[nycbug-talk] Mail message headers

[Hans Zaunere]

> Am I reading the email below correctly by saying it was sent from IP
> 24.236.105.243?

Basically, yeah.

> MAILFROM: francisco at natserv.com
> Received: from user-24-236-105-243.knology.net (HELO 
> natserv.com) (24.236.105.243)
>   by mx3.hrnoc.net with SMTP; 1 Feb 2004 01:55:19 -0000

The key line is this one.  It says:  user-24-236-105-243.knology.net connected to mx3.hrnoc.net, trying to impersonate your domain (HELO natserv.com).

> From: francisco at natserv.com
> To: john at scalabium.com
> Subject: hello
> Date: Sat, 31 Jan 2004 20:55:33 -0500
> MIME-Version: 1.0
> Content-Type: multipart/mixed;
> 	boundary="----=_NextPart_000_0004_F84A52BD.46D0F411"
> X-Priority: 3
> X-MSMail-Priority: Normal

This is all superfluous and can very easily be spoofed.

H