PayPal Scam?

Notice of Verification Necessity

Please read this important information


--------------------------------------------------------------------------------

Why did I get the notice?

You have been sent this notice because the records of PayPal, Inc. indicate you are a current or former PayPal account holder. PayPal is conducting a periodic update of the records. To ensure your account's security, it is important that you provide us accurate information. Please take a moment to verify the personal information we have on file. This notice provides instructions on how to verify your current PayPal account.

--------------------------------------------------------------------------------

What should I do now?

We sincerely ask you, as a PayPal account holder, to login to your account and verify the necessary information. Make the necessary verification within 5 working days, or your account might get temporarily suspended. Proceed with the link below.


the link goes to here

javascript:ol('http://www.topgsmfrance.com/out.php?url=http://200.215.16.194/Agenda/');


Looks a bit dodgy to me

[smicer07]

Well dodgy m8.

Scam .... Scam .... Scam .... Scam .... Scam .... Scam .... Scam ....

[Xaccers]

It redirects to a PayPal login page hosted at http://www.cmnnet.com.br/Agenda/

Which then runs:

https://www.paypal.com/cgi-bin/webscr?cmd=_login-run

Originally Posted by Xaccers

Which then runs:

https://www.paypal.com/cgi-bin/webscr?cmd=_login-run

you think? that never gets in the address line, looks to me as if its done to make you think its doing that

[Xaccers]

Originally Posted by gary_580

you think? that never gets in the address line, looks to me as if its done to make you think its doing that

Sorry, apparently runs
It's listed at the top of the page that loads, and the source looks like paypal stuff.
Definitely stinks though.

[Gareth]

Yes, definitely sounds like a scam. And performing an nslookup on www.paypal.com shows all their addresses fall under the following:

216.113.188.*

And, according to Visual Route, the site they link to h*t*t*p:// 200.215.16.194/Agenda is located in Brazil.

I'm sure I've seen an address to report scam to PayPal - might be worth browsing their site to find it.

edit: also, why have a redirect from that topgsmfrance.com website...? Not very legit, either, imo.

[Tristan]

Originally Posted by gary_580

Notice of Verification Necessity

Please read this important information


--------------------------------------------------------------------------------

Why did I get the notice?

You have been sent this notice because the records of PayPal, Inc. indicate you are a current or former PayPal account holder. PayPal is conducting a periodic update of the records. To ensure your account's security, it is important that you provide us accurate information. Please take a moment to verify the personal information we have on file. This notice provides instructions on how to verify your current PayPal account.

--------------------------------------------------------------------------------

What should I do now?

We sincerely ask you, as a PayPal account holder, to login to your account and verify the necessary information. Make the necessary verification within 5 working days, or your account might get temporarily suspended. Proceed with the link below.


the link goes to here

javascript:ol('http://www.topgsmfrance.com/out.php?url=http://200.215.16.194/Agenda/');


Looks a bit dodgy to me

Looks very dodgy to me too. Perhaps an attempt to exploit a vulnerability in IE?

PayPal have a page to report (aparent?) scams like this:

https://www.paypal.com/uk/cgi-bin/we...center-outside

you can see that is the genuine PayPal site, HTTPS and all! I'd recommend forwarding the e-mail to them and seeing what they say.

[Gareth]

Oops, just seen the posts made whilst I was finding my Visual Route PIN.... heh, you guys are too quick for me

[MikeyB]

I've just recieved a different PayPal Scam, the "from" address is service@paypal.com wording of email:

Dear PayPal member,

Due to concerns, for the safety and integrity of your PayPal account we have issued this warning message.
It has come to our attention that your account information needs to be updated due to inactive members, frauds and spoof reports.If you could please take 5-10 minutes out of your online experience and renew your records. You will not run into any future problems with the online service. However, failure to update your records will result in account suspension.

Once you have updated your account records, your PayPal account service will not be interrupted and will continue as normal. Please follow the link below, login to your account and renew your account information:

http://www.paypal.com/cgi-bin/webscr?cmd=_login-run

Sincerely,
Paypal Department
_____________________________________
Copyright © 1999-2004 PayPal. All rights reserved.
Information about FDIC pass-through insurance



The link just above "Sincerely" actually goes to:
http://www.kimspedition.go.ro/wwwenc...paginamea.html

Which shows a page like in the attached image. Note the URL in the address bar:

[Stephen]

I had same email last month. needless to say got deleted straight away.

[paulyoung666]

just the wording of them smells phishy to me

I just got an email from "so called" Paypal saying some one has tried to log into my account too many times and so my account has been locked for 24 hours, if I want to get back into it within that time I need to "verify" my self, which, the link they gave me goes to something other than Paypal. I just signed in on Paypal with no problem at all, so watch it, there making YET ANOTHER scam.

AFAIK Paypal do not suspend accounts and then ask you to re-verify - so any e-mail that says this is a lie and a scam, delete them.

[Neil]

Originally Posted by Paul M

AFAIK Paypal do not suspend accounts and then ask you to re-verify - so any e-mail that says this is a lie and a scam, delete them.

Make sure you forward it to spoof@paypal.com & spoof@ebay.com 1st though.