There appears to be some some interesting stuffs in the email headers, for FBI, police etc etc whoever this may concern.

The email links in the screen capture goes to the following site:

http://asp123.jp/webscrcmd=_login-run/Secured/Service/mysql/ssl/connection/__/login/

At this point of writing, the site has been taken down. The culprit was traced, identified, caned and sentenced to eternal imprisonment (just kidding).

--------------------
Return-path: <service@paypal.com>
Delivery-date: Tue, 28 Nov 2006 13:11:09 -0700
Received: from [206.53.51.106] (helo=phobos.velcom.com)
Received: from [202.81.63.10] (helo=user)
 by phobos.velcom.com with esmtpa (Exim 4.63 (FreeBSD))
 (envelope-from <service@paypal.com>)
 id 1Gp9HA-000707-Sj; Tue, 28 Nov 2006 15:10:05 -0500
From: "PayPal"<service@paypal.com>
Date: Wed, 29 Nov 2006 03:09:48 +0700
MIME-Version: 1.0
Content-Type: text/html;
 charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - phobos.velcom.com
X-AntiAbuse: Originator/Caller UID/GID - [0 0] / [26 6]
X-AntiAbuse: Sender Address Domain - paypal.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-NAS-Language: Russian
X-NAS-AutoBlock-Code: 7
X-NAS-AutoBlock-Description: Always block emails that contain script
Subject: [Norton AntiSpam] Your Account Will Be Suspended
X-NAS-Classification: 1
X-NAS-MessageID: 4625
X-NAS-Validation: {AD6CC1FE-FAED-4A28-BE69-C0820F641269}