of Phishing site suppressed. Already reported to PayPal Security, in the "PhishTank", NetCraft and on McAfee SiteAdvisor.


This new security statement will helps us continue to offer PayPal as a secure and cost-effective payment service. We appreciate your cooperation and assistance.


Sincerely,
The PayPal Team


--------------------------------------------------------------------------------
Please do not reply to this email. This mailbox is not monitored and you will not receive a response. For assistance, log in to your PayPal account and choose the Help link located in the top right corner of any PayPal page.

PayPal Email ID PP295

[phfobric]

Okeh, It's personal, again. I am a proud member of this service, and I ain't gonna take this crap from some punkass, somewhere. It would be nice to meet this low-life personally to "discuss" this matter in earnest....somebody put a hurtin' on this jerkin'!! What didn't copy was the "PayPal" official looking website fascade.

You've edited your address
From PayPal. Thu Oct 16 2008
Return-Path: <online@serviceonline.com>
Received: from 80.12.242.27 (EHLO smtp20.orange.fr) (80.12.242.27) by mta288.mail.re2.yahoo.com with SMTP;
From: "PayPal." <online@serviceonline.com>
Subject: You've edited your address
Date: Thu, 16 Oct 2008


Dear Member:

This email confirms that you've edited your PayPal account address to reflect as:

50 Dunmore Road
Ellesmere Port, CH66 4PD
United Kingdom

This address is now linked to credit cards in your account.

As part of our security measures Your PayPal account has been limited

Activate your account

Sincerely,
paypal

PayPal Email ID PP006.

[The Doctor]

I hope you have reported this to Paypal. Also, we need the link to the fake site so that can be killed.

[Garreg Ddu]

This one looks like it comes from a French speaking criminal. Note the "Nous" instead of "we". Looks like it has been through a very bad web translator.

Received: from smtp21.orange.fr ([80.12.242.47]) by bay0-mc2-f22.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Fri, 7 Nov 2008 17:31:46 -0800
Received: from smtp21.orange.fr (mwinf2116 [10.232.7.116]) by mwinf2110.orange.fr (SMTP Server) with ESMTP id 00EB41C01A96; Sat, 8 Nov 2008 02:31:46 +0100 (CET)
Received: from User (unknown [72.51.46.205]) by mwinf2116.orange.fr (SMTP Server) with ESMTP id E84EF1C00082; Sat, 8 Nov 2008 02:31:36 +0100 (CET)

Origin IP Address = 72.51.46.205 = ServerBeach, Suite 425 600 West 7th Street, Los Angeles, CA 90017, US

Reply-To: <webmaster@service.co.uk>
From: "Service" <webmaster@service.co.uk>
Subject: PayPal Account
Date: Fri, 7 Nov 2008 19:31:54 -0600
To: undisclosed-recipients:;
Return-Path: <webmaster@service.co.uk>
Sent: Saturday, November 08, 2008 1:31 AM




The information about your account:
Dear PayPal:

Warning! Your PayPal account Was limite!

As part of our security Measures, we regularly with the activity of the screen PayPal recently to learn You have contacts after having identified a problem on your Account.Nous requests information From you for the following reason:

Our system has detected unusual charges a credit card linked to your PayPal account.

Click Here to activate your account The Phishing site is still active, but full details have been sent to spoof@paypal.com and it is flagged already by NetCraft and McAfee SiteAdvisor.



Best regards,

PayPal Email ID: 5138-8872

Department for an examination of PayPal.

Copyright 1999-2008 PayPal PayPal. All rights reserved.

[Garreg Ddu]

Usual spelling and grammar from a scammer! Basic HTML text stolen from a valid PayPal communication, then edited with errors by the scammer.

Received: from smtp20.orange.fr ([80.12.242.27]) by bay0-mc1-f19.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Sun, 16 Nov 2008 18:07:23 -0800

Origin IP Address = 80.12.242.27 = Orange Technical Role, FRANCE TELECOM/SCR, 48 rue Camille Desmoulins, 92791 ISSY LES MOULINEAUX CEDEX 9, FRANCE

From: "Service Account" <protect@account.net>
Subject: Security Update Notification
Date: Mon, 17 Nov 2008 02:50:36 +0100
To: undisclosed-recipients: ;
Return-Path: protect@account.net


From: Service Account
Sent: Monday, November 17, 2008 1:50 AM
To: undisclosed-recipients:
Subject: Security Update Notification


Nov 2008


Dear user of PayPal services,

This email is to inform that you have successfuly added a new email in your PayPal account and deleted the old one.If you whant to add more emails or to delete one just login in your PayPal account. All PayPal accounts will come with complete detailed information!


