by techmani
Wed Sep 28, 2011 9:12 am
Below is full header and body of scam email:
From PayPal Security Wed Sep 28 02:27:08 2011
X-Apparently-To: xxxxx.yahoo.com via 98.139.211.248; Wed, 28 Sep 2011 02:28:49 -0700
Return-Path: <[email protected]>
Received-SPF: softfail (transitioning domain of hushmail.com does not designate 64.59.128.220 as permitted sender)
IHRyYW5zYWN0aW9uIGRldGFpbHMsIGxvZyBpbiB0byB5b3VyIFBheVBhbCBh
Y2NvdW50LiAKCkNsaWNrIGhlcmUgATABAQEB
X-YMailISG: FuFNNT4WLDsSf0SFSzRqHApFa3mWZkDRS2nUvQqPDQDamJta
hai4_XmJS.9I4y2v5PCH6XFpE_s7TBNHu3g6QBZ4qFCDhy5AcaRyDgbhNezj
MOA4J0lvKHYpArFGF5RylWVYZQDk_OjI57gDsyaA6unb7gTlKi99KdYcsd4j
EyUSPynnaQgro0oXTWWpdZzmen55_QX2e3MzTf6SxBKuQHGv.SNT0KdDW67V
Ek.EPj8N_H0hBSy8IsGYj67Q1GsKy6UQ49c3wbpHBziaF2UNRoFW6lPnnKEX
9lrm6NH1wXC4BJg4ImCdB2XGm3nqLslaruj2hsRXB5hLAvZP82Ot_WCbsk93
8VLl3ILdQMR0_DqRIVO9frEmuiMJi2CwA6RwTbcE8sUYpFniObrclQJ___jX
Wx.6zauW8vEFzTnMliOnvdUyNO3CqIrYZ7Bo8o1YM1CIM1UV..fZJ7UtZA_q
Tt8uYwDXlImaMjHlO7phUcziEPD5mkS1yNj5BJhgXmFGDhEtvES0fmw6v34B
SrqkCtwcM0HOSDg8CTkrFtaZoxKl81pKOqlHKhVFAmCVf9B47Z_UPgK2R9RX
bbXMnX1m4.9mgy.NDopnMcqNVauSwp6GiLZth0m9qtGGjMwv1Ec33s2OXRuU
hox0a.PdqZaVqbLvMjp3yv_SVOBJEb.KMGPNNvRtrddANJ_diEymKFYrCNpN
lnJk2L620cfx4xowNrtVMKg8h.An.ah7NHTxx_pT2bTPM.mwv_VnIpUCZEFs
ZY20bOfP7mzD2nYlOLk_9.UTdTUCDu14C3DEHjd5FklHJpkSSVTx1DkyqRtG
d7FC0sh.gfanyAG37gjUo6S8VcyPs3okWC3eWNXSaqpfktvUJ.oD8WLgQrwG
aBdwK6ZFdL7AXAh5HvxDot.XY1Z8HvFDTNi.bpdbzlqhZsOhF03J3R8iUPYA
GSycye3cmpG9yOrvvX3Q9_7cB9yjVWtGT7CWup8qvZcjuLG.ISOQZCoY1bSK
WNjLAC0lFz.tExIfRu77CYnWmoO6LpRgaglZ8vMuRHueF035oOY3O0kOnxLy
nN6HyAx1S59XO.U302v2CPHwLm3JyjN8ZbYNKZCaYEF9YvTsaaJqP_v5DQNV
n6lkNbE-
X-Originating-IP: [64.59.128.220]
Authentication-Results: mta1332.mail.mud.yahoo.com from=hushmail.com; domainkeys=neutral (no sig); from=hushmail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO mail.shawcable.com) (64.59.128.220)
by mta1332.mail.mud.yahoo.com with SMTP; Wed, 28 Sep 2011 02:27:05 -0700
Received: from bpd2mi1no-svcs.prod.shawcable.com ([10.0.184.120])
by bpd2mo2no-ssvc.prod.shawcable.com with ESMTP; 28 Sep 2011 03:27:04 -0600
