Re: Strange IP address in mail header

[Carey Evans <c.evans@clear.net.nz>]

John Foster <johnf@mars.nettrek.net.au> writes:

> I've received some spam, and somthing in the headers made me wonder:
> 
> >>From Staff@ExposeInfidelity.com Sun May 25 20:11:35 1997
> Return-Path: <Staff@ExposeInfidelity.com>
> <<snip>>
> From: Staff@ExposeInfidelity.com
> Received: from mailhost.ExposeInfidelity.com (alt.ExposeInfidelity.com
> (206.1.562.999)) by requestor@site.com (8.8.5/8.6.5) with SMTP id
> ^^^^^^^^^^^^^^^
> HERE ^

[snip]

Is this the first Received header?  The one I got had the ones below
as well, and this one is almost certainly fake:

Received: from holland.it.earthlink.net
 ("port 55887"@holland-c.it.earthlink.net)
 by csc.canterbury.ac.nz (PMDF V5.1-8 #17207)
 with ESMTP id <01IJ9YNTH9IQ8WX04F@csc.canterbury.ac.nz> for
 c.evans@student-aliases.canterbury.ac.nz; Sun, 25 May 1997 06:09:37 +1200
Received: from smtp.earthlink.net
 (Cust44.Max1.Washington2.DC.MS.UU.NET [153.34.0.44])
 by holland.it.earthlink.net (8.8.5/8.8.5) with SMTP id LAA08128; Sat,
 24 May 1997 11:00:39 -0700 (PDT)
Received: from mailhost.ExposeInfidelity.com
 (alt.ExposeInfidelity.com (206.1.562.999)) by requestor@site.com (8.8.5/8.6.5)
 with SMTP id GAA07467 for <requestor@site.com>; Sat,
 24 May 1997 12:49:17 -0600 (EST)

Blocking earthlink.net should keep it out though.

-- 
                Carey Evans  <*>  c.evans@clear.net.nz

       "Our mail program accidentally deleted our remove list."
						 - Real quote from UCE


--
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
debian-user-request@lists.debian.org . 
Trouble?  e-mail to templin@bucknell.edu .