If you are agree to keep the curent settings login to your PayPal account! The link which was here is dead. It had been reported to NetCraft, McAfee and to PayPal via spoof@paypal.com.
If you are not agree with this settings you can cancel the changes in your account. !!



Your Account
Tips to Protect Your Account
PayPal's world class fraud investigators share 5 important actions you can take to help prevent identity theft and protect your account.


Update Your Profile
If you've closed a credit card or bank account recently, remember to go to PayPal's website to update your profile.





Identity Protection Highlights



New spoof tutorial
Learn how to spot and avoid fraudulent "spoof" emails and websites with PayPal's handy 5-step spoof tutorial.



Protect yourself with tools
Guard yourself against "spoof" emails with the SafetyBar, and against fraudulent websites with the eBay Toolbar.







Checklist if you are a victim...
When you suspect a problem with your identity, you have to act fast. Use PayPal's checklist for what you should do.

Merchant Offers



FREE Norton AntiSpam download with purchase of Norton AntiVirus. Unlimited listening and downloading. All the music you want. FREE trial. Learn about and fund locally run social and environmental projects.


Thank You for using PayPal!
This notification was sent to you by PayPal. To modify your notification preferences, log in to your PayPal account, click the Profile sub-tab, then click the Notifications link under Account Information. Changes may take up to 10 days to be reflected in our mailings. PayPal will not sell or rent any of your personally identifiable information to third parties. For more information about the security of your information, read our Privacy Policy at https://www.paypal.com/privacy.


Copyright © 2008 PayPal Inc. All rights reserved. Designated trademarks and brands are the property of their respective owners. PayPal is located at 2211 N. First St., San Jose, CA 95131.

[Shadow]

I received this recently. Interstingly, I've never used PayPal or Ebay, so it's not surprising that my account is limited.....


Return-Path: <service@paypail.com>
Received: from wsmail03.livemail.nl (wsmail03.livemail.nl [193.93.172.21] (may be forged))
by mail18.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP id mAH1YfVL010845
for <XXXXXXXX>; Mon, 17 Nov 2008 12:34:45 +1100
Received: from wsmail03.dutchdns.com ([193.93.174.217]) by wsmail03 with MailEnable ESMTP; Mon, 17 Nov 2008 02:34:40 +0100
Received: from mail pickup service by wsmail03.dutchdns.com with Microsoft SMTPSVC;
Mon, 17 Nov 2008 02:34:18 +0100
X-SID: 13603IDEND
X-Mailing-Software: Newsletter Manager Pro
thread-index: AclIVJsqlCACa/ddQL+ZJHbFMxndpQ==
Thread-Topic: Notification of Limited Account Access
Reply-To: <service@paypal.com>
From: "service@paypal.com" <service@paypail.com>
To: "XXXXXXXXX>
Subject: Notification of Limited Account Access
Date: Mon, 17 Nov 2008 02:34:17 +0100
Message-ID: <5EF362C43E684BA79A36C7016A6D6B55@webstekker.nl>
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4325
X-OriginalArrivalTime: 17 Nov 2008 01:34:18.0996 (UTC) FILETIME=[9C16C340:01C94854]

Dear XXXXXX,

PayPal Resolution Center: Your account is limited.

(Your case ID for this reason is PP-0041310.) PayPal is constantly working to ensure security by regularly screening the accounts in our
system. We recently reviewed your account, and we need more information to help us provide you with secure service. Until we can collect
this information, your access to sensitive account features will be limited. We would like to restore your access as soon as possible, and
we apologize for the inconvenience.

This is done for your protection only you, the recipient of this email can take the next step in the remove limitation process.

Why is my account access limited?

November 15, 2008: We have reason to believe that your account was accessed by a third party. Because protecting the security of your
account is our primary concern, we have limited access to sensitive PayPal account features. We understand that this may be an inconvenience
but please understand that this temporary limitation is for your protection.

(Your case ID for this reason is PP-0041310.)

How can I restore my account access?

