[Dshield] Re: Klez header question

Micheal Patterson micheal at cancercare.net
Fri Aug 30 16:22:44 GMT 2002


"Received: from Pgcdjo ([205.152.62.117]) by out003.verizon.net"

Name:    YL117.yourlink.net
Address:  205.152.62.117

This is a Bell South IP block range.

Unless Klez has the ability to mangle all message headers, that's the
originator.

--

Micheal Patterson
Network Administration
Cancer Care Network
405-733-2230

----- Original Message -----
From: Daniels566 at cs.com
To: list at dshield.org
Sent: Thursday, August 29, 2002 8:55 PM
Subject: Re: [Dshield] Re: Klez header question


This again is the header and return path of the klez I posted a few days
ago. Maybe someone has the skill to map this thing. I sent a copy to Juno
and they determined it was a forgery implying them.

Message Start
Forwarded Message:
Subj: A nice game
Date: 8/18/02 9:36:10 PM Eastern Daylight Time
From: adoptapet2 at juno.com
To: Wolves5149 at aol.com
Received from Internet: click here for more information

This is a special nice game
This game is my first work.
You're the first player.
I expect you would enjoy it.

Return-Path: <adoptapet2 at verizon.net>
Received: from  rly-xg02.mx.aol.com (rly-xg02.mail.aol.com [172.20.115.199])
by air-xg01.mail.aol.com (v87.22) with ESMTP id MAILINXG13-0818213610; Sun,
18 Aug 2002 21:36:10 -0400
Received: from  out003.verizon.net (out003pub.verizon.net [206.46.170.103])
by rly-xg02.mx.aol.com (v87.22) with ESMTP id MAILRELAYINXG25-0818213515;
Sun, 18 Aug 2002 21:35:15 -0400
Received: from Pgcdjo ([205.152.62.117]) by out003.verizon.net
          (InterMail vM.5.01.05.09 201-253-122-126-109-20020611) with SMTP
          id <20020819013544.XWIF13272.out003.verizon.net at Pgcdjo>
          for <Wolves5149 at aol.com>; Sun, 18 Aug 2002 20:35:44 -0500
From: adoptapet2 <adoptapet2 at juno.com>
To: Wolves5149 at aol.com
Subject: A  nice game
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=Khaz84sDP3z0cb68Cj9W63C5597938
Message-Id: <20020819013544.XWIF13272.out003.verizon.net at Pgcdjo>
Date: Sun, 18 Aug 2002 20:36:15 -0500

Good luck, John Daniels




More information about the list mailing list