Website: https://paypal-ref236186301836.com/ and http://paypal.uk-online-help-centre.com/
Creates a new session id for each visit and steal peoples login information, address, and more.
They’re smarter than the average bear. They were accepting connections from Tor exit nodes, but recently stopped. They’re still operating their scam, but seem to have noticed suspicious traffic from Tor.
