different sponsors. He's obviously a spammer for hire.
Some of the bounces quote back HIS headers, which I think is what we need here. I've change my domain name to mydomain.com:
Return-Path: <
[email protected]>
Received: (qmail 5540 invoked from network); 16 Mar 2003 23:38:17 -0000
Received: from unknown (HELO email-96.ig.com.br) ([200.226.132.99])
(envelope-sender <uvilr@ mydomain.com>)
by mailserver-3.ig.com.br (qmail-ldap-1.03) with SMTP
for <
[email protected]>; 16 Mar 2003 23:38:17 -0000
Received: (qmail 18189 invoked from network); 16 Mar 2003 23:11:49 -0000
Received: from mail.langstonwilliams.com (HELO mydomain.com) (204.229.126.206)
by email-96.ig.com.br with SMTP; 16 Mar 2003 23:11:49 -0000
Date: Sun, 16 Mar 2003 10:49:00 -0600
From: "Fly the Legend" <uvilr@ mydomain.com>
To: <
[email protected]>
Subject: Military Adventures in Russia - Fly to the Stratoshere!
Content-type: text/html; charset="us-ascii"
Message-ID: <20030316104900.ftxeuLNu0NSW@ mydomain.com>