Return-Path: <40752360@nathanhoward.com>
Received: from webserver.gtwinc.net ([206.103.139.1])          
by SantaClara01.pop.internex.net (Post.Office MTA v3.1.2          
release (PO203-101c) ID# 0-34792U7500L7500S0) with ESMTP          
id AAA3845 for <chris@lanets.com>;          
Fri, 19 Dec 1997 09:11:16 -0800
From: 40752360@nathanhoward.com
Date: Fri, 19 Dec 97 07:42:09 EST
To: businesses@aol.com
Subject: $$ AUTOMATIC MONEY MACHINE$$
Message-ID: <>

webserver.gtwinc.net ([206.103.139.1]) does in fact resolve. This is the relaying server.
Since this is a spam house, measures are taken to protect the "customer" from his "victims".

MCI is immediately upstream.

>whois gtwinc.net
GTW Communications, Inc (GTWINC2-DOM)
   P.O. Box 36131
   Tucson, AZ 85740-6131
   US

   Domain Name: GTWINC.NET

   Administrative Contact, Technical Contact, Zone Contact:
      Administrator, Domain  (GW924)  dns@GTWINC.COM
      (520)410-4731 (FAX) (520)579-3489
   Billing Contact:
      Administrator, Domain  (GW924)  dns@GTWINC.COM
      (520)410-4731 (FAX) (520)579-3489

   Record last updated on 26-Jun-97.
   Record created on 26-Jun-97.
   Database last updated on 18-Dec-97 06:13:27 EDT.

   Domain servers in listed order:

   DNS.GTWINC.COM               206.103.139.1
   DNS2.GTWINC.COM              206.103.139.2

OK, now onto the forged return address:
>whois nathanhoward.com
NathanHoward Prints (NATHANHOWARD-DOM)
   750 S. Lincoln Ave., STE. 104-469
   Corona, California 91720
   US

   Domain Name: NATHANHOWARD.COM

   Administrative Contact:
      Jeffries, Wanda  (WJ320)  billing@IINET.COM
      909-693-1377 (FAX) 909-693-1380
   Technical Contact, Zone Contact:
      Cowe, Jacquie  (JC1134)  jccowe@IINET.COM
      (909) 693-1377
   Billing Contact:
      Jeffries, Wanda  (WJ320)  billing@IINET.COM
      909-693-1377 (FAX) 909-693-1380

   Record last updated on 15-Oct-97.
   Record created on 15-Oct-97.
   Database last updated on 18-Dec-97 06:13:27 EDT.

   Domain servers in listed order:

   NS.IINET.COM                 206.99.104.99
   NS.MCI.NET                   204.70.128.1

AOL is clearly forged.