A Good Example of Parked Domain
www.Paypal-resolution.com

Whois Record
Registrant:
Domain Discreet
ATTN: paypal-resolution.com
P.O. Box 278
Yarmouth, NS B5A 4B2
CA
Email:

Registrar Name....: REGISTER.COM, INC.
Registrar Whois...: whois.register.com
Registrar Homepage: www.register.com

Domain Name: paypal-resolution.com

Created on..............: Sat, Apr 05, 2008
Expires on..............: Sun, Apr 05, 2009
Record last updated on..: Sat, Apr 05, 2008

Administrative Contact:
Domain Discreet
ATTN: paypal-resolution.com
P.O. Box 278
Yarmouth, NS B5A 4B2
CA
Phone: 1-902-7495331
Email:

Technical Contact:
Domain Discreet
ATTN: paypal-resolution.com
P.O. Box 278
Yarmouth, NS B5A 4B2
CA
Phone: 1-902-7495331
Email:

DNS Servers:

dns038.c.register.com
dns010.d.register.com
dns044.a.register.com
dns132.b.register.com

* More about 'phishing' attacks
* Back to previous page
* How to override this warning

FIRST REGISTERED

Main Content
Paypai.com on 2003-06-07 - Domain History
Next »
Domain: paypai.com - Domain History
Cache Date: 2003-06-07
Registrar: BULKREGISTER.COM, INC.
Registrant Search: Click on an email address we found in this whois record
to see which other domains the registrant is associated with:
askmysite@aol.com

Bulkregister.com for information purposes only, that is, to assist you in

AskMySite.com
3720 Ave L
Brooklyn, NY 11210
US

Domain Name: PAYPAI.COM

Administrative Contact:
Send Your Offer - AskMySite@aol.com
AskMySite.com
Reserved Domain Names - Send your offer!
Cresskill, NJ 07626
US
Phone: +1(347)823-1286
Fax: +1(347)823-1286
Technical Contact:
Send Your Offer - AskMySite@aol.com
AskMySite.com
Reserved Domain Names - Send your offer!
Cresskill, NJ 07626
US
Phone: +1(347)823-1286
Fax: +1(347)823-1286

Record updated on 2002-08-18 00:45:52
Record created on 2002-08-18
Record expires on 2003-08-18
Database last updated on 2003-06-07 05:05:46 EST

Domain servers in listed order:

NS1.MYDOMAIN.COM 64.94.117.195
NS2.MYDOMAIN.COM 216.52.121.228
NS3.MYDOMAIN.COM 66.150.161.130

Paypai.com on 2005-10-05 - Domain HistorY

« Previous Next »
Domain: paypai.com - Domain History
Cache Date: 2005-10-05
Registrar: MONIKER ONLINE SERVICES, INC.
Registrant Search: Click on an email address we found in this whois record
to see which other domains the registrant is associated with:
paypai.com@domainservice.com

Domain Name: PAYPAI.COM

Registrant [162392]:
Moniker, Privacy Services PAYPAI.COM@domainservice.com
Moniker Online Services, LLC.
20 SW 27th Ave.
Suite 201
Pompano Beach
FL
33069
US

Administrative Contact [162392]:
Moniker, Privacy Services PAYPAI.COM@domainservice.com
Moniker Online Services, LLC.
20 SW 27th Ave.
Suite 201
Pompano Beach
FL
33069
US
Phone: +1.9549848445
Fax: +1.9549699155

Billing Contact [162392]:
Moniker, Privacy Services PAYPAI.COM@domainservice.com
Moniker Online Services, LLC.
20 SW 27th Ave.
Suite 201
Pompano Beach
FL
33069
US
Phone: +1.9549848445
Fax: +1.9549699155

Technical Contact [162392]:
Moniker, Privacy Services PAYPAI.COM@domainservice.com
Moniker Online Services, LLC.
20 SW 27th Ave.
Suite 201
Pompano Beach
FL
33069
US
Phone: +1.9549848445
Fax: +1.9549699155

Domain servers in listed order:

NS3.MONIKER.COM 64.49.213.233
NS4.MONIKER.COM 64.49.213.241

Record created on: 2005-08-12 02:52:57.0
Database last updated on: 2005-09-01 16:03:09.25
Domain Expires on: 2006-08-18 00:45:52.0

PayPal alert! Beware the 'Paypai' Scam
Bob Sullivan, Technology News

A scam artist last night created an exact replica of PayPal.com and used the fake site to attempt to pilfer user names and passwords from customers of the online payment system. The site, deceptively named PayPai.com, was a convincing duplicate of the real thing - but according to Network Solutions Inc., Paypai.com is registered to Birykov Inc. in South Ural, Russia.

