Subject:     Re: Fwd: test
Date:        1/13/98 7:27 PM
To:          Jae Jae, jae@hotmail.com

On 1/13/98 3:30 PM, Jae Jae sent the following ASCII stream:

>****I also received this, and it is definitely suspicious. I have no 
>idea who this is, and the company that registered for this IP address 
>matches another of the messages I've just sent you****
>

This does look suspicious.

>
>
>>From rangsarit@upfront.co.th Tue Jan 13 01:30:09 1998
>>Received: from ufo.upfront.co.th ([203.149.7.83]) by nontri.ku.ac.th 

>nslookup 203.149.7.83
Server:  dns.mediacity.com
Address:  205.216.172.10

Hmm, OK. But wait!
>nslookup ufo.upfront.co.th
Server:  dns.mediacity.com
Address:  205.216.172.10

Name:    ufo.upfront.co.th
Address:  203.149.7.83

Nice forgery. Try again later. IP address is more valuable. Who owns it?

>whois 203.149.7.0
Asia Pacific Network Information Center (APNIC2)
   Tokyo Central Post Office Box 351
   Tokyo
   100-91
   JAPAN

   Netname: APNIC-CIDR-BLK
   Netblock: 202.0.0.0 - 203.255.255.0
   Maintainer: AP

   Coordinator:
      Conrad, David Randolph  (DC396)  davidc@APNIC.NET
      +81-3-5500-0480 (FAX) +81-3-5500-0481

   Domain System inverse mapping provided by:

   NS.TELSTRA.NET               203.50.0.137
   TECKLA.APNIC.NET             202.12.28.129
   NS.KRNIC.NET                 202.30.64.21
   NS.RIPE.NET                  193.0.0.193
   MOZART.TECHNET.SG            192.169.33.107

   *** please refer to whois.apnic.net for more information ***
   *** before contacting APNIC                              ***
   *** use whois -h whois.apnic.net <object>                ***

   Record last updated on 19-Sep-97.
   Database last updated on 13-Jan-98 04:06:07 EDT.

Hey!! That was the whois server I was looking for earlier today!!

I hate doing this, but: 

>whois -h whois.apnic.net 203.149.7.83
inetnum:     203.149.4.0 - 203.149.31.0
netname:     SAMART-TH
descr:       Samart Corporation Public Co., Ltd.
descr:       Computer & Telecom Service Provider
country:     TH
admin-c:     CS8-TH
tech-c:      sn1-ap
mnt-by:      MAINT-SAMART-TH
changed:     siriporn@samart.co.th 971222
source:      APNIC

person:      Chalermkiat  Sudtipunyo
address:     Samart Corporation
address:     555 Rasa Tower, 20th Floor, Paholyothin Road
address:     Bangkok 10900
country:     TH
phone:       +662-937-0811-2
fax-no:      +662-937-0810
e-mail:      chalee@samart.co.th
nic-hdl:     CS8-TH
changed:     yoshiko@apnic.net  960710
source:      APNIC

person:      Siriporn Nuchyai
address:     555 Rasa Tower
address:     Phaholyothin Rd.
address:     Chatuchark
phone:       +662-9370521
fax-no:      +662-9370524
e-mail:      siriporn@samart.co.th
nic-hdl:     SN1-AP
mnt-by:      MAINT-SAMART-TH
changed:     siriporn@samart.co.th 971219
source:      APNIC

inetnum:     203.149.4.0 - 203.149.31.0
netname:     SAMART-TH
descr:       Samart Corporation Public Co., Ltd.
descr:       Computer & Telecom Service Provider
country:     TH
admin-c:     CS8-TH
tech-c:      sn1-ap
mnt-by:      MAINT-SAMART-TH
changed:     siriporn@samart.co.th 971222
source:      APNIC

Looking at the top most entry tells you WHO to complain to:
samart.co.th

>(8.8.2/8.7.3) with ESMTP id QAA12688 for <jae@hotmail.com>; Tue, 13 Jan 
>1998 16:16:16 +0700 (GMT)
>>Message-Id: <199801130916.QAA12688@nontri.ku.ac.th>
>>Received: from 203.149.7.85 by ufo.upfront.co.th with SMTP (Microsoft 
>Exchange Internet Mail Service Version 5.0.1457.7)
>>	id CYXS5KJB; Tue, 13 Jan 1998 16:17:34 +0700
>>From: "jae" <Rangsarit@upfront.co.th>
>>To: <jae@hotmail.com>
>>Subject: test
>>Date: Tue, 13 Jan 1998 16:14:50 +0700
>>X-MSMail-Priority: Normal
>>X-Priority: 3
>>X-Mailer: Microsoft Internet Mail 4.70.1161
>>MIME-Version: 1.0
>>Content-Type: text/plain; charset=Windows-874
>>Content-Transfer-Encoding: 7bit
>>
>>test
>>

Seems to me they are looking for a VALID Hotmail drop to collect their complaints and 
bounces, otherwise it will bounce back to the "from" address and cause more problems due 
to invalid addressing. Basically, bouncing back and forth until some process times it out.