SCAM:Warning: You should Confirm your Account information immediately (Fake PayPal Notification)

Got this phishing email from support support1@Int-servicess-pp.pal and cvportal.in, pretending to be from PayPal. If you get this, yes, it’s fake.  The idea is that you click through to a screen that looks like the real paypal login screen. But when you log in, you’re really just goiving these bastards your paypal login info. Be careful, kids!

PayPal
Case ID #9515-9674-2194-5217

Dear Customer,
Your accou­nt has been limited until we hear from you.
Our system detected some incorrect information that have been saved to your accou­nt earlier.

What can you do ?
We just need some more information about your ??­?ou­nt,
so you must follow these steps to get your accou­nt back.
Click here to activate your accou­nt. [links to: cvportal.in/ppl.html…eventually redirects to a very long url at nimrod.in which has a fake paypal login]
Confirm that you are the accou­nt holder
Fill all the required fields

We thank you for your prompt attention to this matter,
Please understand that this a security measure intended to help protect you and your account
We apologise for any inconvenience
yours Sincerely,
PayPal


Copyright © 2014 PayPall, Inc. All rights reserved.

 

Screen shot 2014-11-16 at 3.11.36 PM

 

 

Here’s what it looks like when you click:

Screen shot 2014-11-16 at 3.17.13 PM

For some reason, the senders of this scam email use a charset that doesn’t translate to my wysiwyg in WordPress. Y, P, A, C and E become question marks. Example:

Subject: Warning: You should сonfirm your а­ссount informаtion immediately.

 

 

??­???­l  Case ID #9515-9674-2194-5217

Dear ?ustom?r,
Your ??­?ou­nt has been limit?d until we hear from you.
Our system detected some incorrect information that have been saved to your ??­?ou­nt earlier.

What can you do ?
We just need some more information about your ??­?ou­nt,
so you must follow these steps to get your ??­?ou­nt back.

  1. ?li?k h?r? to activate your ??­?ou­nt. [links to: cvportal.in/ppl.html]
  2. ?onfirm th?t ?ou ?r? th? ??­?ou­nt hold?r
  3. Fill ?ll th? r?quir?d fi?lds


W? th?nk ?ou for ?our ?rom?t ?tt?ntion to this m?tt?r,
?l??s? und?rst?nd th?t this ? s??urit? m??sur? int?nd?d to h?l? ?rot??t ?ou ?nd ?our ???ount
w? ??ologis? for ?n? in?onv?ni?n??

?ours Sin??r?l?,
??­?­??­l

_____________________________________________________________________________
?o??right © 2014 ??­?­???­l, In?. ?ll rights r?s?rv?d.


Ра­Ñ?Ра­l

Case ID #9515-9674-2194-5217

Dear Сustomеr,

Your ас­сou­nt has been limitеd until we hear from you.

Our system detected some incorrect information that have been saved to your ас­сou­nt earlier.

What can you do ?

We just need some more information about your ас­сou­nt,
so you must follow these steps to get your ас­сou­nt back.

  1. сliсk hеrе to activate your ас­сou­nt.
  2. Сonfirm thаt Ñ?ou аrе thе ас­сou­nt holdеr
  3. Fill аll thе rеquirеd fiеlds

Wе thаnk Ñ?ou for Ñ?our Ñ?romÑ?t аttеntion to this mаttеr,
Ñ?lеаsе undеrstаnd thаt this а sесuritÑ? mеаsurе intеndеd to hеlÑ? Ñ?rotесt Ñ?ou аnd Ñ?our ассount
wе аÑ?ologisе for аnÑ? inсonvеniеnсе

Ñ?ours SinсеrеlÑ?,
Ра­Ñ?­Ра­l

_____________________________________________________________________________

СoÑ?Ñ?right © 2014 Ра­Ñ?­РÙ?а­l, Inс. Аll rights rеsеrvеd.

HashTags AreStupidAndSoAreSpacesSoWeShould AbolishSpaces

IfEveryoneJustTypedLikeThisAndWeEssentially AbolishSpaces AsOurPrimary WordSeparators WeWouldntNeed Hashtags BecauseEverythingWouldAlreadyBeSearchableTextStrings. WeCouldUseSpacesToIsolate KeyWords AndPotentially TrandingTopics. This WouldAlsoSaveCharactersWhen Tweeting EtcAndInGeneralItWouldSaveSpaceBecauseIt’s Compression. AbolishSpaces aka #abolishspaces

Chinese Domain/Trademark Scam

Me: This is a scam where they try to get you to pay to protect your trademark, or avoid a lawsuit or something like that.
Email says:
(Please forward this to your CEO, because this is urgent. Thanks)

We are a Network Service Company which is the domain name registration center in Shanghai, China. On Oct 27, 2014, we received an application from Huayu Holdings Ltd requested “[your company domain name]” as their internet keyword and China (CN) domain names. But after checking it, we find this name conflict with your company name or trademark. In order to deal with this matter better, it’s necessary to send email to you and confirm whether this company is your distributor or business partner in China?Kind regards

Sean Zhang
General Manager
Yi Guan (Headquarters)
3002, Nanhai Building, No. 854 Nandan Road,
Xuhui District, Shanghai 200030, China
Tel: +86 21 6191 8696
Mobile: +86 138 1642 8671
Fax: +86 21 6191 8697
Web: www.yiguannetwork.cn