Re: How to trace email sender's domain ?
From: John Thompson (john_at_vector.os2.dhs.org)
Date: 03/15/05
- Next message: Dariusz Kuliński / takeda: "Re: data transfer WinME to Linux: crossover cable?"
- Previous message: Andrei Ivanov: "Re: data transfer WinME to Linux: crossover cable?"
- In reply to: news_at_absamail.co.za: "How to trace email sender's domain ?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: Mon, 14 Mar 2005 19:31:25 -0600
On 2005-03-14, news@absamail.co.za <news@absamail.co.za> wrote:
> Please list the steps to determine an email sender's domain.
> Or perhaps point to a tut.
> Can this be traced also to the town ?
>
> This is the one which interests me now:--
>
> Return-Path: <nospam@isp.com>
> Received: from smtp10.atl.mindspring.net not authenticated
> [207.69.200.246]
> Received: from h-67-101-134-168.nycmny83.dynamic.covad.net
> ([67.101.134.168] helo=Anon)
> by smtp10.atl.mindspring.net with smtp (Exim 3.33 #1)
> id 1DAWVn-0002Dq-00; Sun, 13 Mar 2005 12:04:19 -0500
> From: nospam@isp.com
As an email message is transported across the internet, each mail server
that handles the message adds a "Received:" line to the top of the list of
headers. The bottom "Received:" line is therefore the first mail server to
handle the message; in this case "smtp10.atl.mindspring.net" recieved it
from "h-67-101-134-168.nycmny83.dynamic.covad.net" which is a dynamically
assigned IP. Running a whois aginst the IP address 67.101.134.168
associated with this address, you find it is registered to "Covad
Communications" in San Jose CA and the abuse reporting address is
"abuse-isp@covad.com"
This is most likely some household Windows machine that has been
compromised by a spam-bot. If you report it to the abuse address above,
they can contact the owner of the machine to have them take it off line
and clean it up. It is unlikely that it could be traced back to its
utimate spammer origin, though, as the current spam practice is to relay
through a number of dynamically changing proxies before attempting to
inject the mail in to the mail delivery system. The body of the message
likely contains an address (probably overseas someplace) intended to
direct the recipient to a site where they can be exploited. You may be
able to find an abuse address for the owner of that IP, but responding in
that why may not be effective and in fact may expose you to further spam.
I've had the best luck with European and North American sites; Asian
sites, particularly in China and Korea don't seem to give a rip.
Your best bet is to put a good spam filter, e.g. spamassassin, in front
of your mail system.
-- John (john@os2.dhs.org)
- Next message: Dariusz Kuliński / takeda: "Re: data transfer WinME to Linux: crossover cable?"
- Previous message: Andrei Ivanov: "Re: data transfer WinME to Linux: crossover cable?"
- In reply to: news_at_absamail.co.za: "How to trace email sender's domain ?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
