Return-Path: <89920848@mouse.net>
Received: from cpg.com ([198.3.5.7]) by SantaClara01.pop.internex.net          
(Post.Office MTA v3.1.2 release (PO203-101c)          
ID# 0-34792U7500L7500S0) with SMTP id AAA24560          
for <chris@lanets.com>; Tue, 9 Dec 1997 02:24:49 -0800
Received: from expert.com by cpg.com (SMI-8.6/SMI-SVR4)	id EAA15421; 
Tue, 9 Dec 1997 04:40:27 -0500
From: 89920848@mouse.net
Received: from 353647@ute.net by  (8.8.5/8.6.5) with SMTP id GAA04442 for <mickey@mouse.net>; 
Sat, 06 Dec 1997 12:21:06 -0600 (EST)
Date: Sat, 06 Dec 97 12:21:06 EST
To: mickey@mouse.net
Subject: MAKE ALL THE $$CASH$$ YOU WANT ON THE INTERNET......
Message-ID: <>
Comments: Authenticated sender is <764098@wildnet.net>

Well, this spammer can't be legitimate because they are masking where they came from,
bu tthe relaying server is clearly exposed:

198.3.5.7 resolves to: ultrasparc.cpg.com, which suggests a Sun Sparc-station, but that
is not important. This is where the mail server resides.

>whois cpg.com
Computer Publications Group (CPG-HST) CPG.COM                        198.3.5.1
Computer Publishing Group (CPG-DOM)                                    CPG.COM

>whois CPG-DOM
Computer Publishing Group (CPG-DOM)
   320 Washington St.
   Brookline, MA 02146

   Domain Name: CPG.COM

   Administrative Contact:
      Pryor, Doug  (DP222)  dp@CPG.COM
      617-739-7002
   Technical Contact, Zone Contact:
      Westmacott, Ian  (IW87)  ianw@CPG.COM
      617-738-3407
   Billing Contact:
      Pryor, Doug  (DP222)  dp@CPG.COM
      617-739-7002

   Record last updated on 11-Apr-97.
   Record created on 22-Jul-94.
   Database last updated on 9-Dec-97 05:35:58 EDT.

   Domain servers in listed order:

   ULTRASPARC.CPG.COM           198.3.5.7
   STRANGE.CPG.COM              198.3.5.100
   NS.UU.NET                    137.39.1.3

OK, let's look into the forged entries:

>whois mouse.net
Thukrals Network (MOUSE5-DOM)
   25 Burbages Lane
   Ash Green, Coventry CV6 6AX
   UK

   Domain Name: MOUSE.NET

   Administrative Contact, Technical Contact, Zone Contact:
      Sutaria, Robert  (BS2331)  robert@ENAMES.COM
      + 44  ( 0 ) 181 838 2222 (FAX) + 44  ( 0 ) 181 838 2244
   Billing Contact:
      Sutaria, Robert  (BS2331)  robert@ENAMES.COM
      + 44  ( 0 ) 181 838 2222 (FAX) + 44  ( 0 ) 181 838 2244

   Record last updated on 14-May-97.
   Record created on 14-May-97.
   Database last updated on 9-Dec-97 05:35:58 EDT.

   Domain servers in listed order:

   DNS.MAILBOX.CO.UK            195.82.96.4
   DNS.PORTLAND.CO.UK           195.82.96.6

>whois wildnet.net
Wildnet (WILDNET2-DOM)
   Mobbs Miller Hse.Christchurch Road
   Northampton, - NN1 5LL
   UK

   Domain Name: WILDNET.NET

   Administrative Contact, Technical Contact, Zone Contact:
      Jenkins, Stuart  (SJ481)  stuart@WILDNET.CO.UK
      +44 1604 36560
   Billing Contact:
      NetNames Hostmaster  (NH45-ORG)  hostmaster@NETNAMES.NET
      +44 171 224 2017
Fax- - +44 171 224 4313

   Record last updated on 24-Nov-97.
   Record created on 13-Apr-96.
   Database last updated on 9-Dec-97 05:35:58 EDT.

   Domain servers in listed order:

   DNS0.WILDNET.CO.UK           194.193.100.3
   DNS1.WILDNET.CO.UK           194.193.100.2

>whois expert.com
Computer Publishing Group (EXPERT-DOM)
   320 Washington Street
   Brookline, MA 02146

   Domain Name: EXPERT.COM

   Administrative Contact:
      Pryor, Doug  (DP222)  dp@CPG.COM
      617-739-7002
   Technical Contact, Zone Contact:
      Westmacott, Ian  (IW87)  ianw@CPG.COM
      617-738-3407
   Billing Contact:
      Pryor, Doug  (DP222)  dp@CPG.COM
      617-739-7002

   Record last updated on 18-Apr-97.
   Record created on 17-Jul-89.
   Database last updated on 9-Dec-97 05:35:58 EDT.

   Domain servers in listed order:

   ULTRASPARC.CPG.COM           198.3.5.7
   STRANGE.CPG.COM              198.3.5.100
   NS.UU.NET                    137.39.1.3


Done.