Subject:     Re: FYI
Date:        7/5/98 10:04
To:          Scott Huffman, scooty2@webkorner.com

I didn't get this exact one, but yes, I got 3 of these yesterday. Your assumping of 
Compuserve is not assumption, it is fact.

On 7/5/98 05:55, Scott Huffman sent the following ASCII stream:

>From pae61@prodigy.com Sun Jul 05 04:13:32 1998
Received: by mail.webkorner.com from localhost
    (router,SLMail V3.0); Sun, 05 Jul 1998 04:13:32 -0400
Received: by mail.webkorner.com from hp9000.hrz.uni-oldenburg.de [134.106.40.3]
    (SLmail 3.0.2421 ()); Sun, 05 Jul 1998 04:13:31 -0400

Shows relaying server.

Received: from fb34.uni-oldenburg.de (fb34.uni-oldenburg.de [134.106.34.68])
        by hp9000.hrz.uni-oldenburg.de (8.8.8/8.8.8/09.12.97) with ESMTP id KAA15509;
        Sun, 5 Jul 1998 10:07:55 +0200 (METDST)

Shows hijacked server.

Date: Sun, 5 Jul 1998 10:07:55 +0200 (METDST)
From: pae61@prodigy.com
Received: from FB34/MAILQUEUE by fb34.uni-oldenburg.de (Mercury 1.40);
    5 Jul 98 10:08:37 MEZ-1MESZ
Received: from MAILQUEUE by FB34 (Mercury 1.40); 5 Jul 98 10:07:37 MEZ-1MESZ

Mercury crap. Ignore, although important from an admin point of view. This seems to be a 
really crappy server.

Received: from IBM (206.175.227.50) by fb34.uni-oldenburg.de (Mercury 1.40);
    5 Jul 98 10:07:24 MEZ-1MESZ

Oh my, a forgery? 

>nslookup 206.175.227.50
Server:  ns.mediacity.com
Address:  205.216.172.10

Name:    sf-dnpqi-050.compuserve.net
Address:  206.175.227.50

So much for that!

To: pae61@prodigy.com
Comments: Authenticated sender is <pae61@prodigy.com>
Subject: Email 57 Million People for $99
Message-Id: <199807054301QAA48053@pimaia2y.uni-oldenburg.de>

Seems this spammer has a fetish for German mail servers.