Happy humour Christmas
[1/4] from: chalz::earthlink::net at: 23-Dec-2002 1:01
Hmmm.... I take it that this likely wasn't *actually* from Anton?... Here's
the header info. I cut out the body, which contained some .. uh, "html" and a
base64 .SCR attachment claiming to be type audio/x-midi - indicator right
there.
Status: U
Return-Path: <[rebol-bounce--rebol--com]>
Received: from cobalt.reboltech.com ([208.201.243.114])
by eagle (EarthLink SMTP Server) with ESMTP id 18qkB54tQ3NZFji0
Sun, 22 Dec 2002 20:53:47 -0800 (PST)
Received: from cobalt.reboltech.com (localhost [127.0.0.1])
by cobalt.reboltech.com (8.9.3/8.9.3) with ESMTP id UAA31748;
Sun, 22 Dec 2002 20:32:44 -0800
Received: with LISTAR (v0.129a; list rebol); Sun, 22 Dec 2002 20:32:43 -0800
(PST)
Received: from randall.mail.atl.earthlink.net (randall.mail.atl.earthlink.net
[207.69.200.237])
by cobalt.reboltech.com (8.9.3/8.9.3) with ESMTP id UAA31741
for <[rebol-list--rebol--net]>; Sun, 22 Dec 2002 20:32:41 -0800
Received: from antoninus-z.mspring.net ([207.69.231.70]
helo=antoninus.mspring.net)
by randall.mail.atl.earthlink.net with smtp (Exim 3.33 #1)
id 18QKHK-0003f1-00
for [rebol-list--rebol--net]; Sun, 22 Dec 2002 23:33:22 -0500
X-MindSpring-Loop: [rebol-list--rebol--com]
Received: from out017.verizon.net ([206.46.170.94])
by antoninus.mspring.net (Earthlink Mail Service) with ESMTP id
v0d4gg.rk4.37kbpq6
for <[rebol-list--rebol--com]>; Sun, 22 Dec 2002 23:33:20 -0500 (EST)
Received: from Zandk ([151.205.111.190]) by out017.verizon.net
(InterMail vM.5.01.05.20 201-253-122-126-120-20021101) with SMTP
id <[20021223043311--YFQM28019--out017--verizon--net--Zandk]>
for <[rebol-list--rebol--com]>; Sun, 22 Dec 2002 22:33:11 -0600
From: anton <[anton--lexicon--net]>
To: [rebol-list--rebol--com]
Subject: [REBOL] Happy humour Christmas
MIME-Version: 1.0
Content-type: text/plain
Message-Id: <[20021223043311--YFQM28019--out017--verizon--net--Zandk]>
Date: Sun, 22 Dec 2002 22:33:19 -0600
X-archive-position: 26473
X-listar-version: Listar v0.129a
X-original-sender: [anton--lexicon--net]
Precedence: bulk
Reply-to: [rebol-list--rebol--com]
X-list: rebol
[2/4] from: gchiu:compkarori at: 23-Dec-2002 20:04
On Mon, 23 Dec 2002 01:01:23 -0500
"Charles" <[chalz--earthlink--net]> wrote:
> Hmmm.... I take it that this likely wasn't *actually*
>from Anton?... Here's
It's the Klez worm. Cerebrus intercepted quite a few of
these over the last few days all with a Xmas subject
heading.
Obviously it is someone on the list who probably uses
Verizon as their ISP.
--
Graham Chiu
http://www.compkarori.com/cerebrus/index.html
This dog hunts down spam!
[3/4] from: carl:cybercraft at: 23-Dec-2002 20:39
On 23-Dec-02, Charles wrote:
> Hmmm.... I take it that this likely wasn't *actually* from
> Anton?... Here's the header info. I cut out the body, which
> contained some .. uh, "html" and a base64 .SCR attachment claiming
> to be type audio/x-midi - indicator right there.
Compared with two other Anton headers, the following is seriously
different...
> Received: from Zandk ([151.205.111.190]) by out017.verizon.net
> (InterMail vM.5.01.05.20 201-253-122-126-120-20021101)
> with SMTP
> id <[20021223043311--YFQM28019--out017--verizon--net--Zandk]>
Plus I've received the same kind of audio/x-midi rubbish before. Spam
or a virus?
--
Carl Read
[4/4] from: chalz:earthlink at: 23-Dec-2002 16:01
I was unsure about the headers if it was claiming to originate from a
mindspring user or a verizon user. I'm still no expert at decoding headers.