What actually happens when you click on a link within a “PayPal” email? Here is one example.

Spoofed eBay or PayPal emails have been around for at least ten years and are one of the most common. Most people have caught up to the fact they are phoney but over the years the temptation is getting greater to open the email. All because the writers are getting into people’s heads.


The email claiming you have received funds.


Second half of the email.


This is what happens when you click on the link. An exe requests to be downloaded – double extension of course to try and trick you. Zbot Trojan family – Virus Total review @ http://mcaf.ee/lfibx


Within the website is a simple operating system detection script. If you are using Windows it sends you to: http://**.76.**.78/p2p/PP_detalis_726716942049.pdf.exe. Else go to Google as above. The initial URL (now cleaned up is): http://******************.com.hk/PP_det.html. PP det stands for PayPal detection.