Mass phising email to Indian paypal users about new RBI rule....

Just did some Full Headers investigation and it looks like a sophisticated phishing attempt.

I'm attaching screen-shots of full headers of normal email from paypal versus the full headers of the phishing email.

You can notice that

1) Return path is fake

2) DKIM Authetication shows Permaerror ( Mismatched Key Granularity ! )

3) Message ID has suspicious Java App reference

4) List unsubscribe path is invalid.

5) The mail seem to have arrived via MKT2566.COM which in turn shows different WhoIs info of some Arizona based firm. ( screenshot attached )

Can someone call Paypal US office and confirm it's phishing email?

I'll be informing Brett Tabke - owner of WebmasterWorld Forum, who if i am not mistaken is on Paypal's developer board

Pls revert with your feedback.

 

Strangely I still did not got this email ! I even did not got the foolish PayPal debit card mail that was sent last month

 

That Was NOT a fake mail!!!


Okay I have checked the header too.
And the mail is not fake.
Please check previous mails from Paypal, regarding the recent "Withdrawal" problems. All those mails have exactly the same details and those mails were all from paypal only.

Moreover just now I mailed to Paypal to inform them about this issue, and got this in reply (although nothing in detail..):

Hello ***

Thanks for contacting PayPal's Customer Support. I realize that this
situation can be frustrating, and appreciate the opportunity to help you
resolve this issue.

In this case we are regulated by the Indian government fiscal
regulations and laws; in this case this is a new update to the
regulations regarding to the payment received needs to be withdrawn
before 30 days.

Got more questions? You'll find answers at our improved Help Center.
Click "Help" in the top right corner of any PayPal page to get started!

Sincerely,
***

PayPal, an eBay Company

 

hey guys I DID NOT get this mail (my PP id is @gmail).... any chance this is a phishing attempt and was sent only to yahoo / hotmail? (I sincerely hope so ) - I am not expert in such stuff - just my two pence .... and wishful thinking working overtime

 

Please post screenshot of your FULL HEADERS here.

In my earlier post, the full headers screenshot for the NORMAL paypal email is taken for the February 2010 paypal email and you can clearly see the difference between the two.

 

I love you OMZen , I don't know how to take header shots from my mails.. but I am trusting you guys to prove that it was indeed a phishing mail.......... but that logically speaking should have some link, right? Also, sai_501 burst my hope's bubble

 

I guess they are sending this mails to Business and Premier account holders. One of my friend with personal paypal a/c didn't receive the mail.

 

wrong .. another thread people were wondering whether only personal account holders got it..

 

ok here is the final words

1: This is not fake email. This is correct email sent via email marketing company (PayPal Pte Ltd Department).

2: This rules for all accounts (personal, premire and business)

3: This is confirmed via paypal.

 

So I guess I will be getting the email in the next few hrs

I really don't know what to do now !

 

Final words? From Whom?

Confirmed via Paypal? Who Confirmed? With whom you confirmed?


Please post the DETAILS.

Everyone would appreciate clarity.

 

can anybody PLEASE PLEASE PLEASE call up PayPal ? I can't my baby is sleeping

 

Well I don't want to take the scrnshots of mails from paypal, but as I have said, that letter is from paypal which I have pasted in my previous post.

And instead of screenshots, here's what you are interested in those headers:

Yesterdays' Mail:
Return-Path: <v-cmjddj_ddfjimehp_kiahdml_kiahdml_a@bounce.mkt2566.com>
Received: by mail4070.mkt2566.com
Date: Thu, 8 Apr 2010 22:41:18 -0400 (EDT)
From: PayPal <paypal@paypal.com>
Reply-To:


Mail to inform that withdrawal issue was resolved:

Return-Path: <v-ckhjfc_dbbklfooe_kdbikgk_kdbikgk_a@bounce.mkt2566.com>
Received: by mail4070.mkt2566.com
Date: Tue, 9 Feb 2010 18:44:37 -0500 (EST)
From: PayPal <paypal@paypal.com>
Reply-To:

Okay the return-path is not exactly the same, but one can easily make out that if the second mail is original then this one is too.

 

Just had a friend in USA talk to the company to which email is traced to

Corporate Headquarters
Silverpop Systems Inc.
200 Galleria Parkway, Suite 750
Atlanta, GA 30339
Phone: 678-247-0500
Fax: 678-247-0501
Toll Free: 866-SILVPOP

Their support informed that they are NOT aware of any such email !!

 

i called paypal pte singapore and they confirmed this

(PayPal Pte Ltd Department is paypal singapore devision.

 

i think we got email from signapore paypal, and usa paypal branch is not aware of this,
so the conclusion is that email was real

 

I have a personal account and I have received the mail at my yahoo id.

 

great ,, so we can all pack our bags now and leave the country for all they care

 

Why don't you simply talk to Paypal support....they are the best people to clarify your doubts...

 

I am yet to receive any such mail