HP3000-L Archives

December 2005, Week 1

HP3000-L@RAVEN.UTC.EDU
Options: Use Monospaced Font
Show Text Part by Default
Show All Mail Headers

Message: [<< First] [< Prev] [Next >] [Last >>]
Topic: [<< First] [< Prev] [Next >] [Last >>]
Author: [<< First] [< Prev] [Next >] [Last >>]

Print Reply
Subject:
Re: Sober sender's IP address
From:
"Johnson, Tracy" <[log in to unmask]>
Reply To:
Johnson, Tracy
Date:
Wed, 7 Dec 2005 08:50:42 -0500
Content-Type:
text/plain
Parts/Attachments:
text/plain (79 lines) 
Am I reading it correctly, that it came from a gov't domain name?

Forward it to the FBI.  If it is spoofed domain, then it would be a
crime, if it is a true gov't user, then someone is going get fired (or
get a very poor fitness report.)

Tracy Johnson
Measurement Specialties, Inc. 

BT







NNNN


> -----Original Message-----
> From: HP-3000 Systems Discussion 
> [mailto:[log in to unmask]] On Behalf Of Dave Powell, MMfab
> Sent: Tuesday, December 06, 2005 7:09 PM
> To: [log in to unmask]
> Subject: Re: [HP3000-L] Sober sender's IP address
> 
> 
> I check these things at 
> http://www.spamcop.net/w3m?action=checkblock&ip=69.95.44.90.
> 
> It is "Choice One Communications", which you probably already 
> knew.  But the ip you gave is theirs (I think) not the 
> original villian's.
> 
> This spamcop page is open to non-spamcop users, in fact I 
> found out about it because they were blocking some of our 
> messages because of the headers included an ip number that 
> belongs to our isp, not us.  But since they are messing us up 
> by blocking our legitimate messages, I don't feel guilty 
> about using their page as a tool to check any suspicious ip# 
> I see in a message header when I am deciding whether to open 
> a message or not.
> 
> ----- Original Message ----- 
> From: "Greg Stigers" <[log in to unmask]>
> To: <[log in to unmask]>
> Sent: Tuesday, December 06, 2005 15:05
> Subject: [HP3000-L] Sober sender's IP address
> 
> 
> > We have three users who have gotten 864 Sober.X viral 
> email, all from 
> > the same IP address.
> > Received: from bdfbn.gov ([69.95.44.90]) by mail.munged.com with 
> > Microsoft SMTPSVC(6.0.3790.1830); Tue, 29 Nov 2005 10:47:40 -0500
> >
> > Unfortunately, whois tells me:
> > NetRange:   69.95.0.0 - 69.95.191.255
> > CIDR:       69.95.0.0/17, 69.95.128.0/18
> > Not surprisingly, my attempts to reach someone at the 
> service provider 
> > have fallen on deaf hears, not that I expected much else. Is there 
> > some clever way to track down who might own the IP address in 
> > question?
> >
> > Greg Stigers
> >
> > * To join/leave the list, search archives, change list settings, *
> > * etc., please visit http://raven.utc.edu/archives/hp3000-l.html *
> >
> 
> * To join/leave the list, search archives, change list settings, *
> * etc., please visit http://raven.utc.edu/archives/hp3000-l.html *
> 

* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *

ATOM RSS1 RSS2