Dear PayPal Member:

Attention! Your PayPal account has been violated!

Someone with ip address 149.225.126.87 tried to access your personal account!

Please click the link below and enter your account information on the following page to confirm that you are not currently away. You have 3 days to confirm account information or your account will be locked.

Looking at the source code for this HTML message, I find that the links are directed to “user-service.com” - a site design identical to PayPal.com.

Here’s the whois info:

USER-SERVICE.COM
Registrant: GOLDMAN, DANA
(39217950P)
16400 Collins Avenue
ISLES BEACH, FL 33160 US
Phone: +4184578311002
Domain Name: USER-SERVICE.COM

Administrative Contact :
GOLDMAN, DANA
(39217950P)
dubazik2005@gmail.com
16400 Collins Avenue
ISLES BEACH, FL 33160 US
Phone: +4184578311002

Technical Contact :
AMEN (IPIQLJVZWO)
internic@amen.uk.com
29th Floor
One Canada Square
Canary Wharf
LONDON, e14 5dy UK
Phone: +448704446778

Record expires on 12-Mar-2006
Record created on 12-Mar-2005
Database last updated on 12-Mar-2005

Domain servers in listed order: Manage DNS
NS1.AMENWORLD.COM 62.193.206.145
NS2.AMENWORLD.COM 217.174.202.226

I forwarded the entire message including headers to the PayPal fraud department at: spoof@paypal.com where they confirmed it’s a scam.

One of the top 10 signs of a fake email trying to obtain your PayPal username and password is: Generic greetings (see above). Many spoof emails begin with a general greeting, such as: “Dear PayPal member.” If you do not see your first and last name, be suspicious and do not click on any links or button.

Read PayPal’s 10 ways to recognize fake (spoof) emails.

   Permalink   Subscribe By E-mail

Tags: none