Return-Path: <johnkagba@nichefiresale.com>
Received: from host.rapidsupportstation.com (72.52.212.40) by 
studio42.com with ESMTP (Eudora Internet Mail Server 3.2.10) for 
<chris@studio42.com>; Fri, 22 Feb 2008 15:38:58 -0800
Received: from localhost ([127.0.0.1]:40439 helo=www.nichefiresale.com)	
by host.rapidsupportstation.com with esmtpa (Exim 4.68)	(envelope-from 
<johnkagba@nichefiresale.com>)	id 1JShT1-0001qP-6S; Fri, 22 Feb 2008 18:38:11 -0500
Received: from 82.128.32.178 ([82.128.32.178])
        (SquirrelMail authenticated user johnkagba@nichefiresale.com)
        by www.nichefiresale.com with HTTP;
        Fri, 22 Feb 2008 18:38:11 -0500 (EST)
Message-ID: <4072.82.128.32.178.1203723491.squirrel@www.nichefiresale.com>
Date: Fri, 22 Feb 2008 18:38:11 -0500 (EST)
Subject: ATTENTION:SIR/MADAM
From: "Sgt John Smith" <johnkagba@nichefiresale.com>
Reply-To: sgtjohnsmith2001@yahoo.com.hk
User-Agent: SquirrelMail/1.4.9a
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - host.rapidsupportstation.com
X-AntiAbuse: Original Domain - studio42.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - nichefiresale.com
To: undisclosed-recipients:;

ATTENTION:SIR/MADAM

HOW ARE YOU AND YOUR FAMILY? HOPE ALL IS WELL. MY NAME IS SGT. JOHN SMITH;
I AM AN AMERICAN SOLDIER, SERVING IN THE MILITARY WITH THE ARMY'S 3RD
INFANTRY
DIVISION; WITH A VERY DESPERATE NEED FOR ASSISTANCE, I HAVE SUMMED UP COURAGE
TO CONTACT YOU.  I FOUND YOUR CONTACT PARTICULARS  IN AN ADDRESS JOURNAL.

I AM SEEKING YOUR KIND ASSISTANCE TO MOVE THE SUM OF ($25 MILLION U.S.
DOLLARS)
TWENTY FIVE MILLION UNITED STATES DOLLARS TO YOU IN UNITED STATES, AS FAR
AS I CAN
BE ASSURED THAT M SHARE WILL BE SAFE IN YOUR CARE UNTILI COMPLETE MY SERVICE
HERE. SOURCE OF MONEY: SOME MONEY IN VARIOUS CURRENCIES WERE DISCOVERED IN
BARRELS AT A FARMHOUSE NEAR ONE OF SADDAM'S OLD PALACES IN TIKRIT-IRAQ
DURING A
RESCUE OPERATION, AND IT WAS AGREED BY STAFF SGT RICHARD BUFF AND I
THAT SOME PART OF THIS MONEY BE SHARED AMONG BOTH OF US BEFORE INFORMING
ANYBODY ABOUT IT SINCE BOTH OF US SAW THE MONEY FIRST.

THIS WAS QUITE AN ILLEGAL THING TO DO, BUT I TELL YOU WHAT? NO
COMPENSATION CAN
MAKE UP FOR THE RISK WE HAVE TAKEN WITH OUR LIVES IN THIS HELL HOLE. OF
WHICH MY
BROTHER IN-LAW WAS KILLED BY A ROAD SIDE BOMB LAST TIME. YOU WILL FIND
THE STORY OF THIS MONEY ON THE WEB ADDRESS BELOW:

 http://www.washingtonpost.com/ac2/wp-dyn/A35080-2003Apr24

THE ABOVE FIGURE WAS GIVEN TO ME AS MY SHARE, AND TO CONCEAL THIS KIND
OF MONEY BECAME A PROBLEM FOR ME, SO WITH THE HELP OF A BRITISH
CONTACT WORKING HERE AND HIS OFFICE ENJOY SOME IMMUNITY, I WAS ABLE TO GET
THE
PACKAGE OUT TO A SAFE LOCATION ENTIRELY OUT OF TROUBLE SPOT. HE DOES
NOT KNOW THE REAL CONTENTS OF THE PACKAGE, AND BELIEVES THAT IT
BELONGS TO A BRITISH/AMERICAN MEDICAL DOCTOR WHO DIED IN A RAID HERE IN IRAQ,
AND BEFORE GIVING UP, TRUSTED ME TO HAND OVER THE PACKAGE TO HIS
FAMILY IN UNITED STATES.I HAVE NOW FOUND A VERY SECURED WAY OF GETTING THE
PACKAGE OUT OF IRAQ TO YOUR COUNTRY FOR YOU TO PICK UP, AND I WILL
DISCUSS THIS WITH YOU WHEN I AM SURE THAT YOU ARE WILLING TO ASSIST ME, AND I
BELIEVE THAT MY MONEY WILL BE WELL SECURED IN YOUR HAND BECAUSE YOU HAVE
FEAR OF GOD.

