spoof@paypal.com
Here's the cheezer's email:
In response for your PayPal Inc. account security we have to report that your password may be is compromised. Your account is marked for too many successful logins last week It is more interesting that the hostnames are form different countries:
United States (c-67-160-224-80.client.comcast.net)
Canada (HSE-Toronto-ppp3044429.sympatico.ca)
Sweden (c213-100-93-27.swipnet.se)
Russia (32.122.140.213.telenet.ru)
Your account is limited for security reasons.
Follow the link to make sure you are on a secure PayPal Inc. page and login with currently password.
Please authorize your account information before November 5, 2005.
https://www.paypal.com/us/cgi-bin/webscr?cmd=_login-run
Thank you for using PayPal Inc.
PayPal Inc. Team
Please do not reply to this e-mail. Mail sent to this address cannot be answered. For assistance, log in to your PayPal Inc. account and choose the "Help" link in the header of any page.