I parsed the headers you included below and SC correctly identified
207.251.216.121 as the source of the spam (report to [EMAIL PROTECTED]) --
I have one mail account redirected and about 70% of the spam I parse that
comes thru there is fine and the other 30% points to my redirector. It
appears (in my case) that one of the servers puts a slightly wonky received
line in when it handles the mail; the other server(s) put in "normal"
received lines so it's the luck of the draw as to which server sticks in a
received line and whether SC wants to report to the redirector or to the
real spammer, but it's not a SC problem. In my case when the server that
puts in the slightly screwy header line is the one that handles the mail, I
have to remove that header line before I parse the spam which I understand
is annoying if you are directly filtering thru SC.
In any case, the headers you show below seemed to parse fine for me.
Ellen
"Kevin Hisel" <[EMAIL PROTECTED]> wrote in message
9d4rv6$k1u$[EMAIL PROTECTED]">news:9d4rv6$k1u$[EMAIL PROTECTED]...
> I have an ISP manage my own domain and they redirect any e-mail that comes
> to me
> to my normal POP server. Spamcop seems to be having trouble with these
> emails
> blaming the spam on my ISP and misses the spammer. Here's a typical
header:
>
> X-POP3-Rcpt: [EMAIL PROTECTED]
> Return-Path: <[EMAIL PROTECTED]>
> Received: from 5thelement.wyattweb.com ([216.226.138.99])
> by node-03.advancenet.net (8.9.3/8.9.3) with ESMTP id QAA14221
> for <[EMAIL PROTECTED]>; Sun, 6 May 2001 16:13:11 -0500 (CDT)
> From: [EMAIL PROTECTED]
> Received: from computer (ppp121.tc-1.roc-pt.ny.localnet.com
> [207.251.216.121])
> by 5thelement.wyattweb.com (8.9.0/8.9.0) with SMTP id QAA20757
> for <[EMAIL PROTECTED]>; Sun, 6 May 2001 16:17:43 -0500 (EST)
> Message-Id: <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Subject: protect yourself !
> Mime-Version: 1.0
> Content-Type: text/plain; charset="iso-8859-1"
> Date: Sun, 6 May 2001 17:17:47
>
> The "5thelement.wyattweb.com" is being ID'd by Spamcop as the spammer (it
> sends a complaint to [EMAIL PROTECTED], which I think is the
> contact for wyattweb.) I can easily uncheck any complaints going there,
but
> Spamcop
> misses the real spammer's address and does not send a compaint to the
> "localnet"
> contact unless I manually edit the header which should be a no-no for
> accurate
> spam reporting.
>
> Any tips?
>
> -Kevin Hisel
> http://www.kevinhisel.com/
> [EMAIL PROTECTED]
>
>
>
_______________________________________________
SpamCop-Help mailing list
[EMAIL PROTECTED]
http://news.spamcop.net/mailman/listinfo/spamcop-help
