6 ms·
the only vaguely reliable item in an email header is the last ip in the square bracket inserted bt your mailserver saying where it thinks it "Received from" no
by tejtm 5y ago
the only vaguely reliable item in an email header is the last ip in the square bracket inserted bt your mailserver saying where it thinks it "Received from"
note that in this case it is:
Received: from dap00040.str0.eims.cjis
(dap00040.str0.eims.cjis [10.66.2.72])
and that 10.X.X.X is an un-routable address
(unless you are part of the originating network)
Since I'm not part of the FBI I would strongly suspect
some one was misrepresenting their address to my mailserver.
adding that I really don't know jack about this.
sec is not an interest of mine so please, experts, straighten out any misconceptions I am propagating
- ev1 5y agoThe one inserted by my mailserver is Received: from mx-east.fbi.gov (mx-east-ic.fbi.gov [153.31.119.142]) The 10.* ones were inserted by theirs.
- technion 5y agoThere's a paste from another recipient's headers: https://pastebin.com/8ES3t1hv https://pastebin.com/8ES3t1hv I believe the very top line is inserted by the victim mailserver and points to an FBI IP in a way that can be considered accurate.