[SpamCop-List] Re: Why is fep16.inet.fi a trusted site?
MikeE at ster.invalid
Thu Jul 28 12:29:10 EDT 2005
Robert Blair wrote:
> Why is fep16.inet.fi a trusted site?
Probably SC is familiar with it.
> Normally the parse would stop at the second header and report
> 184.108.40.206 because fep16.inet.fi is not in my mail hosts. It
> appears that there is a problem with inet.fi as 220.127.116.11 is also
> in their IP space.
Yes, and if there's a relay, the user has a bogus yahoo helo.
> Did this spam sit in their email server for 4 days
> or is the second
> received header a fake?
In this case the answer to the maybe determines the SC reportability.
If SC would break the chain it would be reportable and the server would
be reported as a source. As it is, it isn't reportable because it is
too old, and/but the .fi user is currently SCbl/ed.
When I put the same spam into my non-mailhosted account, SC determines
the source to be the 80 IP, but offers to report because it determines
the age to be based on the topline, not the next one down.
That's an interesting difference between mailhosting and nonmailhosting
in terms of determining the age of an item.
Report Spam to:
Re: 18.104.22.168 (Administrator of network where email originates)
To: abuse at inet.fi (Notes)
Yum, this spam is fresh!
Message is 1 hours old
kibitzer, not SC admin
More information about the SpamCop-List