This posting made from the web-site. Please reply via email in addition to the group. Thanks. ------------------------------------------------------ PLEASE REPLY TO ME AT: [EMAIL PROTECTED] This poor guy over at abuse at albanza.com is getting tons of abuse complaints in error... because SpamCop is reporting the Source of the spam in error. Apparently, the best we can figure, is that SpamCop is ignoring the First Received line (assuming it is forged), and going by the Second received line... Which is showing MY OWN hosting company received the message... As a result, I end up reporting lots of spam to MY OWN hosting company -- when in fact, it did Not originate there. The spam below is an example of one that apparently came from a cablemodem on Roadrunner in Houston... But Spamcop mistakenly reported it as originating from albanza.com. Could you please tell me what can be done to correct this? If Spamcop is going to have me reporting spam to the WRONG place, I may as well not waste people's time... and not report it at all. Here is the example spam: Retrieved email: This page may be saved for future reference: http://spamcop.net/sc?id=z19003250zf751ab5cef5c1ece6500dec78c4f1e11z X-Apparently-To: x via web13806.mail.yahoo.com X-Track: 4460: 2 X-YahooFilteredBulk: 209.239.40.169 Received: from unassigned.alabanza.com (EHLO server2200.net) (209.239.40.169) by mta106.mail.yahoo.com with SMTP; 27 Apr 2001 12:13:00 -0700 (PDT) Received: (from itproact@localhost) by server2200.net (8.10.2/8.10.2) id f3RJCx810437 for x; Fri, 27 Apr 2001 15:12:59 -0400 Received: from mta124.mail.yahoo.com (mta124.mail.yahoo.com [128.11.68.139]) by server2200.net (8.10.2/8.10.2) with SMTP id f3RJCuY10429 for <x>; Fri, 27 Apr 2001 15:12:57 -0400 MBOX-Line: From [EMAIL PROTECTED] Fri Apr 27 19:12:48 2001 Received: from mta124.mail.yahoo.com for x; Apr 27 12:12:50 2001 -0700 X-Yahoo-Forwarded: from x to x X-Track: 4084: 2 X-Rocket-Spam: 211.167.225.82 X-YahooFilteredBulk: 211.167.225.82 Received: from 211.167.225.82 (EHLO dominoserver.brilliance.com.cn) (211.167.225.82) by mta124.mail.yahoo.com with SMTP; 27 Apr 2001 12:01:06 -0700 (PDT) Received: from superdada.it ([24.27.122.187]) by dominoserver.brilliance.com.cn (Lotus Domino Release 5.0.3 (Intl)) with SMTP id 2001043000211578:2259 ; Mon, 30 Apr 2001 00:21:15 +0800 Message-ID: <000037c36ee5$00006789$[EMAIL PROTECTED]> To: <x> From: [EMAIL PROTECTED] Subject: Orlando/Mexican Vacation,Amazing Package!!! Date: Fri, 27 Apr 2001 11:21:51 -0600 MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-MIMETrack: Itemize by SMTP Server on dominoserver/bct(Release 5.0.3 (Intl)|21 March 2000) at 2001-04-30 12:21:16 AM, Serialize by Router on dominoserver/bct(Release 5.0.3 (Intl)|21 March 2000) at 2001-04-30 03:00:30 AM, Serialize complete at 2001-04-30 03:00:30 AM Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset="iso-8859-1" Content-Length: 638 Removing X-Yahoo-Forwarded: from x to x Parsing header: Received: from unassigned.alabanza.com (EHLO server2200.net) (209.239.40.169) by mta106.mail.yahoo.com with SMTP; 27 Apr 2001 12:13:00 -0700 (PDT) Possible spammer: 209.239.40.169 [show] "nslookup 169.40.239.209.dialups.mail-abuse.org." (checking ip) not found [show] "nslookup unassigned.alabanza.com" (checking ip) ip not found; unassigned.alabanza.com discarded as fake. [show] "dig unassigned.alabanza.com mx" (digging for mail exchanger) Can't find mailserver. [show] "dig alabanza.com mx" (digging for mail exchanger) Found mailserver:mail.alabanza.com. = 209.239.47.200 [show] "nslookup unassigned.alabanza.com" (checking ip) unassigned.alabanza.com not 209.239.40.169, discarded as fake. [show] "dig -x 209.239.40.169 soa" (digging for start of authority) - [EMAIL PROTECTED] SOA for 209.239.40.169 in same domain as unassigned.alabanza.com - close enough Taking name from IP... [show] "nslookup 209.239.40.169" (getting name) 209.239.40.169 = unassigned.alabanza.com [show] "nslookup unassigned.alabanza.com" (checking ip) ip not found; unassigned.alabanza.com discarded as fake. [show] "dig unassigned.alabanza.com mx" (digging for mail exchanger) Can't find mailserver. [show] "dig alabanza.com mx" (digging for mail exchanger) Found mailserver:mail.alabanza.com. = 209.239.47.200 [show] "nslookup unassigned.alabanza.com" (checking ip) unassigned.alabanza.com not 209.239.40.169, discarded as fake. [show] "dig -x 209.239.40.169 soa" (digging for start of authority) - [EMAIL PROTECTED] SOA