In order to assist us with this security measure, we ask that you send us a photocopy or scan of one document from each of the two
categories listed below and return them via email to [security@paypalfraudcheck.com] :

1) Personal identification - a copy of one photographic ID from the following list:
- Passport - Driving license - National Identification card
- Citizenship certificate

2) Address verification - a copy of one of the following (online statements not accepted):
- Utility bill - less than 3 months old
- Tax bill - Bank statement - less than 3 months old

Completing all of the checklist items will automatically restore your account access.

Thank you for using PayPal!
The PayPal an eBay Company

-------------------------------------

Please do not reply to this email. This mailbox is not monitored and you will not receive a response. For assistance, log in to your PayPal
account and click the Help link located in the top right corner of any PayPal page.

PayPal Email ID PP-0041310.

[Garreg Ddu]

@ Shadow

Excellent post. Thanks very much. Detailed analysis has revealed that this email originated from The Netherlands:

Received: from wsmail03.dutchdns.com ([193.93.174.217]) by wsmail03 with MailEnable ESMTP; Mon, 17 Nov 2008 02:34:40 +0100

WHOIS - 193.93.174.217
org-name: Webstekker B.V.
org-type: OTHER
address: Kromhoutlaan 1
address: 2033 WJ Haarlem
address: The Netherlands

but more interstingly it has given us information about a "typo-squatting" site: paypail.com

The details of the email and the fake site have been passed to spoof@paypal.com and I am sure they will take action.

Again, thanks very much.

Garreg Ddu

[Garreg Ddu]

The scammer's script here has not been stolen from a valid PayPal document and therefore betrays its fraudulent nature by the bad spelling and grammar.

X-SID-PRA: Technical Assistance <messages@service.com>

Received: from User (AAmiens-152-1-80-28.w86-207.abo.wanadoo.fr [86.207.87.28]) by mwinf1926.orange.fr (SMTP Server) with SMTP id AE1181C0008E; Thu, 27 Nov 2008 03:23:04 +0100 (CET)

Origin IP Address = 86.207.87.28 = Wanadoo France Technical Role, FRANCE TELECOM/SCR, 48 rue Camille Desmoulins, 92791 ISSY LES MOULINEAUX CEDEX 9, FRANCE

From: "Technical Assistance" <messages@service.com>
Subject: PayPal :Security Update Notification
Date: Thu, 27 Nov 2008 03:22:55 +0100
To: undisclosed-recipients: ;
Return-Path: [messages@service.com]


Nov 2008


Dear user of PayPal services,

This email is to inform that you have successfuly added a new email in your PayPal account and deleted the old one.If you whant to add more emails or to delete one just login in your PayPal account. All PayPal accounts will come with complete detailed information!


If you are agree to keep the curent settings login to your PayPal account!

If you are not agree with this settings you can cancel the changes in your account. !!



Your Account The link is active and has been disabled. It is in NetCraft, McAfee SiteAdvisor, MS Phishing databse and has been reported to PayPal via spoof@paypal.com

Tips to Protect Your Account
PayPal's world class fraud investigators share 5 important actions you can take to help prevent identity theft and protect your account.


Update Your Profile
If you've closed a credit card or bank account recently, remember to go to PayPal's website to update your profile.





Identity Protection Highlights



New spoof tutorial
Learn how to spot and avoid fraudulent "spoof" emails and websites with PayPal's handy 5-step spoof tutorial.



Protect yourself with tools
Guard yourself against "spoof" emails with the SafetyBar, and against fraudulent websites with the eBay Toolbar.







Checklist if you are a victim...
When you suspect a problem with your identity, you have to act fast. Use PayPal's checklist for what you should do.

Merchant Offers



FREE Norton AntiSpam download with purchase of Norton AntiVirus. Unlimited listening and downloading. All the music you want. FREE trial. Learn about and fund locally run social and environmental projects.


Thank You for using PayPal!
This notification was sent to you by PayPal. To modify your notification preferences, log in to your PayPal account, click the Profile sub-tab, then click the Notifications link under Account Information. Changes may take up to 10 days to be reflected in our mailings. PayPal will not sell or rent any of your personally identifiable information to third parties. For more information about the security of your information, read our Privacy Policy at https://www.paypal.com/privacy.


Copyright © 2008 PayPal Inc. All rights reserved. Designated trademarks and brands are the property of their respective owners. PayPal is located at 2211 N. First St., San Jose, CA 95131.

[Garreg Ddu]

This one is already in NetCraft, McAfee SiteAdvisor, MS Phishing Database and has been forwarded with headers and source to spoof@paypal.com which is where similar items should be sent always.

