Pre-Dated email??

Xantom · Nov 23, 2009

I received a time sensitive email today. *I seriously question the validity of the time stamp. It shows in my inbox with the time I received it, today 6:44PM. However the header date shows yesterdays date and time of 11:30am.

Is there anyway I can verify the date and time?

Is it possible to that this person used a hack to send me a pre dated email somehow?

SMTP · Nov 23, 2009

The sent timestamp is 11/22 at 11:30am? It's possible there was just a delay between when the message was sent and you received it.

BenF · Nov 23, 2009

SMTP said:
The sent timestamp is 11/22 at 11:30am? It's possible there was just a delay between when the message was sent and you received it.

That seems like a very long delay to me

Flurp · Nov 23, 2009

Time zone difference?

Xantom · Nov 24, 2009

Is there an expert that can decipher this and prove or disprove its valid? It would be much appreciated. Gmail is my account theirs is AOL. Any help is appreciated.

Delivered-To: [email protected]
Received: by 10.216.47.141 with SMTP id t13cs424734web;
Mon, 23 Nov 2009 15:44:58 -0800 (PST)
Received: by 10.220.66.74 with SMTP id m10mr6638265vci.62.1259019897882;
Mon, 23 Nov 2009 15:44:57 -0800 (PST)
Return-Path: <[email protected]>
Received: from imr-da01.mx.aol.com (imr-da01.mx.aol.com [205.188.105.143])
by mx.google.com with ESMTP id 16si7139510vws.87.2009.11.23.15.44.57;
Mon, 23 Nov 2009 15:44:57 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 205.188.105.143 as permitted sender) client-ip=205.188.105.143;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 205.188.105.143 as permitted sender) smtp.mail=[email protected]
Received: from imo-da02.mx.aol.com (imo-da02.mx.aol.com [205.188.169.200])
by imr-da01.mx.aol.com (8.14.1/8.14.1) with ESMTP id nANNitGl001937
for <[email protected]>; Mon, 23 Nov 2009 18:44:55 -0500
Received: from [email protected]
by imo-da02.mx.aol.com (mail_out_v42.5.) id o.ccb.5bee419b (43839)
for <[email protected]>; Mon, 23 Nov 2009 18:44:51 -0500 (EST)
Received: from smtprly-db03.mx.aol.com (smtprly-db03.mx.aol.com [205.188.249.154]) by cia-dc03.mx.aol.com (v126.13) with ESMTP id MAILCIADC034-5c404b097563276; Mon, 23 Nov 2009 18:44:51 -0500
Received: from webmail-m091 (webmail-m091.sim.aol.com [64.12.102.41]) by smtprly-db03.mx.aol.com (v126.13) with ESMTP id MAILSMTPRLYDB036-5c404b097563276; Sun, 22 Nov 2009 12:31:15 -0500
To: [email protected]
Subject: F Lite Week 11
Date: Sun, 22 Nov 2009 12:31:15 -0500
X-MB-Message-Source: WebUI
X-AOL-IP: 75.17.192.199
X-MB-Message-Type: User
MIME-Version: 1.0
From: [email protected]
Content-Type: multipart/alternative;
boundary="--------MB_8CC39B0BA2E2D3F_2818_2CA62_webmail-m091.sysops.aol.com"
X-Mailer: AOL Webmail 29202-STANDARD
Received: from 75.17.192.199 by webmail-m091.sysops.aol.com (64.12.102.41) with HTTP (WebMailUI); Sun, 22 Nov 2009 12:31:15 -0500
Message-Id: <[email protected]>
X-Spam-Flag:NO
X-AOL-SENDER: [email protected]

----------MB_8CC39B0BA2E2D3F_2818_2CA62_webmail-m091.sysops.aol.com
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="us-ascii"

xxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxx

----------MB_8CC39B0BA2E2D3F_2818_2CA62_webmail-m091.sysops.aol.com
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="us-ascii"

xxxxxxxxxxxxxxxxxxxxxxx 
xxxxxxxxxxxxxxxxxxxxxxx 
xxxxxxxxxxxxxxxxxxxxxxx 


----------MB_8CC39B0BA2E2D3F_2818_2CA62_webmail-m091.sysops.aol.com--

ratbuddy · Nov 24, 2009

Those last 2 received lines stink to high heaven. Can you show another email received from that same person for comparison?

Xantom · Nov 24, 2009

Thanks for posting...

From today:

Delivered-To: [email protected]
Received: by 10.204.78.8 with SMTP id i8cs37040bkk;
Tue, 24 Nov 2009 08:07:30 -0800 (PST)
Received: by 10.220.127.26 with SMTP id e26mr7596965vcs.99.1259078848343;
Tue, 24 Nov 2009 08:07:28 -0800 (PST)
Return-Path: <[email protected]>
Received: from imr-db02.mx.aol.com (imr-db02.mx.aol.com [205.188.91.96])
by mx.google.com with ESMTP id 2si8243053vws.17.2009.11.24.08.07.27;
Tue, 24 Nov 2009 08:07:28 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 205.188.91.96 as permitted sender) client-ip=205.188.91.96;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 205.188.91.96 as permitted sender) smtp.mail=[email protected]
Received: from imo-ma02.mx.aol.com (imo-ma02.mx.aol.com [64.12.78.137])
by imr-db02.mx.aol.com (8.14.1/8.14.1) with ESMTP id nAOG7KvY023107
for <[email protected]>; Tue, 24 Nov 2009 11:07:20 -0500
Received: from [email protected]
by imo-ma02.mx.aol.com (mail_out_v42.5.) id o.d18.50f3cb10 (45274)
for <[email protected]>; Tue, 24 Nov 2009 11:07:16 -0500 (EST)
Received: from smtprly-da03.mx.aol.com (smtprly-da03.mx.aol.com [205.188.249.146]) by cia-mc03.mx.aol.com (v126.13) with ESMTP id MAILCIAMC034-5bbd4b0c04b12c0; Tue, 24 Nov 2009 11:07:15 -0500
Received: from webmail-m071 (webmail-m071.sim.aol.com [64.12.141.17]) by smtprly-da03.mx.aol.com (v126.13) with ESMTP id MAILSMTPRLYDA034-5bbd4b0c04b12c0; Tue, 24 Nov 2009 11:07:13 -0500
To: [email protected]
Subject: ??
Date: Tue, 24 Nov 2009 11:07:13 -0500
X-MB-Message-Source: WebUI
X-AOL-IP: 72.25.139.66
X-MB-Message-Type: User
MIME-Version: 1.0
From: [email protected]
Content-Type: multipart/alternative;
boundary="--------MB_8CC3B3751C1997A_7F8_10B8C_webmail-m071.sysops.aol.com"
X-Mailer: AOL Webmail 29202-STANDARD
Received: from 72.25.139.66 by webmail-m071.sysops.aol.com (64.12.141.17) with HTTP (WebMailUI); Tue, 24 Nov 2009 11:07:13 -0500
Message-Id: <[email protected]>
X-Spam-Flag:NO
X-AOL-SENDER: [email protected]

