Return-Path: <rounideo76@prodigy.com>
Received: from ktp.uni-paderborn.de ([131.234.180.1])
          by santaclara01.pop.internex.net (Post.Office MTA v3.1.2
          release (PO203-101c) ID# 0-34792U7500L7500S0) with ESMTP
          id AAA4059 for <chris@lanets.com>; Mon, 6 Jul 1998 04:25:10 -0700
Received: from ktpsp (ktpsp6 [131.234.180.2])	by ktp.uni-paderborn.de (8.7.5/8.9.0) 
with ESMTP id NAA06489;	Mon, 6 Jul 1998 13:13:17 +0200 (MET DST)
From: rounideo76@prodigy.com
Received: from Ibm.net (sf-dnpqh-005.compuserve.net [209.154.99.5])	by ktpsp (8.9.0/8.9.0) 
with SMTP id TAA00408;	Sun, 5 Jul 1998 19:05:10 +0200 (MET DST)
Date: Sun, 5 Jul 1998 19:05:10 +0200 (MET DST)
To: rounideo76@prodigy.com
Comments: Authenticated sender is <rounideo76@prodigy.com>
Subject: Email 57 Million People for $99
Message-Id: <199807053607CAA10336@pimaia3y.uni-paderborn.de>

>nslookup 131.234.180.1
Server:  ns.mediacity.com
Address:  205.216.172.10

Name:    ktpsp1.uni-paderborn.de
Address:  131.234.180.1
Relaying server located. I'd use a router, but this is a Class B license, so they may be
using a 16-bit netmask.

>nslookup 131.234.180.2
Server:  ns.mediacity.com
Address:  205.216.172.10

Name:    ktpsp6.uni-paderborn.de
Address:  131.234.180.2
Hijacked server located. It allows relaying, but is not completely broken:

>nslookup 209.154.99.5
Server:  ns.mediacity.com
Address:  205.216.172.10

Name:    sf-dnpqh-005.compuserve.net
Address:  209.154.99.5
Spammer located!!