[SpamCop-List] Re: Why is fep16.inet.fi a trusted site?

[Mike Easter]

Robert Blair wrote:
> www.spamcop.net/sc?id=z790815776z48f4163ea2761b5475b4c0817943ee7dz
>
> Why is fep16.inet.fi a trusted site?

Probably SC is familiar with it.

> Normally the parse would stop at the second header and report
> 194.251.242.241 because fep16.inet.fi is not in my mail hosts. It
> appears that there is a problem with inet.fi as 80.220.243.70 is also
> in their IP space.

Yes, and if there's a relay, the user has a bogus yahoo helo.

> Did this spam sit in their email server for 4 days

Maybe.

> or is the second
> received header a fake?

Maybe

In this case the answer to the maybe determines the SC reportability.
If SC would break the chain it would be reportable and the server would
be reported as a source.  As it is, it isn't reportable because it is
too old, and/but the .fi user is currently SCbl/ed.

When I put the same spam into my non-mailhosted account, SC determines
the source to be the 80 IP, but offers to report because it determines
the age to be based on the topline, not the next one down.

That's an interesting difference between mailhosting and nonmailhosting
in terms of determining the age of an item.

http://www.spamcop.net/sc?id=z790828725z9c9b0a0403c068ef145dc36136698779z
Report Spam to:
Re: 80.220.243.70 (Administrator of network where email originates)
   To: abuse at inet.fi (Notes)

Yum, this spam is fresh!
Message is 1 hours old

<cancelled>

-- 
Mike Easter
kibitzer, not SC admin