Return-Path: <60899120@ix.netcom.com>
Received: from bolt.Lakeheadu.ca ([192.75.62.254])          
by SantaClara01.pop.internex.net (Post.Office MTA v3.1.2          
release (PO203-101c) ID# 0-34792U7500L7500S0) with SMTP          
id AAA18221 for <chris@lanets.com>;          
Wed, 24 Dec 1997 20:31:46 -0800
Received: from bolt.Lakeheadu.ca by bolt.Lakeheadu.ca (SMI-8.6/SMI-SVR4)	id XAA29478; 
Wed, 24 Dec 1997 23:19:12 -0500
From: 60899120@ix.netcom.com
Received: from mailhost.saljflsakss.com (alt1.saljflsakss.com(205.3.22.35)) 
by 51151121@ix.netcom.com (8.8.5/8.6.5) with SMTP id GAA04171 for <51151121@ix.netcom.com>; 
Wed, 24 Dec 1997 20:38:22 -0600 (EST)
Date: Wed, 24 Dec 97 20:38:22 EST
To: 51151121@ix.netcom.com
Subject: Email your AD to 57 MILLION People  ONLY $99  
Message-ID: <331245784125.CAA55885@saljflsakss.com>
Reply-To: 51151121@ix.netcom.com
X-UIDL: 33124512325478965421254125214522
Comments: Authenticated sender is <51151121@ix.netcom.com>

This spam contains forgeries that mask where the spam originated from.

bolt.Lakeheadu.ca ([192.75.62.254]) resolves, showing what I am sure is a hijacked
server to relay this spam.

The next entry makes it appear as if the spam orignated from the relaying server, which
I don't believe for one second.

The next line makes it appear that it came from Netcom, where this spam may have in fact
originated from.

Then there appears to be a very bogus domain name. I'm going to check the IP address:
205.3.22.35 resolves to: NOTHING!!!

>whois 205.3.20.0
SPAWAR (JMCIS-BLOCK)
   DEPARTMENT OF THE NAVY
   SPACE AND NAVAL WARFARE SYSTEM COMMAND
   WASHINGTON, DC 20363-5100

   Netname: JMCIS-BLOCK
   Netblock: 205.0.0.0 - 205.117.255.0
   Maintainer: DNIC

   Coordinator:
      Greunke, Stephen C  (SCG)  STEVE.GREUNKE@NCC.NCTS.NAVY.MIL
      (904) 452-3501 ext. 5470 (DSN) 922-3501 ext 5470

   Domain System inverse mapping provided by:

   NCC.NCTS.NAVY.MIL            134.229.200.3
   GATE.NCTS.NAVY.MIL           138.147.10.10

   Record last updated on 21-Apr-97.
   Database last updated on 24-Dec-97 05:47:34 EDT.

Ah, no wonder why the address doesn't resolve. This is a MILITARY address. That makes perfect
sense to me.

Now for something that should be obvious without me having to do a lookup:
>whois saljflsakss.com
No match for "SALJFLSAKSS.COM".