Tag Archives: PayPal

Fake PayPal account warning delivers Trickbot

My Online Security Posted on by 5

A bit of a change to the Trickbot delivery system today with this email containing the subject of “PayPal account warning” pretending to come from service@paypal.com but actually coming from “noreply@administrationservpaypal-a.tk” which is a look-a-like,  typo-squatted or other domain that can easily be misidentified, mistaken or confused with the genuine site,  with a malicious word doc attachment that pretends to be a PayPal Data Verification Form is today’s latest spoof of a well-known company, bank or public authority delivering Trickbot banking Trojan You can now submit suspicious sites, emails and files via our Submissions system Email Details From: service@paypal.com <noreply@administrationservpaypal-a.tk> Date: … Continue reading →

PayPal Phishing using JavaScript redirect

My Online Security Posted on by  

We see lots of phishing attempts for PayPal credentials. This one is slightly more complicated and devious than many others. At first glance the submit button goes to the genuine PayPal site, with no obvious indications that the details are being sent to a phishing site. The email itself is nothing special, in fact is screams phish or scam, with the bad formatting and using some non English characters ( homograph) in place of Western characters to bypass phishing filters that trigger on some keywords. However we all know that the most obvious scams seem to be the ones that gain the most victims. … Continue reading →

fake PayPal your account has been limited leads to a money making scam

My Online Security Posted on by 1

When I received this email, I thought it was another badly done PayPal phishing attempt. At first glance it looks like it with a typical email that doesn’t have any of the PayPal logos or imprint details. I probably get 10 or 15 PayPal phishing attempts every day. But no! it is yet another scam trying to persuade me to part with my money and join a money making scam where the only person who ever makes any money, is the originator at the top of the pyramid The email looks like: From: service.intl@paypaI.com Date: Sat 01/07/2017 12:19 Subject: Notification PayPaI: Case … Continue reading →

Another new difficult to protect against PayPal phish

My Online Security Posted on by 1

We see lots of phishing attempts for PayPal login credentials . This one is slightly different than many others and much more involved and complicated. At a quick glance it looks similar to many PayPal and other financial phishing attacks with a fairly bland boiler plate email and a html attachment. What is quite different is the HTML attachment and the way it contacts the phishing drop site. These need too much user interaction and too much form filling for the online sandboxes to be able to analyse them and get a drop site for the credentials. They use email … Continue reading →

Don’t be blocked!!! – PayPal Phishing

My Online Security Posted on by 6

We see lots of phishing attempts for Paypal login account credentials. This one is slightly different than many others, mainly in the way the phisher has set up the phishing site. In Internet Explorer you get a “site Hacked” message but in Firefox or Chrome, you get the PayPal Phishing pages. I don’t quite know what the phishers have done wrong to stop this working in Internet Explorer, or what protections Internet Explorer has that other browsers don’t have. In this case and in a lot of other phishing attempts Internet Explorer is much safer than Google Chrome or Firefox. … Continue reading →

Paypal Update account information – Phishing with a difference

My Online Security Posted on by 2

We see lots of phishing attempts for PayPal details. This one is slightly different than many others and much more involved and complicated. This one has a html attachment that contains the phishing acts. There is nothing strange in that. They ask you to give all the usual details. What is strange is that I cannot find the location of the phish. That is, I cannot determine the website that the phished credentials are being sent to. The whole HTML file is encrypted. Normally sending these emails  to scam@netcraft.com gets a reply with the phishing url. All that comes back … Continue reading →

PayPal get your act together

My Online Security Posted on by 6

It is very difficult for the average user to determine if an email from a Bank, Financial institution or PayPal is genuine or a Phishing email. There is some buzz on Twitter today about a series of emails from PayPal who link to what looks like a very suspicious domain. Several of my users have received them, At first glance they definitely look “Non-Kosher” but are actually genuine from PayPal and do redirect to the genuine PayPal log in pages. A domain look up of paypal-communication.com does show it to be a genuine PayPal domain. But how many recipients know … Continue reading →