legal Paypal Phishing attempt

[A D]

This one is really bad, tons of spelling and grammar issues:
=====================================================

Dear PayPal Customer.

We see a transaction who wait for your accept PayPal ID 3ZNX2991XOX ([email protected]) sent on your account an ammount of 320 $USD.
If you know about this transaction please confirm and recieve the ammount please click on link bellow:

http://ns1.hkidol.com//phpmyadmin/config/pp/index.html <http://ns1.hkidol.com//phpmyadmin/config/pp/index.html>

NOTE: Please remember this link is avaible just for 24 Hours and wait for your confirm.
If you don't know about this transaction please ignore this message.


Best Regards.
Thank you for using PayPal payments service.

Copyright . 1999-2011 PayPal. All rights reserved.
RCS Luxembourg B 118 349
PayPal Email ID PP227202312

======================================
Host headers:

Received: (qmail 32582 invoked from network); 22 Feb 2011 18:58:17 -0000
Received: from unknown (HELO p3pismtp01-025.prod.phx3.secureserver.net) ([10.6.12.30])
(envelope-sender <[email protected]>)
by smtp23-02.prod.mesa1.secureserver.net (qmail-1.03) with SMTP
for <[email protected]>; 22 Feb 2011 18:58:17 -0000
X-IronPort-Anti-Spam-Result: AiB/AI+VY03TGK2E/2dsb2JhbACCWoRJhEWMJQEBhgQBhy8CVnOIN6Z+gSaDf4k5gxBfgW8EhQuNUw
Received: from mail.umno.org.my ([211.24.173.132])
by p3pismtp01-025.prod.phx3.secureserver.net with ESMTP; 22 Feb 2011 11:58:09 -0700
Received: from mail.umno.org.my (localhost.localdomain [127.0.0.1])
by mail.umno.org.my (8.12.5/8.12.5) with ESMTP id p1MK52tc029171
for <[email protected]>; Wed, 23 Feb 2011 04:05:02 +0800
Received: (from sophia@localhost)
by mail.umno.org.my (8.12.5/8.12.5/Submit) id p1MK52Qn029169
for [email protected]; Wed, 23 Feb 2011 04:05:02 +0800
Date: Wed, 23 Feb 2011 04:05:02 +0800
To: [email protected]
Subject: Transaction number: 3912003912 wait for your confirmation
Message-ID: <[email protected]>
From: "PayPal" <[email protected]>
Content-Type: text/html
X-Nonspam: None
===========================
reported to [email protected] and [email protected]

 

[fab]

typical