Paypal scammers, srdev.fr

From : service@paypal.com
Sent : Sunday, August 26, 2007 9:37 PM
Subject : Notification of Limited Account Access

X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - gator33.hostgator.com
X-AntiAbuse: Original Domain - hotmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

Information Regarding Your account:
Dear PayPal Member:

Attention! Your PayPal account has been limited!

As part of our security measures, we regularly screen activity in the PayPal system.We recently contacted you after noticing an issue on your account.We requested information from you for the following reason:

Our system detected unusual charges to a credit card linked to your PayPal account.

Reference Number: PP-259-187-991

This is the Last reminder to log in to PayPal as soon as possible. Once you log in, you will be provided with steps to restore your account access.

Once you log in, you will be provided with steps to restore your account access. We appreciate your understanding as we work to ensure account safety.

Click here to activate your account



We thank you for your prompt attention to this matter. Please understand that this is a security measure intended to help protect you and your account. We apologise for any inconvenience..

Sincerely,
PayPal Account Review Department
Copyright © 1999-2007 PayPal. All rights reserved. PayPal Ltd. PayPal FSA Register Number: 226056.

PayPal Email ID PP059

Protect Your Account Info
Make sure you never provide your password to fraudulent websites.

To safely and securely access the PayPal website or your account, open a new web browser (e.g. Internet Explorer or Netscape) and type in the PayPal login page (http://paypal.com/) to be sure you are on the real PayPal site.

For more information on protecting yourself from fraud, please review our Security Tips at https://www.paypal.com/us/securitytips
Protect Your Password
You should never give your PayPal password to anyone.

Sure, the images linked from paypal's server and the warnings to not give out passwords for fraudulent sites give some authentic look, but why would paypal want you to authenticate to a completely non-paypal website? http://srdev.fr/images/paypal.co.uk/paypal/cgi-bin/webscrcmd=_login-run/webscrcmd=_account-run/updates-paypal/confirm-paypal/index.htm - srdev.fr shows a few other google results for fraud attempts.

Another paypal scam - billingline.com

From: do-not-reply@paypalsecurity.com
Subject: Please Restore Your Account Access
Date: June 9, 2007 1:07:33 PM GMT+01:00
Reply-To: do-not-reply@paypalsecurity.com
Return-Path:
[...] Received: from User ([38.114.33.242]) by smtpgw.armorholdings.com with Microsoft SMTPSVC(6.0.3790.3959); Sat, 09 Jun 2007 08:03:18 -0400
Message-Id:
Mime-Version: 1.0
X-Mimeole: Produced By Microsoft MimeOLE V6.00.3790.3959
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
Content-Type: text/html; charset=Windows-1251
Content-Transfer-Encoding: quoted-printable
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-Priority: 1
X-Msmail-Priority: High
Thread-Index: AceqjirC+y1pkfyfQIaztd797ObJDg==
X-Brightmail-Tracker: AAAAAA==
X-Brightmail-Scanned: yes
Original-Recipient: [my email]
X-Originalarrivaltime: 09 Jun 2007 12:03:18.0157 (UTC) FILETIME=[2AAF7BD0:01C7AA8E]

PayPal is constantly working to ensure security by regularly screening the accounts in our system. We recently reviewed your account, and we need more information to help us provide you with secure service. Until we can collect this information, your access to sensitive account features will be limited. We would like to restore your access as soon as possible, and we apologize for the inconvenience.
Why is my account access limited?

Your account access has been limited for the following reason(s):

June 09, 2007: We have reason to believe that your account was accessed by a third party. Because protecting the security of your account is our primary concern, we have limited access to sensitive PayPal account features. We understand that this may be an inconvenience but please understand that this temporary limitation is for your protection.

(Your case ID for this reason is PP-xxx-xxx-xxx )

How can I restore my account access?

Please visit the Resolution Center and complete the steps to remove limitations.

To complete the verification process you must log in and go to resolution center and unlimit your account.

