Return-Path: <access01@yahoo.com>
Received: from vision.com ([204.71.168.1]) by SantaClara01.pop.internex.net          
(Post.Office MTA v3.1.2 release (PO203-101c)          
ID# 0-34792U7500L7500S0) with SMTP id AAA16879          
for <chris@lanets.com>; 
Thu, 4 Dec 1997 08:21:22 -0800
Received: from 204.71.168.1 by vision.com (SMI-8.6/SMI-SVR4)	id LAA28080; 
Thu, 4 Dec 1997 11:01:57 -0500
From: access01@yahoo.com
Received: from ipitco@cybermail.com by  (8.8.5/8.6.5) with SMTP id GAA01126 for <>; 
Thu, 04 Dec 1997 09:57:40 -0600 (EST)
Date: Thu, 04 Dec 97 09:57:40 EST
To: Friend@public.com
Subject: 300 and MORE!
Message-ID: <98333241851110312.5421@ipit.co.th>

204.71.168.1 resolves to ns1.vision.com, showing the relaying server.

I will assume everything else is forged.

>whois vision.com
CMS Automation, Inc. (VISION4-DOM)                                  VISION.COM
Vision.com, S.C.P. (VISION-COM-DOM)                             VISION-COM.COM

>whois VISION4-DOM
CMS Automation, Inc. (VISION4-DOM)
   2215 Tomlynn St.
   Richmond, VA 23230

   Domain Name: VISION.COM

   Administrative Contact:
      Bauer, Betsy  (BB1958)  bbauer@VISION.COM
      804-278-5026
   Technical Contact, Zone Contact:
      Wills, Randy  (RW566)  rwills@VISION.COM
      804-346-9516
   Billing Contact:
      Bauer, Betsy  (BB1958)  bbauer@VISION.COM
      804-278-5026

   Record last updated on 26-Aug-97.
   Record created on 24-Feb-95.
   Database last updated on 4-Dec-97 05:14:38 EDT.

   Domain servers in listed order:

   NS1.VISION.COM               204.71.168.1
   NS.MCI.NET                   204.70.128.1

OK, let's look into a forged domain:
>whois cybermail.com
Net Promotions (CYBERMAIL4-DOM)
   3555 Cremazie Est 805A
   Montreal, Quebec h1Z 2J3
   CA

   Domain Name: CYBERMAIL.COM

   Administrative Contact:
      Selim, Pat  (PS3287)  selim@VIDEOTRON.CA
      514-721 6918
   Technical Contact, Zone Contact:
      Administration, DNS  (CTM-ORG)  domains@BESTDOMAINS.COM
      212-425-3477
Fax- 212-425-3487
   Billing Contact:
      Selim, Pat  (PS3287)  selim@VIDEOTRON.CA
      514-721 6918

   Record last updated on 21-May-97.
   Record created on 21-May-97.
   Database last updated on 4-Dec-97 05:14:38 EDT.

   Domain servers in listed order:

   NS1.GLOBECOMM.NET            207.51.48.20
   NS2.GLOBECOMM.NET            207.51.48.22

Hmm, a spammer domain. I'll bet this spam actually originated from one of their customers.