Hey guys, have a new email and more info.

X-Symantec-TimeoutProtection: 0
X-Symantec-TimeoutProtection: 1
Received: from smtp102.plus.mail.re2.yahoo.com ([206.190.53.27])
by prserv.net (kcin01) with SMTP
id <2007012222360210100ddsk9e>; Mon, 22 Jan 2007 22:36:03 +0000
X-Originating-IP: [206.190.53.27]
Received: (qmail 10580 invoked from network); 22 Jan 2007 22:36:02 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=Received:X-YMail-OSG:Date:From:X-Mailer:Reply-To:X-Priority:Message-ID:To:Subject:MIME-Version:Content-Type:Content-Transfer-Encoding;
b=x4u07bHaFgHUEL+JDhQ9mxFwnpVPmoeLk7pX1tey7g+OuvuW 1dIOuH7re+OAQ+Brkz/kca+BU6o4JXlAbXxK8Gu1VuOjkcG+/RkuDcUzXTwmhNfZX/aK3bqJFAXtameTXuURA2ebhxNSKT2WE+BXcJGRakBekHEpBpHz v8aDFtA= ;
Received: from unknown (HELO yahoo.com) (ohrosha@68.80.139.5 with plain)
by smtp102.plus.mail.re2.yahoo.com with SMTP; 22 Jan 2007 22:35:59 -0000
X-YMail-OSG: 8LxSbnwVM1lv3rW5gILnuCxPhQj3dD1XShqF4uHMW35g_G2bX9 bcJVDEso7e.69SuxcjhfM7MIBl9PqYMz7VSs6.Nm7A0N7CGiRB Mor0XR1375SDjEnYpw--
Date: Tue, 23 Jan 2007 01:27:09 +0300
From: XXX <xxxxxxxxx@yahoo.com>
X-Mailer: The Bat! (v3.95.6) Professional
Reply-To: xxxxxxx <xxxxxx@yahoo.com>
X-Priority: 3 (Normal)
Message-ID: <8711187.20070123012709@yahoo.com>
To: Joe Abrahamson <joeaksa@yahoo.com>,
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-PMFLAGS: 37224576 0 1 P9VFHB02.CNM

Anything you guys can find in this header? She is now down to asking for only $2000!

Joe,

This is a professional spammer.

You are not going to catch this person.

Scott

Scott is right. The Bat! is used by spammers. Here's the info about the I.P. it supposedly came from:

IP: 68.80.139.5
OrgName: Comcast Cable Communications Inc.
OrgID: CMCS
Address: 1800 Bishops Gate Blvd
City: Mt Laurel
StateProv: NJ
PostalCode: 08054
Country: US
NetRange: 68.80.0.0 - 68.87.255.255
CIDR: 68.80.0.0/13
NetName: JUMPSTART-2
NetHandle: NET-68-80-0-0-1
Parent: NET-68-0-0-0-0
NetType: Direct Allocation
NameServer: DNS.INFLOW.PA.BO.COMCAST.NET
NameServer: DNS.CMC.CO.DENVER.COMCAST.NET
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 2002-01-28
Updated: 2006-01-26
RTechHandle: IC161-ARIN
RTechName: Comcast Cable Communications Inc
RTechPhone: 1-856-317-7200
RTechEmail: CNIPEO-Ip-registration@cable.comcast.com

Dave

Anyway to pin it down to a state and city?

Looks like it went from Florida to New Jersey now.

Problem with pro spammmers is that they often use hijacked home computers to send spam. So even if you track this IP down to the very house where it's situated, chances are you'll just find a computer savy person who has nothing to do with spam but just had a bad habbit of not using firewall and leaving it's computer unprotected.

A typical spammer will have hndreds of such drones, churning away mail on command.