MX Lab is intercepting phishing messages that target PayPal users. The email comes from the spoofed address
“Pay Pal.Inc” <Account0909Sur@pay.com> with the subject “Confirm refund request – Identity Verification”.

The contents of the email:

Dear client,PayPal

CONGRATULATIONS!

You have been chosen by the Online Department to take part in our survey.
In return we will credit $99.0 to your account – Just for your time!

SERVICE: PayPal .Inc Online®
EXPIRATION: October – 29 – 2009

hxxp://www.developmentalfun.com/attachments/paypal.eu/index.php

2009 PayPal ® All Rights Reserved

MEOEXQPRKZJCHFGZMHONBBPUQDRLGHPYOORBYS

Following the link brings you to the phishing site with a similar interface to the original PayPal site.

Notice that the phishing site is hosted on a non PayPal domainn, has no HTTPS connection. When filling in a fake login and password I go to the page hxxp://www.developmentalfun.com/attachments/paypal.eu/login.php with the known PayPal progress bar and get a redirect to hxxp://www.developmentalfun.com/attachments/paypal.eu/Revalidate.htm?cmd_submitaccess0023044.submit=data_refund. This is where I need to fill in personal details for the refund. Yeah, right.

When filling in the form with fake data I receive the page hxxp://www.developmentalfun.com/attachments/paypal.eu/thankyou.html?RXZlbnQyIE9jdDI3RXZlbnQyIE9jdDI3 and get a redirect to the official PayPal web site. There is no check wether my social security number, credit card number and CVV2 is valid.

If you have used your real login, password and other details you are screwed by now. At this point the people behind the phishing site now know your details and can go into your PayPal account and get what they need. So it’s not recommended to do such things as I just did.

The navigation at the top doesn’t point to PayPal but to hxxxp://216.104.169.200/login/webscr.html but I got an Internal Server Error. The web site itself is hosted on the server listening to the IP 64.49.206.169. Now the web site http://www.developmentalfun.com/ is a valid one so this hosting account seems to be hacked and is hosting the phishing pages.