Of the link (www.domainline.com) we get

Domain Name: BILLINGLINE.COM
Registrar: DSTR ACQUISITION VII, LLC
Whois Server: whois.dotregistrar.com
Referral URL: http://www.dotregistrar.com
Name Server: NS1.EXTRAHOST.ES
Name Server: NS2.EXTRAHOST.ES
Status: clientTransferProhibited
Updated Date: 14-dec-2006
Creation Date: 20-jan-2005
Expiration Date: 20-jan-2008

Registrant, Administrative Contact, Technical Contact, Zone Contact:
Chazelle Christophe (BILLINGLINE-COM-DOM)
ExtraNext On Line consulting S.L.
Paseo Joan de Borbo, 16
Entresuelo, 2a
Barcelona, ES 08003
ES
+34 902955627
+34 935504050
whois@extranext.es

My PayPal info needs to be confirmed - I don't even use PayPal

From: Billing@PayPal.com
Subject: Credit/Debit card update
Date: May 4, 2006 3:51:07 PM GMT+01:00
To: [my email address]
Reply-To: Billing@PayPal.com
Return-Path:
Delivered-To: [my email address]
X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on u15175516.onlinehome-server.com
X-Spam-Level: *
X-Spam-Status: No, score=1.9 required=7.0 tests=HTML_MESSAGE, HTTPS_IP_MISMATCH,MIME_HTML_ONLY autolearn=no version=3.1.0
Received: (qmail 19012 invoked by uid 2020); 4 May 2006 09:51:09 -0500
Received: from unknown (HELO dok.kifee.com) (72.9.246.226) by [my mail service]
Received: from nobody by dok.kifee.com with local (Exim 4.52) id 1FbfAZ-0003ST-KE for [my email]; Thu, 04 May 2006 10:51:07 -0400
Received-Spf: none ([my email service]: domain at dok.kifee.com does not designate permitted sender hosts)
Mime-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id: <....@dok.kifee.com>
X-Antiabuse: This header was added to track abuse, please include it with any abuse report
X-Antiabuse: Primary Hostname - dok.kifee.com
X-Antiabuse: Original Domain - [my email service]
X-Antiabuse: Originator/Caller UID/GID - [99 99] / [47 12]
X-Antiabuse: Sender Address Domain - dok.kifee.com
X-Source:
X-Source-Args:
X-Source-Dir:

Dear Paypal valued member,

Due to concerns, for the safety and integrity of the paypal
account we have issued this warning message.

It has come to our attention that your account information needs
to be updated due to inactive members, frauds and spoof reports.
If you could please take 5-10 minutes out of your online experience and renew
your records you will not run into any future problems with the online service.
However, failure to update your records will result in account suspension
This notification expires on 48.

Once you have updated your account records your paypal account
service will not be interrupted and will continue as normal.

Please follow the link below and login to your account
and renew your account information
https://www.paypal.com/cgi-bin/webscr?cmd=_login-run

Sincerely,
Paypal customer department!

Please do not reply to this e-mail. Mail sent to this address cannot be answered. For assistance, log in to your PayPal account and choose the "Help" link in the footer of any page.

To receive email notifications in plain text instead of HTML, update your preferences here.


Very entertaining that that link https://www.paypal.com/cgi-bin/webscr?cmd=_login-run links to http://66.160.154.156/catalog/paypal/ - instead http://66.160.154.156/ has a redirect to http://66.160.154.156/catalog/ or as its name, http://www.peek-a-book-store.com/.

That gives

Domain Name: PEEK-A-BOOK-STORE.COM
Registrar: REGISTER.COM, INC.
Whois Server: whois.register.com
Referral URL: http://www.register.com
Name Server: NS1.HE.NET
Name Server: NS2.HE.NET
Status: REGISTRAR-LOCK
Updated Date: 22-aug-2005
Creation Date: 20-aug-2005
Expiration Date: 20-aug-2008


IP address 66.160.154.156 -
OrgName: Hurricane Electric
OrgID: HURC
Address: 760 Mission Court
City: Fremont
StateProv: CA
PostalCode: 94539
Country: US

NetRange: 66.160.128.0 - 66.160.207.255
CIDR: 66.160.128.0/18, 66.160.192.0/20
NetName: HURRICANE-7
NetHandle: NET-66-160-128-0-1
Parent: NET-66-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.HE.NET
NameServer: NS2.HE.NET
NameServer: NS3.HE.NET
Comment:
RegDate: 2003-10-09
Updated: 2005-09-27

