Return-Path: <dollarhurts@hotmail.com>
Received: from captain.misterbizz.com ([207.55.191.20])	by tomcat.ns.net (8.8.5/8.8.5) 
with ESMTP id FAA09646	for <CPICKET@TOMCAT.NS.NET>; Sat, 19 Sep 1998 05:49:22 -0700 (PDT)
From: dollarhurts@hotmail.com
Received: from 207.55.191.20 (tc3-033.sihope.com [209.98.18.135])	by captain.misterbizz.com (8.8.7/8.8.7) with SMTP id HAA08786;	Sat, 19 Sep 1998 07:43:27 -0500
Message-Id: <199809191243.HAA08786@captain.misterbizz.com>
To: user@the.internet
Date: Sat, 19 Sep 98 07:41:07 EST
Subject: Do you want to make money so bad it HURTS!?!?!
X-UIDL: ee8783caea21870c63b20d44f107a085

>nslookup 207.55.191.20
Server:  ns.mediacity.com
Address:  205.216.172.10

*** ns.mediacity.com can't find 207.55.191.20: Non-existent host/domain
>nslookup captain.misterbizz.com
Server:  ns.mediacity.com
Address:  205.216.172.10

*** ns.mediacity.com can't find captain.misterbizz.com: Non-existent host/domain
Well, this is the relaying server. I have to keep digging around.

>traceroute 207.55.191.20
traceroute to 207.55.191.20 (207.55.191.20), 30 hops max, 40 byte packets
 1  grfge002 (205.216.172.1)  0.532 ms  0.361 ms  0.316 ms
 2  bordercore2-hssi0-0-0.SanFrancisco.mci.net (166.48.15.249)  2.882 ms  2.389ms  2.314 ms
 3  core10.SanFrancisco.mci.net (204.70.9.45)  2.734 ms  2.528 ms  2.546 ms
 4  hay-verio-nap.SanFrancisco.mci.net (204.70.10.186)  4.619 ms  4.054 ms  4.306 ms
 5  pao0.pao5.verio.net (129.250.2.50)  4.021 ms  4.958 ms  4.021 ms
 6  pao5.sjc1.verio.net (129.250.2.66)  5.291 ms  7.061 ms  5.475 ms
 7  sjc1.sjc0.verio.net (205.238.56.81)  6.281 ms  7.800 ms  5.662 ms
 8  sjc0.dfw0.verio.net (205.238.56.198)  62.301 ms  62.594 ms  61.880 ms
 9  nkn.dfw.verio.net (205.238.53.216)  63.984 ms  65.191 ms  63.427 ms
10  hoek-gw.nkn.net (204.214.10.50)  70.609 ms  70.118 ms  69.680 ms
11  207.55.191.20 (207.55.191.20)  71.499 ms  68.851 ms  68.456 ms

>whois -h whois.arin.net 207.55.191.0
National Knowledge Networks, Inc. (NETBLK-NKN-BLK-1) NKN-BLK-1
                                                 207.55.128.0 - 207.55.223.255
National Knowledge Networks (NETBLK-NKN-WEBFARM) NKN-WEBFARM
                                                 207.55.191.0 - 207.55.191.255

>whois nkn.net

Registrant:
National Knowledge Networks (NKN2-DOM) (NKN2-DOM)
   400 N. St. Paul Street, Suite 500
   Dallas, TX 75201

   Domain Name: NKN.NET

   Administrative Contact, Technical Contact, Zone Contact:
      System Administrator  (SA250-ORG)  reginfo@NKN.NET
      214-954-0028
Fax- 214-740-1872
   Billing Contact:
      Accounting Dept.  (AD267-ORG)  accounting@NKN.NET
      214-954-0028
Fax- 214-740-1872

   Record last updated on 31-Dec-97.
   Record created on 09-Feb-95.
   Database last updated on 19-Sep-98 04:06:34 EDT.

   Domain servers in listed order:

   DFW.NKN.EDU                  199.171.20.1
   NS2.NKN.NET                  199.171.20.31

Check this out:
>telnet 207.55.191.20 25
Trying 207.55.191.20...
Connected to 207.55.191.20.
Escape character is '^]'.
220 captain.misterbizz.com ESMTP Sendmail 8.8.7/8.8.7; Sat, 19 Sep 1998 11:24:36 -0500
quit
221 captain.misterbizz.com closing connection
Connection closed by foreign host.

>whois misterbizz.com
No match for "MISTERBIZZ.COM".



OK, onto the spammer:
>nslookup 209.98.18.135
Server:  ns.mediacity.com
Address:  205.216.172.10

Name:    tc3-033.sihope.com
Address:  209.98.18.135

Spammer located.