----------MB_8CC3B3751C1997A_7F8_10B8C_webmail-m071.sysops.aol.com
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="us-ascii"

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

----------MB_8CC3B3751C1997A_7F8_10B8C_webmail-m071.sysops.aol.com
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="us-ascii"

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 


----------MB_8CC3B3751C1997A_7F8_10B8C_webmail-m071.sysops.aol.com--

nd4spdbh2 · Nov 24, 2009

ya time stamps on emails can get weird... i have had new emails show up dated a day old and one page in on my emails.

ratbuddy · Nov 24, 2009

Looks like a legit delay to me, I guess AOL just uses some funky internal bounces when routing mail :shrug:

Xantom · Nov 24, 2009

Thanks for the quick responses...

ratbuddy · Nov 24, 2009

To make double sure.. Does anyone here have an AOL email address they can send me a test message from? My address is my username here but on gmail.

Xantom · Nov 24, 2009

Just fired it off...

VinnyTAMU · Nov 24, 2009

The message was sent via AOL Web Mail at Sun, 22 Nov 2009 12:31:15 -0500.

Xantom said:
Received: from 75.17.192.199 by webmail-m091.sysops.aol.com (64.12.102.41) with HTTP (WebMailUI); Sun, 22 Nov 2009 12:31:15 -0500

Here is the first hop, I see no delay here.

Xantom said:
Received: from webmail-m091 (webmail-m091.sim.aol.com [64.12.102.41]) by smtprly-db03.mx.aol.com (v126.13) with ESMTP id MAILSMTPRLYDB036-5c404b097563276; Sun, 22 Nov 2009 12:31:15 -0500

Here is the second hop, I see LOTS of delay. Approximately 30 hours!

Xantom said:
Received: from smtprly-db03.mx.aol.com (smtprly-db03.mx.aol.com [205.188.249.154]) by cia-dc03.mx.aol.com (v126.13) with ESMTP id MAILCIADC034-5c404b097563276; Mon, 23 Nov 2009 18:44:51 -0500

All hops after this last one show normal delay. So NO the email timestamps were not faked, and AOL email apparently sucks! Hope this helps.

ratbuddy · Nov 24, 2009

VinnyTAMU said:
The message was sent via AOL Web Mail at Sun, 22 Nov 2009 12:31:15 -0500.

Here is the first hop, I see no delay here.

Here is the second hop, I see LOTS of delay. Approximately 30 hours!

All hops after this last one show normal delay. So NO the email timestamps were not faked, and AOL email apparently sucks! Hope this helps.

Did you check out all the IPs and stuff? This joker could have been running his own mail server with faked names

He isn't, I checked, but it's always a possibility..

edit: Xantom, didn't get your email yet.. AOL does indeed suck.

VinnyTAMU · Nov 24, 2009

ratbuddy said:
Did you check out all the IPs and stuff? This joker could have been running his own mail server with faked names

He isn't, I checked, but it's always a possibility..

edit: Xantom, didn't get your email yet.. AOL does indeed suck.

That is true but I have yet to see someone go to that length to fake an email.

ratbuddy · Nov 24, 2009

VinnyTAMU said:
That is true but I have yet to see someone go to that length to fake an email.

I don't frequent the blackhat type places but I'm sure there are turnkey programs that will do it for kiddies who are late with their homework.

SMTP · Nov 24, 2009

BenF said:
That seems like a very long delay to me

I don't see a lot of that but it's not unheard of. A few months ago I received a message from a client that was somehow delayed for almost a year. No clue how it happened as mail servers usually don't wait that long to retry delivery.

Xantom · Nov 24, 2009

ratbuddy said:
edit: Xantom, didn't get your email yet.. AOL does indeed suck.

It was returned, sorry. Sent it to "ratbuddy" @gmail... I just sent another one see if that goes through.

Thanks for your help.

ratbuddy · Nov 25, 2009

Xantom said:
It was returned, sorry. Sent it to "ratbuddy" @gmail... I just sent another one see if that goes through.

Thanks for your help.

Got it, and everything looks fine. It seems like AOL just sucks.

Xantom · Nov 25, 2009

ratbuddy said:
Got it, and everything looks fine. It seems like AOL just sucks.

Thanks for your time, it's appreciated.

Pre-Dated email??

Member

Registered

Member

Member

Member

Member

Member

Member

Member

Member

Member

Member

Member

Member

Member

Member

Registered

Member

Member

Member

Similar threads