Re: Paypal phishing - ADDL NOTES

I coincidentally have a legit PP email/notification from just a day 
ago.  Some things to note:

LEGIT:

X-Spam-DCC:www.nova53.net: app3 1207; Body=1 Fuz1=1 Fuz2=1
From:"[email protected]"  <[email protected]>
To: AW <xxxxx.yyy.com>
Subject: You authorized a payment to

((To is actually my email address))

FAKES:
X-Spam-DCC:www.nova53.net: app3 1207; Body=55 Fuz1=98 Fuz2=many
X-OriginatorOrg: smkelopuramy.onmicrosoft.com
From:"[email protected]"  <[email protected]>
To:[email protected]
Subject: This money request has been updated

X-Spam-DCC:www.nova53.net: app3 1207; Body=3 Fuz1=1 Fuz2=many
X-OriginatorOrg: serenashop.store
From:"[email protected]"  <[email protected]>
To:"Invoice-update8@serenashop. store"  <[email protected]>
Subject: Invoice from Michelle Miller (0073)


** No X-OriginatorOrg header in legit email.
** Legit has all "US" relays, and much shorter (4).  Fakes have one "**" relay (I guess undetermined) and much longer.  But don't know how much that would help.