What can you tell me about the information on this e-mail header?

[208.104.161.76] (helo=[192.168.15.3])
      by bed.mysitehosted.com with esmtpa (Exim 4.69)
      (envelope-from <craigslist@entrusted.com>)
      id 1S6kUl-004DGy-Qa

I got a reply to one of my ads on Craigslist.
I've never seen one, that had a header like above.
Normally, well, in all "previous" cases, the person replying to my ad had a user name and a recognizable e-mail address.

The one above looks fishy to me.

What is "craigslist@entrusted.com"

I am reluctant to say, that this message came from an individual interested in my item.

Anyone have any ideas or knowledge on how to look at that header and come away with facts?

CL wants everyone to have an account.
Each account requires a phone number, so you can not have more than one e-mail address on your one, and only, phone number.
So, they are trying to weed out the e-mail addresses that do not have accounts.

When I saw: craigslist@entrusted.com, I immediately thought it was a member of their staff, wanting me to reply back, so they can block my e-mail address.

They have some rules that are questionable rules.
1. If I have a Canadian coin to sell, they do not allow me to offer it for sale in Canada.
2. If I might like to have a penpal in Russia, I can not place a personals ad in Russia.

They tell me that Craigslist is for locals only.

However, I see many U.S. persons with ads placed in other states, and countries.

I got an e-mail a few weeks ago from a female. I replied back and within a few minutes one of my posts was flagged. I highly suspect that member of the CL staff did that.

Now, CL has only 34 employees. So, they can not monitor, screen, etc. all ads. So thousands of ads slip through the crack, and get posted without those persons having a CL account.

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

LVL 85

Dave BaldwinFixer of ProblemsCommented: 2012-03-11

(envelope-from <craigslist@entrusted.com>) means that's where the message actually originated from. If the 'From:' says it was from 'craigslist.org', you know it's being faked.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial

LVL 25

nickg5Author Commented: 2012-03-11

I think is came from someone who works for Craigslist.

Do you come to the same conclusion?

I've got phishing messages from them before.

Does that header indicate my suspicions may be correct?

No, I don't think it came from craigslist at all. Yes, it is probably a phishing attempt. I'd delete it.

LVL 4

kdebugsCommented: 2012-03-11

entrusted.com is a design firm/church (I can't figure it out).

Another possibility is that one of their users created an account to use for craigslist (I use disposable addresses in my own domain all the time for one-time interactions and I see myself creating and using craigs@mydomain to interact with people on craigslist).

If you're feeling paranoid but curious, create a new acct in gmail or other service, and reply. This way your real email remains isolated from this, should you need that.

Alex

nickg5Author Commented: 2012-03-13

thanks

What can you tell me about the information on this e-mail header?

Who is Participating?