Fake Email "Attention: Your PayPal account has been violated!"

[Shimerin]

Hi All,

New here but not new to fake emails from Paypal aka some guy possibly called carlos leyan as when I right the update online link this creature has provided and I go to properties his forward to address shows http://www.carlosleyan.com/home/index.php  strange that looks nothing like paypal.

The IP address he has provided of the attacker is from Canada 204.225.126.8 but he could have made that up, or is it possible he used his own, anyway folk I am sure you wont be fooled into clicking these fakes..

Be Safe

Shim

[Schaggy]

I just received one of the most believable phishing emails I've ever seen (I'm an IT pro, so I see a lot) with this subject line. The link forwarded me to a page at promeps.com - a quick WHOIS gives me the following:

Registrant:
 Sarp Keskin
 Akyol Sokak 12/9 Gazi Mahallesi Yenimahalle ANKARA
 Ankara, Yenimahalle 06560
 TR

 Domain name: PROMEPS.COM


 Administrative Contact:
    Keskin, Sarp  <email disallowed by forum>
    Akyol Sokak 12/9 Gazi Mahallesi Yenimahalle ANKARA
    Ankara, Yenimahalle 06560
    TR
    +90.3122124773    Fax: +90.3122124773

 Technical Contact:
    Keskin, Sarp  <email disallowed by forum>
    Akyol Sokak 12/9 Gazi Mahallesi Yenimahalle ANKARA
    Ankara, Yenimahalle 06560
    TR
    +90.3122124773    Fax: +90.3122124773



 Registration Service Provider:
    Markum.net, <email disallowed by forum>
    +90.2166518480
    http://www.markum.net
    Bu domain Markum.net'ten tescil edilmistir.


 Registrar of Record: TUCOWS, INC.
 Record last updated on 19-May-2012.
 Record expires on 19-May-2013.
 Record created on 19-May-2012.

 Registrar Domain Name Help Center:
    http://tucowsdomains.com

 Domain servers in listed order:
    DNS2.MARKUM.NET   
    DNS1.MARKUM.NET   

The website looks very believable. Don't be fooled.

[JohnnysCharger]

Me too.  The link in the e-mail goes to hXXp://rb-rb.net/wp-admin/includes/redchrome.php