Malicious email

According to WHOIS, the sender is using a COX IP address:

Received: from DesktopPC ([68.3.21.12]) by fed1rmimpo03.cox.net with bizsmtp id

Code:

Cox Communications Inc. COX-ATLANTA (NET-68-0-0-0-1) 
                                  68.0.0.0 - 68.15.255.255
Cox Communications Inc. NETBLK-PH-RDC-68-2-0-0 (NET-68-2-0-0-1) 
                                  68.2.0.0 - 68.3.255.255

# ARIN WHOIS database, last updated 2010-06-23 20:00
# Enter ? for additional hints on searching ARIN's WHOIS database.
#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at https://www.arin.net/whois_tou.html
#
# Attention! Changes are coming to ARIN's Whois service on June 26.
# See https://www.arin.net/features/whois for details on the improvements.

But it's a forged header then no way to determine where it's really sent from.

The IP address is a legit address of a Windows server somewhere, with a Web site and Email system, but it's firewalled and access from the WWW is disallowed:

Code:

d830:~# nmap -v -P0 68.3.21.12

Starting Nmap 5.00 ( http://nmap.org ) at 2010-06-24 07:13 EDT
NSE: Loaded 0 scripts for scanning.
Initiating Parallel DNS resolution of 1 host. at 07:13
Completed Parallel DNS resolution of 1 host. at 07:13, 0.07s elapsed
Initiating SYN Stealth Scan at 07:13
Scanning ip68-3-21-12.ph.ph.cox.net (68.3.21.12) [1000 ports]
Completed SYN Stealth Scan at 07:13, 7.19s elapsed (1000 total ports)
Host ip68-3-21-12.ph.ph.cox.net (68.3.21.12) is up (0.092s latency).
Interesting ports on ip68-3-21-12.ph.ph.cox.net (68.3.21.12):
Not shown: 994 closed ports
PORT     STATE    SERVICE
25/tcp   filtered smtp
80/tcp   filtered http
135/tcp  filtered msrpc
139/tcp  filtered netbios-ssn
445/tcp  filtered microsoft-ds
1433/tcp filtered ms-sql-s

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 7.36 seconds
           Raw packets sent: 1032 (45.408KB) | Rcvd: 1014 (40.560KB)

You could try contacting COX and reporting abuse, they may or may not investigate.

You should edit youir original post and use this <removed-address> in place of the real email address: book dot worm6 at verizon.net.