However, by 10:45 a.m. Pacific Time the copycat site was down. Meanwhile, a spokesperson for PayPal "guaranteed" that "no PayPal user will lose money as a result of this incident."

PayPal, with 2.6 million customers, is easily the largest online payment system designed to support online auction users. Customers set up accounts so they can transfer funds back and forth without having to wait for personal checks to clear or money orders to be delivered. Most customers currently pay nothing for the service, which considerably speeds up the auction buying process.

But in this case, a scam artist has apparently discovered a way to dupe PayPal users by dangling a large payment in front of them. "X.com (PayPal's parent company) has notified law enforcement of the fake site and efforts to steal password information," said spokesperson Vince Sollitto. "We have taken steps to prevent this person from withdrawing money from the PayPal system."

Not only was "Paypai.com" very convincing, but the scam artist goes even one step further. He or she is apparently e-mailing PayPal customers, saying they have a large payment waiting for them in their account. The message then offers up a link, urging the recipient to claim the funds. But the URL that is displayed for the unwitting victim uses a capital "i," (I), which looks just like a lowercase "L," (l), in many computer fonts.

So, when the victim clicks on that link, he or she is directed to a copycat login page that's really sitting on a British Web hosting service called "Easypost." If the victim does log in, the user name and password are sent to the scam artist. E-mails to Easypost were not immediately returned.

Thursday, on a message board devoted to PayPal, several users confessed they'd been tricked into logging in but got suspicious and changed their account information soon after.

"Well color me stupid. I read half your message (warning of the scam), then went over and checked it out. I logged in and then came back and read the rest," wrote one. "Can someone say IDIOT!! I immediately went to the real PayPal and changed my password. Oh well, silly me."

No users reported noticing any PayPal funds had actually been stolen as a result of the scam.

Armed with the user name and password, a scam artist could possibly drain a victim's PayPal account. PayPal did not immediately respond to inquiries, but both that company and Easyhost had been notified of the scam by late Wednesday, according to writers on the Internet message board.

According to one user, the enticing e-mail read like this:

Michael Swenson just sent you money with PayPal. Amount: $827.46 Click here to get you new account bonus! http://www.PayPaI.com/bonus Did you know you can earn money with the PayPal Refer-a-Friend program? Go to http://www.Pay-Pal.com/specialoffers for more details. To view your PayPal balance
or other account information, log in at http://www.PayPaI.com/login

paypai3.jpeg

Header Analysis

Welcome, traveller! You appear to be from United States.

The following IP addresses were extracted from your headers:
IP Address Probable Country Additional Info
69.94.64.194 United States* Whois Google
41.249.122.238 Morocco* Whois Google
* The last IP listed is usually the originating IP address

Here is the text you submitted, with the IP addresses highlighted:

Delivered-To: scamfraudalert@gmail.com
Received: by 10.142.214.16 with SMTP id m16cs289323wfg;
Mon, 7 Apr 2008 13:59:00 -0700 (PDT)
Received: by 10.140.126.14 with SMTP id y14mr1864113rvc.59.1207601940246;
Mon, 07 Apr 2008 13:59:00 -0700 (PDT)
Return-Path:
Received: from mail5.national-net.com (nat606.national-net.com [66.115.129.71])
by mx.google.com with ESMTP id 7si12832981ywo.1.2008.04.07.13.58.59;
Mon, 07 Apr 2008 13:59:00 -0700 (PDT)
Received-SPF: neutral (google.com: 66.115.129.71 is neither permitted nor denied by best guess record for domain of accounts@paypai.com) client-ip=66.115.129.71;
Authentication-Results: mx.google.com; spf=neutral (google.com: 66.115.129.71 is neither permitted nor denied by best guess record for domain of accounts@paypai.com) smtp.mail=accounts@paypai.com
Received: from thunder.host4u.net (thunder.host4u.net [69.94.64.194])
by mail5.national-net.com (Postfix) with ESMTP id 996161DDB2
for ; Mon, 7 Apr 2008 16:58:59 -0400 (EDT)
Received: from User ([41.249.122.238])
(authenticated bits=0)
by thunder.host4u.net (8.13.7/8.13.7) with ESMTP id m37KsldK018553;
Mon, 7 Apr 2008 16:54:49 -0400
Message-Id: <200804072054.m37KsldK018553@thunder.host4u.net>
Reply-To:
From: "accounts@paypaI.com"
Subject: Please Update Your Informations !
Date: Mon, 7 Apr 2008 22:55:19 +0200
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"

paypai2.jpeg