As requested I have shown below the complete internet header for the FAKE PAYPAL MESSAGE. I hope that this helps others to avoid this scumbag. I have deleted references to my e-mail address and replaced them with the word "me".
I see that he also uses the e-mail address:
[email protected]Envelope-to: me
Received: from [10.103.250.125] (helo=out.ip21nec.int.opaltelecom.net)
by mailin11nec.int.opaltelecom.net with esmtp id 1VWgXW-00007d-8a
for me; Thu, 17 Oct 2013 06:54:30 +0100
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AsHGAN15X1LRVdnClGdsb2JhbABaAQIIAoI2TxoTUqxcAZI9CBYOAQEBAQcLCwkSKoEvAQFZAQExLwEHEQgZAw0FECILMBIBBQE1h3MBAw8MmgNnAoJmAiFUgjCPX1uDRwMjJw2JZQEFDIZ6hXaBDIFaDIJggS8DhVCSNoEvjmkYKYFkgmw7gTQLAQEBAwEBgSE
X-IPAS-Result: AsHGAN15X1LRVdnClGdsb2JhbABaAQIIAoI2TxoTUqxcAZI9CBYOAQEBAQcLCwkSKoEvAQFZAQExLwEHEQgZAw0FECILMBIBBQE1h3MBAw8MmgNnAoJmAiFUgjCPX1uDRwMjJw2JZQEFDIZ6hXaBDIFaDIJggS8DhVCSNoEvjmkYKYFkgmw7gTQLAQEBAwEBgSE
Subject: [SUSPECTED SPAM] *** Payment Payment Confirmation **
X-IronPort-AV: E=Sophos;i="4.93,512,1378854000";
d="scan'208";a="246038324"
Received: from mail-lb0-f194.google.com ([209.85.217.194])
by in.ip21nec.int.opaltelecom.net with ESMTP; 17 Oct 2013 06:54:30 +0100
Received: by mail-lb0-f194.google.com with SMTP id z5so331994lbh.1
for <me>; Wed, 16 Oct 2013 22:54:29 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20120113;
h=mime-version:sender:date:message-id:subject:from:to:content-type;
bh=Aeof4EG6L3qxG7/MNBhN8PMApl/5QZTzKntRrZkdT+s=;
b=XvAiYWtSLFV7ON3s9SHntxREyX5sxbm5eI1BLZZdnVzf+ci5LMdpZ5yfFn1CDRWbRx
Rh0U585q0r0XjjUj5Kvbq0FPTeOUD/XcD0mELcDZdNbe+yjXLcpOVPWBK5G8MZHX9txX
unk3gKsUZ1wn2DzQs9MImFIk7U0NM93PNvapQCXpsX4tdL3Cf1jyS/cdP5Sh1xe3v4+J
U+xbkHXKz779731EIRS+eEyK9ZPVl/rD53EkS30TaqKHDr6mrnz2qgYzzf4fYNZlSSOA
necgHboSZIgY6cte1G02PS/RMSZGR5plOkimXK91W+m3WaNbuNPiuNx0AaZGRjZylL6W
N7Tw==
MIME-Version: 1.0
X-Received: by 10.152.120.73 with SMTP id la9mr5711314lab.3.1381989269045;
Wed, 16 Oct 2013 22:54:29 -0700 (PDT)
Sender:
[email protected]Received: by 10.112.39.167 with HTTP; Wed, 16 Oct 2013 22:54:29 -0700 (PDT)
Date: Thu, 17 Oct 2013 06:54:29 +0100
X-Google-Sender-Auth: LmuHGXPb98jQCoFVw2wy9Q40ZKA
Message-ID: <CABc8F5v5nc4MXYwKnvcqXjEST3scHYZyDEVd9Ni08e-8gmQe9g@mail.gmail.com>
From: "
[email protected]" <
[email protected]>
To: me
Content-Type: multipart/alternative; boundary=089e011766e577058c04e8e97374
Bcc: me