- Impact
- 197
Yet another PayPal Spoof - Phishing ... Again ....
Here's what I See :
Here's What I See under Properties of it :
Whois for pacspartner.com
And Whois on hsphereweb.com (Mail Server)
Already forwarded to PayPal and a few other Parties as well ...
Here's what I See :
Dear [email protected],
We recently noticed one or more attempts to log in to your PayPal account
from a different IP address.
If you recently accessed your account while traveling, the unusual log in
attempts may have been initiated by you. However, if you did not initiate
the log ins, please visit PayPal as soon as possible to check-up your
account information:
"http://www.paypal.com/cgi-bin/webscr?cmd=_login-run"
"http://pacspartner.com/bbs/data/main.htm" <<< Actual Link Under ^^^
Thanks for your patience.
Sincerely,
PayPal
----------------------------------------------------------------
Please do not reply to this e-mail. Mail sent to this address cannot be
answered.
Email ID PP32461
Here's What I See under Properties of it :
X-Message-Status: n
X-SID-PRA: [email protected]
X-SID-Result: SoftFail
X-Message-Info: JGTYoYF78jF87JIL6tenGYAAUhLCw+v+jHl1cRifM2U=
Received: from web.hsphereweb.com ([209.208.123.129]) by mc11-f27.hotmail.com with Microsoft SMTPSVC(6.0.3790.211);
Sat, 26 Feb 2005 03:39:19 -0800
Received: from web.hsphereweb.com (localhost [127.0.0.1])
by web.hsphereweb.com (8.12.8p1/8.12.8) with ESMTP id j1QBhhhn083980
for <[email protected]>; Sat, 26 Feb 2005 06:43:43 -0500 (EST)
(envelope-from [email protected])
Received: (from httpd@localhost)
by web.hsphereweb.com (8.12.8p1/8.12.8/Submit) id j1QBhhNc083979;
Sat, 26 Feb 2005 06:43:43 -0500 (EST)
Date: Sat, 26 Feb 2005 06:43:43 -0500 (EST)
Message-Id: <[email protected]>
To: [email protected]
Subject: PayPal Account Security Measures
X-PHP-Script: canadachildren.com/bbs/templates.php for 194.158.202.185
From: <[email protected]>
Reply-To: [email protected]
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Return-Path: [email protected]
X-OriginalArrivalTime: 26 Feb 2005 11:39:19.0955 (UTC) FILETIME=[CF598630:01C51BF7]
Whois for pacspartner.com
Redirected to whois.opensrs.net ...
Registrant:
medicalstandard
3F HIT 17 Haengdang-dong Seongdong-gu
Seoul, 133.070
KR
Domain name: PACSPARTNER.COM
Administrative Contact:
Yoo, Byung Chun [email protected]
3F HIT 17 Haengdang-dong Seongdong-gu
Seoul, 133.070
KR
82.222826600
Technical Contact:
blueweb, blueweb [email protected]
Yeoksam-dong 607-10
#5F Miele Building
Gangnam-gu
Seoul, kr 135-080
KR
+82.234291901 Fax: +82.25673400
Registration Service Provider:
blueweb, [email protected]
+82.34291901
This company may be contacted for domain login/passwords,
DNS/Nameserver changes, and general domain support questions.
Registrar of Record: TUCOWS, INC.
Record last updated on 15-Oct-2004.
Record expires on 15-Oct-2006.
Record created on 15-Oct-2003.
Domain servers in listed order:
DNS1.HRNOC.NET 216.120.225.19
DNS2.HRNOC.NET 216.120.238.254
Domain status: ACTIVE
And Whois on hsphereweb.com (Mail Server)
Registrant:
Domains by Proxy, Inc.
15111 N Hayden Rd., Suite 160
PMB353
Scottsdale, Arizona 85260
United States
Registered through: GoDaddy.com
Domain Name: HSPHEREWEB.COM
Created on: 01-Aug-03
Expires on: 01-Aug-05
Last Updated on: 17-Jul-04
Administrative Contact:
Private, Registration [email protected]
Domains by Proxy, Inc.
15111 N Hayden Rd., Suite 160
PMB353
Scottsdale, Arizona 85260
United States
(480) 624-2599 Fax --
Technical Contact:
Private, Registration [email protected]
Domains by Proxy, Inc.
15111 N Hayden Rd., Suite 160
PMB353
Scottsdale, Arizona 85260
United States
(480) 624-2599 Fax --
Domain servers in listed order:
DNS1.HSPHEREWEB.COM
DNS2.HSPHEREWEB.COM
Already forwarded to PayPal and a few other Parties as well ...