The return address was paypal.com so it went to my inbox instead of junk mail.
I gotta tell ya it looked authentic it told me someone from a different ip address was trying to access my account and if it was me on a different computer that was ok if not I needed to go into my acct. and change my password.
But it greeted me by my email address not my name.
It had the logo even the little PayPal Email ID number on the bottom to prove it was paypal.
But the link was to paypal.com\cgi-bin etc.
I felt kind of stupid but I sent it to spoof@paypal.com and yep it was fake.
When paypal wrote back sure enough I was greeted by my name at the top of the paypal response.
So I learned two things today the link or address is paypal.com\us nothing after that and official paypal email will always use your name and never call you Dear member or email address.