Site as a PayPal Phishing Gateway

Just got myself one of these PayPal phishing emails this morning. It was a very well made email sent to an email address for my partner company in the Netherlands . In the email I was told I had to re-enter details of my PayPal account to keep my unlimited verified status. This I could do by updating my details online.

Phishing Email

Here is the entire email text (click to enlarge screenshot):

paypal phishing

Site behind the email

The site leads to a site faking PayPal and asking for password. After entering these details, you are asked to enter all your personal details as well.

Here a curl report using Google Chrome as user agent:

curl -A "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.112 Safari/534.30"
<META http-equiv="refresh" content="1;URL=">
<html dir="rtl">
<meta http-equiv="Content-Language" content="en-us">
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<base href="">

Site Redirect

That page has a meta refresh:

which leads to an url with the same domain . A whois for that domain runs into an error:

whois -h
GeekTools Whois Proxy v5.0.5 Ready.
Checking access for ok.

Checking server []
The GeekTools Whois Proxy has encountered an error:
Unable to connect to the specified registry

Please try your query again later.

The same goes for . When I curled this domain I did get data. I found out it was a WordPress website. The file – wp-account.php – redirecting to must be on his site.

Google Research on site

Google is your friend and after a brief research I found more details. (Chilean site) – the site the fake PayPal resides with – seems to have been hacked beginning this year by hackers. Not sure if they added this phishing page as well. The phishing has already been reported to PayPal by us and PayPal has replied:

Thanks for forwarding that suspicious-looking email. You’re right – it
was a phishing attempt, and we’re working on stopping the fraud. By
reporting the problem, you’ve made a difference!

Identity thieves try to trick you into revealing your password or other
personal information through phishing emails and fake websites. To learn
more about online safety, click “Security Center” on any PayPal webpage.

Every email counts. When you forward suspicious-looking emails to, you help keep yourself and others safe from identity

Your account security is very important to us, so we appreciate your
extra effort.



Phishtank Mention

The site is mentioned here at Phishtank. Phishtank is a site that keeps track of sites hacked for phishing purposes. It did get whois data of the phishing site:

Network (AS32613 iWeb Technologies Inc.)

ACE: (RFC-3490, RFC-3491, RFC-3492)


Contacto Administrativo (Administrative Contact):
    Organizacion: Particular

Contacto Tecnico (Technical Contact):
    Organizacion: Particular

Servidores de nombre (Domain servers): ( (

Altima modificacion al formulario
    (Database last updated on): 06 de diciembre de 2011 (18:19:13 GMT)

Mas informacion (More information):

Este mensajes esta impreso en ISO-8859-1
(This message is printed in ISO-8859-1)


Hackers try to hack into websites on a daily basis. Not only to add spam, but also to use your site as a phishing website. That is why it is important to always keep your website updated and use the best server security possible. Never ever reply to email like these and if you did and realized it, report it as soon as possible and change your password immediately.

Tagged in : Tagged in : ,
Jasper Frumau

Jasper has been working with web frameworks and applications such as Laravel, Magento and his favorite CMS WordPress including Roots Trellis and Sage for more than a decade. He helps customers with web design and online marketing. Services provided are web design, ecommerce, SEO, content marketing. When Jasper is not coding, marketing a website, reading about the web or dreaming the internet of things he plays with his son, travels or run a few blocks.