While I understand that <removed> is a SMS short-code owned by PayPal. SMS is able to be spoofed.
Is the domain py.pl owned by PayPal, and actively used by PayPal in their SMS messages? The WHOIS info for that domain in no way indicates that it's a legit PayPal domain.
... View more
