Date: Sun, 18 Aug 2002 07:07:31 +0000 From: "Matthew Hanson" <[EMAIL PROTECTED]> Subject: Re: [LIB] [OT] mail routing...
> > From Neil Barnes: > > Which puzzles me: why does the server decide that everything is > being >originated by richard@birmingham? >From: Pres Waterman <[EMAIL PROTECTED]> >recieve and remail the emails. Perhaps this is the account Daniel is >using >to remail. But I thouht he was based in the US??? Back when these Klez posts started coming to my mailbox, both from the list and not, I began looking into the headers of posts to the list generally, and those of infected non-list mail I was getting.. I found that for the same piece of mail coming from the list server, 2 people reported finding 2 different values for the "for <email address>" section of the list server's header. And the value I found in the header of the very same post was different from those two. So evidently the server is not using the same address in that section of the header for every individual email, or group of email messages it transmits. I wrote one or two posts pointing this out. I also went through older posts saved in my mailbox, and found 2-3 different addresses for that value. I've just gone back through all of my saved list posts for the past 2 months, and again, found many different address values in that part of the list headers. Here's an example of the relevant routing portion of the header that the list server inserts: Received: from [65.174.100.24] by hotmail.com (3.2) with ESMTP id MHotMailBEC541BE003A4004314A41AE64180AAB0; Mon, 03 Jun 2002 16:07:44 -0700 Received: from mail77.basiclink.com (65.174.102.137) by BL24 (MailMax 4. 8. 3. 0) with ESMTP id 54092180 for [EMAIL PROTECTED]; Mon, 3 Jun 2002 16:05:17 –0700 And here’s a list of the last address & time/date info from posts from June to present: for [EMAIL PROTECTED]; Mon, 3 Jun 2002 16:05:17 –0700 for [EMAIL PROTECTED]; Fri, 12 Jul 2002 11:58:20 –0700 for [EMAIL PROTECTED]; Mon, 22 Jul 2002 11:08:10 -0700 for [EMAIL PROTECTED]; Tue, 23 Jul 2002 09:03:10 -0700 for [EMAIL PROTECTED]; Thu, 1 Aug 2002 22:10:08 -0700 for [EMAIL PROTECTED]; Wed, 14 Aug 2002 05:31:08 -0700 PDT Neil’s reported these two: [EMAIL PROTECTED]; Mon, 29 Jul 2002 > >06:55:21 -0700 PDT richard@birmingham <???????????????????> Raymond reported this one: for [EMAIL PROTECTED]; Mon, 29 Jul 2002 06:44:40 >-0700 PDT A quick search of the archives show that 5 out of 9 of these addresses belong to list members who have posted one or more times. I’m guessing the other 4 were/are members who never posted. At first I was wondering if the same address value would show up in posts from the same people. But it turned out that data/time was more the common thread. Groups of posts for days at a time would come through with the same value, then change. But that doesn’t explain why 2 list members and myself all received the same post recently with totally different address values in that part of the list header. I think this pretty much rules out this particular address value as being a vaule that represents the email address of the person who originally posted the message. It seems Dan’s list server software pretty much wipes most everything from the original email header it receives, and creates a new one that contains little, if any data from the original. How it comes up with those "for " values is a mystery. The whole deal of there being two Libretto lists, as Pres mentioned, is another issue. From what I've read and vaguely remember, an extirely different Librtetto list was set up as Yahoo group a couple years back. It died a quick death if I'm not wrong. Posts were made to it that didn't come to this list as I recall. But I don't think that list exists at this point, does it? Matt _________________________________________________________________ Send and receive Hotmail on your mobile device: http://mobile.msn.com ************************************************************** http://libretto.basiclink.com - Libretto mailing list http://www.silverace.com/libretto/ - Archives -------TO UNSUBSCRIBE------- Reply to any of the list messages. The reply mail should be addressed to: [EMAIL PROTECTED] - Then replace any text on the message's subject line: cmd:unsubscribe --------TO UNSUBSCRIBE DIGEST------ Do above but with this on subject line: cmd:unsubscribe digest **************************************************************
