Fake Paypal verification email

Heres what i got in my inbox earlier today:

image paypal-phishingpng.png![image paypal-phishingpng.png](https://tlscommunity.com/assets/2019-07-17/04:43:200-paypal-phishingpng.png)

Link: https://linkedin.com/slink?code=f_8dXYe?23011
Seems to be a linkedin redirect link. Already reported website so it should be down very soon.

It has multiple redirects designed to confuse search engines and prevent cache logging.

[quote]

>>> LinkedIn: Log In or Sign Up

>


--------------------------------------------
>

301 Moved Permanently
> --------------------------------------------


Status: 301 Moved Permanently
Code: 301
Date: Wed, 17 Jul 2019 05:47:48 GMT
X-Li-Pop: prod-edc2
X-LI-Proto: http/1.0
Location: https://www.linkedin.com/slink?code=f_8dXYe?23011
Content-Length: 0

>>>

LinkedIn: Log In or Sign Up

>


--------------------------------------------
>

301 Moved Permanently
> --------------------------------------------


Status: 301 Moved Permanently
Code: 301
Server: Apache-Coyote/1.1
Location: https://invoices-cancelpr.myftp.org
Content-Length: 0
Vary: Accept-Encoding
Date: Wed, 17 Jul 2019 05:47:47 GMT
Expect-CT: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
Strict-Transport-Security: max-age=2592000
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: sameorigin
X-Li-Fabric: prod-lor1
Set-Cookie: lidc="b=OGST07:g=1218:u=1:i=1563342558:t=1563428958:s=AQFnE3-Jnq7mqDP0lUFte8zi6mN3_4HG"; Expires=Thu, 18 Jul 2019 05:49:18 GMT; domain=.linkedin.com; Path=/
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store
X-Li-Pop: prod-tln1
X-LI-Proto: http/1.0
X-LI-UUID: /pqTC8YbshXgQosQqisAAA==

>>>

https://invoices-cancelpr.myftp.org

>


--------------------------------------------
>

302 Found
> --------------------------------------------


Status: 302 Found
Code: 302
Date: Wed, 17 Jul 2019 05:47:43 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=9092fe12211f243b45b5cea5542c3541; path=/
Location: signin?country.x=DE&locale.x=de_DE
Connection: close
Content-Type: text/html; charset=UTF-8

>>>

https://invoices-cancelpr.myftp.org/signin?country.x=DE&locale.x=de_DE

>


--------------------------------------------
>

302 Found
> --------------------------------------------


Status: 302 Found
Code: 302
Date: Wed, 17 Jul 2019 05:47:45 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=10fc41baeaa168589ecb8fda0c80dab5; path=/
Location: success
Connection: close
Content-Type: text/html; charset=UTF-8

>>>

https://invoices-cancelpr.myftp.org/success

>


--------------------------------------------
>

302 Found
> --------------------------------------------


Status: 302 Found
Code: 302
Date: Wed, 17 Jul 2019 05:47:45 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=36797d00ad8220afb3efc7776b4b2067; path=/
Location: https://href.li/?https://www.paypal.com//webapps/mpp/paypal-safety-and-security
Connection: close
Content-Type: text/html; charset=UTF-8

>>>

href.li

>


--------------------------------------------
>

200 OK
> --------------------------------------------


Status: 200 OK
Code: 200
Server: nginx
Date: Wed, 17 Jul 2019 05:47:51 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Strict-Transport-Security: max-age=31536000
Vary: Accept-Encoding
X-ac: 3.fra _dfw

[/quote]

I also reported it, hopefully it is shut down soon.

@Rajeshi_Gardner#99418 Wow, that was quick!

[b]This Account has been suspended.[/b]