All the ones I have seen have the same sender and subject.

 

John

 

��� Sender: [EMAIL PROTECTED]

IP Address: 208.11.116.136

�Recipient: xxx

�� Subject: YOUR PAYPAL.COM ACCOUNT EXPIRES

�MessageID: hAEEHY425830

��� Report: /var/spool/MailScanner/incoming/3534/./hAEEHY425830/www.paypal.com.scr� Infection: W32/[EMAIL PROTECTED]

 

Full headers are:

 

�Return-Path: <g>

�Received: from localhost (adsla-136.brazosnet.com [208.11.116.136])

����� by mailin-1.isoc.net (8.11.6/8.11.6) with SMTP id hAEEHY425830

����� for <[EMAIL PROTECTED]>; Fri, 14 Nov 2003 09:17:34 -0500

�Date: Fri, 14 Nov 2003 09:17:34 -0500

�Message-Id: <[EMAIL PROTECTED]>

�From: "PayPal.com" <[EMAIL PROTECTED]>

�To: xxx

�Reply-To: [EMAIL PROTECTED]

�X-Priority: 1 (High)

�Subject: YOUR PAYPAL.COM ACCOUNT EXPIRES

�MIME-Version: 1.0

�Content-Type: multipart/mixed; boundary="----------419864D50A78811"

 

 

Reply via email to