312-49 · Question #353
From the following spam mail header, identify the host IP that sent this spam? From [email protected] [email protected] Tue Nov 27 17:27:11 2001 Received: from viruswall.ie.cuhk.edu.hk…
The correct answer is C. 203.218.39.20. Email headers are read from bottom to top to trace the originating source. The second 'Received' line (the one added by the first server to handle the message) reads: 'Received: from mydomain.com (pcd249020.netvigator.com [203.218.39.20])' - this identifies the external host…
Question
From the following spam mail header, identify the host IP that sent this spam? From [email protected] [email protected] Tue Nov 27 17:27:11 2001 Received: from viruswall.ie.cuhk.edu.hk (viruswall [137.189.96.52]) by eng.ie.cuhk.edu.hk (8.11.6/8.11.6) with ESMTP id fAR9RAP23061 for ; Tue, 27 Nov 2001 17:27:10 +0800 (HKT) Received: from mydomain.com (pcd249020.netvigator.com [203.218.39.20]) by viruswall.ie.cuhk.edu.hk (8.12.1/8.12.1) with SMTP id fAR9QXwZ018431 for ; Tue, 27 Nov 2001 17:26:36 +0800 (HKT) Message-Id: >[email protected] From: "china hotel web" To: "Shlam" Subject: SHANGHAI (HILTON HOTEL) PACKAGE Date: Tue, 27 Nov 2001 17:25:58 +0800 MIME-Version: 1.0 X-Priority: 3 X-MSMail- Priority: Normal Reply-To: "china hotel web"
Options
- A137.189.96.52
- B8.12.1.0
- C203.218.39.20
- D203.218.39.50
How the community answered
(32 responses)- A3% (1)
- B6% (2)
- C72% (23)
- D19% (6)
Explanation
Email headers are read from bottom to top to trace the originating source. The second 'Received' line (the one added by the first server to handle the message) reads: 'Received: from mydomain.com (pcd249020.netvigator.com [203.218.39.20])' - this identifies the external host that originally injected the message into the mail chain. That IP, 203.218.39.20, is the true sender's IP. The IP 137.189.96.52 (A) belongs to the intermediate relay server (viruswall). Option 8.12.1.0 (B) is a Sendmail version number, not an IP. Option D (203.218.39.50) does not appear in the header.
Topics
Community Discussion
No community discussion yet for this question.