>What makes the headers out of order? They look to be from last (on top) to
>first (on bottom).
Normally, the Received: headers will always be on top (mailservers must add
them to the top). Since the Received: headers all appear on the bottom,
that means that either [1] The headers were rearranged, or [2] The
receiving mailserver added all the headers, including the "Subject:"
header. Since the receiving mailserver wouldn't know the subject if it
wasn't included in the headers, we'd have to go with option #1.
So someone somewhere rearranged the headers. Once rearranged, they are no
longer the original headers, and are automatically considered highly
suspect. If they make it look like spam is coming from a mailserver under
your control, it's still a good idea to investigate -- but otherwise it's
best to go back to the sender and say "Sorry, we'll need to see the
original headers."
>I am confused by your statement:
> > *If* the Received: headers are in the correct order and not modified, the
> > E-mail came from 10.140.24.65 (a private IP), which received the E-mail
> > from 63.65.123.55 (the source of the spam).
>
>Are you saying the apparent source was 63.65.123.55 and the relay was
>10.140.24.65? Then what is the connection between smtp5.ifriendly.com and
>psmtp5.array3.laserlink.net? I took it to mean that one of these is an
>alias for the other.
I'd have to look at the headers again to say for sure. But I believe the
top Received: header showed that it received the E-mail from 10.140.24.65,
which received it from 63.65.123.55. 10.140.24.65 is a private IP, and
therefore definitely, positively cannot be an open relay (it is impossible
to reach from the Internet).
As you can see, the altered headers make this much more confusing than it
should be.
From your other post, though, it appears that the only reason that spam
was suspected was because of the "From:" address -- but those are forged in
about 99+% of spam. So this one doesn't seem worth investigating further.
-Scott
---
Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for
IMail. http://www.declude.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
