Here are the relevant headers as I saw them from the list: """ Received: from benjamin.baylink.com ([127.0.0.1]) by localhost (benjamin.baylink.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rv7Ib4bfEtWx for <jra@baylink.com>; Sun, 10 Feb 2013 19:55:34 -0500 (EST) Received: from sc1.nanog.org (sc1.nanog.org [50.31.151.68]) by benjamin.baylink.com (Postfix) with ESMTPS id 280D91F0012A for <jra@baylink.com>; Sun, 10 Feb 2013 19:55:34 -0500 (EST) Received: from localhost ([::1] helo=sc1.nanog.org) by sc1.nanog.org with esmtp (Exim 4.80 (FreeBSD)) (envelope-from <nanog-bounces@nanog.org>) id 1U4hg5-0007zX-6D; Mon, 11 Feb 2013 00:55:25 +0000 Received: from smtp.mnginteractive.com ([63.147.64.243]) by sc1.nanog.org with esmtp (Exim 4.80 (FreeBSD)) (envelope-from <jra@baylink.com>) id 1U4hfD-00074r-27 for nanog@nanog.org; Mon, 11 Feb 2013 00:54:31 +0000 Date: 10 Feb 2013 18:02:46 -0700 X-SBRS: None X-HAT: Message received through Sender Group RELAYLIST, Policy $RELAYED applied. Received: from atglive19.medianewsgroup.com ([10.148.16.99]) by smtp.mnginteractive.com with ESMTP; 10 Feb 2013 18:02:46 -0700 Message-ID: <31513948.1360544065374.JavaMail.atgservice@atglive19.medianewsgroup.com> """ Unless I'm very much mistaken, I believe that last Received before the date (combined with absence of the static IP of my mailserver) is evidence of an envelope-level forgery. If whomever is babysitting the list this quarter pings me direct, I'll give them that static (assuming they can't already see it themselves), and they can double check, but it doesn't look like it came through my server; no appearances of nanog.org in my lots between 1720 and 1855EDT. I note also that I can't see a message body either in the copies I got from the list, or the ones I was forwarded. Cheers, -- jra -- Jay R. Ashworth Baylink jra@baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274
On Sun, Feb 10, 2013 at 08:43:28PM -0500, Jay Ashworth wrote:
Unless I'm very much mistaken, I believe that last Received before the date (combined with absence of the static IP of my mailserver) is evidence of an envelope-level forgery.
Concur -- it looks that way from here as well. What's not clear is whether it's deliberate or an artifact resulting from breakage. ---rsk
----- Original Message -----
From: "Rich Kulawiec" <rsk@gsp.org>
On Sun, Feb 10, 2013 at 08:43:28PM -0500, Jay Ashworth wrote:
Unless I'm very much mistaken, I believe that last Received before the date (combined with absence of the static IP of my mailserver) is evidence of an envelope-level forgery.
Concur -- it looks that way from here as well. What's not clear is whether it's deliberate or an artifact resulting from breakage.
Well, FWIW, I never use anyone's on-platform forwarding service to send article URLs to *anywhere*, much less a mailing list, though curiously I think I *did* put a URL about a Google KC article in a posting last week. Don't remember if it was LAT or not. Just the three postings, right, Rich? Cheers, -- jra -- Jay R. Ashworth Baylink jra@baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274
On Mon, Feb 11, 2013 at 08:39:08AM -0500, Jay Ashworth wrote:
Well, FWIW, I never use anyone's on-platform forwarding service to send article URLs to *anywhere*, much less a mailing list, though curiously I think I *did* put a URL about a Google KC article in a posting last week. Don't remember if it was LAT or not. Just the three postings, right, Rich?
Yes, just the three. Now that I'm more caffeinated, I noticed the presence of X-SBRS: and X-HAT: headers in all three of those. I wonder if those are there because somebody's Cisco Ironport got its hands on those messages and did something ill-advised with them. Perhaps if the list-owners are listening in, they could check to see if there are any NANOG subscribers from mnginteractive.com or medianewsgroup.com; that might shed some light on what's happened here. ---rsk
participants (2)
-
Jay Ashworth
-
Rich Kulawiec