It got caught by my filter, i e, anything not addressed to me. Came from a zombied comcast machine. This is a straight-out Sam Spade output. I will annotate . Enjoy:

11/21/05 18:02:41 Input
The Received: headers are the important ones to read

My comments are just hints, and should be considered only <<
an opinion. I may have guessed wrong, or things may have
changed since I was written

From - Mon Nov 21 17:57:39 2005
Hmmm from isn't a header I recognise
X-Account-Key: account2
X-UIDL: 1eEjOY1f33Nl34p0
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
Status: U
Received: from ([]) by (EarthLink SMTP Server)
with SMTP id 1eEjOY1f33Nl34p0 Mon, 21 Nov 2005 17:07:31
-0500 (EST)
This received header was added by your mailserver received this from someone claiming
to be
This doesn't match the IP address in the headers, so this
may be a relay point. If so all headers below are probably
It really came from <<

From: [email protected]
To: [email protected] <<<<<<
Earthlink is a legitimate ISP and have many legitimate
customers. They have reduced their spam problem significantly recently.
They blame the problems on uunet, usually.

Date: Mon, 21 Nov 2005 20:57:34 UTC
Subject: You visit illegal websites
Importance: Normal
Hmmm importance: isn't a header I recognise
X-Mailer: SpeedMail_V7.61
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: multipart/mixed;
Content-Transfer-Encoding: 7bit

This is a multi-part message in MIME format.


Dear Sir/Madam,

we have logged your IP-address on more than 30 illegal Websites.

Please answer our questions!
The list of questions are attached.

Yours faithfully,
Steven Allison

*** Federal Bureau of Investigation -FBI-
*** 935 Pennsylvania Avenue, NW, Room 3220
*** Washington, DC 20535
*** phone: (202) 324-3000
Content-Type: application/octet-stream;
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="" <<<<<<<