These are not legit -- you can check the IP address that they come from (doing a reverse DNS lookup or IPWHOIS) -- if the reverse DNS or IPWHOIS do not clearly indicate that it is from Spamcop, it isn't.
-Scott

At 09:42 AM 11/12/2002, you wrote:
I got 3 mails this morning from spamcop about spam abuse from our network, I
recall months back there was a bogus letter being sent, could this be
happening again? Or is it legit? If it's legit, I obviously want some
evidence of spamming from our users as we have a no tolerance policy on
spam, and I'll drop whoever it is in a heartbeat, but I don't want to waste
my time/energy if it's bogus.

Thanks.

Paul


Received: from SMTP32-FWD by mail.2khiway.net
(SMTP32) id A00000B34; Mon, 11 Nov 2002 19:20:00 -0500
Received: from reports.spamcop.net [66.153.33.86] by mail.2khiway.net
(SMTPD32-7.13) id A37E86E00DA; Mon, 11 Nov 2002 18:55:42 -0500
To: [EMAIL PROTECTED]
X-Mailer: X-MSMail-Priority: Normal
Subject: Your network is being compromised
Date: Mon, 11 Nov 2002 18:52:55 -0500
From: [EMAIL PROTECTED]
MIME-Version: 1.0
X-Encoding: MIME
Content-Type: multipart/alternative;
boundary="----=_NextPart_63785302331564251"
Message-Id: <[EMAIL PROTECTED]>
X-Declude-Sender: [EMAIL PROTECTED] [66.153.33.86]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: None
Status: U
X-UIDL: 322689227

------------------------------
Received: from SMTP32-FWD by mail.2khiway.net
(SMTP32) id A000013BC; Mon, 11 Nov 2002 19:18:38 -0500
Received: from reports.spamcop.net [66.153.33.86] by mail.2khiway.net
(SMTPD32-7.13) id A35D86E00DA; Mon, 11 Nov 2002 18:55:09 -0500
From: [EMAIL PROTECTED]
MIME-Version: 1.0
X-Encoding: MIME
Content-Type: multipart/alternative;
boundary="----=_NextPart_63785302331564251"
X-Mailer: X-Mailer: Mozilla 4.61 [en]C-CCK-MCD (Win98; U)
To: [EMAIL PROTECTED]
Subject: Your site will be shut down
Message-Id: <[EMAIL PROTECTED]>
Date: Mon, 11 Nov 2002 18:52:22 -0500
X-Declude-Sender: [EMAIL PROTECTED] [66.153.33.86]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: None
Status: U
X-UIDL: 322689226
---------------------------------------
Received: from SMTP32-FWD by mail.2khiway.net
(SMTP32) id A00000BCC; Mon, 11 Nov 2002 18:56:59 -0500
Received: from reports.spamcop.net [66.153.33.86] by mail.2khiway.net
(SMTPD32-7.13) id A34D86E00DA; Mon, 11 Nov 2002 18:54:53 -0500
From: [EMAIL PROTECTED]
Subject: Spamcop will block your network
MIME-Version: 1.0
X-Encoding: MIME
Content-Type: multipart/alternative;
boundary="----=_NextPart_63785302331564251"
Date: Mon, 11 Nov 2002 18:52:09 -0500
Message-Id: <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Mailer: X-Mailer: QUALCOMM Windows Eudora Version 5.0
X-Declude-Sender: [EMAIL PROTECTED] [66.153.33.86]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: None
Status: U
X-UIDL: 322689225




---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Reply via email to