[ale] Sanitized, spoofed "bounced e-mail" header....

Brian J. Dowd bdowd at dentfirst.com
Sat Jul 13 16:07:56 EDT 2002


Following is the beginning (minus about 1000 lines of attempted 
buffer-overflow code)
of an ostensibly bounced-back e-mail I received. Can someone tell me the 
actual
origination of this? Is it C9Mailgw04.amadis.com ? I need a short lesson 
is decoding
mail headers and/or a good FAQ on which to read up.
Thanks,
-Brian


> From - Sat Jul 14 11:12:59 2002
> X-UIDL: 17toxP14F3NZFoB0.0
> X-Mozilla-Status: 0001
> X-Mozilla-Status2: 00000000
> Status:  U
> Return-Path: <stuffingbox at starband.net>
> Received: from C9Mailgw04.amadis.com ([216.163.188.206])
>     by thrush (EarthLink SMTP Server) with ESMTP id 17toxP14F3NZFoB0
>     for <bdowd at dentfirst.com>; Sat, 13 Jul 2002 08:10:49 -0700 (PDT)
> Received: from c9service11.amadis.com (10.9.0.1)  
>         id 3CDDFFF9004FE8B7 for bdowd at DentFirst.com; Sat, 13 Jul 2002 
> 08:07:38 -0700
> Received: from Tredhpnhu (148.64.26.235) by c9service11.amadis.com 
> (NPlex 6.5.012)
>         id 3D063B24000CB581 for bdowd at DentFirst.com; Sat, 13 Jul 2002 
> 08:07:38 -0700
> Date: Sat, 13 Jul 2002 08:07:38 -0700 (added by 
> postmaster at c9service11.amadis.com)
> Message-ID: <3D063B24000CB581 at c9service11.amadis.com> (added by 
> postmaster at c9service11.amadis.com)
> From: postmaster <postmaster at DentFirst.com>
> To: bdowd at DentFirst.com
> Subject: Returned mail--"eager to see you"
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
>     boundary=Cw82V71J097148WcTF2G1WFKL4tw
>
> --Cw82V71J097148WcTF2G1WFKL4tw
> Content-Type: text/html;
> Content-Transfer-Encoding: quoted-printable
>
> <HTML><HEAD></HEAD><BODY>
>
> <FONT>The following mail can't be sent to nlam22461 at yahoo.com:<br>
> <br>
> From: bdowd at DentFirst.com<br>
> To: nlam22461 at yahoo.com<br>
> Subject: eager to see you<br>
> The file is the original mail</FONT></BODY></HTML>
>
> --Cw82V71J097148WcTF2G1WFKL4tw
> Content-Type: application/octet-stream;
>     name=valued sony customer at hotmail.msn[1].bat
> Content-Transfer-Encoding: base64
> Content-ID: <Xzl4MKqj347GMfp6JD>
>
> TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAA

<snipped last 1000+ lines>

>


---
This message has been sent through the ALE general discussion list.
See http://www.ale.org/mailing-lists.shtml for more info. Problems should be 
sent to listmaster at ale dot org.






More information about the Ale mailing list