[SpamCop-List] Re: Ghost emails from spamcop

[Kenneth Brody]

Mike Easter wrote:
> 
> David Barnard wrote:
> > "Kenneth Brody"
> 
> >>     From: spamcop-net at blade4.cesmail.net
> >>
> >> But that means nothing.  It could have easily been put there by the
> >> spammer.
> >
> > It could. But it wasn't. As I mentioned earlier, I have had several of
> > these. In each case, the server (blade4 in this case) matches the
> > spamcop processing headers.
> 
> So what?  There is absolutely no reason to believe that the From wasn't
> created by the sender.  I can't imagine what would make you think
> something else.  You have shown no basis here for such 'bizarre'
> theorizing.

I tried a quick experiment, and sent an e-mail to myself with:

    From:  Ken Brody <kenbrody>

My ISP's SMTP server inserted the hostname of the SMTP server within the
user name, for something like:

    From:  Ken Brody <kenbrody at mta3.myisp.tld>

Perhaps the spam was sent using:

    From: spamcop-net

and blade4 added the "@blade4.cesmail.net"?

Unfortunately, my ISP has recently blocked outgoing SMTP, so I am unable
to test this theory directly.

However, getting back to the original question...  What difference does
this make?

[...]

-- 
+-------------------------+--------------------+-----------------------------+
| Kenneth J. Brody        | www.hvcomputer.com |                             |
| kenbrody/at\spamcop.net | www.fptech.com     | #include <std_disclaimer.h> |
+-------------------------+--------------------+-----------------------------+