On 2011-08-02 11:59 , P. J. Alling wrote:
The originating IP address according to my whois IP search is in New Zealand. It's unlikely that Paul's ISP is located there.
i considered noting that, but i believe it's easy to forge the x-originating-ip; i don't see that header on other email from Comcast users (Comcast seems to use an id instead of the originating ip in the server-generated headers)
otoh, the x-mailer line indicates Zimbra, which i believe is what Comcast uses for webmail; if the x-originating-ip header was added by a webmail server it is probably not forged, and that would be consistent with someone cracking Paul's webmail account
a quick search shows a lot of Comcast users complaining about spam sent from their accounts, and many of them show Zimbra in the x-mailer header
-- PDML Pentax-Discuss Mail List PDML@pdml.net http://pdml.net/mailman/listinfo/pdml_pdml.net to UNSUBSCRIBE from the PDML, please visit the link directly above and follow the directions.
