[time-nuts] 2 (Spoofing)

gbusg gbusg at comcast.net
Tue Oct 4 17:07:29 UTC 2011


The spam message in question was apparently spoofed and did *not* originate 
from Jeff's PC. In the message header, note the Originating-IP was 
[84.27.224.19]. That IP address originates from a server at [Netherlands 
Groningen Ziggo B.v]. Jeff's actual IP address (which I won't repeat here) 
is significantly different and is located in the U.S.A.

Chuck, I think somehow the spoofers have overcome the obstacle you mention, 
unfortunately. (Otherwise how did the user of the Netherlands server manage 
to get spam through to our group?)

-Greg


----- Original Message ----- 
From: "Chuck Harris" <cfharris at erols.com>
To: <jfor at quikus.com>; "Discussion of precise time and frequency 
measurement" <time-nuts at febo.com>
Sent: Tuesday, October 04, 2011 9:20 AM
Subject: Re: [time-nuts] 2


There has to be more to it than that.  Knowing a member's email
address is not a key into the time-nuts (or yahoo) lists.

For instance, if I spoof my return and from addresses to be the same
as my time-nuts subscribed email address, and send a message to
time-nuts at febo.com from one of my non-subscribed email servers, it
gets dutifully ignored.  It came from the wrong email account on the
wrong server.

The simple Occam's Razor style answer, in my opinion, is the hijacked
user's PC has been breached by a typical Windows PC trojan horse
spambot program, and is spewing out spam emails through the hijacked
user's PC's email program.

Right?

-Chuck Harris


_______________________________________________
time-nuts mailing list -- time-nuts at febo.com
To unsubscribe, go to 
https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts
and follow the instructions there. 




More information about the time-nuts mailing list