Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

FW:You just sent a payment to Colin Peterson De: PayPalAgregar a contactos Enviado: Tue, 1 May, 2012 a la(s) 3:09 pm Para:XXX PayPal

You just sent a payment Transaction ID: 2SM69324P0770102B

Hello XXX, Thanks for using PayPal. It may take a few moments for this transaction to appear in your account. Merchant Colin Peterson wcColin22@hotmail.com Note to Thad Peterson You haven't sent a note. Shipping address - confirmed Michael Pepe P.O. Box 173 Cheektowaga, NY14225 United States Total $80.00 USD Payment $100.00 USD Payment sent to Colin Peterson

Help Centre | Resolution Centre | Security Centre

This email was sent by an automated system, so if you reply, nobody will see it. To get in touch with us, log in to your account and click "Contact Us" at the bottom of any page. Copyright 2012 PayPal, Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131.

PayPal Email ID PP1526

The transaction ID links to: http://running.ms/XiTNFwzp/index.html

The Help Centre | Resolution Centre | Security Centre links to: http://running.ms/XiTNFwzp/index.html

The full header is:

Return-Path:    <scoreca95@wonderware.com>
Delivered-To:   XXX
Received:   from smtp26.gate.ord1b (smtp26.gate.ord1b.rsapps.net [10.130.68.26]) by store107a.mail.ord1b (SMTP Server) with ESMTP id EA61C2500B9 for <XXX>; Tue, 1 May 2012 14:20:37 -0400 (EDT)
X-Virus-Scanned:    OK
X-MessageSniffer-Scan-Result:   53
X-MessageSniffer-Rules: 53-4877966-1943-10048-m 53-4877965-9968-10048-m 53-4877966-0-12593-f
X-CMAE-Scan-Result: 100
X-CNFS-Analysis:    v=1.0 c=1 p=OgbITHE_AAAA:8 p=-FAkJhBZpFgP2b9k:21 p=RUWpw8T-7ZvukEw5:21 a=hU7txvdV7mUA:10 a=Pt7wmjh5mqEA:10 a=49vIjkq6VIIA:10 a=cVusd3DhtWcRLELa1k4q7w==:17 a=JwWRWnRqyguN0m43QU8A:9 a=CjuIK1q_8ugA:10 a=qI-sqkvjAAAA:8 a=69EAbJreAAAA:8 a=w74iKPNMAAAA:8 a=A7g0F8Jc9vzIWE5DUNEA:9 a=Njm_G1QJzNOqwLAWfNMA:7 a=tXsnliwV7b4A:10 a=Q3GSQHWQLDMA:10 a=iVt2SwoMscoA:10 a=EfJqPEOeqlMA:10
Received:   from [173.203.2.22] ([173.203.2.22:34116] helo=smtp23.gate.ord1a) by smtp26.gate.ord1b.rsapps.net (envelope-from <scoreca95@wonderware.com>) (ecelerity 2.2.3.49 r(42060/42061)) with ESMTPS (cipher=AES256-SHA) id 43/48-01358-57920AF4; Tue, 01 May 2012 14:20:37 -0400
X-Spam-Threshold:   95
X-Spam-Score:   100
X-MS-Exchange-Organization-SCL: 9
Precedence: junk
X-Spam-Flag:    YES
X-Virus-Scanned:    OK
X-MessageSniffer-Scan-Result:   20
X-MessageSniffer-Rules: 20-0-0--1-f
X-CMAE-Scan-Result: 100
X-CNFS-Analysis:    v=1.0 c=1 p=OgbITHE_AAAA:8 p=-FAkJhBZpFgP2b9k:21 p=RUWpw8T-7ZvukEw5:21 a=0KwdfxIuaWIA:10 a=49vIjkq6VIIA:10 a=w6zKBQCjRVYA:10 a=JwWRWnRqyguN0m43QU8A:9 a=CjuIK1q_8ugA:10 a=qI-sqkvjAAAA:8 a=69EAbJreAAAA:8 a=w74iKPNMAAAA:8 a=A7g0F8Jc9vzIWE5DUNEA:9 a=Njm_G1QJzNOqwLAWfNMA:7 a=tXsnliwV7b4A:10 a=Q3GSQHWQLDMA:10 a=iVt2SwoMscoA:10 a=EfJqPEOeqlMA:10
X-Orig-To:  XXX
X-Originating-Ip:   [116.125.192.20]
Received:   from [116.125.192.20] ([116.125.192.20:37261] helo=[116.125.192.20]) by smtp23.gate.ord1a.rsapps.net (envelope-from <scoreca95@wonderware.com>) (ecelerity 2.2.3.49 r(42060/42061)) with ESMTP id 51/D3-22673-47920AF4; Tue, 01 May 2012 14:20:37 -0400
Received:   from (port=49290 helo=) by server2.unifiedns.com with esmtp (Exim 4.69) (envelope-from <sabirali@a-map.net>) id 1SA4bZ-002Ufy-KH for XXX; Wed, 2 May 2012 03:09:51 +0900
From:   "PayPal" <notify@paypal.com>
To: <XXX>
Subject:    [SPAM] FW:You just sent a payment to Colin Peterson
Date:   Wed, 2 May 2012 03:09:51 +0900
Message-ID: <00b901cd06ce$81fd8e80$85f8ab80$@net>
MIME-Version:   1.0
Content-Type:   multipart/alternative; boundary="----=_NextPart_000_00BA_01CD06F0.090F2E80"
X-Mailer:   Microsoft Office Outlook 12.0
Thread-Index:   Ac0Gzn+LAgp9BZkgRqWDl+N6AtxTTw==
Content-Language:   en-gb
X-ACL-Warn: {
X-AntiAbuse:    This header was added to track abuse, please include it with any abuse report
X-AntiAbuse:    Primary Hostname - server2.unifiedns.com
X-AntiAbuse:    Original Domain - gmail.com
X-AntiAbuse:    Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse:    Sender Address Domain - a-map.net
X-Source:   
X-Source-Args:  
X-Source-Dir:

