MSGID: 2:221/1.58@fidonet ee0f7852   
   REPLY: 2:371/52@fidonet 603e799f   
   PID: OpenXP/5.0.49 (Win32)   
   CHRS: ASCII 1   
   TZUTC: -0500   
   Hello Daniel Path!   
      
    DP> i'm wondering what's inside the pls...   
      
   It turns out to be nothing.  The "trick" was to make it look     
   like there was a 59Byte attachment, when indeed there was     
   nothing!   
      
   The real vector to deliver the payload was this line:   
      
   X-PHP-Script: crystal.net.in/mat/metoo.php for 20.52.179.36   
                                    ^^^^^^^^^   
      
      
   --   
     ../|ug   
      
   --- OpenXP 5.0.49   
    * Origin:  (2:221/1.58)   
   SEEN-BY: 1/123 90/1 103/705 105/81 120/340 123/131 124/5016 129/305   
   SEEN-BY: 154/10 203/0 221/1 6 360 226/30 227/114 702 229/101 424 426   
   SEEN-BY: 229/452 550 664 1016 1017 240/5832 249/110 206 317 400 280/464   
   SEEN-BY: 280/5003 282/1038 288/100 292/854 8125 310/31 317/3 322/757   
   SEEN-BY: 342/200 396/45 423/81 120 712/848 770/1 2452/250   
   PATH: 221/1 280/464 229/101 426