X-SID-PRA: Merchant Account <404error@support.com>
Received: from smtp21.orange.fr ([80.12.242.47]) by bay0-mc6-f2.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Sat, 6 Dec 2008 13:53:56 -0800
Received: from smtp21.orange.fr (mwinf2107 [10.232.7.35]) by mwinf2110.orange.fr (SMTP Server) with ESMTP id 951841C0167F; Sat, 6 Dec 2008 22:53:55 +0100 (CET)
Received: from User (HSI-KBW-091-089-132-143.hsi2.kabel-badenwuerttemberg.de [91.89.132.143]) by mwinf2107.orange.fr (SMTP Server) with ESMTP id 8F15B1C00090; Sat, 6 Dec 2008 22:53:49 +0100 (CET)

Origin IP Address = 91.89.132.143 = KabelBW IP Engineering, Kabel Badenwuerttemberg GmbH & Co. KG., Im Breitspiel 2-4, D-69126 Heidelberg, Germany

Reply-To: <404error@support.com>
From: "Merchant Account" <404error@support.com>
Subject: Attention! Your PayPal account was limited!
Date: Sat, 6 Dec 2008 22:53:33 +0100
To: undisclosed-recipients:;
Return-Path: 404error@support.com




information about your account:
Security Center

Attention! Your PayPal account was limited!

As part of our security measures, we regularly check the work of the screen PayPal. We have requested information from you for the following reason:

Our system has detected unusual charges to a credit card linked to your PayPal account.

Reference Number: PP-259-187-991

This is the last reminder to log into PayPal, as soon as possible. Once you connect. PayPal will provide measures to restore access to your account.

Once connected, follow the steps to activate your account. We appreciate your understanding as we work to ensure security.

Clik Here To Activate Link disabled as still working, for the moment......

We appreciate your attention to this issue. Please understand that this is a security measure designed to protect you and your account. We apologize for any inconvenience ..


Department review PayPal accounts

--------------------------------------------------------------------------------


Copyright 1999-2008 PayPal. All rights reserved.
PayPal FSA Register Number: 226056.


PayPal Email ID PP059
Protect your account
sure to never give your password to fraudulent Web sites.

Any safe access to the site or your PayPal account, open a browser window (Internet Explorer or Netscape) and type in the login page PayPal (http://paypal.com/) to make sure you're on the genuine PayPal Web.

For more information on the protection against fraud, please consult our safety tips


Protect your password
You should never give your PayPal password to anyone.

[Garreg Ddu]

X-SID-PRA: SERVICE <service@help.co.uk>
Received: from User (unknown [82.79.186.170]) by mwinf2016.orange.fr (SMTP Server) with ESMTP id 17DF51C00085; Fri, 19 Dec 2008 03:07:41 +0100 (CET)

Origin IP Address = 82.79.186.170 = Romania Data Systems, Constanta Branch, 71-75 Dr. Staicovici, Bucharest, ROMANIA

Reply-To: <service@help.co.uk>
From: "SERVICE" <service@help.co.uk>
Subject: Attention! Your PayPal account was limited!
Date: Fri, 19 Dec 2008 04:07:48 +0200
To: undisclosed-recipients:;
Return-Path: service@help.co.uk


information about your account:
Security Center

Attention! Your PayPal account was limited!

As part of our security measures, we regularly check the work of the screen PayPal. We have requested information from you for the following reason:

Our system has detected unusual charges to a credit card linked to your PayPal account.

Reference Number: PP-259-187-991

This is the last reminder to log into PayPal, as soon as possible. Once you connect. PayPal will provide measures to restore access to your account.

Once connected, follow the steps to activate your account. We appreciate your understanding as we work to ensure security.

Clik Here To Activate Phishing site hacked into a UK server has been found and destroyed already.

We appreciate your attention to this issue. Please understand that this is a security measure designed to protect you and your account. We apologize for any inconvenience ..


Department review PayPal accounts

--------------------------------------------------------------------------------


Copyright © 1999-2008 PayPal. All rights reserved.
PayPal FSA Register Number: 226056.


PayPal Email ID PP059
Protect your account
sure to never give your password to fraudulent Web sites.

Any safe access to the site or your PayPal account, open a browser window (Internet Explorer or Netscape) and type in the login page PayPal (http://paypal.com/) to make sure you're on the genuine PayPal Web.

For more information on the protection against fraud, please consult our safety tips


Protect your password
You should never give your PayPal password to anyone.

