Return-Path: <mrzjcama8@sapo.pt>
Received: from sapo.pt (212.55.154.23) by studio42.com with SMTP 
(Eudora Internet Mail Server 3.2.10) for <chris@studio42.com>; 
Wed, 16 Apr 2008 10:08:35 -0700
Received: (qmail 2606 invoked from network); 16 Apr 2008 11:41:40 -0000
Received: from unknown (HELO http7) (10.134.35.147)  by relay3 with SMTP; 
16 Apr 2008 11:41:40 -0000
Received: (qmail 3504 invoked by uid 64140); 16 Apr 2008 11:41:39 -0000
Received: from 74.85.13.51 ([74.85.13.51]) by w7.mail.sapo.pt (Horde MIME	
library) with HTTP; Wed, 16 Apr 2008 12:41:38 +0100
Message-ID: <20080416124138.tphyd4ctwcc0s8sc@w7.mail.sapo.pt>
Date: Wed, 16 Apr 2008 12:41:38 +0100
From: mrzjcama8@sapo.pt
Reply-to: mrzarirj.cama1@yahoo.it
To: undisclosed-recipients: ;
Subject: From: Zarir J Cama.
MIME-Version: 1.0
Content-Type: text/plain;	charset=ISO-8859-15;	DelSp="Yes";	format="flowed"
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
User-Agent: Internet Messaging Program (IMP) H3 (4.2-cvs)
X-Originating-IP: 74.85.13.51
X-PTMail-Version: 3.2.6


From: Zarir J Cama.
The Manager Standard Chartered Bank,
First Light Branch
Accra Ghana.

Attn:

I got your contact during my search for a reliable, honest and a  
trustworthy person to entrust this huge transfer project with. My name  
is Mr. Zarir J. Cama. I am the manager of the Standard Chartered
Bank, First Light Branch, Accra Ghana. I am a Ghanaian, married with
two kids.

I am writing to solicit for your assistance in the transfer of funds  
valued at $5,620,000.00 (five million six hundred and twenty thousand  
United States Dollars.)

This fund is the excess of what my branch in which I am the Manager
made as profit during the last annual audition. I have already  
submitted an approved end of the year report for the year 2007 to my  
head office in Accra here and they will never know of this excess. I  
have since then, placed this amount of value $5,620,000.00 USD in a  
suspense escrow account without a beneficiary .

As an officer of the bank, I cannot directly be connected to this  
money thus I am impelled to request for your assistance to receive  
this Money into your bank account. I intend to part 30% of this fund  
to you as compensation while 70% shall be for me. I do stress that  
there are practically no risk involved in this. It is going to be a  
bank- to -bank transfer. All I need from is to stand as the original  
depositor of the fund.

If you accept this offer, I will appreciate your timely response.

Yours Sincerely,

Zarir J Cama.


[studio42@flatus studio42]$ host 212.55.154.23
23.154.55.212.in-addr.arpa domain name pointer relay3.ptmail.sapo.pt.
[studio42@flatus studio42]$ whois 212.55.154.23@whois.ripe.net
[whois.ripe.net]
% This is the RIPE Whois query server #1.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/db/copyright.html

% Note: This output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '212.55.128.0 - 212.55.191.255'

inetnum:        212.55.128.0 - 212.55.191.255
org:            ORG-TCIS1-RIPE
netname:        PT-TELEPAC-980602
descr:          PT.Com - Comunicacoes Interactivas, S.A.
country:        PT
admin-c:        PG259-RIPE
admin-c:        TP3302-RIPE
tech-c:         AA2895-RIPE
status:         ALLOCATED PA
mnt-by:         RIPE-NCC-HM-MNT
mnt-lower:      TELEPAC-MNT
mnt-routes:     TELEPAC-MNT
mnt-domains:    TELEPAC-MNT
source:         RIPE # Filtered

organisation:   ORG-TCIS1-RIPE
org-name:       PT.Com - Comunicacoes Interactivas, S.A.
org-type:       LIR
address:        Av. Fontes Pereira de Melo, 40 - 5
address:        1069-300
address:        Lisboa
address:        Portugal
phone:          +351217907000
fax-no:         +351217907001
admin-c:        AA2895-RIPE
admin-c:        LL1052-RIPE
admin-c:        PC2422-RIPE
admin-c:        PG259-RIPE
mnt-ref:        TELEPAC-MNT
mnt-ref:        RIPE-NCC-HM-MNT
mnt-by:         RIPE-NCC-HM-MNT
source:         RIPE # Filtered

