[SpamCop-List] Re: [reposted from nanae] Problem with misidentification of source foreskimo.com shell users

[Spam Hater]

There is nothing wrong with the parse.  The top message did
come from Eskimo.com as stated.  The problem seems to
be that Flint was trying to report a SPAM message he received
directly to the Pitt Help Desk and not SpamCop as Nanook
alleges.  Then the Pitt Help Desk reported Flint's report as
SPAM to SpamCop!!  Since it came from Flint and his
Eskimo.com address, that is what got tagged as the source.  A
deputy should check on reports coming from the Pitt Help
Desk and slap their wrists for submitting false reports!  They
probably have it automated and never even looked at the
source to see that it was an end user reporting SPAM to them
and not just someone SPAMming them directly...

Once someone can confirm this, someone who reads NANAE
should reply to the whiner and explain what actually happened.

At 10:43 AM 1/21/2004 -0700, Spam Trap typed:
 
>From: Nanook <nanook at eskimo.com>
>Newsgroups: news.admin.net-abuse.email
>Subject: Re: [SpamCop (204.122.16.13) id:621999712]Flint drippin'
>sticky jui
>Date: Wed, 21 Jan 2004 08:52:06 -0800
>Organization: Eskimo North www.eskimo.com (800) 246-6874
>NNTP-Posting-Host: invisible.eskimo.com
>X-Complaints-To: abuse at eskimo.com
>NNTP-Posting-Date: 21 Jan 2004 16:52:09 GMT
>
>
>     Our customer here, flint at eskimo.com, forwarded a spam originating
>from a pitt.edu address to SpamCop for processing.  Once again,
>SpamCop mis-identified this spam as having originated from us.  
>
>Exactly this occurance has gotten our servers black-listed by SpamCop
>several times in the past.
>
>I would really appreciate it if shell users here would reconsider
>forwarding spam to SpamCop, since despite numerous attempts to get the
>folks at SpamCop to address this problem, they continue to misidentify
>the source.
>
>On Wed, 21 Jan 2004, Pitt Help Desk wrote:
>
>> Date: Wed, 21 Jan 2004 08:21:14 -0800
>> From: Pitt Help Desk <621999712 at reports.spamcop.net>
>> To: abuse at eskimo.com
>> Subject: [SpamCop (204.122.16.13) id:621999712]Flint drippin' sticky jui
>>
>> [ SpamCop V1.3.4 ]
>> This message is brief for your comfort.  Please use links below for details.
>>
>> Email from 204.122.16.13 / Wed, 21 Jan 2004 08:21:14 -0800
>> http://www.spamcop.net/w3m?i=z621999712ze27405e6bf8c7066328a062856319543z
>>
>> [ Offending message ]
>> Return-Path: <x>
>> Received: from mb2i1.ns.pitt.edu (mb2i1.ns.pitt.edu [136.142.185.162])
>>           by imap.srv.cis.pitt.edu with ESMTP (8.8.8/8.8.8/cisimap-7.2.2.4)
>>           ID <LAA27538 at imap.srv.cis.pitt.edu>;
>>           Wed, 21 Jan 2004 11:21:23 -0500 (EST)
>> Received: from CONVERSION-DAEMON by pitt.edu (PMDF V5.2-32 #41462)
>>  id <01L5NQA8HE68010VXM at mb2i1.ns.pitt.edu> (ORCPT rfc822;x); Wed,
>>  21 Jan 2004 11:21:19 EST
>> Received: from mx1.eskimo.com ([204.122.16.48])
>>  by pitt.edu (PMDF V5.2-32 #41462)
>>  with ESMTP id <01L5NQA6LX62012KG5 at mb2i1.ns.pitt.edu>
>>  (ORCPT rfc822;x); Wed, 21 Jan 2004 11:21:17 -0500 (EST)
>> Received: from eskimo.com (x [204.122.16.13])
>>  by mx1.eskimo.com (8.9.3/8.8.8) with ESMTP id IAA31872	for <x>;
>>  Wed, 21 Jan 2004 08:21:14 -0800
>> Received: (from flint at localhost)	by eskimo.com (8.9.1a/8.9.1)
>>  id IAA03938	for x; Wed, 21 Jan 2004 08:21:13 -0800 (PST)
>> Date: Wed, 21 Jan 2004 08:21:13 -0800 (PST)
>> From: Steven Flint <x>
>> Subject: Flint drippin' sticky jui
>> To: x
>> Message-id: <2004_____________3938 at eskimo.com>
>>
>>
>> The following unsolicited "spam" e-mail appears to have
>> originated from your network or from one of your users.
>> I apologize if I've sent this to the wrong party.
>>
>> Thank you for your time.
>>
>> ---
>>
>>
>> >From promise at dorms-pppoe-1-77-66.pittsburgh.resnet.pitt.edu  Wed Jan 21 07:56:36 2004
>> Received: from dorms-pppoe-1-77-66.pittsburgh.resnet.pitt.edu (dorms-pppoe-1-77-66.pittsburgh.resnet.pitt.edu [130.49.77.66])
>> 	by mx1.eskimo.com (8.9.3/8.8.8) with SMTP id HAA14107
>> 	for <x>; Wed, 21 Jan 2004 07:56:29 -0800
>> From: promise at dorms-pppoe-1-77-66.pittsburgh.resnet.pitt.edu
>> Received: from alacarta.com [233.165.181.218] by dorms-pppoe-1-77-66.pittsburgh.resnet.pitt.edu (Postfix) with ESMTP id 411A7F84969E for <x>; Wed, 21 Jan 2004 08:40:29 +0000
>> Date: Wed, 21 Jan 2004 08:40:29 +0000
>> Subject: Flint drippin' sticky juices   pvBAQCTzLz82?
>> To: Flint <x>
>> References: <4C71E25BA1903421 at eskimo.com>
>> In-Reply-To: <4C71E25BA1903421 at eskimo.com>
>> Message-ID: <F62019F9D807740B at dorms-pppoe-1-77-66.pittsburgh.resnet.pitt.edu>
>> MIME-Version: 1.0
>> Content-Type: text/html
>> Content-Transfer-Encoding: 8bit
>> Status: R
>>
>> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Frameset//EN" "http://www.w3.org/TR/html4/frameset.dtd">
>> <HTML>
>> <HEAD>
>> <TITLE>Interesting results from internal deposits</TITLE>
>> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">

<SPAM snipped>