Advert.

Do NOT tell your scammer he is posted here, or report their accounts as it puts others at risk!

Phishers impersonating PayPal

DO NOT click on any links in these emails.

Phishers impersonating PayPal

Unread postby SlapHappy » Fri Jul 26, 2013 2:38 am

accounting@paypa|.co.uk bin@vps.assemblage24.com

* 98.130.223.216 Ecommerce Corporation Columbus United States
*Probable originating IP address

Return-Path: <bin@vps.assemblage24.com>
Received: from vps.assemblage24.com ([98.130.223.216])
by mx.google.com with ESMTPS id c7si55211qac.85.2013.07.25.14.19.46
for
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Thu, 25 Jul 2013 14:19:46 -0700 (PDT)
Received-SPF: neutral (google.com: 98.130.223.216 is neither permitted nor denied
by best guess record for domain of bin@vps.assemblage24.com)
client-ip=98.130.223.216;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 98.130.223.216 is neither permitted nor denied by best
guess record for domain of bin@vps.assemblage24.com)
smtp.mail=bin@vps.assemblage24.com
Received: from vps.assemblage24.com (unknown [127.0.0.1])
by vps.assemblage24.com (Postfix) with ESMTP id 8A9166F4018A
for Thu, 25 Jul 2013 21:13:12 +0000 (UTC)
Received: by vps.assemblage24.com (Postfix, from userid 1)
id 75BD56F40182; Thu, 25 Jul 2013 21:13:12 +0000 (UTC)
To:
Subject: Account Under Investigation
From: PayPal <accounting@paypa|.co.uk>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="==Multipart_Boundary_x81ac2c0aff53ee00450b3444528e8208x"
Message-Id: <20130725211312.75BD56F40182@vps.assemblage24.com>
Date: Thu, 25 Jul 2013 17:13:12 -0400 (EDT)

This is a multi-part message in MIME format.

--==Multipart_Boundary_x81ac2c0aff53ee00450b3444528e8208x
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

Dear Customer,

Your Account Will Be Suspended .

1:Question:

Why my account will be suspended ?

1:Answer:

1. You Received a unauthorised payment .
2. You have exceeded the sending money limit.
3. Multiple IP ( Internet protocol ) recentely accessed your account .

2:Question:

How can i avoid suspending my account ?

2:Answer:

By downloading the html attached to this email,and fallowing the instructions inside it.

3:Question:

When my account will be ready to use ?

3:Answer:

After completing the instructions inside the attachment , your account will be instantely ready to use.

Sincerely,
PayPal

Attachment:
Restore.Your.Account.html <Phishing form. May be infected with a virus.
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

PayPal <notice@accounts.com>

Unread postby SlapHappy » Mon Feb 24, 2014 4:40 am

* 195.3.146.83 Rn Data Sia n/a Latvia

Return-Path: <notice@accounts.com>
Received: from mail.anselleurope.com (217.19.231.10.static.hosted.by.combell.com.
[217.19.231.10])
by mx.google.com with ESMTP id g47si3699389eev.52.2014.02.20.07.58.46
for <multiple recipients>;
Thu, 20 Feb 2014 07:58:52 -0800 (PST)
Received-SPF: neutral (google.com: 217.19.231.10 is neither permitted nor denied
by best guess record for domain of notice@accounts.com) client-ip=217.19.231.10;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 217.19.231.10 is neither permitted nor denied by best
guess record for domain of notice@accounts.com) smtp.mail=notice@accounts.com
Date: Thu, 20 Feb 2014 07:58:52 -0800 (PST)
Received: from 127.0.0.1 ([195.3.146.83]) by mail.anselleurope.com with MailEnable
ESMTP; Thu, 20 Feb 2014 16:58:33 +0100
Message-ID: <201422013657.9010@accounts.com>
From: PayPal <notice@accounts.com>
Subject: Verification Required
X-Mailer: Mozilla Thunderbird 18.0 11.0.8303
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.246.516
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="--218"


Update Personal Information

Dear Valued Customer,

It has come to our attention that your PayPal account information needs to be updated as
part of our continuing commitment to protect your account and to reduce the instance of fraud
on our website. If you could please take a few minutes out of your online experience and update
your personal records, you will not run into any problems in the future with the online service.

