[resending since kragen.dnaco.net is down]
*xentinc.com* ? Rohit, you been doing something we should know(now) about ? :)
On Wed, 7 Feb 2001 14:50:52 -0000, in comp.security.misc "Dave Korn"
<no.spam@my.mailbox.invalid> wrote:
>trevlix@yahoo.com wrote in message <95pd0t$ev7$1@nnrp1.deja.com>...
>>Below is an email header that was attached to some SPAM someone in my
>>network received. Maybe I'm reading it wrong, but it looks like the
>>email came from xentinc.com. However, everything I've seached (whois,
>>etc) says that xentinc.com does not exist. Am I missing something?
>>
>>The hostnames and IP's have obviously been changed.
>>
>>Received: from internal.smtp.com ([1.2.3.4]) by ex1.acs.xxx.com with
>>SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13)
>> id 1DZTSJ7A; Fri, 2 Feb 2001 13:31:20 -0500
>>Received: from internal.gtwy.xxx.com (internal.gtwy.xxx.com [1.2.3.5])
>> by internal.smtp.com (8.9.3/8.8.7) with SMTP id NAA18216
>> for <ajones@xxx.com>; Fri, 2 Feb 2001 13:34:49 -0500
>
> OK, these two hops are inside your corporate network, right.
>
>>Received: from unknown (xentinc.com) by external.smtp.com with SMTP id
>>NAA11811
>> (InterLock SMTP Gateway 4.2 for <ajones@acs.roadway.com>);
>> Fri, 2 Feb 2001 13:33:46 -0500
>
> Well, you're fucked there. Your internal gateway keeps track of the HELO
>command sent by the spammer, which is almost certainly forged, but didn't
>bother logging the IP they connected from. This is worse than useless. You
>have no way whatsoever of tracing this spammer because your machine
>discarded the one vital piece of information that could have tracked them.
>
>>Subject: 24 HOUR LIVE F*CKING IN YOUR BROWSER wKgTUFh
>
> That sounds a bit cramped. Remember to maximize the window before you try
>that.
>
> DaveK
>--
>They laughed at Galileo. They laughed at Copernicus. They laughed at
>Columbus. But remember, they also laughed at Bozo the Clown.
>
--
((Udhay Shankar N)) ((udhay @ pobox.com)) ((www.digeratus.com))
God is silent. Now if we can only get Man to shut up.
This archive was generated by hypermail 2b29 : Fri Apr 27 2001 - 23:17:32 PDT