[Towertalk] Anyone know how to read these headers?

Fri, 26 Apr 2002 21:19:56 -0500

Bill:

Supposedly the ISP people can track it with all that gibberish.

I know the U.S. Secret Service wants the "entire" message with the full header
if you complain to them about one of those 411 Nigerian Advance Fee Frauds where
you get an e-mail supposedly from an employee of either the Nigerian government
or a Nigerian (or Sierra Leone) oil company who has $35 million or so (the last
one I got had $130 million to split) he or she  wants to split with you if
you'll just give them your bank routing number, checking account number, etc.
because he can't otherwise get the money out of the country.   I end up getting
one or two of those a week (mostly with a yahoo.com suffix) so I just click on
full, copy it, and send it on to the Secret Service, but I haven't read hardly
anything about the feds arresting too many folks here or in Nigeria.

Also Spam Cop at http://www.spamcop.net
wants the full header and message so they can supposedly track Spam e-mails.
But I still get a ton of those things every couple days.

Tom, WW5L

Bill Otten wrote:

> With all the discussion on the W32 Klez virii around, there was a suggestion
> to read the headers in order to see where a post might have come from. I
> don't know how to read through all this hieroglyphic header stuff but I
> thought perhaps it might serve as a clue for someone. Might lead to helping
> someone find out if they've a virus in their system, but I'd need some help
> with deciphering.....
>
> I got a message saying this:
>
> --------Message not delivered to the following:
>
>           hsz102    No matches to nameserver query
>
>  --------Error Detail (phquery V4.1):
>
>  The message, "No matches to nameserver query," is generated whenever
>  the ph nameserver fails to locate either a ph alias or name field that
>  matches the supplied name.
>
> Here's the remainder of the header:
> --------Unsent Message below:
>
> Received: from out020.verizon.net (out020pub.verizon.net [206.46.170.176])
> by f05n11.cac.psu.edu (8.9.3/8.9.3) with ESMTP id UAA136398
> for <hsz102@psu.edu>; Fri, 26 Apr 2002 20:55:24 -0400
> Received: from Fjfidcduy ([68.64.226.171]) by out020.verizon.net
>           (InterMail vM.5.01.04.05 201-253-122-122-105-20011231) with SMTP
>           id <20020427005426.NUVW1765.out020.verizon.net@Fjfidcduy>
>           for <hsz102@psu.edu>; Fri, 26 Apr 2002 19:54:26 -0500
> From: w5maz <w5maz@uswest.net>
> To: hsz102@psu.edu
> Subject: Border
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary=J1M8T7V587Rg35I7o46gW21kIAsn2z2kv3r
> Message-Id: <20020427005426.NUVW1765.out020.verizon.net@Fjfidcduy>
> Date: Fri, 26 Apr 2002 19:54:54 -0500
>
> --J1M8T7V587Rg35I7o46gW21kIAsn2z2kv3r
> Content-Type: text/html;
> Content-Transfer-Encoding: quoted-printable
>
> <HTML><HEAD></HEAD><BODY>
> <iframe src=3Dcid:K16k4r8h1FE height=3D0 width=3D0>
> </iframe>
> <FONT></FONT></BODY></HTML>
>
> --J1M8T7V587Rg35I7o46gW21kIAsn2z2kv3r
> Content-Type: audio/x-wav;
> name=name) .pif
>
> Any help would be appreciated.
> 73,
>
> Bill KC9CS
>                                                       .
>
> _______________________________________________
> Towertalk mailing list
> Towertalk@contesting.com
> http://lists.contesting.com/mailman/listinfo/towertalk