However, failure to update your records could result in account suspension. Please update your
records as soon as possible.

To update your account information, please download and open the attachment file that we sent
via this email, and simply open it with your web browser.

Once you have updated your account records, any activities going through your account will no
longer be interrupted.

We apologize for any inconvenience. Please understand that this procedure is to keep you and
your account in a protected state.

Copyright © 1999 - 2014 PayPal. All rights reserved.

Attachment: application/octet-stream; name="ReviewAccount.html" <<Phishing form.
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

"PayPal"<security@PayPaI.net>

Unread postby SlapHappy » Thu Mar 13, 2014 5:09 pm

* 187.75.164.96 Vivo Santo André Brazil

Return-Path: <security@paypai.net>
Received: from mail1.emea.globalroaming.com (mail1.emea.globalroaming.com.
[46.4.147.180])
by mx.google.com with ESMTP id w5si5338498eeg.30.2014.03.13.08.28.05
for <multiple recipients>;
Thu, 13 Mar 2014 08:28:08 -0700 (PDT)
Received-SPF: fail (google.com: domain of security@paypai.net does not designate
46.4.147.180 as permitted sender) client-ip=46.4.147.180;
Authentication-Results: mx.google.com;
spf=hardfail (google.com: domain of security@paypai.net does not designate
46.4.147.180 as permitted sender) smtp.mail=security@paypai.net
Message-Id: <5321ce88.856f0e0a.315e.7e17SMTPIN_ADDED_MISSING@mx.google.com>
Received: from User (unknown [187.75.164.96])
by mail1.emea.globalroaming.com (Postfix) with ESMTPA id BE9694039D;
Thu, 13 Mar 2014 15:27:48 +0000 (UTC)
From: "PayPal"<security@PayPaI.net>
Subject: Your account mail has been changed
Date: Thu, 13 Mar 2014 14:30:52 -0700
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0070_01C2A9A6.53886752"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

This is a multi-part message in MIME format.

------=_NextPart_000_0070_01C2A9A6.53886752
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit


Dear PayPal Customer,


You have added danulstr342@sky.co.uk as a new email address for your Paypal account.

If you did not authorize this change, check with family members and others who may have access to your account first.
If you still feel that an unauthorized person has changed your email, click on restore account PayPal and follow the next steps.

Please download the form attached to this email and open it in a web browser.

NOTE: For security reasons, we will record your ip-address, the date and time, Deliberate wrong inputs are criminally pursued and indicated.
Please understand that this is a security measure intended to help protect you and your account.

We apologize for any inconvenience.

If you choose to ignore our request, you leave us no choice but to temporary suspend your account.


Sincerely,
PayPal Account Review Department

Please do not reply to this email as this is only a notification. Mail sent to this address can not be resolved.

attachment;
filename="Restore.Your.PayPal.Account.html"
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

PayPal<Bonus@update.co.uk>

Unread postby SlapHappy » Thu Mar 27, 2014 2:36 pm

38.106.58.10 Cogent Communications Los Angeles United States

Return-Path: <Bonus@update.co.uk> Bonus@update.co.uk
Received: from update.co.uk (mail.lrklawyers.com. [38.106.58.10])
by mx.google.com with ESMTP id o23si2838688yhc.180.2014.03.27.06.05.02
for
Thu, 27 Mar 2014 06:05:03 -0700 (PDT)
Received-SPF: neutral (google.com: 38.106.58.10 is neither permitted nor denied by
best guess record for domain of Bonus@update.co.uk) client-ip=38.106.58.10;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 38.106.58.10 is neither permitted nor denied by best
guess record for domain of Bonus@update.co.uk) smtp.mail=Bonus@update.co.uk
From: PayPal<Bonus@update.co.uk>
To:
Subject: Dear PayPal,
Date: 27 Mar 2014 06:04:28 -0700
Message-ID: <20140327060427.528B2C533F4DAAD2@update.co.uk>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0012_9E20E0FA.39BC69BE"

This is a multi-part message in MIME format.

