Subject:     Re: FW: Over $400 Billion Dollars Is Owed To The North American Pub
Date:        7/8/98 20:35
To:          Scott Huffman, scooty2@webkorner.com

On 7/8/98 19:18, Scott Huffman sent the following ASCII stream:

>Here's another that I got. Did you get this one too?
>
>Scott
>
>
>>From financialhelp@softhome.net Wed Jul 08 21:34:22 1998
>Received: by mail.webkorner.com from localhost
>    (router,SLMail V3.0); Wed, 08 Jul 1998 21:34:22 -0400
>Received: by mail.webkorner.com from web1.atnet.co.jp [210.161.59.1]
>    (SLmail 3.0.2421 ()); Wed, 08 Jul 1998 21:34:21 -0400
>Received: from web1.atnet.co.jp (hd10-097.hil.compuserve.com 
>[206.175.201.97])
>	by web1.atnet.co.jp (8.8.8/3.6Wbeta7-98011411) with SMTP id KAA02098;
>	Thu, 9 Jul 1998 10:19:13 +0900 (JST)
>From: financialhelp@softhome.net
>Message-Id: <199807090119.KAA02098@web1.atnet.co.jp>
>Date: Tue, 30 Jun 98 23:53:33 EST
>To: financialnews@softhome.com
>Subject: Over $400 Billion Dollars Is Owed To The North American Public!

(generous snipping)
Nope, not yet, but I'm sure it's just a matter of time. We seem to be on the same set of 
lists. Figures, it's coming out of Compuserve after hijacking a Japanese mail server.

Let me do some more work in this one. Hey, I'm going to have to do it again anyhow...

>nslookup 205.152.190.238
Server:  ns.mediacity.com
Address:  205.216.172.10

*** ns.mediacity.com can't find 205.152.190.238: Non-existent host/domain

>traceroute 205.152.190.238
traceroute to 205.152.190.238 (205.152.190.238), 30 hops max, 40 byte packets
 1  grfge002 (205.216.172.1)  0.844 ms  0.307 ms  0.294 ms
 2  bordercore2-hssi0-0-0.SanFrancisco.mci.net (166.48.15.249)  6.722 ms  2.333ms  2.317 ms
 3  core7.SanFrancisco.mci.net (204.70.4.93)  2.577 ms  2.681 ms  2.783 ms
 4  Hssi5-1-0.BR1.SFO1.alter.net (206.157.77.78)  5.220 ms  4.895 ms  5.069 ms
 5  114.ATM3-0.XR2.SCL1.ALTER.NET (146.188.145.210)  6.855 ms  5.616 ms  5.595 ms
 6  194.ATM3-0.TR2.SCL1.ALTER.NET (146.188.146.22)  5.715 ms  6.294 ms  5.416 ms
 7  107.ATM8-0-0.TR2.ATL1.ALTER.NET (146.188.136.69)  150.315 ms  303.639 ms  382.580 ms
 8  100.ATM4-0-0.XR2.ATL1.ALTER.NET (146.188.232.97)  60.736 ms  60.236 ms  60.125 ms
 9  194.ATM5-0-0.GW1.MIA1.ALTER.NET (146.188.232.141)  73.820 ms  74.772 ms  74.649 ms
10  bs-miami-gw.customer.alter.net (157.130.65.222)  77.947 ms  76.953 ms  77.160 ms
11  205.152.16.160 (205.152.16.160)  78.919 ms  77.927 ms  76.987 ms
12  172.25.80.90 (172.25.80.90)  118.281 ms  107.670 ms  83.117 ms
13  * * *
14  * * *
15  * * 205.152.190.238 (205.152.190.238)  183.090 ms

>whois -h whois.arin.net 205.152.190.0
BellSouth.net, Inc. (NETBLK-BELLSNET-BLK)
   Suite 200
   Atlanta, GA  30338

   Netname: BELLSNET-BLK1
   Netblock: 205.152.0.0 - 205.152.255.255
   Maintainer: BELL

   Coordinator:
      Dean, Todd  (TD476-ARIN)  hostmaster@BELLSOUTH.NET
      770-206-5942
   Alternate Contact:
      Sosebee, John  (JS4286-ARIN)  sosebee@BELLSOUTH.NET
      (770) 392-4367

   Domain System inverse mapping provided by:

   NS.BELLSOUTH.NET             205.152.0.5
   NS.ATL.BELLSOUTH.NET         205.152.0.20
   NS.MIA.BELLSOUTH.NET         205.152.16.20
   NS.RDU.BELLSOUTH.NET         205.152.32.20

   Record last updated on 09-Dec-96.
   Database last updated on 8-Jul-98 16:10:04 EDT.

The ARIN Registration Services Host contains ONLY Internet
Network Information: Networks, ASN's, and related POC's.
Please use the whois server at rs.internic.net for DOMAIN related
Information and nic.ddn.mil for MILNET Information.

Definately complain to Bellsouth.net, they will nuke the web site. Well, I've had good luck 
with them revealing and nuking spammers. Don't complain to the above contacts.

You may want to visit the web site with cookies disabled and Java disabled and see what contact 
information you can reveal.