[SpamCop-List] Re: Why am I getting these?

[Mike Easter]

Godwin Stewart wrote:
> I suspect the machine bouncing the mail is bouncing it to the SMTP
> envelope MAIL FROM: address which doesn't have to be in the body at
> all. This would mean that spammy is using your e-mail address for
> precisely that purpose.

That seems like a likely mechanism.


I was interested to note the 'cleverness' of SpamPal 'working' the item
in .spam.

> X-SpamPal: SPAM SORBS 218.15.192.251 BODY

That 218.15.192.251 comes from SP figuring out that the body link
http://www.preferredrx.biz is 218.15.192.251 and that it is listed in
sorbs [also spamhaus, spews, and others].  Some list the /16, others
just the /24.

I guess I didn't realize it did that, finding body links, DNSing for the
IP to check in the bl/s..


-- 
Mike Easter