------=_NextPart_000_0012_9E20E0FA.39BC69BE
Content-Type: text/plain
Content-Transfer-Encoding: 8bit


Dear PayPal user,

We recently received a report of unauthorized credit card payment
attempt
associated with this account. To protect you against any further
unauthorised
payment attempts, we've limited access to your PayPal account.
Please take
a minute to review the details below and what steps you need to
take to
remove the limits.

-----------------------------------
Details of disputed transaction
-----------------------------------


Case ID Number: PP-001-546-712-049

-----------------------------------
What to do next
-----------------------------------

Please download the form attached to this email and open it in a
web browser.
Once opened, you will be provided with steps to restore your
account access.
We appreciate your understanding as we work to ensure your
account safety.

-----------------------------------
Due dates
-----------------------------------

Please get back to us as soon as possible.


-----------------------------------
Other details
-----------------------------------

There are no other details for this transaction at this time.


Yours sincerely,
PayPal

-----------------------------------------------------------------
-----

Please do not reply to this email because we are not monitoring
this inbox.
To get in touch with us, log in to your account and click
"Contact Us" at
the bottom of any page.

Copyright © 2014 PayPal, Inc. All rights reserved.

PayPal (Europe) S.à r.l. et Cie, S.C.A.
Société en Commandite par Actions
Registered office: 22-24 Boulevard Royal, L-2449 Luxemburg
RCS Luxemburg B 118 349

PayPal Email ID PP1549

Compressed Archive
Case ID Number PP-001-546-712-049.zip
<< Phishing form. Do not click in your email!
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

From: PayPal <cust@reports.com>

Unread postby SlapHappy » Tue Apr 15, 2014 4:53 pm

91.208.16.240 Llc Maersk-invest n/a Russian Federation

Return-Path: <cust@reports.com>
Received: from radiolan.ca (mail.radiolan.ca. [64.34.78.5])
by mx.google.com with ESMTP id vl2si14580440igb.10.2014.04.14.21.39.48
for <multiple recipients>;
Mon, 14 Apr 2014 21:39:55 -0700 (PDT)
Received-SPF: none (google.com: cust@reports.com does not designate permitted sender hosts)
client-ip=64.34.78.5;
Authentication-Results: mx.google.com;
spf=neutral (google.com: cust@reports.com does not designate permitted sender hosts) smtp.mail=cust@reports.com
Received: from CPSERVER.cp.local ([99.232.100.13])
by radiolan.ca (radiolan.ca)
(MDaemon.PRO.v7.2.5.R)
with ESMTP id md50010575605.msg;
Tue, 15 Apr 2014 00:39:12 -0400
Received: from 127.0.0.1 ([91.208.16.240]) by CPSERVER.cp.local with Microsoft
SMTPSVC(6.0.3790.4675);
Tue, 15 Apr 2014 00:38:55 -0400
Message-ID: <20144153653.21815@reports.com>
From: PayPal <cust@reports.com>
Subject: Review Account
X-Mailer: GNUMail System 8.0.4854
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="--19118"
X-Spam-Processed: radiolan.ca, Tue, 15 Apr 2014 00:39:12 -0400
(not processed: message from trusted or authenticated source)
X-MDRemoteIP: 99.232.100.13
X-Return-Path: cust@reports.com
Date: Tue, 15 Apr 2014 00:39:12 -0400

----19118
Content-Type: multipart/alternative; boundary="--28317"

----28317
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

Bcc:
Return-Path: cust@reports.com
X-OriginalArrivalTime: 15 Apr 2014 04:38:56.0380 (UTC) FILETIME=[9C91ABC0:01CF5864]
Date: 15 Apr 2014 00:38:56 -0400


Bcc: Return-Path: cust@reports.com X-OriginalArrivalTime: 15 Apr 2014 04:38:56.0380 (UTC) FILETIME=[9C91ABC0:01CF5864] Date: 15 Apr 2014 00:38:56 -0400
Dear Valued Customer,

Our security system has detected that you have changed your PayPal email address.
However, we have reverted the email address back to its original settings.

If you feel that an unauthorized person has changed your email, download the form
attachment in this email and fill in your personal details in the form in order to keep
your original email and to restore your PayPal account.

Please do understand that this is a security measure intended to help protect you and
your account. We apologize for any inconvenience.

