Search:  

 
 
   All ForumsHot TopicsGallery






how-to block ads


 
Forums » Up and Running » Security » Spam, Scam and Phishbusters » X-Originating-IP
 
Search Topic:
  Share Topic:
RSS topic:
 
Posting
toggle:
flat / full
normal / watch
Post a:
Post a:
The Fight - It's Payback Time! »
« [spammer hunt] Hotmail spam all has MX as part of address  
AuthorAll Replies


joewesh

join:2000-11-19
Westbury, NY
 X-Originating-IP

Can I rely on the X-Originating-IP header to be accurate?


nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T Midwest

No, you cannot rely on that.

If you receive the mail from hotmail or yahoo, then the top "X-Originating-IP:" appears to be accurate. But I have seen mail with more than one of these headers, and the ones not added by yahoo or hotmail were forged by the spammer.

The basic principle of examining headers:
•You can trust headers added by your own server (or your ISP server)•If those headers show that the mail was received from a trusted site (a site that you trust), then you can also rely on the headers added by that trusted site.
Be suspicious of anything else.


Mordy
Comfortably Numb
Premium,MVM,ExMod 2004-07
join:2001-12-02
Denver, CO

reply to joewesh
An X- entry is a comment that a mail program can insert to the headers. It can contain any text, and thus it can be easily made to create a false X-Originating-IP record in the header. I don't trust the X- record information; the Received: header records contain the actual IP addresses, but fake records and false information can be put in the Received: records as well.
--
Facts do not cease to exist because they are ignored - Aldous Huxley

NormanS
Premium,MVM
join:2001-02-14
San Jose, CA
·Pacific Bell - SBC

reply to joewesh
said by joewesh See Profile:

Can I rely on the X-Originating-IP header to be accurate?
Maybe yes, maybe no. In every case where you can trust them, you can also trust the Received line which contains the same IP address. Or, should that be the other way around. Here is an example with three X-Headers, of that type, which can be trusted:

Received: from spooler by aosake.net (Mercury/32 v4.01b); 8 May 2005 00:21:52 -0700
X-Envelope-To:
Return-path:

Received: from mta807.mail.scd.yahoo.com (66.94.225.147) by aosake.net (Mercury/32 v4.01b) ID MG00018E;
8 May 2005 00:21:48 -0700

X-Yahoo-Forwarded: from ***@pacbell.net to ***@aosake.net
X-Rocket-Track: -40 ; IPCR=n-w0,n100,g0 ; IP=64.4.16.194
Authentication-Results: mta807.mail.scd.yahoo.com
from=hotmail.com; domainkeys=neutral (no sig)
X-Originating-IP: [64.4.16.194]
Received: from 207.115.57.80 (EHLO ylpvm49.prodigy.net) (207.115.57.80)
by mta807.mail.scd.yahoo.com with SMTP; Sun, 08 May 2005 00:21:34 -0700
X-Originating-IP: [64.4.16.194]
Received: from hotmail.com (bay22-dav14.bay22.hotmail.com [64.4.16.194])
by ylpvm49.prodigy.net (8.12.10 083104/8.12.10) with ESMTP id j487LXxk016832
for ; Sun, 8 May 2005 03:21:33 -0400
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
Sun, 8 May 2005 00:21:33 -0700
Message-ID:
Received: from 67.116.50.149 by BAY22-DAV14.phx.gbl with DAV;
Sun, 08 May 2005 07:21:32 +0000
X-Originating-IP: [67.116.50.149]
X-Originating-Email: [***@hotmail.com]
X-Sender: ***@hotmail.com
From: "***"

The MSN Hotmail server, "BAY22-DAV14.phx.gbl" added the first one, way down near the bottom. The SBC server, "ylpvm49.prodigy.net" added the middle one. The Yahoo! server, "mta807.mail.scd.yahoo.com", added the top one.

Spammers are also known to add them. Knowing that MSN Hotmail puts them in for the source IP address of the message received by their WebDAV servers, and that SBC and Yahoo! put them in for the IP address of the source MTA connecting to the MX helps. Better, though, to rely on the Received lines, and start working down from the ones added by your mail system. In the case of these headers, the first trusted Received line is at the very top, where aosake.net reports receiving the message from yahoo.com (in bold typeface).

--
Norman
~A deam, dream, no dream
~Voices of the night go across the forest
~A dream, dream, no dream
~Good night my good child


JimCarver

@co.uk

I am currently being scammed by a 419 scammer but i know this and am having some fun with them. There is this in the header "X-Originating-Ip: 194.201.99.237" the received is the same. The funny thing is though that i am having contact with a guy in Nigeria and a one in Amsterdam. They both have the same IP address as above. does this mean they are using the same computer?


nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T Midwest


inetnum: 194.201.99.224 - 194.201.99.239
netname: HORSDIST02
descr: Horsham District Council
country: GB
admin-c: SF3576-RIPE
tech-c: MW20016-RIPE
status: ASSIGNED PA
mnt-by: AS1849-MNT
remarks: Please send abuse notification to abuse@uk.uu.net

Jon_Hanson
Mountain Dew Rules
Premium
join:2001-07-09
Gilbert, AZ

reply to JimCarver
said by JimCarver:

I am currently being scammed by a 419 scammer but i know this and am having some fun with them. There is this in the header "X-Originating-Ip: 194.201.99.237" the received is the same. The funny thing is though that i am having contact with a guy in Nigeria and a one in Amsterdam. They both have the same IP address as above. does this mean they are using the same computer?
As has been said before in this thread, you really can't trust the X-Originating-IP header. I wouldn't put a lot of faith in that information.
Forums » Up and Running » Security » Spam, Scam and PhishbustersThe Fight - It's Payback Time! »
« [spammer hunt] Hotmail spam all has MX as part of address  

Most commented news this week
· [176] East Coast Verizon Workers Authorize Strike
· [166] Is AT&T Hinting At Usage-Based Pricing This Fall?
· [149] Time Warner Cable Using Fine Print To Foist Caps On Customers
· [125] Is Broadband A Civil Right?
· [111] The Great Landline Exodus Continues
· [97] Update Your Browser, Dummy
· [86] Comcast Hit With Another Throttling Lawsuit
· [85] Friday Open Thread
· [82] What's Your Favorite Newsgroup Provider?
· [73] Google's Cerf: Baby Bells Act Like Tots Having Tantrums
Saturday, 26-Jul
08:04:05
Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
8th year online! © 1999-2008 dslreports.com.
page compression OFF