3 ms·

Everyone knows that such spam mails are NOT sent by the company, but by scammers. Look at the raw email header. So why is this comment on top? It seems HN got

by frik 9y ago

Everyone knows that such spam mails are NOT sent by the company, but by scammers. Look at the raw email header. So why is this comment on top? It seems HN got mainstream and with it the usefulness is declining - low quality comments staying on top that can be answered by common sense.

DanBC 9y ago
It's likely that Animats knows what he's doing. He also says that the email contains a link to the real website, not to a scam website. So, if it was sent by a scammer what's the purpose? How does it work? And if it was sent by the company, why are they sending email that looks like a scam?
- Animats 9y ago
  The mail header entry at the point it leaves FedEx's systems and enters my website is: Received: from pvma00057.prod.fedex.com ([204.135.8.98]:61625 helo=mx28.infosec.fedex.com) by gator4118.hostgator.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.87) (envelope-from <prvs=1370ad99fd=bounce@nds.fedex.com>) id 1dWn4C-00092V-Dd for nagle@animats.com; Sun, 16 Jul 2017 12:10:48 -0500 DKIM-Signature: v=1; a=rsa-sha256; d=fedex.com; s=edc; c=relaxed/relaxed; q=dns/txt; i=@fedex.com; t=1500225037; h=From:Sender:Reply-To:Subject:Date:Message-ID:To; bh=M2wd7ncO9bsu5aQpoaGPtLYIjzi/OkxO+5qgmnqO1D4=; b=ktUTxDShfkakjcLd2BEwRVC4X4ItHdPYvR+Dqyj6oiWPWrsuWA98jHqIssipCXHa XsPn72sxMnWIlwy0LLC3r2WGTUBHg7afy0K804QLQ2ztSHr7CnMZ4jFh0O6A9ElQ 16twStNpiG9XBF4Gho08WHg+EUrKSnTqPwknnhOg+9BVyKZLsQhsGAk1Bl/Vgu9z 55RxPd3VjDlAM04i+sZZaLLTX3TLA8jbMHNgZpwx01j6/whY2RVktfMYvmJZo3n9 6XVJTcUVA3QiXb32Ps9OwGpOZQMSR0EKGrXSEUyk8YEGDZmFkZOgy6cUZBuzKRXs yPqdVtE4gHvuck8T5nrllg==; X-AuditID: cc870862-345fb700000012f5-3f-596b9e0d6fb1 That looks OK. Unless FedEx has an open mail forwarder, a break-in at "pvma00057.prod.fedex.com", or DNS trouble, that's from FedEx.
  - frik 9y ago
    IP seems legit, is from FedEx - apologize. NetRange: 204.135.0.0 - 204.135.255.255 CIDR: 204.135.0.0/16 NetName: FEDEX-2009-BLOCK NetHandle: NET-204-135-0-0-1 Parent: NET204 (NET-204-0-0-0-0) NetType: Direct Assignment OriginAS: AS7726 Organization: FedEx (FEC) RegDate: 2009-07-20 Updated: 2017-04-29 Ref: https://whois.arin.net/rest/net/NET-204-135-0-0-1 OrgName: FedEx OrgId: FEC Address: 70 FedEx Parkway City: Collierville StateProv: TN PostalCode: 38017 Country: US RegDate: Updated: 2014-06-02 Ref: https://whois.arin.net/rest/org/FEC
nl 9y ago
Generally it's good to assume that Animats knows more about how the internet works than you do, especially if it is something related to networks.
nothrabannosir 9y ago
For the record, that's John Nagle: https://en.m.wikipedia.org/wiki/Nagle%27s_algorithm https://en.m.wikipedia.org/wiki/Nagle%27s_algorithm

by frik 9y ago

DanBC 9y ago

It's likely that Animats knows what he's doing. He also says that the email contains a link to the real website, not to a scam website. So, if it was sent by a scammer what's the purpose? How does it work? And if it was sent by the company, why are they sending email that looks like a scam?

Animats 9y ago
The mail header entry at the point it leaves FedEx's systems and enters my website is: Received: from pvma00057.prod.fedex.com ([204.135.8.98]:61625 helo=mx28.infosec.fedex.com) by gator4118.hostgator.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.87) (envelope-from <prvs=1370ad99fd=bounce@nds.fedex.com>) id 1dWn4C-00092V-Dd for nagle@animats.com; Sun, 16 Jul 2017 12:10:48 -0500 DKIM-Signature: v=1; a=rsa-sha256; d=fedex.com; s=edc; c=relaxed/relaxed; q=dns/txt; i=@fedex.com; t=1500225037; h=From:Sender:Reply-To:Subject:Date:Message-ID:To; bh=M2wd7ncO9bsu5aQpoaGPtLYIjzi/OkxO+5qgmnqO1D4=; b=ktUTxDShfkakjcLd2BEwRVC4X4ItHdPYvR+Dqyj6oiWPWrsuWA98jHqIssipCXHa XsPn72sxMnWIlwy0LLC3r2WGTUBHg7afy0K804QLQ2ztSHr7CnMZ4jFh0O6A9ElQ 16twStNpiG9XBF4Gho08WHg+EUrKSnTqPwknnhOg+9BVyKZLsQhsGAk1Bl/Vgu9z 55RxPd3VjDlAM04i+sZZaLLTX3TLA8jbMHNgZpwx01j6/whY2RVktfMYvmJZo3n9 6XVJTcUVA3QiXb32Ps9OwGpOZQMSR0EKGrXSEUyk8YEGDZmFkZOgy6cUZBuzKRXs yPqdVtE4gHvuck8T5nrllg==; X-AuditID: cc870862-345fb700000012f5-3f-596b9e0d6fb1 That looks OK. Unless FedEx has an open mail forwarder, a break-in at "pvma00057.prod.fedex.com", or DNS trouble, that's from FedEx.
- frik 9y ago
  IP seems legit, is from FedEx - apologize. NetRange: 204.135.0.0 - 204.135.255.255 CIDR: 204.135.0.0/16 NetName: FEDEX-2009-BLOCK NetHandle: NET-204-135-0-0-1 Parent: NET204 (NET-204-0-0-0-0) NetType: Direct Assignment OriginAS: AS7726 Organization: FedEx (FEC) RegDate: 2009-07-20 Updated: 2017-04-29 Ref: https://whois.arin.net/rest/net/NET-204-135-0-0-1 OrgName: FedEx OrgId: FEC Address: 70 FedEx Parkway City: Collierville StateProv: TN PostalCode: 38017 Country: US RegDate: Updated: 2014-06-02 Ref: https://whois.arin.net/rest/org/FEC

nl 9y ago

Generally it's good to assume that Animats knows more about how the internet works than you do, especially if it is something related to networks.

nothrabannosir 9y ago

For the record, that's John Nagle: https://en.m.wikipedia.org/wiki/Nagle%27s_algorithm https://en.m.wikipedia.org/wiki/Nagle%27s_algorithm