Thank you,

PayPal

Please do not reply to this email. This mailbox is not monitored and you will not receive a response. Furthermore,
should you require any assistance, you may log in to your PayPal account and click Help in the top right corner
of any PayPal page.


HTML Attcahment:
VerifyAccount.htm
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

"PayPal"<No+Reply@paypal.org.il>

Unread postby SlapHappy » Mon Apr 28, 2014 2:30 am

128.199.206.30 Digitalocean Singapore Singapore

Return-Path: <No+Reply@paypal.org.il>
Received: from uoni.uoinomarymaan ([128.199.206.30])
by mx.google.com with ESMTP id pu6si17780410pac.102.2014.04.20.17.34.45
for
Sun, 20 Apr 2014 17:34:47 -0700 (PDT)
Received-SPF: neutral (google.com: 128.199.206.30 is neither permitted nor denied
by best guess record for domain of No+Reply@paypal.org.il) client-ip=128.199.206.30;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 128.199.206.30 is neither permitted nor denied by best
guess record for domain of No+Reply@paypal.org.il) smtp.mail=No+Reply@paypal.org.il
Received: from User (localhost [127.0.0.1])
by uoni.uoinomarymaan (Postfix) with SMTP id 7E514408D9;
Sun, 20 Apr 2014 20:34:33 -0400 (EDT)
From: "PayPal"<No+Reply@paypal.org.il>
Subject: Important: Your account has been limited until we hear from you ID:
(Ref #PP-008-337-839-142)
Date: Mon, 21 Apr 2014 02:36:07 +0200
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_002B_01C2A9A6.6763BC96"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20140421003433.7E514408D9@uoni.uoinomarymaan>
To: undisclosed-recipients:;

This is a multi-part message in MIME format.

------=_NextPart_000_002B_01C2A9A6.6763BC96
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit



Your Account PayPal Has Been Limited !
Dear User ,

You recently tried to pay with PayPal but the transaction was declined because !

You don't make the new Account's Update to your PayPal account.

We understand it may be frustrating not to have full access to your PayPal account. We want to work with you to get your account back to normal as quickly as possible.
As part of our security measures, We request information from you for the following reason:

Our system detected unusual charges to a credit card linked to your PayPal account.

Download the attachment form to verify your Profile information and restore your account.
Make sure you enter the information accurately, and according to the formats required.
Fill in all the required fields.


We thank you for your prompt attention to this matter


*? Green Dot Corporation. Green Dot and MoneyPak are registered trademarks of Green Dot.Usage of this service is subject to identity verification and other controls. This service is being provided by a registered Money Services Business.
Your email preferences are set to receive "News and Promotions".
Please do not reply to this email. We are unable to respond to inquiries sent to this address. For immediate answers to your questions, visit our Help Center by clicking "Help" at the top of any PayPal page.

Copyright ? 2014 PayPal, Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131.

Attachment is infected form.
[HTML]
attachment;
filename="#PP-008-337-839-142.html"
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

"PayPal"<No+Reply@paypal.org.in>

Unread postby SlapHappy » Mon Apr 28, 2014 4:39 am

188.226.155.105 Digital Ocean n/a Netherlands

Return-Path: <No+Reply@paypal.org.in>
Received: from 1.1.com ([188.226.155.105])
by mx.google.com with ESMTP id c48si18599785eeb.277.2014.04.17.09.34.36
for <multiple recipients>;
Thu, 17 Apr 2014 09:34:46 -0700 (PDT)
Received-SPF: neutral (google.com: 188.226.155.105 is neither permitted nor denied
by best guess record for domain of No+Reply@paypal.org.in)
client-ip=188.226.155.105;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 188.226.155.105 is neither permitted nor denied by
best guess record for domain of No+Reply@paypal.org.in)
smtp.mail=No+Reply@paypal.org.in
Received: from User (localhost [127.0.0.1])
by 1.1.com (Postfix) with SMTP id E4FCC300342;
Thu, 17 Apr 2014 12:33:24 -0400 (EDT)
From: "PayPal"<No+Reply@paypal.org.in>
Subject: Important: Your account has been limited until we hear from you ID: (Ref ##PP-003-524-239-662)
Date: Thu, 17 Apr 2014 18:34:46 +0200
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0094_01C2A9A6.73E49BD6"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20140417163324.E4FCC300342@1.1.com>
To: undisclosed-recipients:;

This is a multi-part message in MIME format.

