Return-Path: <info@live.com>
Received: from spam.healingplacechurch.org (72.12.54.83) by studio42.com 
with ESMTP (Eudora Internet Mail Server 3.2.10) for <chris@studio42.com>; 
Fri, 27 Jun 2008 08:52:43 -0700
X-ASG-Debug-ID: 1214571878-7b8900810000-7k7F4c
X-Barracuda-URL: http://72.12.54.83:8000/cgi-bin/mark.cgi
Received: from mail.healingplacechurch.org (localhost [127.0.0.1])	by 
spam.healingplacechurch.org (Spam Firewall) with ESMTP id 7BB8B18667A	for 
<chris@studio42.com>; Fri, 27 Jun 2008 08:04:38 -0500 (CDT)
Received: from mail.healingplacechurch.org (mail.healingplacechurch.org [72.12.54.86]) 
by spam.healingplacechurch.org with ESMTP id yw3Ry2ElFEOMwy1i for <chris@studio42.com>; 
Fri, 27 Jun 2008 08:04:38 -0500 (CDT)
Received: (qmail 19542 invoked by uid 0); 27 Jun 2008 13:04:26 -0000
Received: from 127.0.0.1 by mail.healingplacechurch.org (envelope-from <info@live.com>, 
uid 89) with qmail-scanner-1.23st  (clamdscan: 0.75. f-prot: 4.3.4/3.14.8. 
spamassassin: 2.63. perlscan: 1.23st.   Clear:RC:1(127.0.0.1):.  
Processed in 0.355028 secs); 27 Jun 2008 13:04:26 -0000
X-Barracuda-BBL-IP: nil
Received: from unknown (HELO mail.healingplacechurch.org) (127.0.0.1)  
by 0 with SMTP; 27 Jun 2008 13:04:25 -0000
Received: from 83.229.122.154 (proxying for 192.168.0.23)
        (SquirrelMail authenticated user hpclive@healingplacechurch.org);
        by mail.healingplacechurch.org with HTTP;
        Fri, 27 Jun 2008 08:04:25 -0500 (CDT)
Message-ID: <39540.83.229.122.154.1214571865.squirrel@83.229.122.154>
Date: Fri, 27 Jun 2008 08:04:25 -0500 (CDT)
X-ASG-Orig-Subj: CLAIM OF REWARD
Subject: CLAIM OF REWARD
From: "IWON/PROMO 2008" <info@live.com>
Reply-To: iwon.collinsdept1@live.com
User-Agent: SquirrelMail/1.4.3a
X-Mailer: SquirrelMail/1.4.3a
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
X-Barracuda-Connect: mail.healingplacechurch.org[72.12.54.86]
X-Barracuda-Start-Time: 1214571879
X-Barracuda-Virus-Scanned: by Barracuda Spam Firewall at healingplacechurch.org
To: undisclosed-recipients:;




ATTN:

Congratulations as we bring to your notice, Iwon Promo Board has chosen
you by the board of trustees as one of the final recipients on this year
Bonanza
cash grant/Donation. To celebrate the 16th anniversary Celebration, we are
giving
out a yearly donation of 450,000.00 USD to 3 lucky recipients, as a Bonanza.
All Participants are selected from individuals all over the continent that do
register on the Internet daily. This Iwon Bonanza is approved by the British
Gaming Board and also licensed by the International association of Gaming
Regulators (IAGR).Your computer selected # is(Iwon-005676568-Bz) and your
contact address.

Your Name In Full:
Valid Contact Address:
State/City:
Zip code/Country:
Valid Phone/Fax Contact Number:
Age:
Occupation:
Religion:
Ref: 769760FG08
Your computer selected # is Iwon-005676568-Bz

Please you are advised to fill the form, and send it immediately to our
lawyer Mr. Peter Collins to file for your awarded claims.

Barrister. Peter Collins
Personal Contact: iwon.collinsdept1@live.com
Phone :+44- 702- 403 -1429
Fax: +44 703-197- 9654

You are to keep all information away from the general public especially your
computer selected # is Iwon-005676568-Bz. This is important as a case
of double claims will not be entertained.



