Return-Path: <82964820@hotmail.com>
Received: from aunet.net (root@mail.aunet.net [202.132.255.185])	
by tomcat.ns.net (8.8.5/8.8.5) with ESMTP id AAA15978	for <cpicket@ns.net>; 
Wed, 19 Nov 1997 00:54:01 -0800 (PST)
From: 82964820@hotmail.com
Received: from mail.aunet.net (chs0070.awod.com [208.140.96.70]) 
by aunet.net (8.8.5/8.7.3) with SMTP id QAA10515; 
Wed, 19 Nov 1997 16:41:39 +0800 (CST)
Received: from mailhost.nowhere.com (alt.1nowhere.com (208.9.77.65)) 
by nowhere.com (8.8.5/8.6.5) with SMTP id GAA01752 for <UcanDoit@kolomiec.rosmail.com>; 
Wed, 19 Nov 1997 03:05:16 -0600 (EST)
Date: Wed, 19 Nov 97 03:05:16 EST
To: UcanDoit@kolomiec.rosmail.com
Subject: FIRM UP WITHOUT GIVING UP...the food you love!
Message-ID: <199702580039DAA007056>
Reply-To: UcanDoit@hotmail.com
X-PMFLAGS: 34078848 0
Comments: Authenticated sender is <success@nowhere.com>
X-UIDL: 4590327a97abd5g342usl675po521kl

mail.aunet.net [202.132.255.185] does resolve, showing the relaying server.

chs0070.awod.com [208.140.96.70] also resolves. This would appear to be the point of
origination.

(alt.1nowhere.com (208.9.77.65)) does NOT resolve. This and everything below it forged.

First I will look up the relaying server:
>whois aunet.net
AUNET (AUNET2-DOM)
   2490 Sand Hill Road
   Menlo Park, CA 94025
   USA

   Domain Name: AUNET.NET

   Administrative Contact, Technical Contact, Zone Contact:
      Foley, Matthew  (MF1115)  mfoley@AUNET.NET
      650-361-1783 (FAX) 650-361-8644
   Billing Contact:
      Foley, Matthew  (MF1115)  mfoley@AUNET.NET
      650-361-1783 (FAX) 650-361-8644

   Record last updated on 08-Sep-97.
   Record created on 27-Sep-95.
   Database last updated on 19-Nov-97 05:22:02 EDT.

   Domain servers in listed order:

   AUTH00.NS.UU.NET             198.6.1.65
   AUTH01.NS.UU.NET             198.6.1.81
   UUCP-GW-1.PA.DEC.COM         16.1.0.18 204.123.2.18
   UUCP-GW-2.PA.DEC.COM         16.1.0.19

Now the originating domain:
>whois awod.com
A World Of Difference, Inc. (AWOD-DOM)
   1 Carriage Lane Building J
   Charleston, SC 29407

   Domain Name: AWOD.COM

   Administrative Contact:
      Flood, Stewart  (SF81)  sff@AWOD.COM
      (803) 769-4488
   Technical Contact, Zone Contact:
      Hostmaster, Hostmaster  (HH543)  hostmaster@AWOD.COM
      803-769-4488 (FAX) 803-556-3304
   Billing Contact:
      Flood, Stewart  (SF81)  sff@AWOD.COM
      (803) 769-4488

   Record last updated on 10-Nov-97.
   Record created on 24-May-94.
   Database last updated on 19-Nov-97 05:22:02 EDT.

   Domain servers in listed order:

   NS-1.AWOD.COM                208.140.99.11
   NS-2.AWOD.COM                208.140.99.12

Sounds like a spam house to me.

Onto forged entries now:
>whois rosmail.com
Rosnet - Russian Telecommunications Network JSC (ROSMAIL-DOM)
   2/15, Maroseika st
   Moscow, Russia 101000
   RU

   Domain Name: ROSMAIL.COM

   Administrative Contact:
      Gorstein, Michael J  (MG78-RIPE)  mike@ROSMAIL.COM
      +7 095 755 85 95 (FAX) +7 095 975 26 29
   Technical Contact, Zone Contact:
      Rosnet NOC  (RN26-ORG)  noc@ROSNET.NET
      +7 095 755 85 88
Fax- - +7 095 975 26 29
   Billing Contact:
      Mukhin, Sergey A  (SM45-RIPE)  violet@ROSNET.NET
      +7 095 755 85 88 (FAX) +7 095 975 26 29

   Record last updated on 16-Sep-97.
   Record created on 01-Nov-94.
   Database last updated on 19-Nov-97 05:22:02 EDT.

   Domain servers in listed order:

   NS.ROSNET.RU                 195.90.128.117
   NS2.ROSNET.RU                195.90.128.137
   NIC.NEAR.NET                 192.52.71.4
   NIC3.BARRNET.NET             131.119.245.6
   NS.ITEP.RU                   193.124.224.35

>whois nowhere.com
Seaman, Lisa (NOWHERE2-DOM)
   11 Upper Terrace
   San Francisco, CA 94117

   Domain Name: NOWHERE.COM

   Administrative Contact:
      Seaman, Lisa  (LS126)  lisa@NOWHERE.COM
      +1 415 221 7495
   Technical Contact, Zone Contact:
      Nowhere Hostmaster  (NH44-ORG)  hostmaster@NOWHERE.COM
      unlisted
   Billing Contact:
      Seaman, Lisa  (LS126)  lisa@NOWHERE.COM
      +1 415 221 7495

   Record last updated on 13-Jun-97.
   Record created on 21-Dec-94.
   Database last updated on 19-Nov-97 05:22:02 EDT.

   Domain servers in listed order:

   NS1.NOWHERE.COM              208.210.190.41
   NS2.NOWHERE.COM              206.190.29.173
This looks like spam house to me.