petre at maltzen.net
Fri Apr 9 15:25:43 UTC 2004
The address could be spoofed as well obviously. But just for fun: looking at
the header from the message,
Received: from pc10 (dhcp-192-203-56.in2cable.com [188.8.131.52])
by mx1.redhat.com (8.12.10/8.12.10) with SMTP id i38H2kMD029465
for <K12OSN at redhat.com>; Thu, 8 Apr 2004 13:02:49 -0400
the originating address was
184.108.40.206, which according to whois.geektools.com, belongs to the In2Cable
ISP in Mumbai, India, as the header suggests.
Ken Meyer wrote:
> Will that be the REAL IP, or will it be spoofed as well?
> Ken Meyer
> -----Original Message-----
> From: k12osn-bounces at redhat.com [mailto:k12osn-bounces at redhat.com]On
> Behalf Of Caleb Wagnon
> Sent: Friday, April 09, 2004 7:41 AM
> To: Support list for opensource software in schools.
> Subject: Re: [K12OSN] Hi
> Petre Scheie said:
>>Yes it is a virus. Unfortunately, it's not on my machine, even though the
>>message purports to be from me; I say unfortunately because it means I
>>fix it. I forget which Windows virus it is, but it spoofs the sender of
>>message, extracting names/addresses from the infected user's inbox. For
>>record, the only message that went out of my box on April 8 was two hours
>>after the message below.
> The sender field will be spoofed but you can still look at the email header
> and find what ip address it originates from.
> Caleb Wagnon MCP A+ CCNA
> Technology Coordinator
> Fordyce School District
> K12OSN mailing list
> K12OSN at redhat.com
> For more info see <http://www.k12os.org>
More information about the K12OSN