Re: [CR] Phantom Messages

(Example: Humor)

To: classicrendezvous@bikelist.org ("Classicrendezvous")
Subject: Re: [CR] Phantom Messages
References: <6CA3A7C9.3380707F.0269AA25@aol.com>
From: "Morgan Fletcher" <morgan@hahaha.org>
Date: Mon, 09 Aug 2004 14:42:26 -0700
In-Reply-To: <6CA3A7C9.3380707F.0269AA25@aol.com> (LouDeeter@aol.com's message of "Mon, 09 Aug 2004 16:59:58 -0400")


LouDeeter@aol.com writes:
> Chuck says my silence speaks volumes. This message doesn't show up in my
> "sent" file... I have no idea how this happens.

Most likely it was a virus trying to propagate itself, faking its return address using one if found in the infected host machine's address book or inbox.

Lou's email had these headers:

Received: from imo-d05.mx.aol.com ([205.188.157.37]) by catfood.nt.phred.org with Microsoft SMTPSVC(6.0.3790.0); Mon, 9 Aug 2004 14:01:03 -0700 Message-ID: <6CA3A7C9.3380707F.0269AA25@aol.com>

It's quite clear that it came from an AOL account. Another Received header shows it coming from LouDeeter@aol.com, specifically. The "ghost" message has these headers:

Received: from VAIO.net ([68.239.38.224]) by catfood.nt.phred.org with Microsoft SMTPSVC(6.0.3790.0); Mon, 9 Aug 2004 13:28:12 -0700 Message-ID: <hrosyrvzmbiucxnafuc@bikelist.org>

It's coming in from vaio.net, and the sender has scrubbed its own origin from the mail transfer history. It's not from Lou.

Anyway,

Morgan -- VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
>> Morgan Fletcher, Oakland, CA <<
>> Sign the Vuelta on OLN petition: http://www.petitiononline.com/vuelta3/ <<