Let me second Michael here. The spam did indeed originate from
64.228.124.155, and 211.198.162.193 is just the relay server. SC did not
"err," per se, it just needs to be very rigorous in its parsing to avoid ANY
false positives, so it often cries "broken" on these relay chains because of
the way the mail servers record their information. No problem, just go back
and investigate the header when you see a chain error. Run a relay check
(Sam Spade is good for this, as is http://www.abuse.net/relay.html), compare
the header from the spam with the relay check header, and draw your own
conclusions. Sure, it takes a little more time, but you can then lart the
spammer and the relay. I usually add the spammer's ISP into the "User
Notification" box, with a note on why I think the spam originated from their
network.
-Peter
[posted and mailed]
"michael lefevre" <[EMAIL PROTECTED]> wrote in message
9c97rf$o7g$[EMAIL PROTECTED]">news:9c97rf$o7g$[EMAIL PROTECTED]...
i can't officially acknowledge it, 'cause i'm just another user... however,
spamcop errs in this way all the time... it's erring on the side of
caution...
because of very dodgy configuration of the kornet mail server that the
spammer abused, spamcop can't make a direct connection between
"211.198.162.193" and "server.kornet.net", so it doesn't send a report to
the source identified by that kornet server...
if spamcop was to "trust" headers of this kind, then spamcop would be easily
fooled by spammer's fake headers and would send many more bogus reports...
michael
[posted and emailed]
<[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]...
> This posting made from the web-site. Please reply via
> email in addition to the group. Thanks.
> ------------------------------------------------------
> See <http://spamcop.net/sc?id=z18951331z04710d750c41b7106c430fb444d245dbz>
>
> No spam complaint was sent to sympatico.ca where the spam apparently
originated. It appears that the relay IP at the beginning of the received
from line obfuscated proper detection of the originating dialup IP from
sympatico.ca.
>
> I would appreciate an acknowledgement that you agree SpamCop software did
in fact err.
>
> Thank you.
_______________________________________________
SpamCop-Help mailing list
[EMAIL PROTECTED]
http://news.spamcop.net/mailman/listinfo/spamcop-help
