Subject:     Re: Fwd: Make Your Dreams Come True!!
Date:        7/12/98 12:03
To:          Joseph Thomas, jfthomas@mindspring.com

On 7/12/98 08:57, Joseph Thomas sent the following ASCII stream:

>Hi ho,
>
>I see that this one was sent through a mail relay.  Where in the header can
>I determine who accessed that mail relay? 
>
Let's see:

First, with your unedited(and squashed) headers. Please, if possible, don't squash up 
the headers. I also use Eudora Pro, so I know it doens't do this. Just copy/paste 
them as-is.

Return-Path: <readthhis@usa.net> 
Received: from mail-relay.ubc.ca
(mail-relay.ubc.ca [137.82.1.2]) 
by camel10.mindspring.com (8.8.5/8.8.5)
with ESMTP id KAA22389 
for <jfthomas@mindspring.com>; Sun, 12 Jul 1998
10:58:40 -0400 (EDT) 
From: readthhis@usa.net 
Received: from
iris.brc.ubc.ca (iris.brc.ubc.ca [137.82.2.8]) 
by mail-relay.ubc.ca
[137.82.1.2] (8.8.8/8.8.8) with SMTP id HAA10170; 
Sun, 12 Jul 1998
07:57:57 -0700 (PDT) 
Received: from 3delcipini2.com by iris.brc.ubc.ca via
SMTP (940816.SGI.8.6.9/911001.SGI) 
id HAA09115; Sun, 12 Jul 1998 07:56:37
-0700 
Date: Sat, 11 Jul 1998 10:24:50 -0400 
Message-ID:
<82336334@3delcipini2.com> 
Subject: Make Your Dreams Come True!!

Now to tear these apart:

Return-Path: <readthhis@usa.net> 
Received: from mail-relay.ubc.ca
(mail-relay.ubc.ca [137.82.1.2]) 
by camel10.mindspring.com (8.8.5/8.8.5)
with ESMTP id KAA22389 
for <jfthomas@mindspring.com>; Sun, 12 Jul 1998
10:58:40 -0400 (EDT) 

>nslookup 137.82.1.2
Server:  ns.mediacity.com
Address:  205.216.172.10

Name:    mail-relay.ubc.ca
Address:  137.82.1.2
Relaying server identified.

From: readthhis@usa.net 
Forgery.

Received: from
iris.brc.ubc.ca (iris.brc.ubc.ca [137.82.2.8]) 
by mail-relay.ubc.ca
[137.82.1.2] (8.8.8/8.8.8) with SMTP id HAA10170; 
Sun, 12 Jul 1998
07:57:57 -0700 (PDT) 

>nslookup 137.82.2.8
Server:  ns.mediacity.com
Address:  205.216.172.10

Name:    iris.brc.ubc.ca
Address:  137.82.2.8
This is the hijacked server, when the forwarded to the other server, who then relayed it out.

Received: from 3delcipini2.com by iris.brc.ubc.ca via
SMTP (940816.SGI.8.6.9/911001.SGI) 
id HAA09115; Sun, 12 Jul 1998 07:56:37
-0700 

Well, the forgery coupled with the poorly configured hijacked server doesn't show the true 
origniating point and accepts the forgery.

>whois 3delcipini2.com
No match for "3DELCIPINI2.COM".

Date: Sat, 11 Jul 1998 10:24:50 -0400 
Message-ID:
<82336334@3delcipini2.com> 
Subject: Make Your Dreams Come True!!

These certainly aren't my dreams. Call the toll free number once for each time you've received this 
spam. This is perfectly OK, as each spam is a solicitation for you to call. I got one spam company 
really angry with me by repeatedly calling their number. They asked me to stop calling. I asked them 
to stop sending me their one-time spam and I was calling ONCE for each time they spammed me.

That should do it.