From owner-freebsd-questions@FreeBSD.ORG Wed May 18 20:08:00 2005 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D4F1216A4CE for ; Wed, 18 May 2005 20:08:00 +0000 (GMT) Received: from smtp-out4.blueyonder.co.uk (smtp-out4.blueyonder.co.uk [195.188.213.7]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5C67D43D8B for ; Wed, 18 May 2005 20:07:59 +0000 (GMT) (envelope-from xfb52@dial.pipex.com) Received: from [82.41.37.55] ([82.41.37.55]) by smtp-out4.blueyonder.co.uk with Microsoft SMTPSVC(5.0.2195.6713); Wed, 18 May 2005 21:08:33 +0100 Message-ID: <428BA098.1080306@dial.pipex.com> Date: Wed, 18 May 2005 21:07:52 +0100 From: Alex Zbyslaw User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-GB; rv:1.7.7) Gecko/20050510 X-Accept-Language: en, en-us MIME-Version: 1.0 To: jonvalverde@aol.com References: <8C72933FE6C89D0-B0C-45179@FWM-D38.sysops.aol.com> <428B7BE8.8050605@dial.pipex.com> <8C729E9F5024F11-E80-3CBE1@FWM-D29.sysops.aol.com> In-Reply-To: <8C729E9F5024F11-E80-3CBE1@FWM-D29.sysops.aol.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 18 May 2005 20:08:33.0489 (UTC) FILETIME=[5E229410:01C55BE5] cc: FreeBSD Questions Subject: Re: Finding out original source of e-mail X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 18 May 2005 20:08:01 -0000 jonvalverde@aol.com wrote: > Thanks Alex....I have had a hacker problem lately and it is someone > I'm pretty confident I know....I know they are very tech savy, so just > trying to confirm. Alex wrote: > > Looking at the first received line shows that FWM-D38.sysops.aol.com > received the email from 204.214.222.51. Usually you would expect to > see a name associated with that address, but in this case there isn't. Is this *your* IP address, perhaps? Given that this was sent using a WebMail interface it *could* have been someone doing this by hand. I have no idea how easy AOL Webmail is to spoof. Having said that, sending email to accounts which don't work is a hallmark of spam bots. If you have any passwords for your AOL account, I would suggest changing them. --Alex