From owner-freebsd-questions Fri Aug 22 20:33:17 1997 Return-Path: Received: (from root@localhost) by hub.freebsd.org (8.8.7/8.8.7) id UAA18446 for questions-outgoing; Fri, 22 Aug 1997 20:33:17 -0700 (PDT) Received: from mackay01.cqit.qld.edu.au (root@cqit.qld.edu.au [203.22.80.2]) by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id UAA18434 for ; Fri, 22 Aug 1997 20:33:09 -0700 (PDT) Received: from carbon.chalmers.com.au (carbon.cqit.qld.edu.au [203.22.80.5]) by mackay01.cqit.qld.edu.au (8.7.3/8.6.9) with ESMTP id NAA13611; Sat, 23 Aug 1997 13:27:47 +1000 (EST) Message-ID: <33FE5940.80C3BB24@chalmers.com.au> Date: Sat, 23 Aug 1997 13:30:09 +1000 From: Robert Chalmers Reply-To: robert@chalmers.com.au Organization: chalmers.com.au X-Mailer: Mozilla 4.01 [en] (Win95; I) MIME-Version: 1.0 To: Andrew CC: questions@FreeBSD.ORG Subject: Re: break-in??? X-Priority: 3 (Normal) References: Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG X-Loop: FreeBSD.org Precedence: bulk Get's more interesting by the moment. http://time.cdrom.com actually brings up the FreeBSD home page. I'd say one of the staff has brought their kid in while they do a bit of overtime. You know the thing. "Hey, just play on that PC over there on that desk while I get these papers done...." intersting from the point of view that it all leads back to Rome.. er, FBSD :-) bob Andrew wrote: > > > > Looking at the headers as a start, seems to have come > > from;============= > > from ibmmail.COM (ibmmail.com > > [204.146.168.193]) by hub.freebsd.org (8.8.7/8.8.7) with > SMTP > > id > > KAA22284; Fri, 22 Aug 1997 10:55:16 -0700 > > (PDT) > > ============= > > so shouldn't be hard to track past that point if it's > worth > > it. Some kid most likely. > > What does this bit further down mean? This ip address > appears to be > time.cdrom.com. Does this bit mean it was relayed through > ibmmail.com? > Would it most likely be forged? > > Received: from 204.216.27.226 by ibmmail.COM (IBM VM SMTP > V2R3) with TCP; > Fri, 22 Aug 97 13:16:09 EDT > To: undisclosed-recipients:; > > Andrew Perry -- http://www.chalmers.com.au Books-New & Secondhand Support Whirled Peas. Agents for CIBTC. Associate of Amazon.com, and Partner Program with iBS. Books about China, books from China. Sheng huo jiu shi dou zheng Business Links in Dalian, and Beijing. Building the China Trade