Here is one for you: Microsoft Mail Internet Headers Version 2.0 Received: from vtf-kys-18.corp.trademe.co.nz ([10.184.0.196]) by mail.newjobz.co.nz with Microsoft SMTPSVC(6.0.3790.211); Fri, 26 Aug 2005 11:43:39 +1200 Received: from mxpool21 (127.0.0.1) by vtf-kys-18.corp.trademe.co.nz (LSMTP for Windows NT v1.1b) with SMTP id <12.0000059D(a)vtf-kys-18.corp.trademe.co.nz>; Thu, 25 Aug 2005 18:34:53 -0500 From: "=?iso-8859-1?B?bWFpbGVyQHRyYWRlbWUuY28ubno=?=" <mailer(a)trademe.co.nz> To: info(a)newjobz.co.nz Subject: Your Trade Me Bid was Cancelled !!! Date: Thu, 25 Aug 2005 18:34:52 -0500 MIME-Version: 1.0 X-Mailer: Internal Email Service (4.4.0.701) Message-ID: <!~!4F4AE01c3858$508b8$430E0F4D(a)trademe.co.nz> Reply-To: mailer(a)trademe.co.nz Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Return-Path: mailer(a)trademe.co.nz X-OriginalArrivalTime: 25 Aug 2005 23:43:41.0046 (UTC) FILETIME=[D288B960:01C5A9CE] James Butler IT Manager Stu Macann & Associates Ltd -----Original Message----- From: Simon Lyall [mailto:simon(a)darkmere.gen.nz] Sent: Friday, 26 August 2005 12:14 To: nznog Subject: RE: [nznog] Trade Me phishing scam?? Hmm, if people are going to post copies next time could they include full headers. For example it looks like (from a couple of have seen) the timezone in the emails is at -0500 and there don't seem to be many different originating IPs. -- Simon J. Lyall. | Very Busy | Mail: simon(a)darkmere.gen.nz "To stay awake all night adds a day to your life" - Stilgar | eMT. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog