[exim] Stopping PayPal phishing - filter script

I added the following script to my mail filter making the assumption
that all email the comes from paypal server would have received lines
that include paypal.com. I wanted to share this and also ask if anyone
knows if there is a reason this wouldn't work.

if "$h_from:" contains "paypal.com"
then
   if "$h_Received:" does not contain "paypal.com"
   then
      deliver spoof@???
      finish
   endif
endif