PayPal officiaI notice - Email Scam
7th January 2004

Is this really a periodic account review? - Not this time, its a scam ...

This spoof email appears to take the form of a text email with a link (see images below), but the text area is actually an image. And clicking any where on that image will open a forged Paypal page.

This really constitutes a disguised link, since the link text (contained within the image) is completely different to the page that will be opened.

The image text states that a credit card is 'unconfirmed', and that you need to use the link to that, and remove your accont from an apparent 'restricted status'.. This is of-course, a complete fabrication, and clicking on the image will result in a forged Paypal web form appearing in your browser (see images below).

The fake Paypal page has the following URL (see browser address bar) http://211.38.233.233:2347 / which resolves to kornet.net (Korean Telecom), and which clearly has nothing to do with Paypal. Any data entered and submitted into this form is captured and processed using PHP script located in the same web space.

If you have received this hoax email, please remember that it is very common for these email scams to be redistributed at a later date with only slightly different content or the same but with the fake page(s) hosted by a different provider. Also, once you have received one of these hoaxes, it is also common place to receive at least another one and usually a day or two after the first, although not necessarily from the same apparent sender.

Take a good look at the following images, because this hoax email scam may be coming to an inbox near you!

The Email ...

The fake web page...