Waffle

From: "service@paypal.com" We added an additional email address to your PayPal account.

But we are not done yet!

You must click the link below and enter your old email adress and your
password on the following page to confirm this email address.
[link to http://219.95.218.123/index/... disguised as a real Paypal support link]

Case ID Number: PP-072-838-482

You can also confirm your email address by logging into your PayPal account at
http://www.paypal.com Click on the "Confirm email" link in the Activate Account box
and then enter this confirmation number: 0756-7515-8945-8936-3223

This email is sent to you by the contracting entity to your User Agreement, either PayPal Inc or PayPal (Europe) Limited.
Thank you for using PayPal!
The PayPal Team

PayPal Email ID PP059

In other words, if you haven't actually added an email address yourself just now, it will look like Paypal is innocently reporting the results of an "incident" in progress, which you will have to stop right now. If you have, it will be a message you've been waiting for. And like terrorists, phishers only have to be lucky once. You, on the other hand, have to be on your guard at all times.
Also, filtering messages like this will without also filtering out real Paypal messages.

Whois information on this spammer. They're at:

Server Used: [ whois.apnic.net ]

http://219.95.218.123/ = [ tm.net.my ]

inetnum: 219.95.128.0 - 219.95.255.255
netname: ADSL-STREAMYX-TMNET
descr: TMNET
country: MY
admin-c: MH91-AP
tech-c: MH91-AP
remarks: abuse@tm.net.my

remarks: streamyx@tm.net.my

remarks: tmcops@tm.net.my

mnt-by: TM-NET-AP
changed: anieayop@tm.net.my

20040415
status: ASSIGNED NON-PORTABLE
source: APNIC
person: Mahadi Harun
address: Level 26 (North)
address: Menara Telekom
address: Jalan Pantai Baru
address: 50672 Kuala Lumpur.
country: MY
phone: 603-2240-3089
fax-no: 603-7956 0211
e-mail: mahadi@telekom.com.my

nic-hdl: MH91-AP
mnt-by: TM-NET-AP
changed: anieayop@tm.net.my

20041109
source: APNIC