Hi,
Just wondering if anybody can answer a question about email headers
from SMTP servers:
In a recent scam/spam, this is the first header line above the message
content (i.e. it *should* be the first system the mail went through in
the chain, in the normal way SMTP always worked).
Received: from [144.217.20.147] (ip147.ip-144-217-20.net [144.217.20.147])
by vEdge-AC1.cox.com (Postfix) with ESMTP id C3705179FEE;
Tue, 22 Dec 2020 23:47:06 -0500 (EST)
As far as I know, that IP can't be faked (it exists, the host names and
IP resolve in both directions, and it's a fair bet that the message did
go through it). Whois queries say it belongs to OVH Hosting, who are
prolific supporters of spamming.
But is that cox.com domain name something that's user-configurable text
that the spammer could fill in, or is that filled in by software out of
spammer's control?
As a FQDN it doesn't resolve (for me), and the TLD cox.com resolves to
completely different IPs.
--
uname -rsvp
Linux 3.10.0-1160.11.1.el7.x86_64 #1 SMP Fri Dec 18 16:34:56 UTC 2020 x86_64
Boilerplate: All unexpected mail to my mailbox is automatically deleted.
I will only get to see the messages that are posted to the mailing list.
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