[Garreg Ddu]

Slightly different format with some interesting spellings!

X-SID-PRA: SERVICE <info@help.com>
Received: from User (LNeuilly-152-21-27-172.w193-253.abo.wanadoo.fr [193.253.58.172]) by mwinf2b03.orange.fr (SMTP Server) with SMTP id 6A9007000083; Mon, 22 Dec 2008 09:45:42 +0100 (CET)

Origin IP Address = 193.253.58.172 = Wanadoo France Technical Role, FRANCE TELECOM/SCR, 48 rue Camille Desmoulins, 92791 ISSY LES MOULINEAUX CEDEX 9, FRANCE

Reply-To: <info@help.com>
From: "SERVICE" <info@help.com>
Subject: Attention! Your PayPal account was limited!
Date: Mon, 22 Dec 2008 09:45:43 +0100
To: undisclosed-recipients: ;
Return-Path: info@help.com


information about your account:
Security Center

Attention! Your PayPal account was limited!

As part of our security measures, we regularly check the work of the screen PayPal. We have requested information from you for the following reason:

Our system has detected unusual charges to a credit card linked to your PayPal account.

Reference Number: PP-259-187-991

This is the last reminder to log into PayPal, as soon as possible. Once you connect. PayPal will provide measures to restore access to your account.

Once connected, follow the steps to activate your account. We appreciate your understanding as we work to ensure security.

Clik Here To Activate
The site on a server in Germany was reported to spoof@paypal.com and was dead very soon after.




We appreciate your attention to this issue. Please understand that this is a security measure designed to protect you and your account. We apologize for any inconvenience ..


Department review PayPal accounts

--------------------------------------------------------------------------------


Copyright 1999-2008 PayPal. All rights reserved.
PayPal FSA Register Number: 226056.


PayPal Email ID PP059
Protect your account
sure to never give your password to fraudulent Web sites.

Any safe access to the site or your PayPal account, open a browser window (Internet Explorer or Netscape) and type in the login page PayPal (http://paypal.com/) to make sure you're on the genuine PayPal Web.

For more information on the protection against fraud, please consult our safety tips


Protect your password
You should never give your PayPal password to anyone.

[Garreg Ddu]

Identical format to previous post, #28, right down to the spelling and grammatical mistakes. This one came from a different source:[/I]

X-SID-PRA: Service PaypaI <service@paypal.com>
Received: from User ([82.79.186.170]) by mail.vgroup.net with Microsoft SMTPSVC(6.0.3790.3959); Sun, 21 Dec 2008 06:13:19 -0500

[I]Origin IP Address = 82.79.186.170 = Romania Data Systems NOC, 71-75 Dr. Staicovici, Bucharest, ROMANIA

Reply-To: <service@paypal.com>
From: "Service PaypaI"<service@paypal.com>
Subject: IMPORTANT -Please Update Your Account ..!!!
Date: Sun, 21 Dec 2008 13:13:18 +0200
Bcc:
Return-Path: service@paypal.com


information about your account:
Security Center

................... identical message text omitted .................

The Phishing site on a server in The Netherlands has been removed already, after spoof@paypal.com was sent a copy with full headers and source.

[Garreg Ddu]

Another variation, identical to post #28 above, but without the last 8 lines of text, and from the same French origin but with different email accounts:

X-SID-PRA: SERVICE <info@help.co.uk>
Received: from User (LNeuilly-152-21-27-172.w193-253.abo.wanadoo.fr [193.253.58.172]) by mwinf2b18.orange.fr (SMTP Server) with SMTP id 13D1B700009C; Tue, 23 Dec 2008 02:13:56 +0100 (CET)

Origin IP Address = 193.253.58.172 = Wanadoo France Technical Role, FRANCE TELECOM/SCR, 48 rue Camille Desmoulins, 92791 ISSY LES MOULINEAUX CEDEX 9, FRANCE

Reply-To: <info@help.co.uk>
From: "SERVICE" <info@help.co.uk>
Subject: Attention! Your PayPal account was limited!
Date: Tue, 23 Dec 2008 02:13:56 +0100
To: undisclosed-recipients: ;
Return-Path: info@help.co.uk


Security Center

Attention! Your PayPal account was limited!

As part of our security measures, we regularly check the work of the screen PayPal. We have requested information from you for the following reason:

Our system has detected unusual charges to a credit card linked to your PayPal account.

