[nsp-sec] PayPal phishing scam - any contacts?

[Joel Rosenblatt]

Hi,

A paypay fake login at <http://guijarro-hnos.es/cmd/>

Phishing email below.

Thanks,
Joel

Joel Rosenblatt, Manager Network & Computer Security
Columbia Information Security Office (CISO)
Columbia University, 612 W 115th Street, NY, NY 10025 / 212 854 3033
http://www.columbia.edu/~joel


-------- Original Message --------
From: 	- Thu Jul 09 13:32:26 2009
X-Mozilla-Status: 	0001
X-Mozilla-Status2: 	00000000
Return-Path: 	<service at unc.edu>
Received: 	from lmtpproxyd (mockmeat-eth1.cc.columbia.edu
[128.59.33.169]) by bregenwurst.cc.columbia.edu (Cyrus v2.3.13) with
LMTPA; Thu, 09 Jul 2009 13:25:01 -0400
X-Sieve: 	CMU Sieve 2.3
Received: 	from mockmeat.cc.columbia.edu ([unix socket]) by
mail.columbia.edu (Cyrus v2.3.13) with LMTPA; Thu, 09 Jul 2009 13:25:00
-0400
X-Sieve: 	CMU Sieve 2.3
Received: 	from jujube.cc.columbia.edu (jujube.cc.columbia.edu
[128.59.28.170]) by mockmeat.cc.columbia.edu (8.13.1/8.13.1) with ESMTP
id n69HP08q007204; Thu, 9 Jul 2009 13:25:00 -0400
Received: 	from relais.videotron.ca (relais.videotron.ca
[24.201.245.36]) by jujube.cc.columbia.edu (8.14.3/8.14.3) with ESMTP id
n69HOt7d026218; Thu, 9 Jul 2009 13:25:00 -0400 (EDT)
MIME-version: 	1.0
Content-transfer-encoding: 	7BIT
Content-type: 	text/html; charset=koi8-u
Received: 	from User ([70.83.225.238]) by VL-MO-MR002.ip.videotron.ca
(Sun Java(tm) System Messaging Server 6.3-4.01 (built Aug 3 2007;
32bit)) with SMTP id <0KMI00HLEZ14GS10 at VL-MO-MR002.ip.videotron.ca>;
Thu, 09 Jul 2009 13:24:55 -0400 (EDT)
Message-id: 	<0KMI00HLHZ15GS10 at VL-MO-MR002.ip.videotron.ca>
Reply-to: 	noreply at support.com
From: 	service <service at unc.edu>
Subject: 	Notice
Date: 	Thu, 09 Jul 2009 13:24:53 -0400
X-Priority: 	3
X-MSMail-priority: 	Normal
X-Mailer: 	Microsoft Outlook Express 6.00.2600.0000
X-MIMEOLE: 	Produced By Microsoft MimeOLE V6.00.2600.0000
To: 	undisclosed-recipients:;
X-Spam-Score: 	4.863 (****) CU_OK_AR_OUTLOOK CU_SHORTSPAM4
FORGED_MUA_OUTLOOK FORGED_OUTLOOK_HTML FORGED_OUTLOOK_TAGS HTML_MESSAGE
HTML_MIME_NO_HTML_TAG MIME_HTML_ONLY TVD_PH_SUBJ_META
X-Scanned-By: 	MIMEDefang 2.65 on 128.59.28.170



We regret to inform you that access to your account has been temporarily limited.

This has been done due to several failed log-in attempts.

To restore your account please log in correctly
<http://guijarro-hnos.es/cmd/>.

If you fail to log in correctly your account will be suspended for fraud prevention.

You will be able to register again for PayPaI only after you authenticate your profile.

We apologize for the inconvenience, this measure was taken for your protection.

PayPaI Security Team