[studio42@flatus studio42]$ host 72.12.54.83
83.54.12.72.in-addr.arpa domain name pointer spam.healingplacechurch.org.
[studio42@flatus studio42]$ whois 72.12.54.83@whois.arin.net
[whois.arin.net]
Network Telephone Corporation NTEL-NETBLOCK4 (NET-72-12-0-0-1)
                                  72.12.0.0 - 72.12.63.255
Network Telephone Corporation ATLANTA-CORE-ADSL (NET-72-12-54-0-1)
                                  72.12.54.0 - 72.12.54.255

# ARIN WHOIS database, last updated 2008-06-26 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

[studio42@flatus studio42]$ whois NET-72-12-0-0-1@whois.arin.net
[whois.arin.net]

OrgName:    Network Telephone Corporation
OrgID:      NTEL
Address:    3300 North Pace Blvd
Address:    Network Tel Suite
City:       Pensacola
StateProv:  FL
PostalCode: 32504
Country:    US

NetRange:   72.12.0.0 - 72.12.63.255
CIDR:       72.12.0.0/18
NetName:    NTEL-NETBLOCK4
NetHandle:  NET-72-12-0-0-1
Parent:     NET-72-0-0-0-0
NetType:    Direct Allocation
NameServer: NS1.NETWORKTEL.NET
NameServer: NS2.NETWORKTEL.NET
Comment:
RegDate:    2004-10-25
Updated:    2005-11-10

RTechHandle: IA61-ARIN
RTechName:   IP Admin
RTechPhone:  +1-850-469-9904
RTechEmail:  ipadmin@networktel.net

OrgTechHandle: IA61-ARIN
OrgTechName:   IP Admin
OrgTechPhone:  +1-850-469-9904
OrgTechEmail:  ipadmin@networktel.net

# ARIN WHOIS database, last updated 2008-06-26 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

I think I've seen these folks victimized before. Despite anti-spam
measures in place, once the attack happens via an "authenticated"
source, those measures often then fail. So, no doubt some identity
theft, phishing or some other attack enabled this.

Where from?

[studio42@flatus studio42]$ host 83.229.122.154
Host 154.122.229.83.in-addr.arpa not found: 3(NXDOMAIN)
[studio42@flatus studio42]$ whois 83.229.122.154@whois.ripe.net
[whois.ripe.net]
% This is the RIPE Whois query server #3.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/db/copyright.html

% Note: This output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '83.229.122.152 - 83.229.122.159'

inetnum:        83.229.122.152 - 83.229.122.159
org:            ORG-BA146-RIPE
netname:        Beddy-Josh
descr:          Beddy-Josh
country:        NG
admin-c:        OS1429-RIPE
tech-c:         OS1429-RIPE
status:         ASSIGNED PA
mnt-by:         SV-MNT
mnt-lower:      SV-MNT
source:         RIPE # Filtered

organisation:   ORG-BA146-RIPE
org-name:       Beddy-Josh
org-type:       OTHER
address:        Plot 23 Oregbeni Housing Estate
address:        Ikpoba Edo
address:        Nigeria
e-mail:         samoniyi@yahoo.com
phone:          +2348023393165
admin-c:        OS1429-RIPE
tech-c:         OS1429-RIPE
mnt-ref:        SV-MNT
mnt-by:         SV-MNT
source:         RIPE # Filtered

person:         Omiyi Samuel
address:        Plot 23 Oregbeni Housing Estate
address:        Ikpoba Edo
address:        Nigeria
e-mail:         samoniyi@yahoo.com
phone:          +2348023393165
nic-hdl:        OS1429-RIPE
source:         RIPE # Filtered

% Information related to '83.229.0.0/17AS25228'

route:        83.229.0.0/17
descr:        SkyVision Network Services
origin:       AS25228
mnt-by:       SV-MNT
source:       RIPE # Filtered

% Information related to '83.229.64.0/18AS8513'

route:          83.229.64.0/18
descr:          SkyVision
origin:         AS8513
mnt-by:         SV-MNT
mnt-lower:      SV-MNT
source:         RIPE # Filtered