Spamcop madness

[Jan Meijer <]

FYI,

Spamcom-madness.  This example clearly showes the dangers of clueless users
using something like spamcop.  I'm glad it was not the RBL.  In this case, we
have been harrassed for a couple of weeks by someone spoofing one of our
ipaddresses in spams.  The text in this mail is what the
"abuse-responder-on-duty" send back to the complainer, explaining we could not
help him and why.  Next thing I know, I get another spamcop report, saying the
friendly reply is a spam!.

Jan

> Please stop this person from using your network to propogate spam!
> - SpamCop V1.2.6 -
> This message is brief for your comfort.  Please follow this link:
> http://spamcop.net/w3m?i=11160024-82623
> Email from 192.87.109.26 / Mon, 18 Sep 2000 14:45:39 +0200 (MET DST)
> 
> Offending message including original headers:
> "From Luuk.Oostenbrink@localhost Mon Sep 18 05:47:08 2000"
> Received: from [192.87.108.3] by hotmail.com (3.2) with ESMTP id MHotMailBB8F5977002ED821EED9C0576C0392710; Mon Sep 18 05:45:50 2000
> Received: from zuurtje.surfnet.nl ([192.87.109.5])
>         by survis.surfnet.nl with ESMTP (exPP)
>         id 13b0In-0002aE-00; Mon, 18 Sep 2000 14:45:41 +0200
> Received: from suriname.surfnet.nl (suriname.surfnet.nl [192.87.109.26])
>         by zuurtje.surfnet.nl (8.9.3/8.9.3/ZUURTJE-0.7) with ESMTP id OAA29931;
>         Mon, 18 Sep 2000 14:45:39 +0200 (MET DST)
> Date: Mon, 18 Sep 2000 14:45:39 +0200 (CEST)
> From: Luuk Oostenbrink <Luuk.Oostenbrink@localhost
> To: Undisclosed recipients: ;
> Subject: Re: [SpamCop:145.43.208.1,id:11027050] Fw: good timing?
> In-Reply-To: <"11067230-postmaster@localhost"@spamcop.net>
> Message-ID: <Pine.LNX.4.21.0009181443000.32577-100000@localhost
> Organization: SURFnet bv
> Address: "Radboudburcht, P.O. Box 19035, 3501 DA Utrecht, NL"
> Phone: +31 302 305 305
> Telefax: +31 302 305 329
> MIME-Version: 1.0
> Content-Type: TEXT/PLAIN; charset=US-ASCII
> 
> Hi,
> 
> The address 145.43.208.1 is not in use. The network which it would be part
> of isn't even routed. Therefore this part of the header must be spoofed.
> 
> > Received: from ebiamsgtw001.ebi.nl (145.43.208.1 [145.43.208.1]) by
> > ebibbixch001.adam2.ebi.nl with SMTP (Microsoft Exchange Internet Mail
> 
> I'm afraid I can't be of any help.
> 
> Regards,
> --
> Luuk Oostenbrink        postmaster@localhost


-- 
voer een eend, geen oorlog