1

I have a Gmail and a live mail so I forward my live mails to Gmail.

I don't remember signing up for PayPal using live mail. I work for a signer and I sell her songs online using PayPal so these days I'm receiving these mails (sent to live mail, forwarded to Gmail)

from    service@intl.paypal.com service@intl.paypal.com
to  "REMOVED@REMO.VED" <REMOVED@REMO.VED>
date    Sun, Oct 23, 2011 at 4:42 PM
subject Don't forget to claim your money from Manar J
signed-by   intl.paypal.com
    Important mainly because of your interaction with messages in the conversation.
hide details 4:42 PM (58 minutes ago)
Hello REMOVED@REMO.VED,

You've still got funds!


On Oct 16, 2011 you received $13.00 USD from REMOVED@REMO.VED. After you sign up for a PayPal account you will not only have access to the money sent by Manar J, you can also use your account in the following ways:
- Send Money to anyone with an email address
- Pay for over 3,000,000 eBay auctions
- Shop at more than 30,000 websites that accept PayPal

Or you can just withdraw your money directly to your bank account.

With all the ways for you to use PayPal, claim your funds today by clicking on the link below:


https://www.paypal.com/ca/links/uni/em=REMOVED@REMO.VED&txn_id=80570870K6731843E

Note: If you do not claim your money by Nov 15, 2011, this payment will be automatically cancelled and the money will be returned to REMOVED@REMO.VED's account. In addition, REMOVED@REMO.VED has the option to cancel this payment at any time until you have claimed.

----------------------------------------------------------------------
Help Centre:
https://www.paypal.com/ca/cgi-bin/helpweb?cmd=_help
Resolution Centre:
https://www.paypal.com/ca/cgi-bin/?cmd=_complaint-view
Security Centre:
https://www.paypal.com/ca/security

This email was sent by an automated system, so if you reply, nobody will see it. To get in touch with us, log in to your account and click "Contact Us" at the bottom of any page.

Copyright © 2011 PayPal, Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131.

