Das Mail kam heute bei mir und ein paar anderen Leuten aus meinem Verein über unsere Vereinsadressen rein:
From CHAOS 0 message
Date: Thu, 21 Apr 2005 04:02:52 +0000
Received: from 126.96.36.199 by ; Thu, 21 Apr 2005 07:03:52 +0500
From: "firstname.lastname@example.org" <email@example.com>
Reply-To: "firstname.lastname@example.org" <email@example.com>
To: #@teamstaroffice.org, #@teamstaroffice.org, #@teamstaroffice.org
Subject: PayPal Security Measures
Dear valued PayPal member:
PayPal is committed to maintaining a safe environment for its community of
buyers and sellers. To protect the security of your account, PayPal employs
some of the most advanced security systems in the world and our anti-fraud
teams regularly screen the PayPal system for unusual activity.
Recently, our Account Review Team identified some unusual activity in your
account. In accordance with PayPal`s User Agreement and to ensure that your
account has not been compromised, access to your account was limited. Your
account access will remain limited until this issue has been resolved. This
is a fraud prevention measure meant to ensure that your account is not
In order to secure your account and quickly restore full access, we may
require some specific information from you for the following reason:
We would like to ensure that your account was not accessed by an
unauthorized third party. Because protecting the security of your account
is our primary concern, we have limited access to sensitive PayPal account
features. We understand that this may be an inconvenience but please
understand that this temporary limitation is for your protection.
Case ID Number: PP-040-187-541
We encourage you to log in and restore full access as soon as possible.
Should access to your account remain limited for an extended period of
time, it may result in further limitations on the use of your account.
However, failure to restore your records will result in account suspension.
Please update your records as soon as possible!
Once you have updated your account records, your PayPal session will not be
interrupted and will continue as normal.
To update your Paypal records click on the following link:
Thank you for your prompt attention to this matter. Please understand that
this is a security measure meant to help protect you and your account. We
apologize for any inconvenience.
PayPal Account Review Department
PayPal Email ID PP522
Accounts Management As outlined in our User Agreement, PayPal will
periodically send you information about site changes and enhancements.
Der erste Link führt nach Taiwan: http://188.8.131.52/.ppl/ Eine Krankenakte gibt es bislang nicht.
Abgekippt wurde der Dreck in den USA: 184.108.40.206 - die Whois-Daten sind etwas mager (http://www.bek.com).
PayPal ist informiert.
Erstaunlich finde ich, dass die Phisher eine wohlsortierte Datenbank führen. Ansonsten lägen nicht die Vereinsadressen alle beieinander.