Return-Path: <37160821@aol.com>
Received: from crusoe.crusoe.net (crusoe.crusoe.net [206.136.64.10])	
by tomcat.ns.net (8.8.5/8.8.5) with ESMTP id BAA21755	for <cpicket@ns.net>; 
Thu, 30 Oct 1997 01:11:55 -0800 (PST)
From: 37160821@aol.com
Received: from friday.crusoe.net ([206.136.64.11]) by crusoe.crusoe.net          
(Post.Office MTA v3.1.2 release (PO203-101c)          
ID# 0-42851U2500L250S0) with SMTP id AAA29360;          
Thu, 30 Oct 1997 04:08:59 -0500
Received: from 206.136.64.11 by friday.crusoe.net (SMI-8.6/SMI-SVR4)	id EAA05573; 
Thu, 30 Oct 1997 04:06:42 -0500
Date: Fri, 31 Oct 97 04:07:27 EST
To: friends@aol.com
Subject: Explode Your Online Business NOW!
Message-ID: <>
X-UIDL: 09cde8e0c15e012da829fde307753cf0

Lots to look up, some is NOT listed here.
This spammer is defrauding AOL to start with, then abusing mailexcite.com for his
little drop boxes. Let's ensure the headers are correct.

crusoe.crusoe.net [206.136.64.10 resolves.

friday.crusoe.net ([206.136.64.11]) also resolves. Looks to me(via addressing) that
this bounced from one mail server to another. My guess: one handles internal mail, the other
the outside world. Either way, we've found our source.

>whois crusoe.net
Crusoe Communications (CRUSOE-DOM)
   387 Passaic Ave
   Fairfield, NJ 07004

   Domain Name: CRUSOE.NET

   Administrative Contact, Technical Contact, Zone Contact:
      De Groot, Mark  (MD651)  degroot@CRUSOE.NET
      201-882-1022
   Billing Contact:
      Tranter, Robert  (RT390)  tranter@CRUSOE.NET
      201.808.2773 (FAX) 201.808.1066

   Record last updated on 07-Oct-96.
   Record created on 13-Oct-95.
   Database last updated on 30-Oct-97 05:32:06 EDT.

   Domain servers in listed order:

   FRIDAY.CRUSOE.NET            206.136.64.11
   CRUSOE.CRUSOE.NET            206.136.64.10
   AUTH00.NS.UU.NET             198.6.1.65
   AUTH01.NS.UU.NET             198.6.1.81

Traceroute does show UU.Net upstream.