Phishy: PayPal - Flagged Account
Just got this one (and have notified PayPal already):
Quote:
PayPal <
https://www.paypal.com/us>
Dear PayPal Member,
Your account has been randomly flagged in our system as a part of our routine security measures. This is a must to ensure that only you have access and use of your PayPal account and to ensure a safe PayPal experience. We require all flagged accounts to verify their information on file with us. To verify your Information at this time, please visit our secure server webform by clicking the hyperlink below
Click here to verify your Information <http://202.108.69.147/webscr/>
Thank you for using PayPal!
The PayPal Team
--------------------------------------------------------------------------------
Please do not reply to this e-mail. Mail sent to this address cannot be answered. For assistance, log in to your PayPal account and choose the "Help" link in the footer of any page.
To receive email notifications in plain text instead of HTML, update your preferences here <
https://www.paypal.com/us/PREFS-NOTI>.
PayPal Email ID PP478
Protect Your Account Info
Make sure you never provide your password to fraudulent websites.
To safely and securely access the PayPal website or your account, open up a new web browser (e.g. Internet Explorer or Netscape) and type in the PayPal URL (
http://www.paypal.com/).
PayPal will never ask you to enter your password in an email.
For more information on protecting yourself from fraud, please review our Security Tips at
http://www.paypal.com/securitytips
Header info:
Quote:
From - Fri Feb 25 02:04:54 2005
X-Account-Key: account3
X-UIDL: 78644dce3bc9b76d346181a76e70edbb
X-Mozilla-Status: 0001
X-Mozilla-Status2: 10000000
X-Apparently-To:
[email protected] via aa.bb.cc.dd; Thu, 24 Feb 2005 23:00:39 -0800
X-YahooFilteredBulk: aa.bb.cc.dd
Authentication-Results: aa.bb.cc.dd from=paypal.com; domainkeys=neutral (no sig)
X-Originating-IP: [aa.bb.cc.dd]
Return-Path: <
[email protected]>
Received: from aa.bb.cc.dd (EHLO aa.bb.cc.dd) (aa.bb.cc.dd)
by aa.bb.cc.dd; Thu, 24 Feb 2005 23:00:39 -0800
Received: from paypal.com (unknown [216.117.177.39])
by mailhub.korax.net (Postfix) with ESMTP id 19A2B2B6BEC
for <
[email protected]>; Fri, 25 Feb 2005 02:00:39 -0500 (EST)
Message-ID: <
[email protected]>
From:
[email protected]
To:
[email protected]
Subject: [Bulk] PayPal - Flagged Account
Reply-To:
[email protected]
Date: 25 Feb 2005 02:00:30 -0500
X-Antivirus: AVG for E-mail 7.0.300 [266.4.0]
Mime-Version: 1.0
However, the address -- 202.108.69.147 -- resolves to:
Quote:
inetnum: 202.108.69.0 - 202.108.69.255
netname: YS-INFORMATION-CO
descr: YS Information Co.Ltd
country: CN
admin-c: GS26-AP
tech-c: GS26-AP
mnt-by: MAINT-CNCGROUP-BJ
changed:
[email protected] 20040116
status: ASSIGNED NON-PORTABLE
source: APNIC
person: Gao SuJian
address: Yang Fang Dian Lu 9 Hai Dian District
address: Beijing 100038
nic-hdl: GS26-AP
phone: +86-10-13910230034
fax-no: +86-10-88244077
e-mail:
[email protected]
mnt-by: MAINT-CNCGROUP-BJ
changed:
[email protected] 20040108
source: APNIC
China. So unless PayPal has outsourced...
Additional "stuff": The 404 reports:
Quote:
Apache/2.0.53 (Unix) DAV/2 PHP/5.0.3 mod_perl/1.999.21 Perl/v5.8.0 Server at 202.108.69.147 Port 80