I WANT YOU TO TELL ME HOW MUCH YOU WILL TAKE FROM THIS MONEY FOR THE
ASSISTANCE YOU WILL GIVE TO ME. ONE PASSIONATE APPEAL I WILL MAKE TO
YOU IS NOT TO DISCUSS THIS MATTER WITH ANYBODY, SHOULD YOU HAVE REASONS TO
REJECT THIS OFFER, PLEASE AND PLEASE DESTROY THIS MESSAGE AS ANY
LEAKAGE OF THIS INFORMATION WILL BE TOO BAD FOR US SOLDIER'S HERE IN
IRAQ.

I DO NOT KNOW HOW LONG WE WILL REMAIN HERE, AND I HAVE BEEN SHOT,
WOUNDED AND SURVIVED TWO SUICIDE BOMB ATTACKS BY THE SPECIAL GRACE OF
GOD, THIS AND OTHER REASONS I WILL MENTION LATER HAS PROMPTED ME TO REACH
OUT FOR HELP, I HONESTLY WANT THIS MATTER TO BE RESOLVED IMMEDIATELY,
PLEASE CONTACT ME AS SOON AS POSSIBLE MY ONLY WAY OF CONMMUNICATION IS BY
EMAIL.

GOD BLESS YOU AND YOUR FAMILY.

SGT. JOHN SMITH.
3RD INFANTRY DIVISION







[studio42@flatus studio42]$ host 72.52.212.40
40.212.52.72.in-addr.arpa domain name pointer host.rapidsupportstation.com.
[studio42@flatus studio42]$ whois 72.52.212.40@whois.arin.net
[whois.arin.net]

OrgName:    Liquid Web, Inc.
OrgID:      LQWB
Address:    4210 Creyts Rd.
City:       Lansing
StateProv:  MI
PostalCode: 48917
Country:    US

ReferralServer: rwhois://rwhois.liquidweb.com:4321/

NetRange:   72.52.128.0 - 72.52.255.255
CIDR:       72.52.128.0/17
NetName:    LIQUIDWEB-6
NetHandle:  NET-72-52-128-0-1
Parent:     NET-72-0-0-0-0
NetType:    Direct Allocation
NameServer: NS.LIQUIDWEB.COM
NameServer: NS1.LIQUIDWEB.COM
Comment:
RegDate:    2006-08-03
Updated:    2007-03-26

OrgAbuseHandle: ABUSE551-ARIN
OrgAbuseName:   Abuse
OrgAbusePhone:  +1-800-580-4985
OrgAbuseEmail:  abuse@liquidweb.com

OrgTechHandle: IPADM47-ARIN
OrgTechName:   IP Administrator
OrgTechPhone:  +1-800-580-4985
OrgTechEmail:  ipadmin@liquidweb.com

# ARIN WHOIS database, last updated 2008-02-21 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

I just fail to see any reason to not blacklist them outside of me being lazy.

Onto scammer:

[studio42@flatus studio42]$ host 82.128.32.178
Host 178.32.128.82.in-addr.arpa not found: 3(NXDOMAIN)
[studio42@flatus studio42]$ whois 82.128.32.178@whois.afrinic.net
[whois.afrinic.net]
% This is the AfriNIC Whois server.

% Note: this output has been filtered.

% Information related to '82.128.0.0 - 82.128.127.255'

inetnum:        82.128.0.0 - 82.128.127.255
org:            ORG-MTL1-AFRINIC
netname:        NG-MLTL-20030522
descr:          Multi-Links Telecommunications Limited
descr:          PROVIDER Local Registry
country:        NG
admin-c:        RIA27
tech-c:         RIA27
status:         ALLOCATED PA
mnt-by:         AFRINIC-HM-MNT
mnt-lower:      MLTL-INT-MNT
mnt-domains:    MLTL-INT-MNT
remarks:        data has been transferred from RIPE Whois Database 20050221
source:         AFRINIC # Filtered
parent:         0.0.0.0 - 255.255.255.255

organisation:   ORG-MTL1-AFRINIC
org-name:       Multi-Links Telecommunications Limited
country:        NG
org-type:       LIR
address:        231,Adeola Odeku Street
                Victoria Island
address:
address:        Lagos
address:        Nigeria
phone:          +23417740000
fax-no:         +23412622452
e-mail:         deep@multi-links.com
admin-c:        RIA27
tech-c:         RIA27
mnt-ref:        MLTL-INT-MNT
mnt-ref:        AFRINIC-HM-MNT
mnt-by:         AFRINIC-HM-MNT
remarks:        data has been transferred from RIPE Whois Database 20050221
source:         AFRINIC # Filtered

person:       IP Admin-RIPE
address:      Multilinks Telecommunications Limited
address:      231 Adeola Odeku Str.
address:      Victoria Island, Lagos, Nigeria
e-mail:       ipadmin@multilinks.com
remarks:      complaints/spam report : abuse@multilinks.com
phone:        +2341774000
nic-hdl:      RIA27
remarks:      data has been transferred from RIPE Whois Database 20050221
source:       AFRINIC # Filtered