Tim May <tcmay@got.net> writes:
Namely, who is "irsnwpr@net.insp.irs.gov" and what does he or she think of the "DEATH TO TYRANTS" subject header, sent to me (and maybe others). ... The headers in the first of the messages I received were:
Received: from tcs_gateway1.treas.gov (tcs-gateway1.treas.gov [204.151.245.2]) by you.got.net (8.8.5/8.8.3) with SMTP id PAA28395 for <tcmay@got.net>; Fri, 18 Jul 1997 15:29:59 -0700 ... Received: from tcs_gateway1.treas.gov (tcs-gateway1.treas.gov [204.151.245.2]) by you.got.net (8.8.5/8.8.3) with SMTP id PAA28954 for <tcmay@got.net>; Fri, 18 Jul 1997 15:39:39 -0700
If those headers are forged, it is an expert forgery. The MX hosts for the net.insp.irs.gov domain are fun: net.insp.irs.gov preference = 10, mail exchanger = tcs-gateway2.treas.gov net.insp.irs.gov preference = 20, mail exchanger = tcs-gateway1.treas.gov net.insp.irs.gov preference = 30, mail exchanger = gotcha.treas.gov irs.gov nameserver = gotcha.treas.gov irs.gov nameserver = nis.ans.net irs.gov nameserver = ns.ans.net tcs-gateway2.treas.gov internet address = 204.151.246.2 tcs-gateway1.treas.gov internet address = 204.151.245.2 gotcha.treas.gov internet address = 204.151.246.80 `gotcha.treas.gov'? It's a real host connected through ans.net ... 12 h10-1.t32-0.New-York.t3.ans.net (140.223.57.30) 139.839 ms 126.702 ms 125.82 ms 13 h11-1.t56-1.Washington-DC.t3.ans.net (140.223.57.21) 147.248 ms 124.774 ms 118.815 ms 14 f0-0.cnss60.Washington-DC.t3.ans.net (140.222.56.196) 192.54 ms 125.939 ms 166.529 ms 15 enss3080.t3.ans.net (192.103.66.18) 130.917 ms 131.057 ms 145.377 ms 16 gotcha.treas.gov (204.151.246.80) 133.065 ms 134.345 ms 131.596 ms Except for hop 16, this is the same traceroute as to tcs-gateway2.treas.gov. For what it's worth, the traceroute to tcs-gateway1 is slightly different: 8 h13-1.t16-0.Los-Angeles.t3.ans.net (140.223.9.14) 44.997 ms 51.526 ms 51.875 ms 9 h14-1.t112-0.Albuquerque.t3.ans.net (140.223.17.10) 60.895 ms 60.426 ms 57.762 ms 10 h14-1.t64-0.Houston.t3.ans.net (140.223.65.9) 81.131 ms * 85.067 ms 11 h14-1.t80-1.St-Louis.t3.ans.net (140.223.65.14) 117.62 ms 100.623 ms 104.878 ms 12 h10-1.t60-0.Reston.t3.ans.net (140.223.61.13) 126.368 ms 136.017 ms 123.367 ms 13 f2-0.c60-10.Reston.t3.ans.net (140.223.60.220) 129.505 ms 128.214 ms 128.52 ms 14 enss3079.t3.ans.net (204.148.66.66) 134.707 ms 162.912 ms 160.774 ms 15 tcs-gateway1.treas.gov (204.151.245.2) 154.268 ms * 155.898 ms