X-Cloudmark-SP-Filtered: true
X-Cloudmark-SP-Result: v=1.1 cv=rhzBfl3TH6jSClqh7E8qe//hARbvbzCI0ETuu7/2kJU= c=1 sm=1
a=Dyoqhi_TatcA:10 a=yJqszdsZ_GEA:10 a=BLceEmwcHowA:10 a=Cfj4BQAnxiAA:10
a=DlvqEtx5w7oA:10 a=GIGAWDD8LUTO7LS4Urxydw==:17 a=BQj6jt4wAAAA:8
a=3w433JKfKE2cEbr3-84A:9 a=EHr8d8ifmMJienjDeI8A:7 a=Ft8UYL4EG9YA:10
a=jkf_j_aOiYIA:10 a=2uYoGXZXthgA:10 a=cZhw1FQ6iIAA:10 a=dINs5lqTw4oA:10
a=qiWi7Edwir4A:10 a=NWVoK91CQyQA:10 a=HpAAvcLHHh0Zw7uRqdWCyQ==:117
X-IronPort-AV: E=Sophos;i="4.68,454,1312178400";
d="scan'208";a="600990012"
Received: from unknown (HELO bpd2mi1no-cmts.prod.shawcable.com) ([192.168.183.120])
by bpd2mi1no-cmts.prod.shawcable.com with ESMTP; 28 Sep 2011 03:27:04 -0600
Message-Id: <[email protected]>
X-reinject: true
Received: from unknown (HELO darklord) ([174.5.217.218])
by bpd2mi1no-dmz.prod.shawcable.com with SMTP; 28 Sep 2011 03:26:52 -0600
From: "PayPal Security"<[email protected]>
Subject: Receipt for Your Payment
Date: Wed, 28 Sep 2011 11:27:08 +0200
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Content-Length: 189
From PayPal Security Wed Sep 28 02:27:08 2011
X-Apparently-To: xxxxx.yahoo.com via 98.139.211.248; Wed, 28 Sep 2011 02:28:49 -0700
Return-Path: <[email protected]>
Received-SPF: softfail (transitioning domain of hushmail.com does not designate 64.59.128.220 as permitted sender)
IHRyYW5zYWN0aW9uIGRldGFpbHMsIGxvZyBpbiB0byB5b3VyIFBheVBhbCBh
Y2NvdW50LiAKCkNsaWNrIGhlcmUgATABAQEB
X-YMailISG: FuFNNT4WLDsSf0SFSzRqHApFa3mWZkDRS2nUvQqPDQDamJta
hai4_XmJS.9I4y2v5PCH6XFpE_s7TBNHu3g6QBZ4qFCDhy5AcaRyDgbhNezj
MOA4J0lvKHYpArFGF5RylWVYZQDk_OjI57gDsyaA6unb7gTlKi99KdYcsd4j
EyUSPynnaQgro0oXTWWpdZzmen55_QX2e3MzTf6SxBKuQHGv.SNT0KdDW67V
Ek.EPj8N_H0hBSy8IsGYj67Q1GsKy6UQ49c3wbpHBziaF2UNRoFW6lPnnKEX
9lrm6NH1wXC4BJg4ImCdB2XGm3nqLslaruj2hsRXB5hLAvZP82Ot_WCbsk93
8VLl3ILdQMR0_DqRIVO9frEmuiMJi2CwA6RwTbcE8sUYpFniObrclQJ___jX
Wx.6zauW8vEFzTnMliOnvdUyNO3CqIrYZ7Bo8o1YM1CIM1UV..fZJ7UtZA_q
Tt8uYwDXlImaMjHlO7phUcziEPD5mkS1yNj5BJhgXmFGDhEtvES0fmw6v34B
SrqkCtwcM0HOSDg8CTkrFtaZoxKl81pKOqlHKhVFAmCVf9B47Z_UPgK2R9RX
