Originally posted by KRaNiX Received: from gimli.nni.com ([126.96.36.199] verified)
by admin.nni.com (CommuniGate Pro SMTP 4.1.8)
with ESMTP id 302742183 for [email protected]; Mon, 26 Apr 2004 08:10:01 -0400
Received: (from [email protected])
by gimli.nni.com (8.12.3/8.12.3/Submit) id
Means: His email account [email protected] is hosted by 1&1 and he is forwarding all emails addressed to that account to [email protected]. kundenserver.de is his domain's (sighost.co.uk) MX server as you can easily determine.
Received: from [188.8.131.52] (helo=admin.nni.com)
by mxng12.kundenserver.de with esmtp (Exim 3.35 #1)
The email originates from 184.108.40.206, therefore he should turn to
rgName: NuNet Inc.
Address: 26 Bethlehem Plaza
NetRange: 220.127.116.11 - 18.104.22.168
NetType: Direct Allocation
Comment: * RWHOIS reassignment information for this block is available at:
Comment: * rwhois.nni.com:4321:rwhois
Senders' addresses of emails can be forged arbitrarily, that's not a big secret I hope. Looks like somebody is running an anonymous mailer (?) script on 22.214.171.124 (since that ip doesn't appear in RBLs).