Mass phising email to Indian paypal users about new RBI rule....

Discussion in 'PayPal' started by true_promote, Apr 9, 2010.

  1. OMZen

    OMZen Peon

    Messages:
    9
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    0
    #41
    Just did some Full Headers investigation and it looks like a sophisticated phishing attempt.

    I'm attaching screen-shots of full headers of normal email from paypal versus the full headers of the phishing email.

    You can notice that

    1) Return path is fake

    2) DKIM Authetication shows Permaerror ( Mismatched Key Granularity ! )

    3) Message ID has suspicious Java App reference

    4) List unsubscribe path is invalid.

    5) The mail seem to have arrived via MKT2566.COM which in turn shows different WhoIs info of some Arizona based firm. ( screenshot attached )

    Can someone call Paypal US office and confirm it's phishing email?

    I'll be informing Brett Tabke - owner of WebmasterWorld Forum, who if i am not mistaken is on Paypal's developer board

    Pls revert with your feedback.
     

    Attached Files:

    OMZen, Apr 9, 2010 IP
  2. Red_Virus

    Red_Virus Well-Known Member

    Messages:
    3,756
    Likes Received:
    249
    Best Answers:
    0
    Trophy Points:
    135
    #42
    Strangely I still did not got this email ! I even did not got the foolish PayPal debit card mail that was sent last month :(
     
    Red_Virus, Apr 9, 2010 IP
  3. sai_510

    sai_510 Peon

    Messages:
    126
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #43
    That Was NOT a fake mail!!!


    Okay I have checked the header too.
    And the mail is not fake.
    Please check previous mails from Paypal, regarding the recent "Withdrawal" problems. All those mails have exactly the same details and those mails were all from paypal only.

    Moreover just now I mailed to Paypal to inform them about this issue, and got this in reply (although nothing in detail..):

    Hello ***

    Thanks for contacting PayPal's Customer Support. I realize that this
    situation can be frustrating, and appreciate the opportunity to help you
    resolve this issue.

    In this case we are regulated by the Indian government fiscal
    regulations and laws; in this case this is a new update to the
    regulations regarding to the payment received needs to be withdrawn
    before 30 days.

    Got more questions? You'll find answers at our improved Help Center.
    Click "Help" in the top right corner of any PayPal page to get started!

    Sincerely,
    ***

    PayPal, an eBay Company
     
    sai_510, Apr 9, 2010 IP
  4. WebBuddy

    WebBuddy Well-Known Member

    Messages:
    1,364
    Likes Received:
    23
    Best Answers:
    0
    Trophy Points:
    100
    #44
    hey guys I DID NOT get this mail (my PP id is @gmail).... any chance this is a phishing attempt and was sent only to yahoo / hotmail? (I sincerely hope so :( ) - I am not expert in such stuff - just my two pence .... and wishful thinking working overtime
     
    WebBuddy, Apr 9, 2010 IP
  5. OMZen

    OMZen Peon

    Messages:
    9
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    0
    #45
    Please post screenshot of your FULL HEADERS here.

    In my earlier post, the full headers screenshot for the NORMAL paypal email is taken for the February 2010 paypal email and you can clearly see the difference between the two.
     
    OMZen, Apr 9, 2010 IP
  6. WebBuddy

    WebBuddy Well-Known Member

    Messages:
    1,364
    Likes Received:
    23
    Best Answers:
    0
    Trophy Points:
    100
    #46
    I love you OMZen , I don't know how to take header shots from my mails.. but I am trusting you guys to prove that it was indeed a phishing mail.......... but that logically speaking should have some link, right? Also, sai_501 burst my hope's bubble
     
    WebBuddy, Apr 9, 2010 IP
  7. Scorpion

    Scorpion Well-Known Member

    Messages:
    268
    Likes Received:
    12
    Best Answers:
    0
    Trophy Points:
    108
    #47
    I guess they are sending this mails to Business and Premier account holders. One of my friend with personal paypal a/c didn't receive the mail.
     
    Scorpion, Apr 9, 2010 IP
  8. WebBuddy

    WebBuddy Well-Known Member

    Messages:
    1,364
    Likes Received:
    23
    Best Answers:
    0
    Trophy Points:
    100
    #48
    wrong .. another thread people were wondering whether only personal account holders got it..
     
    WebBuddy, Apr 9, 2010 IP
  9. eadler25

    eadler25 Peon

    Messages:
    217
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #49
    ok here is the final words

    1: This is not fake email. This is correct email sent via email marketing company (PayPal Pte Ltd Department).