bbXMnX1m4.9mgy.NDopnMcqNVauSwp6GiLZth0m9qtGGjMwv1Ec33s2OXRuU
hox0a.PdqZaVqbLvMjp3yv_SVOBJEb.KMGPNNvRtrddANJ_diEymKFYrCNpN
lnJk2L620cfx4xowNrtVMKg8h.An.ah7NHTxx_pT2bTPM.mwv_VnIpUCZEFs
ZY20bOfP7mzD2nYlOLk_9.UTdTUCDu14C3DEHjd5FklHJpkSSVTx1DkyqRtG
d7FC0sh.gfanyAG37gjUo6S8VcyPs3okWC3eWNXSaqpfktvUJ.oD8WLgQrwG
aBdwK6ZFdL7AXAh5HvxDot.XY1Z8HvFDTNi.bpdbzlqhZsOhF03J3R8iUPYA
GSycye3cmpG9yOrvvX3Q9_7cB9yjVWtGT7CWup8qvZcjuLG.ISOQZCoY1bSK
WNjLAC0lFz.tExIfRu77CYnWmoO6LpRgaglZ8vMuRHueF035oOY3O0kOnxLy
nN6HyAx1S59XO.U302v2CPHwLm3JyjN8ZbYNKZCaYEF9YvTsaaJqP_v5DQNV
n6lkNbE-
X-Originating-IP: [64.59.128.220]
Authentication-Results: mta1332.mail.mud.yahoo.com from=hushmail.com; domainkeys=neutral (no sig); from=hushmail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO mail.shawcable.com) (64.59.128.220)
by mta1332.mail.mud.yahoo.com with SMTP; Wed, 28 Sep 2011 02:27:05 -0700
Received: from bpd2mi1no-svcs.prod.shawcable.com ([10.0.184.120])
by bpd2mo2no-ssvc.prod.shawcable.com with ESMTP; 28 Sep 2011 03:27:04 -0600
X-Cloudmark-SP-Filtered: true
X-Cloudmark-SP-Result: v=1.1 cv=rhzBfl3TH6jSClqh7E8qe//hARbvbzCI0ETuu7/2kJU= c=1 sm=1
a=Dyoqhi_TatcA:10 a=yJqszdsZ_GEA:10 a=BLceEmwcHowA:10 a=Cfj4BQAnxiAA:10
a=DlvqEtx5w7oA:10 a=GIGAWDD8LUTO7LS4Urxydw==:17 a=BQj6jt4wAAAA:8
a=3w433JKfKE2cEbr3-84A:9 a=EHr8d8ifmMJienjDeI8A:7 a=Ft8UYL4EG9YA:10
a=jkf_j_aOiYIA:10 a=2uYoGXZXthgA:10 a=cZhw1FQ6iIAA:10 a=dINs5lqTw4oA:10
a=qiWi7Edwir4A:10 a=NWVoK91CQyQA:10 a=HpAAvcLHHh0Zw7uRqdWCyQ==:117
X-IronPort-AV: E=Sophos;i="4.68,454,1312178400";
d="scan'208";a="600990012"
Received: from unknown (HELO bpd2mi1no-cmts.prod.shawcable.com) ([192.168.183.120])
by bpd2mi1no-cmts.prod.shawcable.com with ESMTP; 28 Sep 2011 03:27:04 -0600
Message-Id: <[email protected]>
X-reinject: true
Received: from unknown (HELO darklord) ([174.5.217.218])
by bpd2mi1no-dmz.prod.shawcable.com with SMTP; 28 Sep 2011 03:26:52 -0600
From: "PayPal Security"<[email protected]>
Subject: Receipt for Your Payment
Date: Wed, 28 Sep 2011 11:27:08 +0200
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Content-Length: 189
