[SpamCop-List] possibe missed relay rape
Chris Abbey
spamcop-list
Mon, 12 Feb 2001 20:42:12 -0600
First off: love the new interface... I've been using lynx for a while
and hadn't seen the *per recipient* additional comments before...
way cool. And Good luck on the upgrades... we all know how much
fun it can be to upgrade production systems... especially with a
lot of bitchy users.... ;)
Anyway, I was parsing this little beasty and I think I disagree
with the final judgement sc came up with:
http://spamcop.net/sc?id=z16689466z608fa5c87fff416a779289590b17ac0ez
It basicaly didn't report the spam to anyone except the email
addresses contained therein.
By my read of the headers ksmail.netcologne.de is a relay,
it maybe a willing relay or it may have been raped, but it's
clearly a realy, and there's no good reason in this parse
NOT to report it. (I'd call ghost.tevox.net the guilty party,
with 200.0.0.3 being some internal machine generating the spam,
or an external spammer... or perhaps the input to some double
relay system... wtf is "VPOP3" anyway and do we trust it to
accurately report sources??) Cheers -=Chris
p.s. dig the client on this! the lizard is just about
usable for nntp!!