Probably the starting IP is spoofed.
-----Original Message----- From: Rob Ellis [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 06, 2003 9:30 AM To: Exchange Discussions Subject: RE: Internet Header Question Well, a quick look on www.samspade.org tells me that 169.139.15.251 is part of the Broward County Public Schools network in Florida. 210.91.16.8 is in Seoul, Korea I'm not sure why it displays both those IP addresses as part of the same 'hop', someone with a bit more experience can probably explain that. Regards, Rob Ellis IT Manager Samsara Group plc Tel 023 9224 7979 Mob 07974 111867 MCP BEng(hons) -----Original Message----- From: Jose Manzano [mailto:[EMAIL PROTECTED] Sent: 06 August 2003 14:18 To: Exchange Discussions Subject: RE: Internet Header Question Hello Rob, What do the other 2 IP's represent that are in the header? Thank you !! -----Original Message----- From: Rob Ellis [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 06, 2003 9:09 AM To: Exchange Discussions Subject: RE: Internet Header Question 157.124.218.229 Regards, Rob Ellis IT Manager Samsara Group plc Tel 023 9224 7979 Mob 07974 111867 MCP BEng(hons) -----Original Message----- From: Jose Manzano [mailto:[EMAIL PROTECTED] Sent: 06 August 2003 14:05 To: Exchange Discussions Subject: Internet Header Question Hello Group, I have a question about the Internet headers of an Email. If one looks at this Spam Email Header ---- --------------------------------------------------------------------- Received: from 169.139.15.251 (210.91.16.8 [210.91.16.8]) by mail.wpbpl.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2656.59) id PYC9TG9D; Wed, 6 Aug 2003 07:22:09 -0400 Received: from [157.124.218.229] by 169.139.15.251 with SMTP; Wed, 06 Aug 2003 15:21:11 +0600 Message-ID: <[EMAIL PROTECTED]> From: "Beckie Yaung" <[EMAIL PROTECTED]> Reply-To: "Beckie Yaung" <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: Re: my pictures are ready now Date: Wed, 06 Aug 2003 15:21:11 +0600 X-Mailer: Microsoft Outlook Express 5.50.4522.1200 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="F11140.F0BB5D4" X-Priority: 1 --F11140.F0BB5D4 Content-Type: text/html; Content-Transfer-Encoding: quoted-printable --F11140.F0BB5D4-- ---------------------------------------------------------------------- Would the spam be coming from the 210.91.16.8, 169.139.15.251, or the 157.124.218.229 IP? _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
