Text 179, 104 rader
Skriven 2005-01-11 12:16:38 av Gerald Miller (1:342/512)
    Kommentar till text 177 av Frank Vest (1:124/6308.1)
Ärende: Header
==============
Hello Frank,

    Responding to a post in the INTERNET area:
    On Tuesday January 11 2005 at 06:49,
    Frank Vest [1:124/6308.1] wrote to All & Mark,
    about: Header

 FV> In an attemt to drive myself crazy... and the fact that this just
 FV> happened to arrive today. :) Here's a header:
 FV> -------------- cut --------------

From - Tue Jan 11 06:29:47 2005
X-UIDL: 7102bf47eef5f2d6bdf88fb41a68cc37
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Apparently-To: flv@sbcglobal.net via 206.190.37.163; Tue, 11 Jan
2005 03:57:03 -0800
Authentication-Results: mta827.mail.sc5.yahoo.com
  from=hotmail.com; domainkeys=neutral (no sig)
X-Originating-IP: [165.146.39.191]
Return-Path: <donwills1@hotmail.com>
Received: from 207.115.63.32  (EHLO yipvme.prodigy.net)
(207.115.63.32)
  by mta827.mail.sc5.yahoo.com with SMTP; Tue, 11 Jan 2005 03:57:03
-0800
X-Header-Overseas:
Mail.from.Overseas.source.rndf-146-39-191.telkomadsl.co.za
X-Originating-IP: [165.146.39.191]
Received: from mydomain.com (rndf-146-39-191.telkomadsl.co.za
[165.146.39.191])
        by yipvme.prodigy.net (8.12.10 083104/8.12.10) with ESMTP id
j0BBti6F224878
        for <flv@sbcglobal.net>; Tue, 11 Jan 2005 06:55:55 -0500
Message-Id: <200501111155.j0BBti6F224878@yipvme.prodigy.net>
Received: from nk3.mx.aol.com ([150.88.44.218]) by nk4.hotmail.com
with Internet Mail Service
        id 0219073E;
         Tue, 11 Jan 2005 11:51:05 -0000
Received: from mailin-01.mail.lycos.com ([168.124.56.217]) by
mailin-02.google.com with Microsoft SMTPSVC
        id 01582870;
         Tue, 11 Jan 2005 11:50:55 -0000
Received: from mailin-03.excite.com ([178.45.182.211]) by
mailin-04.linksynergy.com with SMTP
        id 018D9DED;
         Tue, 11 Jan 2005 11:50:45 -0000
Date: Tue, 11 Jan 2005 13:50:45 +0200
From: donwills1@hotmail.com
To: donwills1@hotmail.com
Subject: I NEED YOUR ASSISTANCE

 FV> ----------------- cut ----------------

I cut and pasted your header (as displayed above) into the Spam Abuse program.
This is what was returned back to me:

*********
In line: Received: from 207.115.63.32  (EHLO yipvme.prodigy.net)
Useless qmail received line
*********
In line: Received: from mydomain.com (rndf-146-39-191.telkomadsl.co.za
Useless qmail received line
**********
Parsing:
Sender (or dispatching mailserver) IP:150.88.44.218
He/she/it has said to be :nk3.mx.aol.com
Receiving mailserver [by]:nk4.hotmail.com
*********
In line: Received: from mailin-01.mail.lycos.com ([168.124.56.217]) by
Useless qmail received line
*********
In line: Received: from mailin-03.excite.com ([178.45.182.211]) by
Useless qmail received line
150.88.44.218 is the last valid ip, probably the spammer?
***** RESULTS ******
- 150.88.44.218([No rDns configured]): Spam source
Searching for abuse addresses in the cache
Found results in the cache
Possible abuse address: : hostmaster@arin.net
Possible abuse address: : hostmaster@nic.ad.jp
Possible abuse address: : hostmaster@arin.net
Possible abuse address: : hm-changed@apnic.net
Possible abuse address: : hm-changed@apnic.net
Possible abuse address: : hostmaster@nic.ad.jp
Possible abuse address: : apnic-ftp@nic.ad.jp
Possible abuse address: : ip-staff@nic.ad.jp
Possible abuse address: : hostmaster@nic.ad.jp

Now, I can't explain all the "Useless qmail received line" unless it was
because of line wrap...

I can't verify that "165.146.39.191" is the originating IP.  I may have to
run all the "Possible abuse address" through a WhoIs to get the originating
IP (what's ".jp" ?  Japan?).

Could you install the Spam Abuse program on your machine and run your
header through it to see if you can get the same results as I have posted
above?

           Cheers ... Gerald

... If we aren't supposed to eat animals, why are they made of meat?
--- GoldED+/DPMI32 v1.1.5-040330 [msg of Tuesday January 11 2005]
 * Origin: Are those Bugle Boy Jeans you're taking off? (1:342/512)