Return-Path: <uncredit@bdr.it>
Received: from n054.sc0.he.tucows.com (64.97.144.71) by studio42.com with 
ESMTP (Eudora Internet Mail Server 3.2.10) for <chris@studio42.com>; 
Mon, 11 Feb 2008 09:59:16 -0800
Received: from sc0-out02.emaildefenseservice.com (64.97.131.2) by 
n054.sc0.he.tucows.com (7.2.069.1)
        id 476BFC7B00DB25F2; Mon, 11 Feb 2008 14:38:48 +0000
Message-ID: <476BFC7B00DB25F2@n054.sc0.he.tucows.com> (added by 
postmaster@bouncemessage.net)
X-SpamScore: 64
X-Spamcatcher-Summary: 64,4,0,3a197bcbc919ed50,3186d4c1082eac24,uncredit@bdr.it,-
X-Spamcatcher-Explanation: (50%)	BODY: contains "for immediate release";(25%)	
REPLY-TO: contains email address of form "5+ digits@webmail domain";(25%)	BODY: contains text similar to "usd millions";
Received: from User (unknown [82.128.34.228])	(Authenticated sender: yhgfd@rexian.com)	by sc0-out02.emaildefenseservice.com (Postfix) with ESMTP;	Mon, 11 Feb 2008 14:29:09 +0000 (UTC)
Reply-To: <Andrew_Wolley10057@hotmail.com>
From: " OFFICIAL PAYMENT"

[studio42@flatus studio42]$ host 64.97.144.71
71.144.97.64.in-addr.arpa domain name pointer smtpout1071.sc0.he.tucows.com.

[studio42@flatus studio42]$ whois 64.97.144.71@whois.arin.net
[whois.arin.net]

OrgName:    Tucows.com Co.
OrgID:      TUCOW
Address:    96 Mowat Avenue
City:       Toronto
StateProv:  ON
PostalCode: M6K-3M1
Country:    CA

NetRange:   64.96.0.0 - 64.99.255.255
CIDR:       64.96.0.0/14
NetName:    TUCOWS-BLK2
NetHandle:  NET-64-96-0-0-1
Parent:     NET-64-0-0-0-0
NetType:    Direct Allocation
NameServer: NS1.HE.TUCOWS.COM
NameServer: NS2.HE.TUCOWS.COM
NameServer: NS3.HE.TUCOWS.COM
Comment:
RegDate:    2000-05-18
Updated:    2006-02-28

OrgTechHandle: NOC2038-ARIN
OrgTechName:   Network Operations Center
OrgTechPhone:  +1-416-535-0123
OrgTechEmail:  arin-maint@tucows.com

# ARIN WHOIS database, last updated 2008-02-10 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

It's more effective to blacklist Tucows because they seem to do a lot of abuse-support
services these days.

Onto scammer:

[studio42@flatus studio42]$ host 82.128.34.228
Host 228.34.128.82.in-addr.arpa not found: 3(NXDOMAIN)
[studio42@flatus studio42]$ whois 82.128.34.228@whois.afrinic.net
[whois.afrinic.net]
% This is the AfriNIC Whois server.

% Note: this output has been filtered.

% Information related to '82.128.0.0 - 82.128.127.255'

inetnum:        82.128.0.0 - 82.128.127.255
org:            ORG-MTL1-AFRINIC
netname:        NG-MLTL-20030522
descr:          Multi-Links Telecommunications Limited
descr:          PROVIDER Local Registry
country:        NG
admin-c:        RIA27
tech-c:         RIA27
status:         ALLOCATED PA
mnt-by:         AFRINIC-HM-MNT
mnt-lower:      MLTL-INT-MNT
mnt-domains:    MLTL-INT-MNT
remarks:        data has been transferred from RIPE Whois Database 20050221
source:         AFRINIC # Filtered
parent:         0.0.0.0 - 255.255.255.255

organisation:   ORG-MTL1-AFRINIC
org-name:       Multi-Links Telecommunications Limited
country:        NG
org-type:       LIR
address:        231,Adeola Odeku Street
                Victoria Island
address:
address:        Lagos
address:        Nigeria
phone:          +23417740000
fax-no:         +23412622452
e-mail:         deep@multi-links.com
admin-c:        RIA27
tech-c:         RIA27
mnt-ref:        MLTL-INT-MNT
mnt-ref:        AFRINIC-HM-MNT
mnt-by:         AFRINIC-HM-MNT
remarks:        data has been transferred from RIPE Whois Database 20050221
source:         AFRINIC # Filtered

person:       IP Admin-RIPE
address:      Multilinks Telecommunications Limited
address:      231 Adeola Odeku Str.
address:      Victoria Island, Lagos, Nigeria
e-mail:       ipadmin@multilinks.com
remarks:      complaints/spam report : abuse@multilinks.com
phone:        +2341774000
nic-hdl:      RIA27
remarks:      data has been transferred from RIPE Whois Database 20050221
source:       AFRINIC # Filtered