[boost] Re: Got a boost-request email with MyDoom in it...

From: Dan W. (danw_at_[hidden])
Date: 2004-02-11 23:38:49

Yeah, never mind... 129.79.245.244 below is in the IP range of the 
University of Indiana; and the fact that it says it received the email 
from local host (127.0.0.1) either means that IU.edu's SMTP server is 
hacked, or that there's another machine in their campus that's hacked 
and pretending to be local host;  or else that local host is hacked, or 
that my ISP is hacked, or that the server here at work is hacked, or...

...or that I'm hacked... :(

> Return-Path: <boost-bounces_at_[hidden]>
> Delivered-To:
>     raytron-controls.com-danw_at_[hidden]
> Received: (qmail 3143 invoked by uid 417); 12 Feb 2004
>     01:56:58 -0000
>   This received header was added by your mailserver
>   Just a qmail status line
> 
> Received: from unknown (HELO heart-of-gold.osl.iu.edu)
>     (129.79.245.244)   by 192.168.0.39 with SMTP; 12 Feb 2004
>     01:56:58 -0000
>   192.168.0.39 received this from someone claiming
>   to be unknown
>   (192.168.0.39 doesn't record the senders IP
>    address in any way I recognise, so it's impossible to be
>    sure. All received headers after this one should be
>    treated with suspicion)
> 
> Received: from heart-of-gold.osl.iu.edu
>     (localhost.localdomain [127.0.0.1])         by
>     heart-of-gold.osl.iu.edu (8.11.6/8.11.6) with ESMTP id
>     i1C0b0529863;         Wed, 11 Feb 2004 19:37:00 -0500
>   heart-of-gold.osl.iu.edu received this from someone claiming
>   to be heart-of-gold.osl.iu.edu
>   but really from 127.0.0.1(No rDNS)
> 
>   All headers below may be forged
> 
> Date: Wed, 11 Feb 2004 19:37:00 -0500
> Message-Id:
>     <200402120037.i1C0b0529863_at_[hidden]>
> From: boost-request_at_[hidden]
> Subject: Boost Digest, Vol 639, Issue 6
> To: boost_at_[hidden]
> X-BeenThere: boost_at_[hidden]
> X-Mailman-Version: 2.1.4
> Precedence: list
> List-Id: Boost mailing list <boost.lists.boost.org>
>   Hmmm list-id: isn't a header I recognise
> List-Help:
>     <mailto:boost-request_at_[hidden]?subject=help>
>   Hmmm list-help: isn't a header I recognise
> List-Post: <mailto:boost_at_[hidden]>
>   Hmmm list-post: isn't a header I recognise
> List-Subscribe:
>     <http://lists.boost.org/mailman/listinfo.cgi/boost>,
>      <mailto:boost-request_at_[hidden]?subject=subscribe>
>   Hmmm list-subscribe: isn't a header I recognise
> List-Archive: <http://lists.boost.org/MailArchives/boost>
>   Hmmm list-archive: isn't a header I recognise
> List-Unsubscribe:
>     <http://lists.boost.org/mailman/listinfo.cgi/boost>,
>      <mailto:boost-request_at_[hidden]?subject=unsubscribe>
>   Hmmm list-unsubscribe: isn't a header I recognise
> Sender: boost-bounces_at_[hidden]
> Errors-To: boost-bounces_at_[hidden]
> -------------------------------------------

Cheers!