Forum Antiscam
Support Team <service@inti.paypai.com> - Druckversion

+- Forum Antiscam (http://antiscam.de)
+-- Forum: Internet-Abzocke und Inkasso-Angstmache - Phishing - Handy-Abzocke (/forumdisplay.php?fid=25)
+--- Forum: Phishing (/forumdisplay.php?fid=27)
+--- Thema: Support Team <service@inti.paypai.com> (/showthread.php?tid=11325)



Support Team <service@inti.paypai.com> - Germane - 18.10.2015 11:04

Von: Support Team <service@inti.paypai.com>
an: xxx.xxx@xxx.xxx
Datum: 17. Oktober 2015 um 23:46
Betreff: Your account has been Iimited untiI we hear from you

Hello Costommer,

We recorded previously suspicious movements in your account. Check your recent activity and update your account by logging in now.
PayPal email address: Statement Date:
service@intI.paypaI.com 17 Oct 2015

Update Your Account


Did you know?

Discover Buyer Protection

If your purchase does not match the description or fails to arrive, you may be eligible for a reimbursement.
Learn more

Use PayPal to shop for your favorite brands worldwide.

Shop with us at thousands of websites all over the world. Discover where you can use your account and the latest offers for our users
See merchants

Spoiler :
Delivered-To: xxx.xxx@xxx.xxx
Received: by 10.182.226.65 with SMTP id rq1csp690596obc;
Sat, 17 Oct 2015 14:46:58 -0700 (PDT)
X-Received: by 10.194.117.39 with SMTP id kb7mr24063049wjb.129.1445118418341;
Sat, 17 Oct 2015 14:46:58 -0700 (PDT)
Return-Path: <service@inti.paypai.com>
Received: from plesk.kosmotic.es (plesk.kosmotic.es. [85.238.12.36])
by mx.google.com with ESMTPS id pn1si31969347wjb.155.2015.10.17.14.46.57
for <xxx.xxx@xxx.xxx>
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Sat, 17 Oct 2015 14:46:58 -0700 (PDT)
Received-SPF: neutral (google.com: 85.238.12.36 is neither permitted nor denied by best guess record for domain of service@inti.paypai.com) client-ip=85.238.12.36;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 85.238.12.36 is neither permitted nor denied by best guess record for domain of service@inti.paypai.com) smtp.mailfrom=service@inti.paypai.com
Received: (qmail 13150 invoked by uid 48); 17 Oct 2015 23:46:49 +0200
Date: Sat, 17 Oct 2015 23:46:49 +0200
To: xxx.xxx@xxx.xxx
From: =?UTF-8?Q?Support_Team?= <service@intI.paypaI.com>
Reply-To:
Subject: =?UTF-8?Q?Your_account_has_been_Iimited_untiI_we_hear_from_you?=
Message-ID: <1974c0e0cb3f94658dafaeb7e444dc4e@www.kosmotic.es>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version ]
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/html; charset="iso-8859-1"

Code:
General IP Information
IP:    85.238.12.36
Decimal:    1441664036
Hostname:    plesk.kosmotic.es
ASN:    41721
ISP:    Cartagon S.L.
Organization:    Cartagon S.L.
Services:    None detected
Type:    Broadband
Assignment:    Static IP
Blacklist:    
Geolocation Information
Continent:    Europe
Country:    Spain es flag



RE: Support Team <service@inti.paypai.com> - Germane - 18.10.2015 11:13

Zitat:Received: from plesk.kosmotic.es (plesk.kosmotic.es. [85.238.12.36])

Zitat:From: =Support_Team <service@intI.paypaI.com>

intI.paypaI.com
Verwendung eines großen i anstatt kleinen l bei der Schreibweise von Paypal.
Gefälschte Server Domain!

http://www.scamadviser.com/
Zitat: inti.paypai.com Website not active
Versendender Server bereits wieder deaktiviert!

Google Mail Warnung.
Zitat:Achtung – Sicherheitsrisiko! Eine größere Anzahl anderer Nutzer hat ähnliche Nachrichten als Phishing-E-Mails markiert. Es kann daher sein, dass diese E-Mail gefährlich ist. Weitere Informationen

Link der Nachricht
Code:
http://www.wp.trish.in/wp-admin/network/.update/Update/
Wird nicht zu Paypal sondern einem anderen Server weitergeleitet.

[Bild: phishinglppbh.jpg]