Tried to confirm a header, got the Department of Defense

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Tue May 15, 2007 2:55 pm

I got this email in my in box today.

Quote:

From : MS JOANNA ELSON <[email protected]>
Reply-To : [email protected]
Sent : Monday, May 14, 2007 11:12 PM
Subject : CONFIDENTIAL PROPOSAL [CODE NO: AM-0007]

MIME-Version: 1.0
Received: from mtai01.charter.net ([209.225.8.181]) by bay0-mc5-f17.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Mon, 14 May 2007 21:12:41 -0700
Received: from aa01.charter.net ([10.20.200.153]) by mtai01.charter.net (InterMail vM.7.08.02.00 201-2186-121-20061213) with ESMTP id <[email protected]>; Tue, 15 May 2007 04:12:40 +0000
Received: from fepweb13 ([10.20.200.83]) by aa01.charter.net with ESMTP id <20070515041239.KNAJ8690.aa01.charter.net@fepweb13>; Tue, 15 May 2007 00:12:39 -0400
X-Message-Info: LsUYwwHHNt1iXXd1lWgYTtrIxq6STjqfXDZWpuyihhwH0miPGS7eUWLiEmPECnqp
Sensitivity: Normal
X-Chzlrs: 0
Return-Path: [email protected]
X-OriginalArrivalTime: 15 May 2007 04:12:41.0495 (UTC) FILETIME=[47FF0A70:01C796A7]

Good Day,
I am Mr. Ming Yang, Director of Operations of the Hang Seng Bank Ltd, Sai Wan Ho
Branch, Hong Kong.For security purpose, due to telecom interception in Hong
Kong, I shall not accept or acknowledge any phone call. Only fax messages/emails
would be treated in relation to this proposal but not without this code; [CODE
NO: AM-0007]. Should you be further interested, I would prefer you to reach me
soon and finally after that I shall provide you with more details of this
operation.
Kind Regards

Mr. Ming Yang
Hang Seng Bank Ltd
Sai Wan Ho Branch
171 Shaukiwan Road
Hong Kong.
[email protected]

The 'from' email address was goofy, and the names didn't match, which piqued my curiosity. When I did the header analysis, it said that the originating IP address was the DoD Information Center.

http://www.dnsstuff.com/tools/whois.ch?ip=7.08.02.00

So... is the government out to get me?

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

Quote:

Received: from aa01.charter.net ([10.20.200.153]) by mtai01.charter.net (InterMail vM.7.08.02.00 201-2186-121-20061213)

Abbot, see my post below, it might clear things up for you about why it is giving that 7.08.02.00 for the IP when that's not actually an IP address in the header:

http://forum.419eater.com/forum/viewtopic.php?p=694929#694929

With the headers you posted above, here is where the header tool misreads those numbers as an IP address:

Posted: Tue May 15, 2007 3:11 pm

I make it the Charter Communications Holding Company in St Louis according to my IP lookup.

Posted: Tue May 15, 2007 3:17 pm

10.0.0.0 is a reserved block for private networks. There's no such (public) address on the Internet.

fepweb13 ([10.20.200.83]) is internal interface of the web server (private)
aa01.charter.net ([10.20.200.153]) is the internal interface of the mail server (private)
mtai01.charter.net ([209.225.8.181]) is the external interface of the mail server (public)

It seems that charter.net doesn't report the IP address of the originating node. This is common on HTTP mail interfaces.

Posted: Tue May 15, 2007 3:18 pm

Thanks for clearing that up. I think I get it now. Sorry for the noob post.

Posted: Tue May 15, 2007 7:37 pm

You're in luck! I've come across Mr M1ng Y4ng. In my experience with him, his IP came back to Nigeria.

Tried to confirm a header, got the Department of Defense	View next topic View previous topic