[Lance Romance]

Lets Go Freeper Nerds.

[Turk82_1]

On the case

[Tall_Texan]

Somehow I can't believe a CNN anchor would say "don't believe what the media tells you". He is the media.

[SusaninOhio]

I have a couple very anti-Bush emails that arrived in my outlook this afternoon, from someplace called 'misleader.com'. I have never heard of them or their site until now and I would like to know how they got my email address.

Blocking is somewhat satisfying but it would be more fun to make their lives miserable in some small way, whoever they are.

Has anyone else been getting strange garbage like that?

[idkfa]

Mail Header

An email will gather together information from each of the computers it passes through on the way to the recipient and this is stored in the email header. In Outlook, right click on the email message and select Options.Headers are best read from the bottom up, as they are added to as the email passes through the system:

Note: The "Reply-To" field is added by the originator and serves to direct replies, whereas the "Return-Path" field is used to identify a path back to the originator.

 

Header line	Meaning
Microsoft Mail Internet Headers Version 2.0	Header title
Received: from EXIC1.lse.ac.uk ([158.143.216.121]) by ExF2.lse.ac.uk with Microsoft SMTPSVC(5.0.2195.5329);              Tue, 15 Jul 2003 12:16:56 +0100	Email passed from Exchange gateway servers to staff mailbox server
Received: from EXAV2.pc.lse.ac.uk ([158.143.216.132]) by EXIC1.lse.ac.uk with Microsoft SMTPSVC(5.0.2195.5329);             Tue, 15 Jul 2003 12:16:55 +0100	Email passed from anti-virus servers to Exchange gateway server
Received: From exas1.lse.ac.uk ([158.143.216.135]) by EXAV2.pc.lse.ac.uk (WebShield SMTP v4.5 MR1a);            id 1058267813844; Tue, 15 Jul 2003 12:16:53 +0100	Email passed from anti-spam servers to anti-virus servers
Content-Class: urn:content-classes:message
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
Received: from web60003.mail.yahoo.com ([216.109.116.226]) by exas1.lse.ac.uk with Microsoft SMTPSVC(5.0.2195.5329); Tue, 15 Jul 2003 12:14:24 +0100Message-ID: <20030715111424.6388.qmail@web60003.mail.yahoo.com>	Email received by LSE anti-spam server from originator’s email server. This is the point of entry to the LSE.
Received: from [158.143.113.49] by web60003.mail.yahoo.com via HTTP; Tue, 15 Jul 2003 12:14:24 BST	Date and time received by the originator’s email servers
Date: Tue, 15 Jul 2003 12:14:24 +0100 (BST)	Date and time sent
From: "Daniel Simpson" <djs@yahoo.co.uk>	Originator’s email address
Reply-To: <d.simpson@hotmail.com>	Reply to address
Subject: Test Email	Subject
To: <f.muir@lse.ac.uk>	Recipients email address
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="0-710479544-1058267664=:1719"
Content-Transfer-Encoding: 8bit
Return-Path: <djs@yahoo.co.uk>	Originator’s email address
X-OriginalArrivalTime: 15 Jul 2003 11:14:24.0580 (UTC) FILETIME=[3F7D6840:01C34AC2]	Arrival time at originators email servers
--0-710479544-1058267664=:1719 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit --0-710479544-1058267664=:1719 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: 7bit --0-710479544-1058267664=:1719--	Start of the email message

[notfondajane]

This one is probably to easy, the host name is aaron.mail.atl.earthlink.net. I doubt the "aaron" is a coincidence.

[draino]

I email with Aaron Brown regularly - and that does not sound like it would come from him -

Is he completely biased? For Da*n sure he is!! - Will he ever admit it - hell no.

His bias drives me nuts at times - his complete unwillingness to see it drives me even further crazy.

If the email came out of Houston I doubt it was from Aaron (unless it was from his blueberry handheld).

[draino]

Earthlink is NOT Aaron Browns email -

[orangelobster]

That's funny. I got the exact same e-mail spam. I think it is mailed out to random e-mail addresses, so it's probably a waste of time trying to figure out where it came from. Just add it to the penis enlargement and viagra spam mail in the trash.

[notfondajane]

re: my post, never mind...

[Slings and Arrows]

SpamCop it. Basic service is free.

[GnuHere]

I am no Freeper nerd, but just looking at the spelling and punctuation errors in that e-mail would make it absolutely comical if it was indeed, sent from a CNN hack.

[sbMKE]

No connection btw the aaron.mail.atl specifiers and Aaron Brown.

The entire string before the @earthlink is part of a routing scheme by earthlink. Essentially splitting network traffic/requests into segments (aaron, betty, condi or whatever), protocol (mail denotes smtp or pop; other variations in the string are likely web for http; and ftp for ftp, etc.) finally atl could be geographically based on city (Atlanta) or other region (Atlantic?).

That said, I may be missing something but it looks like the @earthlink address is you, and the other address is the sender.

[MrBambaLaMamba]

Got the exact same spam twice today from 2 different sources.
The socialists and apologists for terrorism are busy, obviously nervous.

[sbMKE]

RR usually assigns IPs on a rotating dynamic basis. A user shows multiple IPs per connection/session.

If this is your sender it's a home user. Likely not in VA.


Search results for: 68.206.59.156

OrgName: Road Runner
OrgID: RRSW
Address: 13241 Woodland Park Road
City: Herndon
StateProv: VA
PostalCode: 20171
Country: US

ReferralServer: rwhois://ipmt.rr.com:4321

NetRange: 68.200.0.0 - 68.207.255.255
CIDR: 68.200.0.0/13
NetName: RR-SOUTHEAST-BLK3
NetHandle: NET-68-200-0-0-1
Parent: NET-68-0-0-0-0
NetType: Direct Allocation
NameServer: DNS1.RR.COM
NameServer: DNS2.RR.COM
NameServer: DNS3.RR.COM
NameServer: DNS4.RR.COM
Comment:
RegDate: 2003-01-31
Updated: 2004-09-17

OrgAbuseHandle: ABUSE10-ARIN
OrgAbuseName: Abuse
OrgAbusePhone: +1-703-345-3416
OrgAbuseEmail: abuse@rr.com

OrgTechHandle: IPTEC-ARIN
OrgTechName: IP Tech
OrgTechPhone: +1-703-345-3416
OrgTechEmail: abuse@rr.com

[L`enn]

I would think an email addy with Aaron with an Atlanta ISP would be quite common as Hank Aaron would be a icon there. Like there probably is a lots of Favre@xxx.wisc.com's out there.

[Xenalyte]

houston.rr.com is the local RoadRunner address.

[Mr. Bird]

C'mon, Lance. You've been around here long enough. It's just some spam. Even if you found the "original" sender, it's likely some dupe.

[El Gran Salseron]

It's spam. My IP is 68.xxx.xxx.xxx and I'm in Houston.

The problem is that the spammer can "change" his/her IP address by changing his/her network card or going offline by unplugging his cable modem for awhile then plug it back in with the hope that his IP address will change.....assuming that he has a dynamic IP.

If he has a static IP then you can nail him. :-)

[Dave S]

Somehow I think a network anchor has better things to do than spam you with hate mail.