An official Orcon email originating from a Slingshot IP?

Forums › 2degrees (including Slingshot, Orcon, Flip, Stuff Fibre, MyRepublic, 2talk and Vocus) › An official Orcon email originating from a Slingshot IP?

bonkiebonks

389 posts

Ultimate Geek

#22666 4-Jun-2008 16:39

So I registered to be notified Orcon launches their new Orcon+ network in my area.

I got the email "Good News - Orcon@Home+ has launched in your area!"

A quick check on the email header revealed that the email came from a *.jetbuster.co.nz IP. and I did a traceroute to the address, and sure enough it was indeed from Slingshot!

This is an excerpt from the message header:
Received: from 202-180-120-xyz.jetbuster.co.nz ([202.180.120.xyz] helo=MarciPC)
    by mx8.orcon.net.nz with esmtpa (Exim 4.69)
    (envelope-from )
    id 1K3iIM-0006YB-IB
    for XXXXX@XXXXX.XXXXX; Wed, 04 Jun 2008 14:00:11 +1200

This was what I got from the traceroute:

Tracing route to jetbuster.co.nz [202.180.68.145]
over a maximum of 30 hops:

1     2 ms    <1 ms    <1 ms net-172-gw.net.auckland.ac.nz [130.216.175.254]

2    <1 ms    <1 ms    <1 ms cx-alfa-to-lib-sx.net.auckland.ac.nz [130.216.25
2.9]
3    <1 ms    <1 ms    <1 ms br1-to-cx-alpha.net.auckland.ac.nz [130.216.246.
41]
4     2 ms     3 ms     3 ms clix-uofauckland-nz-1.cpe.clix.net.nz [203.97.60
.81]
5     1 ms     1 ms     1 ms ge-1-0-0-927.ie1.telstraclear.net [218.101.61.8]

6     1 ms     2 ms     1 ms 203.167.221.213
7     1 ms     1 ms     1 ms 202.180.65.20
8     1 ms     1 ms     1 ms www.slingshot.co.nz [202.180.68.145]

What's up?

jmosen

551 posts

Ultimate Geek

Lifetime subscriber

#135669 5-Jun-2008 13:40

Perhaps their bandwidth problems are so bad that they have to use another ISP to get their mail out?

(Sorry but after a frustrating month of Orcon, couldn't resist).

Jonathan

freitasm

BDFL - Memuneh
79250 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#135689 5-Jun-2008 14:40

What about the rest of the headers? Can you list all here? It could be just some temporary routing or even a PR company instead.

bonkiebonks

389 posts

Ultimate Geek

#135704 5-Jun-2008 15:23

Here's the rest of the header. This was sent to an Xtra email address by the way:

From Orcon Wed Jun 4 12:00:19 2008
Return-Path:
Authentication-Results: mta102.tnz.mail.aue.yahoo.com from=orcon.net.nz; domainkeys=neutral (no sig)
Received: from 219.88.242.58 (EHLO mx8.orcon.net.nz) (219.88.242.58)
by mta102.tnz.mail.aue.yahoo.com with SMTP; Tue, 03 Jun 2008 19:00:12 -0700
Received: from Debian-exim by mx8.orcon.net.nz with local (Exim 4.69)
    (envelope-from )
    id 1K3iIN-0008Rn-CP
    for XXXXXXXX@xtra.co.nz; Wed, 04 Jun 2008 14:00:11 +1200
Received: from 202-180-120-xyz.jetbuster.co.nz ([202.180.120.xyz] helo=MarciPC)
    by mx8.orcon.net.nz with esmtpa (Exim 4.69)
    (envelope-from )
    id 1K3iIM-0006YB-IB
    for XXXXXXXX@xtra.co.nz; Wed, 04 Jun 2008 14:00:11 +1200
thread-index: AcjF5r2jswoHOVI/SWaxg3jHpsqcFg==
Thread-Topic: Good News - Orcon@Home+ has launched in your area!
Reply-To: "Orcon"
From: "Orcon"
Sender: "Orcon"
To:
Cc:
Subject: Good News - Orcon@Home+ has launched in your area!
Date: Wed, 4 Jun 2008 14:00:19 +1200
Message-ID: <651651365E934BDD9201E8E6E52ED59E@office.orcon.net.nz>
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_06FE_01C8C64B.52DA3C60"
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
Content-Length: 4226

sleemanj

1490 posts

Uber Geek

#135742 5-Jun-2008 18:59

bonkiebonks: Here's the rest of the header.

Looks like Marci (MarciPC, I speculate is the PC used by Marci), sent the email from a slingshot connection through the Orcon mail server (I'm assuming it's not an Open Relay and they must have authenticated to it), who sent the email on to your xtra account (at yahoo).

As Mauricio says it's probably just be a third party company doing the mailing for Orcon, and didn't think that it would be sensible to actually be using an Orcon account at the time (or thought that by changing the SMTP server it would be "enough").

---
James Sleeman
I sell lots of stuff for electronic enthusiasts...

Filterer

489 posts

Ultimate Geek

#135748 5-Jun-2008 19:19

Oh rofl, the email appears to be from someone using the office.orcon.net.nz server/mail system

You think that the orcon office runs off a slinghost connection?

edit: You beat me too it from loading the page and posting sleemanj. Where did the MarciPC comment from?

Peppery

919 posts

Ultimate Geek

Trusted

#135751 5-Jun-2008 19:33

Filterer: Where did the MarciPC comment from?

bonkiebonks: *snip*
Received: from 202-180-120-112.jetbuster.co.nz ([202.180.120.xyz] helo=MarciPC)

Filterer

489 posts

Ultimate Geek

#135756 5-Jun-2008 19:47

Hrrm my computer is as blind as me, I looked, even did a Ctrl-F and didn't find the word 'marci' anywhere.