I just got a bounce message from the forged spam which has the full headers:
Received: (qmail 22115 invoked by uid 507); 10 Dec 2002 18:21:39 -0000 Delivered-To: dublin-hotels.net-groups@dublin-hotels.net Received: (qmail 22071 invoked by alias); 10 Dec 2002 18:21:34 -0000 Received: from unknown (HELO macmegasite.com) (200.37.60.157) by 0 with SMTP; 10 Dec 2002 18:21:34 -0000 Received: from 170.107.201.224 ([170.107.201.224]) by symail.kustanai.co.kr with smtp; 11 Dec 2002 04:24:08 -0900 Received: from [117.78.63.74] by a231242.upc-a.zhello.nl with esmtp; 10 Dec 2002 19:23:11 -0100 Reply-To:Message-ID: <031d14e06c1b$3367d7b6$7ec66ca4@udgbby> From: To: Subject: Really was that me? Date: Tue, 10 Dec 2002 17:59:36 -0000 MiME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 8bit X-Priority: 1 (High) X-MSMail-Priority: High X-Mailer: Microsoft Outlook, Build 10.0.2627 Importance: Normal
It appears to have originated from 200.37.60.157, which samspade.org seems to indicate is in South America, possibly Peru. Other hosts mentioned in the headers are in Korea.