for 209.239.40.169 in same domain as unassigned.alabanza.com - close enough [show] "nslookup 169.40.239.209.blackholes.mail-abuse.org." (checking ip) not found [show] "nslookup 169.40.239.209.inputs.orbs.org." (checking ip) not found [show] "nslookup 169.40.239.209.dialups.mail-abuse.org." (checking ip) not found [show] "nslookup 169.40.239.209.inputs.orbs.org." (checking ip) not found 209.239.40.169 has already been sent to ORBS Received line accepted Received: (from itproact@localhost) by server2200.net (8.10.2/8.10.2) id f3RJCx810437 for x; Fri, 27 Apr 2001 15:12:59 -0400 no ip found in received line Ignored Received: from mta124.mail.yahoo.com (mta124.mail.yahoo.com [128.11.68.139]) by server2200.net (8.10.2/8.10.2) with SMTP id f3RJCuY10429 for <x>; Fri, 27 Apr 2001 15:12:57 -0400 [show] "nslookup 169.40.239.209.dialups.mail-abuse.org." (checking ip) not found Possible spammer: 128.11.68.139 [show] "nslookup mta124.mail.yahoo.com" (checking ip) ip = 128.11.68.139 [show] "nslookup 139.68.11.128.blackholes.mail-abuse.org." (checking ip) not found [show] "nslookup 139.68.11.128.inputs.orbs.org." (checking ip) not found Chain test:server2200.net =? unassigned.alabanza.com [show] "nslookup server2200.net" (checking ip) ip = 64.177.95.189 [show] "nslookup unassigned.alabanza.com" (checking ip) ip not found; unassigned.alabanza.com discarded as fake. Chain test:server2200.net =? unassigned.alabanza.com [show] "nslookup server2200.net" (checking ip) ip = 64.177.95.189 [show] "nslookup unassigned.alabanza.com" (checking ip) ip not found; unassigned.alabanza.com discarded as fake. Chain error; 'server2200.net' != 'unassigned.alabanza.com' or 'unassigned.alabanza.com'; received line discarded Received: from mta124.mail.yahoo.com for x; Apr 27 12:12:50 2001 -0700X-Track: 4084: 2 no ip found in received line Ignored Received: from 211.167.225.82 (EHLO dominoserver.brilliance.com.cn) (211.167.225.82) by mta124.mail.yahoo.com with SMTP; 27 Apr 2001 12:01:06 -0700 (PDT) [show] "nslookup 169.40.239.209.dialups.mail-abuse.org." (checking ip) not found Possible spammer: 211.167.225.82 Taking name from IP... [show] "nslookup 211.167.225.82" (getting name) no name [show] "dig mx unassigned.alabanza.com" (digging for mail exchanger) 211.167.225.82 is not MX for unassigned.alabanza.com [show] "nslookup 82.225.167.211.blackholes.mail-abuse.org." (checking ip) not found [show] "nslookup 82.225.167.211.inputs.orbs.org." (checking ip) not found Chain test:mta124.mail.yahoo.com =? unassigned.alabanza.com [show] "nslookup mta124.mail.yahoo.com" (checking ip) ip = 128.11.68.139 [show] "nslookup unassigned.alabanza.com" (checking ip) ip not found; unassigned.alabanza.com discarded as fake. Chain test:mta124.mail.yahoo.com =? unassigned.alabanza.com [show] "nslookup mta124.mail.yahoo.com" (checking ip) ip = 128.11.68.139 [show] "nslookup unassigned.alabanza.com" (checking ip) ip not found; unassigned.alabanza.com discarded as fake. Chain error; 'mta124.mail.yahoo.com' != 'unassigned.alabanza.com' or 'unassigned.alabanza.com'; received line discarded Received: from superdada.it ([24.27.122.187]) by dominoserver.brilliance.com.cn (Lotus Domino Release 5.0.3 (Intl)) with SMTP id 2001043000211578:2259 ; Mon, 30 Apr 2001 00:21:15 +0800 Untrusted:(Lotus Domino Release 5.0 Removing possible fake IP from header:[24.27.122.187] Received: from superdada.it ( x ) by dominoserver.brilliance.com.cn (Lotus Domino Release 5.0.3 (Intl)) with SMTP id 2001043000211578:2259 ; Mon, 30 Apr 2001 00:21:15 +0800 no ip found in received line Ignored Right now, this email would be detained by SpamCop filters: chain error Tracking message source:209.239.40.169: [show] "nslookup 209.239.40.169" (getting name) 209.239.40.169 = unassigned.alabanza.com [show] "nslookup unassigned.alabanza.com" (checking ip) ip not found; unassigned.alabanza.com discarded as fake. abuse.net unassigned.alabanza.com = [EMAIL PROTECTED] [show] "dig -x 209.239.40.169 soa" (digging for start of authority) - [EMAIL PROTECTED] abuse.net alabanza.com = [EMAIL PROTECTED] Statistics: [EMAIL PROTECTED] score:181 209.239.40.169 score:5 Report already sent to: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Would send message source reports to: Re:209.239.40.169 (Administrator of network where email originates) [EMAIL PROTECTED] _______________________________________________ SpamCop-Help mailing list [EMAIL PROTECTED] http://news.spamcop.net/mailman/listinfo/spamcop-help
