SCAM:Warning: You should Confirm your Account information immediately (Fake PayPal Notification)

Got this phishing email from support support1@Int-servicess-pp.pal and cvportal.in, pretending to be from PayPal. If you get this, yes, it’s fake.  The idea is that you click through to a screen that looks like the real paypal login screen. But when you log in, you’re really just goiving these bastards your paypal login info. Be careful, kids!

PayPal
Case ID #9515-9674-2194-5217

Dear Customer,
Your accou­nt has been limited until we hear from you.
Our system detected some incorrect information that have been saved to your accou­nt earlier.

What can you do ?
We just need some more information about your ??­?ou­nt,
so you must follow these steps to get your accou­nt back.
Click here to activate your accou­nt. [links to: cvportal.in/ppl.html…eventually redirects to a very long url at nimrod.in which has a fake paypal login]
Confirm that you are the accou­nt holder
Fill all the required fields

We thank you for your prompt attention to this matter,
Please understand that this a security measure intended to help protect you and your account
We apologise for any inconvenience
yours Sincerely,
PayPal


Copyright © 2014 PayPall, Inc. All rights reserved.

 

Screen shot 2014-11-16 at 3.11.36 PM

 

 

Here’s what it looks like when you click:

Screen shot 2014-11-16 at 3.17.13 PM

For some reason, the senders of this scam email use a charset that doesn’t translate to my wysiwyg in WordPress. Y, P, A, C and E become question marks. Example:

Subject: Warning: You should сonfirm your а­ссount informаtion immediately.

 

 

??­???­l  Case ID #9515-9674-2194-5217

Dear ?ustom?r,
Your ??­?ou­nt has been limit?d until we hear from you.
Our system detected some incorrect information that have been saved to your ??­?ou­nt earlier.

What can you do ?
We just need some more information about your ??­?ou­nt,
so you must follow these steps to get your ??­?ou­nt back.

  1. ?li?k h?r? to activate your ??­?ou­nt. [links to: cvportal.in/ppl.html]
  2. ?onfirm th?t ?ou ?r? th? ??­?ou­nt hold?r
  3. Fill ?ll th? r?quir?d fi?lds


W? th?nk ?ou for ?our ?rom?t ?tt?ntion to this m?tt?r,
?l??s? und?rst?nd th?t this ? s??urit? m??sur? int?nd?d to h?l? ?rot??t ?ou ?nd ?our ???ount
w? ??ologis? for ?n? in?onv?ni?n??

?ours Sin??r?l?,
??­?­??­l

_____________________________________________________________________________
?o??right © 2014 ??­?­???­l, In?. ?ll rights r?s?rv?d.


Ра­Ñ?Ра­l

Case ID #9515-9674-2194-5217

Dear Сustomеr,

Your ас­сou­nt has been limitеd until we hear from you.

Our system detected some incorrect information that have been saved to your ас­сou­nt earlier.

What can you do ?

We just need some more information about your ас­сou­nt,
so you must follow these steps to get your ас­сou­nt back.

  1. сliсk hеrе to activate your ас­сou­nt.
  2. Сonfirm thаt Ñ?ou аrе thе ас­сou­nt holdеr
  3. Fill аll thе rеquirеd fiеlds

Wе thаnk Ñ?ou for Ñ?our Ñ?romÑ?t аttеntion to this mаttеr,
Ñ?lеаsе undеrstаnd thаt this а sесuritÑ? mеаsurе intеndеd to hеlÑ? Ñ?rotесt Ñ?ou аnd Ñ?our ассount
wе аÑ?ologisе for аnÑ? inсonvеniеnсе

Ñ?ours SinсеrеlÑ?,
Ра­Ñ?­Ра­l

_____________________________________________________________________________

СoÑ?Ñ?right © 2014 Ра­Ñ?­РÙ?а­l, Inс. Аll rights rеsеrvеd.

Leave a Reply

Your email address will not be published. Required fields are marked *