Bon Matin All, The active owner of BLUES-L received the appended trolling post from the news-feed, since we are self moderated (Editor=owner,(BLUES-L) ), Bill just let the post die. But the [log in to unmask] since then subscribed to the list ... I know there is no "failsafe" way to see if someone is pulling our leg but I would appreciate if anyone with experience with AOL headers can give an educate guess on a spoof/prank vs a roller ... From the header I would hazard that someone posted on AOL.COM news server... ISC.ORG does exists and is located in California... Are they mandated to replace the [log in to unmask] address ? Or can it mean that the "spoofer" used their server to in the AOL news feed ? As a precaution I advised Bill (the active owner) to notify [log in to unmask] and to do the same with ISC.ORG ... Is the normal procedure CC'ing the technical contact from the Whois database ? Thanks for any input. Eric. co-owner BLUES-L. PS If that`s a troll I guess s/he's with limited skills since a few more header lines could have brought havoc on the list. ----------- Trolling post in question ------------- > >------------------------ Original message (29 > >lines) -------------------------- > >Return-Path: <[log in to unmask]> > >Received: from BROWNVM (NJE origin SMTP@BROWNVM) by BROWNVM.BROWN.EDU (LMail > >V1.2a/1.8a) with BSMTP id 6043; Wed, 16 Jun 1999 09:58:14 -0400 > >Received: from nut.brown.edu (128.148.19.196) by BROWNVM.brown.edu > > (IBM VM SMTP V2R4) with TCP; Wed, 16 Jun 99 09:58:12 EDT > >Received: from isgate.is (isgate.is [193.4.58.51]) > > by nut.brown.edu (8.9.1a/8.9.1) with ESMTP id JAA09949 > > for <[log in to unmask]>; Wed, 16 Jun 1999 09:57:42 -0400 > >(EDT) > >Received: from ngeout01.news.aol.com (ngeout01.news.aol.com > >[152.163.176.244]) > > by isgate.is (8.9.3r/8.9.0Imo) with SMTP id NAA22539 > > for <[log in to unmask]>; Wed, 16 Jun 1999 > >13:57:40 GMT > >Received: from ladder05.news-fddi.aol.com (ladder05.news-fddi.aol.com > >[172.16.31.190]) by ngeout01.news.aol.com (8.6.12/8.6.12) with ESMTP id > >JAA11195 for <[log in to unmask]>; Wed, 16 Jun 1999 > >09:57:23 -0400 > >To: <[log in to unmask]> > >From: [log in to unmask] (I Can Post) > >Newsgroups: bit.listserv.blues-l > >Date: 16 Jun 1999 13:57:23 GMT > >Organization: AOL http://www.aol.com > >Subject: I heard you can post anything here! > >Message-ID: <[log in to unmask]> > > > >man, it is SOOOOOOO KEWL that thers is a place whre you can post ANYTHING > >and > >they won't throw you off. KeWl! MuChO! > > > >So, like you'll be seein lots of posts fromme and my buddies frum know ahn, > >U > >no! > > > >KKKKEEEEEWWWWWLLLLLL!!! > >hohohohohohohohohohohohohohohohohohohohohoho > >hahahahahahahahahahahahahahahahahahahahahaha > >You suck