Return-Path: <95042016@msn.com>
Received: from vger.cpnet.net (root@vger.cpnet.net [204.112.116.100])	
by tomcat.ns.net (8.8.5/8.8.5) with ESMTP id SAA07539	for <cpicket@ns.net>; 
Fri, 30 Jan 1998 18:32:04 -0800 (PST)
From: 95042016@msn.com
Received: from mail.cpnet.net (1Cust103.max13.santa-clara.ca.ms.uu.net [153.34.146.231])	
by vger.cpnet.net (8.8.5/8.8.5) with SMTP id TAA00080;	
Fri, 30 Jan 1998 19:55:01 -0600 (CST)
Received: from bob.ted.carol.and.alice(6985.3.88.24) by 6785555@msn.com (8.8.5/8.6.5) 
with SMTP id GAA00157 for <19888765@msn.com>; Fri, 30 Jan 1998 07:36:12 -0600 (EST)
Date: Fri, 30 Jan 98 07:36:12 EST
To: 19888765@msn.com
Subject: ALERT - Internet Fraud and Spying
Message-ID: <this.company.is.not.endorsed.by.or.affiliated.with.msn.or.aol.or.any.other.isp>
Reply-To: 56788891@msn.com
Comments: Authenticated sender is <private.company.and.not.a.internet.service.provider>
X-UIDL: 78927499998765666777777722234562

First, before I get into this, look at the FORGED bogus Message-ID line.
Hmm, if it's not affiliated, then why forge? Idiot. Lame forgeries too. More fraud!!
These messages are to try and avoid complaints. Not gonna work.

>nslookup 204.112.116.100
Server:  dns.mediacity.com
Address:  205.216.172.10

Name:    vger.cpnet.net
Address:  204.112.116.100
Wow, that was quick. Found the relaying server.

Now, despite the lame forgery, let's move into the point of origination:

>nslookup 153.34.146.231
Server:  dns.mediacity.com
Address:  205.216.172.10

Name:    1Cust103.max13.santa-clara.ca.ms.uu.net
Address:  153.34.146.231

OK, that was just too darn easy.

Let me finish up the information on the relaying site:

>whois cpnet.net
Central Plains Network (CPNET-DOM)
   165 Saskatchewan Avenue East
   Portage la Prairie, MB R1N 0L7
   CA

   Domain Name: CPNET.NET

   Administrative Contact, Technical Contact, Zone Contact:
      Olson, Lars  (LO42)  lars@CPNET.NET
      (204)  239-1974

   Record last updated on 08-Jan-97.
   Record created on 05-Sep-95.
   Database last updated on 30-Jan-98 04:14:09 EDT.

   Domain servers in listed order:

   VGER.CPNET.NET               204.112.116.100
   ACCESS.MBNET.MB.CA           130.179.16.143

OK, so let me get this straight:
This guy dials in from Santa Clara, California, hijacks a server in Canada for a known
spammer company in Chico, California, forges header information, is running a hit-and-run
scam, and wants to warn ME about fraud. Hmm, seems this spam warns me of this guy, so I guess
it did it's job.