Received another of those fake paypal emails this morning. Getting three a week now, very annoying.

Decided to look at this one a little closer.

This is the link the mail provided:

UPDATE YOUR INFORMATION HERE : https://www.paypal.com/update

This takes you to:

Domain ID162340872-LROR
Domain Name:RENOULT.ORG
Created On:23-May-2011 07:08:27 UTC
Last Updated On:23-Jul-2011 03:49:38 UTC
Expiration Date:23-May-2012 07:08:27 UTC
Sponsoring Registrar:Online SAS (R99-LROR)
Status:CLIENT TRANSFER PROHIBITED
Registrant ID:BMN-475564
Registrant Name:jean-claude RENOULT
Registrant Street1:WHOIS PROXY PRIVACY
Registrant Street2:Chez ONLINE - BP 438
Registrant Street3:
Registrant City:PARIS
Registrant State/Province:
Registrant Postal Code:75366
Registrant Country:FR
Registrant Phone:+33.899193788
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:[IMG]file:///C:\DOCUME~1\Farrahy\LOCALS~1\Temp\msohtml1\01\clip _image002.jpg[/IMG]Admin ID:BMN-194612
Admin Name:Loic QUEVA
Admin Organization:E-SolutionsWeb
Admin Street1:3 R petit pavillon
Admin Street2:
Admin Street3:
Admin City:Montfort le Gesnois
Admin State/Province:
Admin Postal Code:72450
Admin Country:FR
Admin Phone:+33.272919549
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:[IMG]file:///C:\DOCUME~1\Farrahy\LOCALS~1\Temp\msohtml1\01\clip _image004.jpg[/IMG]Tech ID:BMN-194612

This redirects you to:

Premier Account Sign Up - PayPal

The website at aulas.org.br has been reported as a “phishing” site. Phishing sites trick users into disclosing personal or financial information, often by pretending to represent trusted institutions, such as banks.

AULAS.ORG.BR is hosted in the US by:

HostDime owns and operates its own data center in Orlando, Fla.

With a client base of more than 700,000 hosted domains on 3,000 servers, HostDime presently ranks among the top 50 biggest web hosting companies in the world and is a pioneer in Global Web Hosting.

Online fraud either blatantly ignoring the most simple security of somebody is using these sites to front the scam. Either way HostDime do not seem to be doing a thing about it.

I thought, what if the joint knowledge of the people posting and visiting here was used to find out more about this annoying and nasty ( The final site gets 95 hits a day and it is one of many) attack on ordinary people.

We all get these mails telling us to update our details etc. Can we put our differences aside and have a common goal. Track these people down.

Jaysus Da Bert must be really strapped for cash this time!

It's like putting your finger in a dam to stop the coming bursting dam....the dam is already bursting and all the fingers you can muster will only stop a drop as the rest of the torrent rushes around you.

Florida also has more spammers per sq. foot than any other place on earth.

Good post & thread. It'll become particularity relevant later on this week once the Irish medjia do their jobs.

I like responding to the lads offering me millions. It's great craic, leading them on and annoying them.

Originally Posted by DeputyEdo

I like responding to the lads offering me millions. It's great craic, leading them on and annoying them.

I started one recently, I noticed that once I responded the email address changed as I was passed on from an opener to a handler.

I annoyed him when I called him a poor beggar

There may be many who have no idea of how to track a scam email.

So, this is the how of it.

When you mouse over a link in your email look in the left of the bottom bar. This will show you the real address you are going to.

Note that down and then go to a URL spy site, I use URLSPY.org. write or paste the address you have and the site will give you chapter and verse. See sample I posted at start of the thread.

Now, look at the country the server is in, this tells you what jurisdiction you will need to report the site to to get it shut down.

If enough of us do this we can make a difference and that makes it worth your time.

I had a lengthy exchange from a spammer purporting to be my sister. It was the usual "my phone and cards have been stolen and I need money for my hotel can you wire me some?" deal.

To bait the hook I replied to her that she didn't need to ask, what with me owing her €50k which she had lent me to help me start a business.

They fell for it, hook,, line and sinker, and despite my warnings to her to avoid contact with those "filthy, lazy criminals in Nigeria (I even used the N-word liberally) they tried to keep me sweet. No matter what abuse I sent to my "sister", they stayed keen - even saying - as my "sister", of course - that the Nigerians were exactly as described. I loved the thought of them typing that.

I eventually set up a handover of the €50k and sent the Nigerian police a copy of the details of the handover. I doubt that they did anything, but I never got a "you never turned up" mail, so maybe something was done.