PayPal Email ID  PP287

the email header is

Delivered-To: REMOVED@REMO.VED
Received: by 10.205.113.1 with SMTP id eu1cs10566bkc;
        Sun, 23 Oct 2011 06:47:33 -0700 (PDT)
Received: by 10.204.0.67 with SMTP id 3mr9952162bka.55.1319377652397;
        Sun, 23 Oct 2011 06:47:32 -0700 (PDT)
DomainKey-Status: good
Received-SPF: softfail (google.com: best guess record for domain of transitioning service@intl.paypal.com does not designate 66.211.168.230 as permitted sender) client-ip=66.211.168.230;
Received: by 10.204.17.200 with POP3 id t8mf2835933bka.9;
        Sun, 23 Oct 2011 06:47:31 -0700 (PDT)
X-Gmail-Fetch-Info: REMOVED@REMO.VED 2 pop3.live.com 995 REMOVED@REMO.VED
x-store-info:sbevkl2QZR7OXo7WID5ZcdV2tiiWGqTnL8LqRHZDpO1LljV8CY4abg/x/aBZ7kZpOA7dp8CMP2jBJlGe2j1u8/yJCqK230PpRDa2iNgE1Pxyc5/OTXjYOQ==
Authentication-Results: hotmail.com; sender-id=pass (sender IP is 66.211.168.230) header.from=service@intl.paypal.com; dkim=neutral header.d=intl.paypal.com; x-hmca=pass
X-Message-Status: n:0:n
X-SID-PRA: service@intl.paypal.com <service@intl.paypal.com>
X-SID-Result: Pass
X-AUTH-Result: PASS
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MTtHRD0xO1NDTD0w
X-Message-Info: NhFq/7gR1vS84Z3s8P/PD2PmjThklwQUUCTlifbWwbZas5RHXIj5bCNHZkYDeT7/6lJUKdpPU1ihnDfdUx10OS7lvwXCU4LGHgEPDXM9jXMyYh6JQZ0QudAf+H/yZJepMU5ct6o7E3U=
Received: from mx0.phx.paypal.com ([66.211.168.230]) by BAY0-MC3-F5.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
     Sun, 23 Oct 2011 06:42:09 -0700
DomainKey-Signature: q=dns; a=rsa-sha1; c=nofws;
    s=dkim; d=intl.paypal.com;
    h=DKIM-Signature:Received:Date:Message-Id:Subject:X-MaxCode-Template:To:From:X-Email-Type-Id:X-XPT-XSL-Name:Content-Transfer-Encoding:Content-Type:MIME-Version;
    b=X3Ppz3q2DhbjP9o+a12Kmp7zU0s2HK38xynL9gggbJ0Z5zLmOT2lyQbZ+ehfXJ0x
    ncyQem1qF84SGHNGyUTkrftMoj8EMX4YW/mehBGx1PhyAa4Fcg6az0H81aqh60Hd
    Tvyku/KSWVugHDbxaVYtL9p2Wc7Shl/2oDnGtwff5TI=
DKIM-Signature: v=1; a=rsa-sha1; d=intl.paypal.com; s=dkim; c=relaxed/relaxed;
    q=dns/txt; i=@intl.paypal.com; t=1319377329;
    h=From:From:Subject:Date:To:MIME-Version:Content-Type;
    bh=pj5nysbQp1u+AG7E1DmjN7GYKJ4=;
    b=8zEnNZSiq5qrnLnT1u8c+M3SqOi8FUrUKLnd4jgpetgW2IBlkfts/rjVvy5cLwdU
    +xntHLJ7PWcBNc4hwG+SVQY98jpVFEAbYotQbpHuhlJL98VCKyb7NUqzNLp/ML2Y
    DT11fv30rOPeBML8K7n2n/jLwsBHJ39NvJiQJqLnJoI=;
Received: (qmail 16849 invoked by uid 999); 23 Oct 2011 13:42:08 -0000
Date: Sun, 23 Oct 2011 06:42:08 -0700
Message-Id: <1319377328.16849@paypal.com>
Subject: Don't forget to claim your money from Manar J
X-MaxCode-Template: email-transaction-reminder-unilateral
To: "REMOVED@REMO.VED" <REMOVED@REMO.VED>
From: "service@intl.paypal.com" <service@intl.paypal.com>
X-Email-Type-Id: PP287
X-XPT-XSL-Name: 
  email_pimp/CA/en_US/transaction/buyer/TransactionReminderUnilateral.xsl
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=windows-1252
MIME-Version: 1.0
Return-Path: service@intl.paypal.com
X-OriginalArrivalTime: 23 Oct 2011 13:42:09.0056 (UTC) FILETIME=[8F799A00:01CC9189]

I have a feeling that this email is all about phishing, but I want to ask you first before marking it as spam

EDIT

I entered my live mail, in the forgot password form so that if I have an account I'll receive a forgot password email, it says

We couldn't find your email address. Please try again or select I don't know what email address I used.

So the email does not exist, I don't have an a PayPal account with my live mail. Furthermore check this

On Oct 16, 2011 you received $13.00 USD from manou__91@hotmail.com

A normal human does not put 2 __ in the email right? A human uses 1 _ only

So what do you say should I create a PayPal account with my live mail or what

Lynob
  • 5,550
  • 23
  • 66
  • 96

2 Answers2

3

You can easily find out by logging into Paypal. If you've received a payment, then it will show up there. If you don't have a Paypal account, just register with the same email address and the payment will show up either way.

You don't have to click the link on the email to verify this. In fact, banks heavily advise against clicking links on emails to access your email because it is insecure. If it is a valid communication, then the communication can be verified by separately visiting the bank's website.

surfasb
  • 22,896
3

This is possibly a valid PayPal mail. PayPal is indeed sending mails like these.

The PayPal-Links in this mail indeed point to PayPal and not to any phising site.

Received: from mx0.phx.paypal.com ([66.211.168.230]) by BAY0-MC3-F5.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
     Sun, 23 Oct 2011 06:42:09 -0700

Microsoft recieved this mail from valid PayPal mail servers. "66.211.168.230" is run by eBay (try host 66.211.168.230).

It sounds as if you already would have an PayPal account? Just open paypal and add this mail address to the ones registered with paypal - then you should be able to claim the money with your old account (if the mail is valid).

Jens Erat
  • 18,485
  • 14
  • 68
  • 80