From owner-freebsd-questions  Fri Aug 22 16:21:00 1997
Return-Path: <owner-freebsd-questions>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.7/8.8.7) id QAA09662
          for questions-outgoing; Fri, 22 Aug 1997 16:21:00 -0700 (PDT)
Received: from python.shoal.net.au (perrya@python.shoal.net.au [203.26.44.5])
          by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id QAA09657
          for <questions@FreeBSD.ORG>; Fri, 22 Aug 1997 16:20:50 -0700 (PDT)
Received: from localhost (perrya@localhost)
	by python.shoal.net.au (8.8.6/8.8.5) with SMTP id JAA27006
	for <questions@FreeBSD.ORG>; Sat, 23 Aug 1997 09:20:38 +1000 (EST)
Date: Sat, 23 Aug 1997 09:20:38 +1000 (EST)
From: Andrew <perrya@python.shoal.net.au>
Reply-To: Andrew <perrya@python.shoal.net.au>
To: questions@FreeBSD.ORG
Subject: Re: break-in???
In-Reply-To: <33FE0841.97FFD8B9@chalmers.com.au>
Message-ID: <Pine.BSI.3.95.970823091620.26677B-100000@python.shoal.net.au>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-questions@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk


> 
> Looking at the headers as a start, seems to have come
> from;=============
>                 from ibmmail.COM (ibmmail.com
> [204.146.168.193]) by hub.freebsd.org (8.8.7/8.8.7) with SMTP
> id
>                 KAA22284; Fri, 22 Aug 1997 10:55:16 -0700
> (PDT)
> =============
> so shouldn't be hard to track past that point if it's worth
> it. Some kid most likely.



What does this bit further down mean? This ip address appears to be
time.cdrom.com. Does this bit mean it was relayed through ibmmail.com?
Would it most likely be forged? 

Received: from 204.216.27.226 by ibmmail.COM (IBM VM SMTP V2R3) with TCP;
   Fri, 22 Aug 97 13:16:09 EDT
To: undisclosed-recipients:;


Andrew Perry