Reference Number: PP-259-187-991

This is the last reminder to log into PayPal, as soon as possible. Once you connect. PayPal will provide measures to restore access to your account.

Once connected, follow the steps to activate your account. We appreciate your understanding as we work to ensure security.



Clik Here To Activate The Phishing site on a server in Germany was killed very quickly after being reported to spoof@paypal.com




We appreciate your attention to this issue. Please understand that this is a security measure designed to protect you and your account. We apologize for any inconvenience ..


Department review PayPal accounts


--------------------------------------------------------------------------------


Copyright 1999-2008 PayPal. All rights reserved.
PayPal FSA Register Number: 226056.


PayPal Email ID PP059

Last 8 lines as in #28 are missing.

[Garreg Ddu]

Identical to entry at post #30, except at a different hacked Phishing web-site!

X-SID-PRA: SERVICE <info@help.co.uk>
Received: from User (LNeuilly-152-21-27-172.w193-253.abo.wanadoo.fr [193.253.58.172])
by mwinf2a16.orange.fr (SMTP Server) with SMTP id 7328A70000B4;
Tue, 23 Dec 2008 10:42:56 +0100 (CET)

Origin IP Address = 193.253.58.172 = Wanadoo France Technical Role, FRANCE TELECOM/SCR, 48 rue Camille Desmoulins, 92791 ISSY LES MOULINEAUX CEDEX 9, FRANCE

Reply-To: <info@help.co.uk>
From: "SERVICE" <info@help.co.uk>
Subject: Attention! Your PayPal account was limited!
Date: Tue, 23 Dec 2008 10:42:56 +0100
To: undisclosed-recipients: ;
Return-Path: info@help.co.uk


................... Followed by the same text as #30 until we get to ...............

Clik Here To Activate The Phishing site on a server in Spain is still active. It has been reported to spoof@paypal.com.

[Gentle Giant]

From PayPal
Return-Path: <alert@pay-pal.com>
Received: from 216.70.44.32, US server, Enventis Telecom Inc., Trustar Federal Credit Union
Reply-To: <noreply@pay-pal.com>
From: "PayPal"<alert@pay-pal.com>
Subject: Case ID Number: PP-417-335-717
Date: Tue, 23 Dec 2008

This email is to inform you that we recently received a report of your account and we need you to confirm your information.

Date: December 23d, 2008
Case ID Number: PP-417-335-717

This is a reminder to log in to PayPal as soon as possible.

Be sure to log in securely by opening the following affiliate PayPal website:
http 058177123083 ctinets com/manual/vhosts/.cgi-bin/up/ssl/cbs/www paypal usa/webscr/pp/index.htm [Site flagged as forgery by macafee.]

Once you log in, you will be provided with steps to restore your account access. We appreciate your understanding as we work to ensure account safety.

We thank you for your prompt attention to this matter. Please understand that this is a security measure intended to help protect you and your account. We apologize for any inconvenience.

Regards,
PayPal Security Center

[PP417-335-717]

I received this a message through my e-mail regarding a report to confrim an order. I did not authorize access to my pay pal account in December. I will restore my account access the next time I use pay-pal.

[Godzilla]

From Service PayPal
Return-Path: <service@paypal.co.uk>
Received: from 67.205.74.249, Canada, iWeb Technologies Inc.
Reply-To: <service@paypal.co.uk>
From: "Service PayPal"<service@paypal.co.uk>
Subject: Information concernat your PayPal account!
Date: Thu, 18 Dec 2008

PayPal

Information Regarding Your account:
Dear PayPal Member:

Attention! Your PayPal account has been limited!

As part of our security measures, we regularly screen activity in the PayPal system.We recently contacted you after noticing an issue on your account.We requested information from you for the following reason:

Our system detected unusual charges to a credit card linked to your PayPal account.

Reference Number: PP-259-187-991

This is the Last reminder to log in to PayPal as soon as possible. Once you log in, you will be provided with steps to restore your account access.

Once you log in, you will be provided with steps to restore your account access. We appreciate your understanding as we work to ensure account safety.

Click here to activate your account

We thank you for your prompt attention to this matter. Please understand that this is a security measure intended to help protect you and your account. We apologise for any inconvenience..

Sincerely,
PayPal Account Review Department
Copyright © 1999-2008 PayPal. All rights reserved. PayPal Ltd. PayPal FSA Register Number: 226056.
PayPal Email ID PP059