Should I be concerned about this? Is there anything I should do about it or just ignoring it would be ok?

The owner of this account is followed one of the links (she is not sure which one) and it said not found, is this of any concern either?

links moved into code block so you don't click on them

share|improve this question
    
you should just click on "Report Spam" and ignore it. –  user221287 May 2 '12 at 18:48
    
@Dez thanks for the edit, good idea! –  Trufa May 3 '12 at 3:32
1  
I don't believe e-mail questions of this sort have anything whatsoever to do with Web Apps. –  Evan Carroll Sep 24 '12 at 16:13

2 Answers 2

up vote 5 down vote accepted

If the links you are being asked to follow take you to a url different then the normal paypal.com I would be warned that it is most likely fake.

In this case what I do anyway just to be safe is I type directly into my url bar the address name, in this case www.paypal.com. You can log in and it should notify you if there are any payments that need to be confirmed.

Note: Paypal does sometimes require confirmation so this could be a valid email, but it's always better safe then sorry.

share|improve this answer
    
There does not seem to be anything in the account, so I should be safe, I was only concerned if this was something I should check. Thanks for the answer! –  Trufa May 2 '12 at 3:19
    
@Trufa When Paypal needs you to confirm a payment it should appear when you log on otherwise you probably don't therefore this email may be fake. –  Fogest May 2 '12 at 3:25
    
None of the urls seem to be from Paypal. If it were from Paypal, at least the transaction URLs would be from paypal.com .. Don't trust it. –  Bibhas May 2 '12 at 4:52

I received the same mail, it's certainly spam and I highly recommend not to click on any of the links. I am sure, they will present you a fake log-in screen and voilà, they have your log-in credentials.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.