Phishing PayPal email includes web form

One of the latest phishing emails with the subject “PayPal Forma ID PP697″ caught our attention because of the fact that it included a complete HTML form inside the email. The phishing is regarding a refund request and the amount would be transferred to your credit card within 5 or 7 days.

The form seduces you to submit not only your credit card details but also your email and PayPal password. This could directly lead to the hacking and abuse of your PayPal account.

The form sends the filled in details to the host hxxp://www.swisstools.net/mailform.asp and when processed it will redirect you to the Italian PayPal web site. When we tested this we got a Microsoft OLE DB Provider for ODBC Driver error as a result.

World Business Guide is using misleading marketing trick

Today, MX Lab received an email regarding the “World BusinessGuide” directory. At first there seems nothing wrong with the mailing but when looking further there are some points that need your attention.

The messages is from “World Business Register” with different email addresses in use:

info@easyhomecorporation.com
info@easycitycorporation.com
info@bigorganization4you.com
www@companyregpro.net
www@companyregstore.net
www@easycompregonline.com
www@bestcompregpro.com

The subject is “Business Registration 2009/2010″. The body of the email:

Ladies and Gentlemen.

In order to have your company inserted in the registry of World Businesses
for 2009/2010 edition, please print, complete and submit the enclosed
form (PDF file) to the following address:

WORLD BUSINESS GUIDE
P.O. Box 2021
3500 GA Utrecht
The Netherlands

email: register@wbgtoday.net
FAX: +31 20 524 8107

Updating is free of charge!

If you are not the intended recipient, please submit an email to
unsubscribe@wbgtoday.net
Your request shall be dealt with accordingly.

Attached is a PDF document that needs to be printed, filled in and sent to an PO Box address in The Netherlands.

When reading the PDF document carefully you can find the following:

I WILL HAVE AN INSERTION INTO ITS DATA BASE FOR THREE YEARS. THE PRICE PER YEAR IS EURO 995.

While the email itself states “Updating is free of charge!” you will have to pay € 995 each year with a minimum 3 year period by signing the document. This is quite misleading if you ask me.

A few more observations that should warn you about a possible scam:

  • the email is sent from easyhomecorporation.com while there is no web site on this place so the registration of this domain is purely for spoofine the real origin.
  • and more important, the document needs to be sent to a PO Box in The Netherlands while the company is International Directories Group Ltd  located in Spain according to the document.

In the past we have received similar letters by regular post here in Belgium and some organisations like Unizo have instructions (in Dutch) on how to report the illegal and deceptive practices to the authorities.

If you have received such a email, or regular mail, don’t sign the document, sent it to the trash or report to your local authorities.

[Update March, 9th 2010] MX Lab received a new registration PDF from the World Business Directory. Read the article.

Follow

Get every new post delivered to your Inbox.

Join 109 other followers