Bon Matin All,

The active owner of BLUES-L received the appended trolling post from the
news-feed, since we are self moderated (Editor=owner,(BLUES-L) ),  Bill just
let the post die. But the [log in to unmask] since then subscribed to the list
...

I know there is no "failsafe" way to see if someone is pulling our leg but I
would appreciate if anyone with experience with AOL headers can give an
educate guess on a spoof/prank vs a roller ...

From the header I would hazard that someone posted on AOL.COM news server...
ISC.ORG does exists and is located in California... Are they mandated to
replace the [log in to unmask] address ? Or can it mean that the "spoofer"
used their server to in the AOL news feed ?

As a precaution I advised Bill (the active owner) to notify [log in to unmask]
and to do the same with ISC.ORG ... Is the normal procedure CC'ing the
technical contact from the Whois database ?

Thanks for any input.

Eric.
co-owner BLUES-L.

PS If that`s a troll I guess s/he's with limited skills since a few more
header lines could have brought havoc on  the list.

----------- Trolling post in question -------------
> >------------------------ Original message (29
> >lines) --------------------------
> >Return-Path: <[log in to unmask]>
> >Received: from BROWNVM (NJE origin SMTP@BROWNVM) by BROWNVM.BROWN.EDU
(LMail
> >V1.2a/1.8a) with BSMTP id 6043; Wed, 16 Jun 1999 09:58:14 -0400
> >Received: from nut.brown.edu (128.148.19.196) by BROWNVM.brown.edu
> >   (IBM VM SMTP V2R4) with TCP; Wed, 16 Jun 99 09:58:12 EDT
> >Received: from isgate.is (isgate.is [193.4.58.51])
> >        by nut.brown.edu (8.9.1a/8.9.1) with ESMTP id JAA09949
> >        for <[log in to unmask]>; Wed, 16 Jun 1999 09:57:42 -0400
> >(EDT)
> >Received: from ngeout01.news.aol.com (ngeout01.news.aol.com
> >[152.163.176.244])
> >        by isgate.is (8.9.3r/8.9.0Imo) with SMTP id NAA22539
> >        for <[log in to unmask]>; Wed, 16 Jun 1999
> >13:57:40 GMT
> >Received: from ladder05.news-fddi.aol.com (ladder05.news-fddi.aol.com
> >[172.16.31.190]) by ngeout01.news.aol.com (8.6.12/8.6.12) with ESMTP id
> >JAA11195 for <[log in to unmask]>; Wed, 16 Jun 1999
> >09:57:23 -0400
> >To: <[log in to unmask]>
> >From: [log in to unmask] (I Can Post)
> >Newsgroups: bit.listserv.blues-l
> >Date: 16 Jun 1999 13:57:23 GMT
> >Organization: AOL http://www.aol.com
> >Subject: I heard you can post anything here!
> >Message-ID: <[log in to unmask]>
> >
> >man, it is SOOOOOOO KEWL that thers is a place whre you can post ANYTHING
> >and
> >they won't throw you off. KeWl! MuChO!
> >
> >So, like you'll be seein lots of posts fromme and my buddies frum know
ahn,
> >U
> >no!
> >
> >KKKKEEEEEWWWWWLLLLLL!!!
> >hohohohohohohohohohohohohohohohohohohohohoho
> >hahahahahahahahahahahahahahahahahahahahahaha
> >You suck