Need some help with this

[anniemac]

I received a spam email from this address: zspm23@imail.etsu.edu. It was casino advertising but for some reason it wouldn't open so I don't know what casino it was for. However, my question is this, how do I go about finding out where/who it came from. Not that I care which casino, but in the US an email that came with .edu at the end usually comes from a college. ETSU is a university here in Texas and I am really curious if this actually came from a college computer.

I know that most of you at CM are far more knowledgeable about this sort of thing than I am or will ever be, so I was just wondering if someone could help with this.

[bb28]

It's most likely a forged email address......happens all the time.
If you want to know more look at the headers on the email. If you need help with that, post what email client you are using.

Hope that helps.

[anniemac]

I am attaching a copy of the email. Nothing opens up. I am just curious.

Thanks for the help.

[bb28]

I see you are using yahoo email. I can help show you how to view the header info in the email but someone else will need to take a look at it to let you know what the info means. I''m not sure who it was but others on here have posted that have knowledge about email headers.

You can view the header by going into the options menu on your yahoo email page, top of page on the right side, above listing of your emails. After you are in the options menu go to Management/General Preferences and select the option that is under the messages part that says "show all headers".

Then you can go back to the email in question and copy and paste the header here and ask for help with it.

BB

[lojo]

Or you can go to the bottom of the message (looks like you're using the older yahoo, I do too) on the bottom right there will be "Full Headers" click on that and take a screenshot or copy paste here. Be sure to go through and remove your info. It will look something like this:

From Kaitlyn Gonzalez Thu Jan 3 21:48:46 2008
X-Apparently-To: xxlojoxx@yahoo.com via 68.xxx.xxx.104; Thu, 03 Jan 2008 21:49:48 -0800
X-YahooFilteredBulk: 69.81.87.16
X-Originating-IP: [69.81.87.16]
Return-Path: <hjbberq@excite.com>
Authentication-Results: mta434.mail.mud.yahoo.com from=excite.com; domainkeys=neutral (no sig)
Received: from 69.81.87.16 (HELO jays.earthlink.net) (69.81.87.16) by mta434.mail.mud.yahoo.com with SMTP; Thu, 03 Jan 2008 21:49:47 -0800
Received: from [200.191.81.126] (HELO IhsNSETtvEYSzBuciw1chw) by jays.earthlink.net with Microsoft SMTPSVC(6.0.3790.211); Fri, 4 Jan 2008 00:49:07 -0500
Message-ID: <2e0201c84e6c$01c90dc9$2a74e871@jays.earthlink.net >
From: "Kaitlyn Gonzalez" <hjbberq@excite.com> Add to Address Book Add Mobile Alert
To: xxxlojoxxx@yahoo.com
Subject: Welcome to our casino0. Special offers! extra!
Date: Fri, 4 Jan 2008 00:48:46 -0500
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="------=_NextPart_000_3442_344377E7.1FFE925F"
Precedence: normal
Content-Length: 52216
A new electronic publication from Ca*si*no-World. Announcement Letters.

[anniemac]

Since I don't know what this is, does this tell me where it came from?

Thanks.

[lojo]

Can you copy and paste it so its easier to read? It can be sleuthed from there me eyes ain't what they used to was.

[anniemac]

Let's see if this is better. I told all I am computer illiterate.



From zspm23@imail.etsu.edu Sat Jan 5 14:37:20 2008
X-Apparently-To: via 68.142.207.95; Sat, 05 Jan 2008 14:37:21 -0800
X-YahooFilteredBulk: 67.19.218.194
X-Originating-IP: [67.19.218.194]
Return-Path: <zspm23@imail.etsu.edu>
Authentication-Results: mta376.mail.re4.yahoo.com from=imail.etsu.edu; domainkeys=neutral (no sig)
Received: from 67.19.218.194 (HELO nebula.websiteactive.com) (67.19.218.194) by mta376.mail.re4.yahoo.com with SMTP; Sat, 05 Jan 2008 14:37:20 -0800
Received: from srvgzjr (252.36.205.173) by nebula.websiteactive.com; Sun, 6 Jan 2008 09:37:20 +1100
Date: Sun, 6 Jan 2008 09:37:20 +1100
From: zspm23@imail.etsu.edu Add to Address Book Add Mobile Alert
X-Mailer: The Bat! (v2.01)
Reply-to: <se@msn.com>
X-Priority: 3 (Normal)
Message-ID: <33607599.20071119072933@imail.etsu.edu>
To: Subject: big money
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------F3452192283AC"
Content-Length: 206613

[bb28]

Result for 67.19.218.194

--> /usr/local/bin/fwhois 67.19.218.194@whois.arin.net
[whois.arin.net]

OrgName: ThePlanet.com Internet Services, Inc.
OrgID: TPCM
Address: 1333 North Stemmons Freeway
Address: Suite 110
City: Dallas
StateProv: TX
PostalCode: 75207
Country: US

ReferralServer: rwhois://rwhois.theplanet.com:4321

NetRange: 67.18.0.0 - 67.19.255.255
CIDR: 67.18.0.0/15
NetName: NETBLK-THEPLANET-BLK-11
NetHandle: NET-67-18-0-0-1
Parent: NET-67-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.THEPLANET.COM
NameServer: NS2.THEPLANET.COM
Comment:
RegDate: 2004-03-15
Updated: 2004-07-29

RTechHandle: PP46-ARIN
RTechName: Pathos, Peter
RTechPhone: +1-214-782-7800
RTechEmail: admins@theplanet.com

OrgAbuseHandle: ABUSE271-ARIN
OrgAbuseName: Abuse
OrgAbusePhone: +1-214-782-7802
OrgAbuseEmail: abuse@theplanet.com

OrgNOCHandle: TECHN33-ARIN
OrgNOCName: Technical Support
OrgNOCPhone: +1-214-782-7800
OrgNOCEmail: admins@theplanet.com

OrgTechHandle: TECHN33-ARIN
OrgTechName: Technical Support
OrgTechPhone: +1-214-782-7800
OrgTechEmail: admins@theplanet.com

# ARIN WHOIS database, last updated 2008-01-05 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

[lojo]

I've never quite known the best way to deal with stuff like this. Is forwarding the message to abuse@theplanet.com the best thing? I don't have time right now to crack it down further... hope I was a help in getting the info here to be looked at.

You were awesome bb28