RTechHandle: ZH17-ARIN
RTechName: Hurricane Electric
RTechPhone: +1-510-580-4100
RTechEmail: hostmaster@he.net

OrgAbuseHandle: ABUSE1036-ARIN
OrgAbuseName: Abuse Department
OrgAbusePhone: +1-510-580-4100
OrgAbuseEmail: abuse@he.net

OrgTechHandle: ZH17-ARIN
OrgTechName: Hurricane Electric
OrgTechPhone: +1-510-580-4100
OrgTechEmail: hostmaster@he.net

And, of course I am going to update my PayPal info to this obnoxious website. After all, I don't even have a PayPal account.

Dear Spammers, I Hate You.

Dear
* Nigerian Bank with only a Hotmail address
* Nigerian millionaire who is living in the concentration camp with T1 speed internet address
* Some Business man in a poor country with millions of dollars to send me with some swanky article linked to BBC webpage in your email
* Anyone who wants to send me millions of dollars from Africa
* Russian or British authority telling me I have won millions of dollars or pounds or euros in a lottery I did not participate to
* some swanky businessman out there telling me about business opportunities / about v1@grA / (iaLi5 / diamond business / some fake internet actions / something else
* Escuela Tántrica anything
* Company that granted me millions of dollars of loan that I did not apply for
* Buyer asking me about an eBay item I have not seen in my life that you are asking me about
* Barrister, Thumba Mulato, Next of Kin, Former President of Nigeria I had never head of
* PayPal buyer asking me about anything - since I don't even have a PayPal account
* Anyone I have never asked to be emailed by for your commercial, spam, religious spam needs or whatever.

For your immmediate mind refreshment: if you happen to be one of these lusers in this mailto list below, I mean especially you.

cletusopanka@yahoo.com.au, biglobe.lee.pang@gmail.com, tjfw4os@izap.com, fredadams100@hotmail.com, lawrence_george3@hotmail.com, daveg@diamondinvestment.com, david_lugard@hotmail.com, daveg@diamondinvestment.com, fred_adams001@hotmail.com, ukonlinenotification2005@msn.com, patrickadams2000@hotmail.com, sunlondon@msn.com, chuksobiora2@yahoo.co.in, abiolaw200555@yahoo.com, h.promotion@virgilio.it, chineduego@universia.net.mx, wst@netzero.net, cbn_contracts_department150@hotmail.com, harrykeem@netscape.net, drsophialoren@unaidsconsultant.net, philgan98@yahoo.co.uk,
nicolenicolejj@netscape.net, christopher_idah@mailbg.com, haruna4b@hotmail.com, gtalotto2@gmail.com, shehu_abubakar@hotmail.com, jamesevans@o2.pl, no.reply_optinsub21093332@optinright.com, lonneylegalfirm@yahoo.co.in, thembamulato9@yahoo.co.in, ohn_williams25@walla.com, hktdlv4f5@hotmail.com, awarddraw@usl8888.com, helenohelen@sify.com, kayojones@netscape.net, susan234@walla.com, hzkyvvvv4f5@hotmail.com, paul_mbekif@yahoo.co.in, mcgarydouglas@netscape.net, olofinjana@teenmail.co.za, grace_morgan_1970@yahoo.fr, sales@bestwebstoreonline.net, skyblue@conlared.com, olofinjana@teenmail.co.za, markgross4agel@comcast.net, internationalloteria@zwallet.com, frv4f5@hotmail.com, princehenry247@yahoo.com, prince247@lovetrain.com, frv4f5@hotmail.com, okadigbow@uku.co.uk, petkwame@zwallet.com, ahmed2trust@jubii.dk, ahmedee2005@hotmail.com, themba1@mailbox.co.za, euro_lotto2005_london1@emsergipe.com, eurolotto05lon@netscape.net, nnbangura1@yahoo.co.in, manewmann@netscape.net, corrymatley@hotmail.com, derek.davis@personal.ro, sans_front02@ny.com, themba1@mailbox.co.za, georgeakinyele@zipmail.com.br, jabumdu@webmail.co.za, chriseze@eresmas.com, johnelokannpc@eramail.co.za, johnelokannpc13@yahoo.co.in, tsouwarin@yahoo.com, Jennygirl740@Usa.com, Jennygirl740@yahoo.ca, lewsike@dearriba.com, themba5@mailbox.co.za, microsoftword@eresmas.com, khumalo_steve@yahoo.com, khumalo_236@hotmail.com, globasicinsuranc@eresmas.com, frankidris004@teenmail.co.za, luisae@eresmas.com, issah_abdoul300@latinmail.com, mgraeme@mscold.com, david_okoh@o2.pl, itlotto@terra.com.mx, moses_moloi@yahoo.com, msjantaylor@globalum.com, msjantaylor2005@walla.com, moses_moloi@yahoo.com, olakaseem68@eresmas.com, james_obi@globalum.com, keen_john11@inmail24.com, keen_john@unlimitedworld.org, james_obi@globalum.com, amed_smith@pleasehelpthechildrenofgod.com, personal007@eresmas.com, el_konam@indiatimes.com, paulguei4@0500mail.com, md-chambers@hotmail.co.uk, info-mdchambers@hotmail.co.uk, williams_okon_10@eresmas.com, willia_okon00@mail2world.com, presidency4@eresmas.com, lagutin87@eresmas.com, sulemanumar@zipmail.com.br, rivmu@kaixo.com, bensonmolefe@hotmail.com, patobi001@eresmas.com, sojiben@zipmail.com.br, sojiben30@yahoo.com, pccs_banker@HOTMAIL.COM, jerrygani@walla.com, felixubah@she.com, infocbnoffice_01@handbag.com, infocbnoffice@bluebottle.com, frank2005@tsamail.co.za, email.frank2000@yahoo.com, ladygoodwin@teenmail.co.za, lisagoodwin@teenmail.co.uk, mrsurulere@zipmail.com.br, mrsurulere_1@mail2world.com, barr_kery@yahoo.com, bnn_innocent@yahoo.com, hdschuen@netscape.net, tony_nzuma@email.lu, abbaabacha2@tiscali.dk, abbaabacha2@yahoo.co.uk,
paulguei1@0500mail.com.

I just wanted to tell you that
* If you live in a concentration camp with a T1 speed Internet access, where can I sign up to get to live there?
* I have zero interest in your viagra, cialis, diamond business, buying some random actions some spammer tolds me to, or sending money to anyone that approaches me over email
* That you really irritate me. The fact that you repeatedly keep spamming me irritates me that much that I want you to get if not unable to reproduce and keep your idiot genes in the gene pool, at least get that poor that you will never ever have an access to a computer so that you could spam me any more, or that you would have a Windows 3.1 with Outlook Express, and getting so millions of spams to the email addresses you have ever used to spam me. I rely on the spam harvesters in this to collect your email addresses, and send you adverts for more viagra, cialis, ephedra, diet pills, anything that makes you lose weight, lose money, get more inches in your p*nis, and at least as many proposals of these Nigerian Banks with a hotmail address, these State Owned lotteries with yahoo or other free email address, and to get also all the Blonde, Educated Russian Or Other Eastern European Ladies Who Want You To Marry For Money. I ALSO HOPE THAT PEOPLE WILL USE THE CAPS LOCK AS WELL AS YOU HAVE USED IT FOR ALL THESE YEARS. I HOPE YOUR DAUGHTER WILL HAVE PREMARITAL SEX WITH A PERSON OF THE RACE AND SEX YOU DO NOT APPROVE. I HOPE YOU WILL GET NIGHTMARES OF SPAM, AND ALL THAT YOU WILL BE EATING FOR THE REST OF YOUR LIFE, IS CANNED SPAM.
* AND, AS THE LAST POINT, THAT I REALLY REALLY HATE THE ABUSIVE USE OF CAPS LOCK, EVEN IF IT IS USED IN YOUR WHATEVER REASONS.
* I very kindly ask you to leave me the f*** alone, and select some other people in the mailto: list above in this webpage to entertain you. Imagine if all you Nigerians are so rich, just unite and you could buy Saudi Arabia and a few states of USA if all your monetary investments were united.
* That if you really have millions of dollars and are still stupid enough to live in a concentration camp, I hope you die. Painfully.