Tracing packets (was Re: Spamhaus Exposed)

Thu Mar 18 00:12:48 UTC 2004

On Wed, 17 Mar 2004, Steve Linford wrote:
>  From Deep Throat, received 17/3/04, 21:10 +0000 (GMT):
> >  Disturbing information on one of the founders of Spamhaus.org
> >
> >  http://www.geocities.com/jackjack9872004/
>
> Not just a load of BS, but posted to NANOG anonymously, through a
> hijacked machine at 198.26.130.36 (The Pentagon) no less.

Has that actually been confirmed.  Any machine associated with the path
could have been compromised including systems with transitive trust which
may not appear in the e-mail headers.

Occam's Razor would say the message most likely did originated where it
says it originated.  But when I just checked it wasn't listed in any of
the major block lists of compromised hosts (spamcop does list it as a
spam source), and the Pentagon hasn't confirmed the computer was compromised.