I often get confused when looking at these headers and I was wondering if anyone could help describe exactly what this means to me. I'm trying to determine where the source of the spam is coming from on this particular email. The part that is confusing me is where it is received by two different servers, first by my server (noelani.mailcode.com) from server2000.kunchien.idv.tw and then again by that server from mailin-01.mx.aol.com. Even on legitimate email messages it usually has two received by lines (like my bottom example), but that makes more sense to me since my server has the later date/time stamp, unlike the first example. Unless I'm reading the data/time wrong. If anyone can explain it to me that would be great (either online or offline) and/or point me in the right direction to figure it out myself. Thanks a lot.
FIRST HEADER
Received: from server2000.kunchien.idv.tw (61-219-228-138.HINET-IP.hinet.net [61.219.228.138]) by noelani.mailcode.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13)
id YYVQL2HY; Fri, 14 Dec 2001 07:10:14 -0500
Received: from mailin-01.mx.aol.com ([209.31.211.115]) by server2000.kunchien.idv.tw with Microsoft SMTPSVC(5.0.2195.1600);
Fri, 14 Dec 2001 20:11:44 +0800
Message-ID: <000063f07644$000038ec$[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>,<[EMAIL PROTECTED]>,<[EMAIL PROTECTED]>,<[EMAIL PROTECTED]>,<[EMAIL PROTECTED]>
Cc: <[EMAIL PROTECTED]>,
<[EMAIL PROTECTED]>,
<[EMAIL PROTECTED]>,
<[EMAIL PROTECTED]>,
<[EMAIL PROTECTED]>
From: [EMAIL PROTECTED]
Subject: Isn't It Time You Solved Your "little" Problem? 29102
Date: Fri, 14 Dec 2001 04:19:13 -2000
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1252"
Content-Transfer-Encoding: 7bit
Reply-To: [EMAIL PROTECTED]
X-Mailer:: Internet Mail Service (5.5.2650.21)
Return-Path: [EMAIL PROTECTED]
X-OriginalArrivalTime: 14 Dec 2001 12:11:45.0699 (UTC) FILETIME=[7FCAFF30:01C18498]
SECOND HEADER
Received: from uuout11smtp2.uu.flonetwork.com ([205.150.6.42]) by noelani.mailcode.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13)
id YYVQL2C8; Fri, 14 Dec 2001 00:31:25 -0500
Received: from uucore10pumper1 (uuout11relay1.uu.flonetwork.com [172.20.71.10])
by uuout11smtp2.uu.flonetwork.com (Postfix) with SMTP id 3991E24EED
for <[EMAIL PROTECTED]>; Fri, 14 Dec 2001 00:24:19 -0500 (EST)
Message-Id: <[EMAIL PROTECTED]>
From: eWEEK News <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: OS Flaw Opens Systems to Remote Attackers
MIME-Version: 1.0
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Date: Fri, 14 Dec 2001 00:24:19 -0500 (EST)
