Bingo!

I just received three of these spams (and reported them to Paypal security) this morning.

I got two of them -- the same message as yours -- last night. The very clever perpetrator sent them out from an ISP with a vigorous and strong anti-spam policy ... and had the disguised URL pointing to a page on the same server from which the message was sent. *Very* clever.

My copies were sent out a little after 8:00 PM PDT. By the time I started digging, at 10:00 PM PDT, the spammer's account had been nuked and the evil URL had become Error 404. Score one for the Good Guys.

I got 5 this morning, but the URL was just a bit different:
http://www.paypal.com/cgi-bin/webscr?cmd=_home
I posted it this morning, as well as the Boing now, at:
http://radio.weblogs.com/0123486/2003/06/25.html#a230