Another sample that started in SBL59329

Again, why does any web mail site accept mail from SBLed sites?

From http://www.spamhaus.org/SBL/sbl.lasso?query=SBL59329
10-Oct-2007 14:28 GMT | SR18
419 source (Escalation)
Previous attempts to get this illegal advance-fee-fraud
spammer removed have failed... Escalating.

Please make no mistake about the user on 82.128.13.8,
he is using stolen username/password sets to send this spam.

Spammer's contact info:
Reply-to: hotmail.com>
Email: wiretransfer_andrewwolley1008@hotmail.com
EMAIL:wiretransfer_andrewwolley1008@hotmail.com or
wiretransfer_dept01@excite.com
hotmail.com is listed at RFC-Ignorant.org (abuse and postmaster)
excite.com is listed at RFC-Ignorant.org (abuse and postmaster)

This junk came from:
196.25.211.9 <=> juliet.telkomsa.net
196.25.0.0 - 196.25.255.255 is assigned to saix.net (ZA)
196.0.0.0 - 196.255.255.255 is assigned to AFRINIC (??)
196.25.211.9 is listed at: WPBL, Backscatter
Backscatter says:
Sorry 196.25.211.9 is blacklisted at
http://www.backscatterer.org/?ip=196.25.211.9
WPBL says:
Spam source - http://wpbl.info/record?ip=196.25.211.9

telkomsa.net says they got it from:
82.128.23.195 <=> ml82.128.23.195.multilinks.com
82.128.0.0 - 82.128.127.255 is assigned to multilinks.com (NG)
82.128.23.195 is listed at: SBL-ZEN, UCEPROTECT-2
SBL-ZEN says:
http://www.spamhaus.org/SBL/sbl.lasso?query=SBL58761 /23
http://www.spamhaus.org/SBL/sbl.lasso?query=SBL59329 /19
http://www.spamhaus.org/query/bl?ip=82.128.23.195
UCEProtect says:
Net 82.128.23.0/24 is UCEPROTECT-Level2 listed because of 5 abusers. Your
ISP ERMS-EARTHLNK - EARTHLINK, INC./AS4355 has to fix this. See:
http://www.uceprotect.net/rblcheck.php?ipr=82.128.23.195
multilinks.com is listed at RFC-Ignorant.org (abuse, postmaster, and whois)

------- Forwarded Message

Return-Path: telkomsa.net>
[local routing snipped]
Received: from telkomsa.net (juliet.telkomsa.net [196.25.211.9])
by ip-64-139-1-69.sjc.megapath.net (Postfix) with ESMTP id 472F6BE2E
for <"hal-na..."@ip-64-139-1-69.sjc.megapath.net>; Sun, 13 Apr 2008 06:17:16
-0700 (PDT)
Received: (qmail 29215 invoked from network); 13 Apr 2008 07:30:46 -0000
Received: from unknown (HELO User) (online552512@telkomsa.net@[82.128.23.195])
(envelope-sender telkomsa.net>)
by O (qmail-ldap-1.03) with SMTP
for syrupcity.net>; 13 Apr 2008 07:30:39 -0000
Reply-To: hotmail.com>
From: "OFFICIAL PAYMENT" telkomsa.net>
Subject: PART-PAYMENT VALUED $8.3M UNITED STATED DOLLARS
Date: Mon, 14 Apr 2008 09:27:42 -0700
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20080413131716.472F6BE2E@ip-64-139-1-69.sjc.megapath.net>
To: undisclosed-recipients:;

WORLD BANK GROUP AND UNITED NATION ORGANIZATION
OFFICIAL CONTRACT PAYMENT UNIT.
Our Ref: FGN /SNT/STB
RELEASE CODE No: 0763;

PART-PAYMENT VALUED $8.3M UNITED STATED DOLLARS

ATTN,Beneficiary,

Our Ref: FGN /SNT/STB

Your Ref:

WORLD BANK GROUP AND UNITED NATION ORGANIZATION do hereby give this
irrevocable approval order with Release Code:GNC/3480/02/00 in your favor for
your contract entitlement/award winning payment with the UNITED NATION to
your nominated bank account. Now you're new Payment,United nation Approval
No;UN5685P,White House Approved No:WH44CV, Reference No.-35460021, Allocation
No: 674632 Password No: 339331 , Pin Code No: 55674 and your Certificate of
Merit Payment No : 103 , Released Code No: 0763; Immediate Citibank Telex
confirmation No: -1114433 ; Secret Code No:XXTN013, Having received these
vital payment number , therefore You are qualified now to received and
confirm Your payment with the United Nation immediately within the next 72hrs.

As a matter of fact, you are required to Deal and Communicate only with MR
ANDREW WOLLEY, DIRECTOR INTERNATIONAL REMMITTANCE CITIBANK OF UNITED KINGDOM,
with the help and monitory team from the CITIBANK OF NEW YORK which is our
official remitting bank, Committee On Foreign Payment Matters in United
Nation, has look up to make sure you receive your fund valued $8.3m. So
contact: MR ANDREW WOLLEY on his contact information,Direct Citibank
Telephone No +44 793 617 9966, Cell/mobile +44-7011138970 or cell/mobile
+44-7011138970 Fax Number:+44 870 288 7323, Telephone Number:+44 870288 7101,
Email: wiretransfer_andrewwolley1008@hotmail.com for immediate release of
your contract/inheritance/Award Winning claim Be informed that you are not
allowed to correspond with any person or office anymore, You are required to
send bellow information for your transfer.

1) YOUR FULL NAME:
2) ADDRESS,CITY,STATE AND COUNTRY.
3) PHONE,FAX AND MOBILE
4) COMPANY NAME(IF ANY) POSITION AND ADDRESS
5) BANK DETAILS,ACCOUNT NO,ROUTING NO,/SWIFT CODE AND BANK ADDRESS.
6) PROFESSION,AGE AND MARITAL STATUS
7) COPY OF YOUR INT'L PASSPORT/DRIVERS LICENSE

NOTE: YOUR PERSONAL CONTACT/COMMUNICATIONCODE WITH CITIBANK IS(511),YOU ARE
ARE ADVICE TO SEND YOU FULL BANKING INFORMATION TO THE CITIBANK OF LONDON
INTERNATIONAL REMMITTANCE DIRECTOR HEADED BY MR ANDREW WOLLEY AND MAKE SURE
YOU SPEAK WITH HIM, WITH YOUR NEW PAYMENT CODE FOR RELEASE OF YOUR PAYMENT
AND SEND HIM ALL YOUR BANKING INFORMATION NOW. CONTACT CODE(511)

OFFICER:MR ANDREW WOLLEY.
POSITION:DIRECTOR,INTL,REMMITTANCE CITIBANK LONDON.
TELEPHONE OFFICE/BANK:+44 793 617 9966,
FAX NUMBER:+44 870 288 7323,+44 870 288 7101
BANK TELEPHONE,+44-700-5931171 or cell/mobile +44-7011138970.
EMAIL:wiretransfer_andrewwolley1008@hotmail.com or
wiretransfer_dept01@excite.com

SIR FRANK PETERSON.
(CHAIRMAN COMMITTE ON FOREIGN CONTRACT/AWARD WINING PAYMENT UNITED
NATION AND USA GOVERNMENT).

------- End of Forwarded Message

--
These are my opinions, not necessarily my employer's. I hate spam.