It has been pointed out to me that when someone sends mail from hotmail it may contain more information that one may see at first glance. For example the full header may look like

Received: from newserver1.ul.ie ([136.201.1.140]) by exch-staff1.ul.ie with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13)

id 2S0Z76MQ; Wed, 30 Jul 2003 13:48:53 +0100

Received: from mgw1.ul.ie (Not Verified[136.201.1.117]) by newserver1.ul.ie with NetIQ MailMarshal (v5.5.3.17)

id ; Wed, 30 Jul 2003 13:58:43 +0100

Received: from hotmail.com ([65.54.245.117]) by ul.ie (PMDF V5.2-32 #41948)

with ESMTP id <0HIU00GKV9BZ4G@ul.ie> for Michael.Barry@STAFFMAIL.ul.ie

(ORCPT rfc822;michael.barry@ul.ie); Wed, 30 Jul 2003 13:57:36 +0100 (BST)

Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Wed,

30 Jul 2003 05:56:49 -0700

Received: from 62.221.5.1 by by1fd.bay1.hotmail.msn.com with HTTP; Wed,

30 Jul 2003 12:56:49 +0000 (GMT)

Date: Wed, 30 Jul 2003 05:56:49 -0700

From: Mike Sux

Subject: your blog sucks eggs

To: michael.barry@ul.ie

Bcc:

Message-id:

MIME-version: 1.0

Content-type: text/plain; format=flowed

X-Originating-IP: [62.221.5.1]

X-Originating-Email: [mike_sux@hotmail.com]

X-OriginalArrivalTime: 30 Jul 2003 12:56:49.0786 (UTC)

FILETIME=[0A83ADA0:01C3569A]

And if we examine the X-Originating-IP [62.221.5.1] using nslookup we get

Name: vpn.parthusceva.com

Address: 62.221.5.1

Aliases: 1.5.221.62.in-addr.arpa

Which means my anonymous mailer is most likely somehwere in the parthusceca vpn. Now lots of companies have policies against sending malicous and insulting emails and I am sure parthusceva is no exception.

If only I knew someone there I could complain to…

Of course this also means I should apologise for accusing lots of people in error.

Leave a Reply