Re: [RCSE] Re: Application - Header analysis

Fri, 27 Jun 2003 06:43:39 -0700

[EMAIL PROTECTED] wrote:
Please see the attached zip file for details. 

It's a forgery.  It didn't come from me.  Further, it doesn't have
my signature at the bottom, which all my e-mails do.

Received: from List.airage.com (list.airage.com [66.181.201.61])
        by mail.isoar.ca (8.12.8/8.12.8) with ESMTP id h5R4pZfF024302
        for <[EMAIL PROTECTED]>; Fri, 27 Jun 2003 00:51:35 -0400

The address 66.181.201.61 is indeed list.airage.com, and my server
added this header.  It's genuine.

Received: from flyby.airage.com ([192.168.1.62]) by List.airage.com
          (Post.Office MTA v3.5.2 release 221 ID# 35-56975U100L100S0V35)
          with ESMTP id com for <[EMAIL PROTECTED]>;
          Fri, 27 Jun 2003 00:55:32 -0400

The address 192.168.1.62 is not flyby.airage.com, but rather an
internal private nextwork address.  I'm guessing it is legitimate,
given previously received list messages with the same header.

Received: from pilot.airage.com ([192.168.1.60]) by flyby.airage.com
          (Post.Office MTA v3.5.3 release 223 ID# 35-57062U100L100S0V35)
          with SMTP id com for <[EMAIL PROTECTED]>;
          Fri, 27 Jun 2003 01:00:19 -0400

The address 192.168.1.60 is not pilot.airage.com, but rather an
internal private nextwork address.  I'm guessing it is legitimate
given previously received list messages with the same header.

Received: from NITRO.airage.com ([66.181.193.8])
 by pilot.airage.com (SAVSMTP 3.1.0.29) with SMTP id M2003062700561501507
 for <[EMAIL PROTECTED]>; Fri, 27 Jun 2003 00:56:15 -0400

The address 192.168.1.62 is indeed nitroairage.com.  I'm guessing it
is legitimate as the chain is intact, and given previously received
list messages with the same header.

Received: from ME (ip68-103-106-154.ks.ok.cox.net [68.103.106.154])
        by NITRO.airage.com (Build 101 8.9.3/NT-8.9.3) with ESMTP id AAA32418
        for <[EMAIL PROTECTED]>; Fri, 27 Jun 2003 00:51:13 -0400

This looks like the source of the message:
  ip68-103-106-154.ks.ok.cox.net [68.103.106.154]

--
Andrew E. Mileski
Ottawa, Canada
http://isoar.ca/

RCSE-List facilities provided by Model Airplane News. Send "subscribe" and "unsubscribe" requests to [EMAIL PROTECTED] Please note that subscribe and unsubscribe messages must be sent in text only format with MIME turned off.

Reply via email to