Finta mail di PayPal

[winoni71]

Ho ricevuto poco fa una delle tante finte mail da PayPal.
Stavolta sono stati un po' sbadati, questo è quello che ho ricevuto (ho trovato interessante le frasi che ho messo in grassetto, presumo siano comunicazioni interne tra i responsabili).

Content-type: text/html; charset=iso-8859-1
From: PayPal <[email protected]>
Return-Path: [email protected]
X-OriginalArrivalTime: 13 Jun 2015 16:10:34.0016 (UTC) FILETIME=[7A3C6A00:01D0A5F3]


<!--
Here we go some texte here to fuck security 5f62e80430001cc8f6e5f7fa220b740d
what do you think about itbbdaf7580f685c49f0e3e9eaf4615ea1
--><div class="msg"> <table style="font:11px Verdana,Arial,Helvetica,sans-serif;color:rgb(51,51,51)" width="580" border="0" cellpadding="0" cellspacing="0">
<tbody><tr valign="top"> <td colspan="3"> <table width="100%" border="0" cellpadding="0" cellspacing="0">
<tbody><tr valign="top"> <td><a href="https://www.paypal.com/" target="_blank"> <img src="http://images.paypal.com/en_US/i/logo/logo_emailheader_113wx46h.gif" alt="PayPal" border="0"></a></td> </tr> <tr> <td> <img alt="" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="1" border="0" height="10"></td>
</tr> <tr> <td> </td> </tr> </tbody></table> </td> </tr> <tr> <td colspan="3"> <img src="http://images.paypal.com/en_US/i/scr/scr_emailTopCorners_580wx13h.gif" style="vertical-align:bottom" alt="" border="0" height="13"></td>
</tr> <tr> <td style="border-left:1px solid rgb(221,221,221);background:url("http://i/scr/scr_emailLeftBorder_13wx1h.gif") repeat-y left center" width="12">
<img src="http://images.paypal.com/en_US/i/scr/pixel.gif" alt="" border="0"></td> <td style="width:530px;word-wrap:break-word;padding:12px;margin:0pt" width="530"> <table width="100%"> <tbody><tr> <td> <h2> <span style="font-weight:bold;color:rgb(200,128,57);font-size:15px">
Confirm your account with PayPal</span></h2>
</td> </tr> </tbody></table> <p>Dear Member,</p> <p>You account has been temporarily Iimited if you want unlock it </p>
<p>please check it from here <wbr>
</p> <p> <wbr>

<!---Safe url Connection ---->
<a href="http://www.appapaa.com/paypal/update/service/costumer/information/check/" target="_blank">Unlock Your Account </a>
<!---Safelink ---->

</p> <p> </p> <ul> <li>Receive cross-border payments from the many countries that PayPal serves.</li> <li>Withdraw your payments to the bank account you selected.</li> <li>Become verified and remove your spending limit.</li>
</ul> <p>Yours sincerely,<br> PayPal </p></td> <td style="border-right:1px solid rgb(221,221,221);background:url("http://i/scr/scr_emailRightBorder_13wx1h.gif") repeat-y left center" width="12">
<img src="http://images.paypal.com/en_US/i/scr/pixel.gif" alt="" border="0"></td>
</tr> <tr> <td colspan="3"> <img src="http://images.paypal.com/en_US/i/scr/scr_emailBottomCorners_580wx13h.gif" alt="" border="0" height="13"></td>
</tr></tbody></table><table style="padding-top:20px;font:10px Verdana,Arial,Helvetica,sans-serif;color:rgb(51,51,51)" width="580" border="0" cellpadding="0" cellspacing="0">
<tbody><tr>
<td> <div style="margin:5px 0pt;padding:0pt">
<a href="#" target="_blank">
Help Centre</a><span style="color:rgb(204,204,204)"> | </span>
<a href="#" target="_blank">
Resolution Centre</a><span style="color:rgb(204,204,204)"> |
</span><a href="#" target="_blank">
Security Centre</a></div> <p>Please do not reply to this email because we are not monitoring this inbox. To get in touch with us, log in to your account and click
"Contact Us" at the bottom of any page.</p> <p>Copyright © 2015 PayPal Inc. All rights reserved.</p>
<p>Consumer advisory: PayPal Pte Ltd, the Holder of the PayPal™ payment service stored value facility, does not require the approval of the Monetary Authority of Singapore. Consumers (users) are advised to read the
<a href="#" target="_blank">
terms and conditions</a> carefully.</p> <img src="https://102.112.2O7.net/b/ss/paypalglobal/1/G.4--NS/123456?pageName=system_email_PP1429" alt="" width="1" border="0" height="1"><p>
PayPal Email ID PP1629</p></td> </tr></tbody></table><table border="0" cellpadding="0" cellspacing="0" width="171" height="22">
<tbody><tr><td valign="top" height="22" width="171">
</td>
</tr>
</tbody></table>
</div>

[Robotex]

Probabile che il sito da cui è partita la mail sia stato vittima di un attacco. Cercando su Google la stringa in questione ho trovato uno script che genera tali mail.