Tobacco Promo.

[Arnold]

From [email protected]
To "undisclosed recipients: ;"

Your Email ID has been awarded 1,000,000.00 GBP in the Tobacco Promo.for claims send:
Name....
Address...
Tel...

[Berger]

Here is another one:

From: British Tobacco Promo [[email protected]]
Reply-To: [email protected]
Sent: 11 July 2010
Subject: Your E-mail Was Selected

Your Email ID has been awarded 1,000,000.00 G.B.P in the Tobacco Promo send your details
Names:
Country:
Occupation:
Tel:

The message heading contains:

Return-Path: <[email protected]>
Received: from smtp9.sbb.rs (smtp9.sbb.rs [89.216.2.41]) by
mx.google.com with ESMTP id r1si9454884bkf.64.2010.07.11.14.08.10;
Sun, 11 Jul 2010 14:08:14 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 89.216.2.41 as permitted sender) client-ip=89.216.2.41;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 89.216.2.41 as permitted sender) smtp.mail=[email protected]
Received: from webmail.sbb.rs (webmail.sbb.rs [82.117.194.30]) by smtp9.sbb.rs
(8.14.0/8.14.0) with ESMTP id o6BL8AW1032355; Sun, 11 Jul 2010 23:08:10 +0200
Received: from 41.220.68.2 (SquirrelMail authenticated user szeljko)
by webmail.sbb.rs with HTTP; Sun, 11 Jul 2010 22:48:57 +0200
(CEST)
Message-ID: <[email protected]>
Date: Sun, 11 Jul 2010 22:48:57 +0200
Subject: Your E-mail Was Selected
From: British Tobacco Promo <[email protected]>
Reply-To: [email protected]
User-Agent: SquirrelMail/1.4.13
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
X-SMTP-Vilter-Version: 1.3.2
X-SBB-Virus-Status: clean
X-SBB-Spam-Score: 0.5
X-SBB-Spam-Level: X
To: Undisclosed recipients:;
X-MS-Exchange-Organization-SCL: 4
X-MS-Exchange-Organization-PCL: 2
X-MS-Exchange-Organization-Antispam-Report:
DV:3.3.5705.600;OrigIP:172.16.20.2

It can be seen that it came from the IP 41.220.68.2 (which is Nigeria) but via Serbia.

[trose]

are most IPs that come from random countries suspicious??

[Arnold]

It's the contents of an email that is the main sign that it's a scam. But as http://www.419eater.com/scamtracker/ shows, most scammers are based in West Africa. Although they can be found anywhere.
The main value of the IP address is when it shows that the email didn't come from where the scammer claims to be.