Date: Mon, 4 Jun 2012 10:43:57 -0400
From: "PayPal" [firstname.lastname@example.org]
Subject: Your Paypal Ebay.com payment.
Transaction ID: 73013749
You sent a payment of $950.48 USD to Quentin Cotton
Thanks for using PayPal. To see all the transaction details, Log In to your PayPal account.
It may take a few moments for this transaction to appear in your account.
Carroll.Dickinson@yahoo.com Note to seller
You haven't included a note.
Shipping address - confirmed
4787 Hyde Rd
The seller hasn't provided any shipping details yet.
Description Unit price Qty Amount
1927 Supermarine S.5 & Gloster seaplane Schneider Trophy Race Photograph
$950.48 USD 23 $950.48 USD
Shipping and handling $0.00 USD
Insurance - not offered ----
Total $950.48 USD
Payment $950.48 USD
Issues with this transaction?
You have 45 days from the date of the transaction to open a dispute in the Resolution Center.
Questions? Go to the Help Center at: www.paypal.com/help.
Please do not reply to this email. This mailbox is not monitored and you will not receive a response. For assistance, log in to your PayPal account and click Help in the top right corner of any PayPal page.
You can receive plain text emails instead of HTML emails. To change your Notifications preferences, log in to your account, go to your Profile, and click My settings.
PayPal Email ID PP303
The link in the email goes to a malicious payload at [donotclick]adnroidsoft.net/main.php?page=017f3bb5c2be6a41 (report here) hosted on 220.127.116.11 (China Mobile Communications Corporation). Unless you do business with China, you might want to consider blocking 18.104.22.168/11 to be on the safe side.
Other sites on the same IP which may also be malicious are: