Return-Path: <Greatdeals@aanews.com>
Received: from mercury.gmds.com ([206.98.109.20])          
by SantaClara01.pop.internex.net (Post.Office MTA v3.1.2          
release (PO203-101c) ID# 0-34792U7500L7500S0) with ESMTP          
id AAA16760; Sat, 6 Dec 1997 04:57:48 -0800
Received: by mercury.gmds.com (8.8.5/8.8.5) with SMTP id FAA19187;	
Sat, 6 Dec 1997 05:40:10 -0600
From: Greatdeals@aanews.com
Received: from BdavidC@aaanews.com by BdavidC@aaanews.com (8.8.5/8.6.5) 
with SMTP id GAA08208 for <BdavidC@aaanews.com>; 
Sat, 06 Dec 1997 04:18:36 -0600 (EST)
Date: Sat, 06 Dec 97 04:18:36 EST
To: BdavidC@aaanews.com
Subject: 48 MILLION Email Leads $195 + BONUSES
Message-ID: <Greatnews@aaanews.com>
Reply-To: BdavidC@aaanews.com
X-PMFLAGS: 128 0
X-UIDL: 10000000000000000000000000000011
Comments: Authenticated sender is <BdavidC@aaanews.com>

More GMDS crap.

mercury.gmds.com ([206.98.109.20]) resolves, showing GMDS gladly relayed this.

Everything else is masked.

>whois gmds.com
Faust Brokers (GMDS-DOM)
   7930 SE 9th Ave.
   Portland, OR 97202

   Domain Name: GMDS.COM

   Administrative Contact, Technical Contact, Zone Contact:
      Faust, Charles  (CF1381)  mtgquotes@GMDS.COM
      1-503-230-8805 (FAX) 1-503-230-8805
   Billing Contact:
      Faust, Charles  (CF1381)  mtgquotes@GMDS.COM
      1-503-230-8805 (FAX) 1-503-230-8805

   Record last updated on 29-Oct-97.
   Record created on 11-Apr-97.
   Database last updated on 6-Dec-97 05:21:38 EDT.

   Domain servers in listed order:

   NS.GMDS.COM                  206.98.109.2
   NS2.GMDS.COM                 206.98.109.3

Now for a traceroute, showing GMDS gets their access from MCI.
Hop Result Min.  Avg.  Max.  IP.            Name
1   3/3    0.195 0.201 0.206 204.119.240.5  pm4.ns.net
2   3/3    0.161 0.211 0.285 204.119.240.1  nsnet-gw.ns.net
3   3/3    0.155 0.238 0.305 204.70.120.25  border5-serial2-4.sacramento.mci.net
4   2/3    0.151 0.265 0.380 204.70.164.49  core2-fddi-0.sacramento.mci.net
5   3/3    0.173 0.200 0.248 204.70.1.233   core4-hssi-6.sanfrancisco.mci.net
6   3/3    0.178 0.211 0.268 204.70.4.33    core2.seattle.mci.net
7   3/3    0.167 0.197 0.245 204.70.203.66  border6-fddi-0.seattle.mci.net
8   3/3    0.183 0.217 0.273 204.70.205.6	
9   3/3    0.177 0.230 0.323 206.98.109.20	

Now let's look up who owns the Class C license:

>whois 206.98.109.0
IPNS, INC. (NETBLK-MCI-206-98-108) MCI-206-98-108206.98.108.0 - 206.98.111.255
MCI Internet Services (NETBLK-MCI-NETBLK06) MCI-NETBLK06
                                                  206.96.0.0 - 206.103.255.255

To single out one record, look it up with "!xxx", where xxx is the
handle, shown in parenthesis following the name, which comes first.

This clearly shows MCI owning the IP addresses.

Now onto the forged domain:
>whois aaanews.com
Bruce Connelly (AAANEWS-DOM)
   1711 W. Hall Ave
   Slidell, LA 70460
   USA

   Domain Name: AAANEWS.COM

   Administrative Contact:
      ct1245, Craig  (CT1245)  cte@NEVWEST.COM
      702-869-4972 (FAX) 702-869-4972
   Technical Contact, Zone Contact:
      jw728, Jim  (JW728)  inic@NEVWEST.COM
      702- (FAX) 702-631-4147
   Billing Contact:
      Connelly, Bruce  (BC3416)  bdavidc@AAANEWS.COM
      504-781-6615

   Record last updated on 07-Jun-97.
   Record created on 07-Jun-97.
   Database last updated on 6-Dec-97 05:21:38 EDT.

   Domain servers in listed order:

   SAHARA.LLV.COM               205.254.164.2
   MOJAVE.LLV.COM               205.254.164.3

What does that not surprise me?

You'll also notice a Hotmail address, and an invalid IEMMC remove address. We all know the 
IEMMC is a defunct organization.