------=_NextPart_000_0094_01C2A9A6.73E49BD6
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit



Your Account PayPal Has Been Limited !
Dear User ,

You recently tried to pay with PayPal but the transaction was declined because !

You don't make the new Account's Update to your PayPal account.

We understand it may be frustrating not to have full access to your PayPal account. We want to work with you to get your account back to normal as quickly as possible.
As part of our security measures, We request information from you for the following reason:

Our system detected unusual charges to a credit card linked to your PayPal account.

Download the attachment form to verify your Profile information and restore your account.
Make sure you enter the information accurately, and according to the formats required.
Fill in all the required fields.


We thank you for your prompt attention to this matter


*? Green Dot Corporation. Green Dot and MoneyPak are registered trademarks of Green Dot.Usage of this service is subject to identity verification and other controls. This service is being provided by a registered Money Services Business.
Your email preferences are set to receive "News and Promotions".
Please do not reply to this email. We are unable to respond to inquiries sent to this address. For immediate answers to your questions, visit our Help Center by clicking "Help" at the top of any PayPal page.

Copyright ? 2014 PayPal, Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131.

[HTML]
attachment;
filename="#PP-003-524-239-662.html"
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

"PayPal"<No+Replys@paypal.org.il>

Unread postby SlapHappy » Mon May 12, 2014 4:39 am

128.199.247.58 Digitalocean Singapore Singapore

Return-Path: <No+Replys@paypal.org.il>
Received: from www.yughenqwe.net ([128.199.247.58])
by mx.google.com with ESMTP id qe5si5475163pbc.109.2014.05.11.16.56.43
for <multiple recipients>;
Sun, 11 May 2014 16:56:56 -0700 (PDT)
Received-SPF: none (google.com: No+Replys@paypal.org.il does not designate permitted
sender hosts) client-ip=128.199.247.58;
Authentication-Results: mx.google.com;
spf=neutral (google.com: No+Replys@paypal.org.il does not designate permitted sender hosts) smtp.mail=No+Replys@paypal.org.il
Received: from User (localhost [127.0.0.1])
by www.yughenqwe.net (Postfix) with SMTP id 38EDD40334;
Sun, 11 May 2014 19:52:22 -0400 (EDT)
From: "PayPal"<No+Replys@paypal.org.il>
"Subject: Important : Your account has been limited until we hear from you ID:
(Ref #PP-002-054-171-451)
Date: Mon, 12 May 2014 01:54:05 +0200
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_00EB_01C2A9A6.4277BBE2"
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20140511235223.38EDD40334@www.yughenqwe.net>
To: undisclosed-recipients:;

This is a multi-part message in MIME format.

------=_NextPart_000_00EB_01C2A9A6.4277BBE2
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit



Your Account PayPal Has Been Limited !

Hello ,

You recently tried to pay with PayPal but the transaction was declined because !

You don't make the new Account's Update to your PayPal account.

PayPal is constantly working to ensure security by regularly screening the accounts is our
system. We recently reviewed your account, and we need more information to help
How can I restore my account access ?

Download the attachment form to verify your Profile information and restore your account.
Make sure you enter the information accurately, and according to the formats required.
Fill in all the required fields.
We thank you for your prompt attention to this matter





HTML
PP-002-054-171-451..html
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

"PayPal"<No+Replys@paypal.org.il>

Unread postby SlapHappy » Fri May 16, 2014 6:46 am

107.170.5.242 Digital Ocean Oakland United States

Return-Path: <No+Replys@paypal.org.il>
Received: from www.2Einamoracrafts.com ([107.170.5.242])
by mx.google.com with ESMTP id t1si6051753qga.72.2014.05.12.06.48.38
for <multiple recipients>;
Mon, 12 May 2014 06:48:48 -0700 (PDT)
Received-SPF: none (google.com: No+Replys@paypal.org.il does not designate
permitted sender hosts) client-ip=107.170.5.242;
Authentication-Results: mx.google.com;
spf=neutral (google.com: No+Replys@paypal.org.il does not designate permitted
sender hosts) smtp.mail=No+Replys@paypal.org.il
Received: from User (localhost [127.0.0.1])
by www.2Einamoracrafts.com (Postfix) with SMTP id 9E47840359;
Mon, 12 May 2014 09:44:30 -0400 (EDT)
From: "PayPal"<No+Replys@paypal.org.il>
Subject: Important : Your account has been limited until we hear from you ID:
(Ref #PP-002-054-171-451)
Date: Mon, 12 May 2014 15:46:09 +0200
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0084_01C2A9A6.59B67572"
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20140512134430.9E47840359@www.2Einamoracrafts.com>
To: undisclosed-recipients:;

This is a multi-part message in MIME format.

