MSGID: 2:221/1.58@fidonet ee0f7852
REPLY: 2:371/52@fidonet 603e799f
PID: OpenXP/5.0.49 (Win32)
CHRS: ASCII 1
TZUTC: -0500
Hello Daniel Path!

 DP> i'm wondering what's inside the pls...

It turns out to be nothing.  The "trick" was to make it look  
like there was a 59Byte attachment, when indeed there was  
nothing!

The real vector to deliver the payload was this line:

X-PHP-Script: crystal.net.in/mat/metoo.php for 20.52.179.36
                                 ^^^^^^^^^


--
  ../|ug

--- OpenXP 5.0.49
 * Origin:  (2:221/1.58)
SEEN-BY: 1/123 90/1 103/705 105/81 120/340 123/131 124/5016 129/305
SEEN-BY: 154/10 203/0 221/1 6 360 226/30 227/114 702 229/101 424 426
SEEN-BY: 229/452 550 664 1016 1017 240/5832 249/110 206 317 400 280/464
SEEN-BY: 280/5003 282/1038 288/100 292/854 8125 310/31 317/3 322/757
SEEN-BY: 342/200 396/45 423/81 120 712/848 770/1 2452/250
PATH: 221/1 280/464 229/101 426