    2: This rules for all accounts (personal, premire and business)

    3: This is confirmed via paypal.
     
    eadler25, Apr 9, 2010 IP
  10. Red_Virus

    Red_Virus Well-Known Member

    Messages:
    3,756
    Likes Received:
    249
    Best Answers:
    0
    Trophy Points:
    135
    #50
    So I guess I will be getting the email in the next few hrs :(

    I really don't know what to do now !

     
    Red_Virus, Apr 9, 2010 IP
  11. OMZen

    OMZen Peon

    Messages:
    9
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    0
    #51

    Final words? From Whom?

    Confirmed via Paypal? Who Confirmed? With whom you confirmed?


    Please post the DETAILS.

    Everyone would appreciate clarity.
     
    OMZen, Apr 9, 2010 IP
  12. WebBuddy

    WebBuddy Well-Known Member

    Messages:
    1,364
    Likes Received:
    23
    Best Answers:
    0
    Trophy Points:
    100
    #52
    can anybody PLEASE PLEASE PLEASE call up PayPal ? I can't my baby is sleeping :p
     
    WebBuddy, Apr 9, 2010 IP
  13. sai_510

    sai_510 Peon

    Messages:
    126
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #53
    Well I don't want to take the scrnshots of mails from paypal, but as I have said, that letter is from paypal which I have pasted in my previous post.

    And instead of screenshots, here's what you are interested in those headers:

    Yesterdays' Mail:
    Return-Path: <v-cmjddj_ddfjimehp_kiahdml_kiahdml_a@bounce.mkt2566.com>
    Received: by mail4070.mkt2566.com
    Date: Thu, 8 Apr 2010 22:41:18 -0400 (EDT)
    From: PayPal <paypal@paypal.com>
    Reply-To:



    Mail to inform that withdrawal issue was resolved:

    Return-Path: <v-ckhjfc_dbbklfooe_kdbikgk_kdbikgk_a@bounce.mkt2566.com>
    Received: by mail4070.mkt2566.com
    Date: Tue, 9 Feb 2010 18:44:37 -0500 (EST)
    From: PayPal <paypal@paypal.com>
    Reply-To:


    Okay the return-path is not exactly the same, but one can easily make out that if the second mail is original then this one is too.
     
    sai_510, Apr 9, 2010 IP
  14. OMZen

    OMZen Peon

    Messages:
    9
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    0
    #54
    Just had a friend in USA talk to the company to which email is traced to

    Corporate Headquarters
    Silverpop Systems Inc.
    200 Galleria Parkway, Suite 750
    Atlanta, GA 30339
    Phone: 678-247-0500
    Fax: 678-247-0501
    Toll Free: 866-SILVPOP

    Their support informed that they are NOT aware of any such email !!
     
    OMZen, Apr 9, 2010 IP
  15. eadler25

    eadler25 Peon

    Messages:
    217
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #55
    i called paypal pte singapore and they confirmed this

    (PayPal Pte Ltd Department is paypal singapore devision.
     
    eadler25, Apr 9, 2010 IP
  16. jackqs

    jackqs Peon

    Messages:
    1,262
    Likes Received:
    5
    Best Answers:
    0
    Trophy Points:
    0
    #56
    i think we got email from signapore paypal, and usa paypal branch is not aware of this,
    so the conclusion is that email was real
     
    jackqs, Apr 9, 2010 IP
  17. emiley

    emiley Active Member

    Messages:
    327
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    53
    #57
    I have a personal account and I have received the mail at my yahoo id.
     
    emiley, Apr 9, 2010 IP
  18. WebBuddy

    WebBuddy Well-Known Member

    Messages:
    1,364
    Likes Received:
    23
    Best Answers:
    0
    Trophy Points:
    100
    #58
    great ,, so we can all pack our bags now :( and leave the country for all they care
     
    WebBuddy, Apr 9, 2010 IP
  19. sai_510

    sai_510 Peon

    Messages:
    126
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #59
    Why don't you simply talk to Paypal support....they are the best people to clarify your doubts...
     
    sai_510, Apr 9, 2010 IP
  20. WebBuddy

    WebBuddy Well-Known Member

    Messages:
    1,364
    Likes Received:
    23
    Best Answers:
    0
    Trophy Points:
    100
    #60
    I am yet to receive any such mail
     
    WebBuddy, Apr 9, 2010 IP