------=_NextPart_000_0084_01C2A9A6.59B67572
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit


Your Account PayPal Has Been Limited !

Hello ,

You recently tried to pay with PayPal but the transaction was declined because !

You don't make the new Account's Update to your PayPal account.

PayPal is constantly working to ensure security by regularly screening the accounts is our
system. We recently reviewed your account, and we need more information to help
How can I restore my account access ?

Download the attachment form to verify your Profile information and restore your account.
Make sure you enter the information accurately, and according to the formats required.
Fill in all the required fields.

We thank you for your prompt attention to this matter

[HTML]
attachment;
filename="PP-002-054-171-451..html"
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

"PPService"<support@ppservice.com>

Unread postby SlapHappy » Fri Feb 13, 2015 5:16 am

* 104.236.122.155 Digital Ocean New York United States

Return-Path: <support@ppservice.com>
Received: from lilessam.com ([104.236.122.155])
by mx.google.com with ESMTP id p9si446638qai.60.2015.02.11.02.57.10;
Wed, 11 Feb 2015 02:57:11 -0800 (PST)
Received-SPF: fail (google.com: domain of support@ppservice.com does not
designate 104.236.122.155 as permitted sender) client-ip=104.236.122.155;
Authentication-Results: mx.google.com;
spf=fail (google.com: domain of support@ppservice.com does not
designate 104.236.122.155 as permitted sender)
smtp.mail=support@ppservice.com
Received: from User (localhost [127.0.0.1])
by lilessam.com (Postfix) with SMTP id B12D140419;
Wed, 11 Feb 2015 05:56:04 -0500 (EST)
Reply-To: <support@ppservice.com>
From: "PPService"<support@ppservice.com>
Subject: your account is blocked
Date: Wed, 11 Feb 2015 18:56:47 +0800
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_00DD_01C2A9A6.56DEA2B4"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20150211105608.B12D140419@lilessam.com>
To: undisclosed-recipients:;




PayPal


Reference #PP-015-839-335-159

Account Status Update Response required
Change your password and security questions Upon receipt

Good Day ,
Thank you for using PayPal.
Recently, there's been activity in your account that seems unusual compared to your normal account activities. Please Download the attachment to confirm your identity and update your password and security questions.

To help protect your account, no one can send money or withdraw money. In addition, no one can add money to your account, add a card, add a bank account, remove any bank accounts, remove credit cards, send refunds, or close your account.
What's going on?

We're concerned that someone is using your account without your knowledge. Recent activity from your account seems to have occurred from a suspicious location or under circumstances that may be different than usual.
What to do

1-Download the attachment form to verify your Profile information and restore your account.
2-Make sure you enter the information accurately, and according to the formats required.
Fill in all the required fields.
What's next?

Let's work together to restore your account. After you complete all of the tasks, we should respond within 72 hours.

Thanks for choosing PayPal. If you need help or have any questions, call us at 1-888-221-1161, 4:00 AM to 10:00 PM Pacific Time Monday through Friday, 6:00 AM to 8:00 PM Pacific Time Saturday and Sunday, Please note that hours of operation may vary on holidays.

Sincerely,
PayPal


This email was sent by an automated system, so if you reply, nobody will see it. To get in touch with us, log in to your account and click "Contact Us" at the bottom of any page.

Copyright © 2015 PayPal, Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131.

PayPal Email ID PP74831 - 4927hkb11d24f
Attachments area

Preview attachment #PP-015-839-335-159.html
[HTML]
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

Next

Return to No clicky clicky. Sites that try to install a virus on your PC.

Who is online

Users browsing this forum: No registered users and 18 guests