Tag Archives: PayPal

PayPal phishing scam using Conditional CSS tricks and Google Captcha

My Online Security Posted on by  

OK got a quite strange & unusual PayPal phishing scam arrive today. The scammers either don’t like Microsoft users or can’t work out how to get the scam to work in Internet explorer or Outlook properly.  Neither the email or the website work in a Microsoft Email client or a Microsoft Browser. This is the first time I have seen Phishers & scammers using conditional css display tricks to send or attempt to send different email client users to different sites. It is also the first time I have seen a captcha on a phishing or scam site, which I … Continue reading →

Fake PayPal Debt recovery email – Extortion, Blackmail, scam and Phishing

My Online Security Posted on by  

Another quite different extortion, blackmail, phishing scam this morning. It is primarily aimed at French speaking users although it was received to an email address used by an English speaker. It  comes from what purports or pretends to be a debt recovery service. It basically says that you owe PayPal €37.18 ( might be other amounts of money  in other versions)  and that they have been employed by PayPal to recover the debt. This is a total scam and you should not pay or fill in any forms on the website being linked to  https://eu-recouvrement.com/. Do not reply to the … Continue reading →

Fake PayPal account warning delivers Trickbot

My Online Security Posted on by 5

A bit of a change to the Trickbot delivery system today with this email containing the subject of “PayPal account warning” pretending to come from service@paypal.com but actually coming from “noreply@administrationservpaypal-a.tk” which is a look-a-like,  typo-squatted or other domain that can easily be misidentified, mistaken or confused with the genuine site,  with a malicious word doc attachment that pretends to be a PayPal Data Verification Form is today’s latest spoof of a well-known company, bank or public authority delivering Trickbot banking Trojan You can now submit suspicious sites, emails and files via our Submissions system Email Details From: service@paypal.com <noreply@administrationservpaypal-a.tk> Date: … Continue reading →

PayPal Phishing using JavaScript redirect

My Online Security Posted on by  

We see lots of phishing attempts for PayPal credentials. This one is slightly more complicated and devious than many others. At first glance the submit button goes to the genuine PayPal site, with no obvious indications that the details are being sent to a phishing site. The email itself is nothing special, in fact is screams phish or scam, with the bad formatting and using some non English characters ( homograph) in place of Western characters to bypass phishing filters that trigger on some keywords. However we all know that the most obvious scams seem to be the ones that gain the most victims. … Continue reading →

fake PayPal your account has been limited leads to a money making scam

My Online Security Posted on by 1

When I received this email, I thought it was another badly done PayPal phishing attempt. At first glance it looks like it with a typical email that doesn’t have any of the PayPal logos or imprint details. I probably get 10 or 15 PayPal phishing attempts every day. But no! it is yet another scam trying to persuade me to part with my money and join a money making scam where the only person who ever makes any money, is the originator at the top of the pyramid The email looks like: From: service.intl@paypaI.com Date: Sat 01/07/2017 12:19 Subject: Notification PayPaI: Case … Continue reading →

Another new difficult to protect against PayPal phish

My Online Security Posted on by 1

We see lots of phishing attempts for PayPal login credentials . This one is slightly different than many others and much more involved and complicated. At a quick glance it looks similar to many PayPal and other financial phishing attacks with a fairly bland boiler plate email and a html attachment. What is quite different is the HTML attachment and the way it contacts the phishing drop site. These need too much user interaction and too much form filling for the online sandboxes to be able to analyse them and get a drop site for the credentials. They use email … Continue reading →

Don’t be blocked!!! – PayPal Phishing

My Online Security Posted on by 6

We see lots of phishing attempts for Paypal login account credentials. This one is slightly different than many others, mainly in the way the phisher has set up the phishing site. In Internet Explorer you get a “site Hacked” message but in Firefox or Chrome, you get the PayPal Phishing pages. I don’t quite know what the phishers have done wrong to stop this working in Internet Explorer, or what protections Internet Explorer has that other browsers don’t have. In this case and in a lot of other phishing attempts Internet Explorer is much safer than Google Chrome or Firefox. … Continue reading →

Paypal Update account information – Phishing with a difference

My Online Security Posted on by 2

We see lots of phishing attempts for PayPal details. This one is slightly different than many others and much more involved and complicated. This one has a html attachment that contains the phishing acts. There is nothing strange in that. They ask you to give all the usual details. What is strange is that I cannot find the location of the phish. That is, I cannot determine the website that the phished credentials are being sent to. The whole HTML file is encrypted. Normally sending these emails  to scam@netcraft.com gets a reply with the phishing url. All that comes back … Continue reading →

PayPal get your act together

My Online Security Posted on by 6

It is very difficult for the average user to determine if an email from a Bank, Financial institution or PayPal is genuine or a Phishing email. There is some buzz on Twitter today about a series of emails from PayPal who link to what looks like a very suspicious domain. Several of my users have received them, At first glance they definitely look “Non-Kosher” but are actually genuine from PayPal and do redirect to the genuine PayPal log in pages. A domain look up of paypal-communication.com does show it to be a genuine PayPal domain. But how many recipients know … Continue reading →

Your PayPal access bloqued phishing

My Online Security Posted on by  

Another one in the multitude of daily phishing emails trying to steal your PayPal account. This one is worth mentioning because of the bad spelling and grammar that proves this does not come from an English speaking criminal The original email looks like this. It will NEVER be a genuine email from PayPal or Your Bank so don’t ever follow the links or fill in the html ( webpage) form that frequently comes attached to the email. From: no-reply@paypal.com Date: Tue 06/09/2016 14:59 Subject: Your PayPal access bloqued Body content:  Dear Customer, Your account is temporarily suspended. We are … Continue reading →