role:           TELEPAC IP-REG
address:        Telepac II - Comunicacoes Interactivas, SA
address:        Av. Fontes Pereira de Melo, 40 - 5
address:        Forum Picoas - 1069-300 Lisboa
address:        Portugal
phone:          +351-21-7907000
remarks:        trouble:      * * ABUSE REPORTS * * - Please report to abuse@mai
l.telepac.pt
admin-c:        LL1052-RIPE
admin-c:        PC2422-RIPE
admin-c:        MCN5-RIPE
tech-c:         AA2895-RIPE
tech-c:         PG259-RIPE
nic-hdl:        TP3302-RIPE
mnt-by:         TELEPAC-MNT
source:         RIPE # Filtered
abuse-mailbox:  abuse@mail.telepac.pt

person:         Pedro Jose Goncalves
address:        PT.Com - Comunicacoes Interactivas, SA
address:        Av. Fontes Pereira de Melo, 40 - 3 - BL A
address:        Forum Picoas - 1069-300 Lisboa
address:        PT
phone:          +351-21-7907000
fax-no:         +351-21-7907001
nic-hdl:        PG259-RIPE
remarks:        *** PLEASE READ THIS ***
remarks:        I am NOT hacking into your computer!
remarks:        I am listed here as contact for network IP blocks
remarks:        allocated and assigned to PT.Com, SA ISP services.
remarks:        Please DO NOT send me any reports of network abuse.
remarks:        For abuse reports e-mail to abuse@mail.telepac.pt
remarks:        *** THANK YOU ***
mnt-by:         TELEPAC-MNT
source:         RIPE # Filtered

person:       Alfredo Alvim
address:      Telepac II - Comunicacoes Interactivas, SA
address:      Av. Fontes Pereira de Melo, 40
address:      Forum Picoas - 1069-300 Lisboa
address:      PT
phone:        +351-21-7900000
fax-no:       +351-21-7907001
nic-hdl:      AA2895-RIPE
remarks:      For abuse related reports, please use abuse@mail.telepac.pt
mnt-by:       TELEPAC-MNT
source:       RIPE # Filtered

% Information related to '212.55.128.0/18AS3243'

route:        212.55.128.0/18
descr:        Telepac - Comunicacoes Interactivas, SA
origin:       AS3243
mnt-by:       TELEPAC-MNT
source:       RIPE # Filtered

There's really no need to accept traffic from there.

And the spammer:

[studio42@flatus studio42]$ host 74.85.13.51
51.13.85.74.in-addr.arpa is an alias for 51.0-63.13.85.74.in-addr.arpa.
[studio42@flatus studio42]$ whois 74.85.13.51@whois.arin.net
[whois.arin.net]

OrgName:    Telekenex
OrgID:      CCDT
Address:    3221 20th St
City:       San Francisco
StateProv:  CA
PostalCode: 94110
Country:    US

ReferralServer: rwhois://69.28.97.4:4321

NetRange:   74.85.0.0 - 74.85.31.255
CIDR:       74.85.0.0/19
NetName:    CCDT-NET-BLK1
NetHandle:  NET-74-85-0-0-1
Parent:     NET-74-0-0-0-0
NetType:    Direct Allocation
NameServer: NS.TELEKENEX.COM
NameServer: NS2.TELEKENEX.COM
Comment:
RegDate:    2007-05-10
Updated:    2007-11-30

RAbuseHandle: TELEK1-ARIN
RAbuseName:   Telekenex NOC
RAbusePhone:  +1-415-287-1293
RAbuseEmail:  NOC@telekenex.com

RTechHandle: TELEK-ARIN
RTechName:   Telekenex Admin
RTechPhone:  +1-415-287-1234
RTechEmail:  champton@telekenex.com

OrgAbuseHandle: TELEK1-ARIN
OrgAbuseName:   Telekenex NOC
OrgAbusePhone:  +1-415-287-1293
OrgAbuseEmail:  NOC@telekenex.com

OrgNOCHandle: TELEK1-ARIN
OrgNOCName:   Telekenex NOC
OrgNOCPhone:  +1-415-287-1293
OrgNOCEmail:  NOC@telekenex.com

OrgTechHandle: BBU99-ARIN
OrgTechName:   Bush, Brendan
OrgTechPhone:  +1-415-287-1118
OrgTechEmail:  bbush@telekenex.com

OrgTechHandle: TELEK-ARIN
OrgTechName:   Telekenex Admin
OrgTechPhone:  +1-415-287-1234
OrgTechEmail:  champton@telekenex.com

OrgTechHandle: HOSTM894-ARIN
OrgTechName:   hostmaster
OrgTechPhone:  +1-415-276-8000
OrgTechEmail:  hostmaster@barriejonescook.com

# ARIN WHOIS database, last updated 2008-04-15 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

Sorry, the zombie