Re: Spam "from" reserved netblocks

Geoff Lane wrote:
> Recently, I've got a lot of spam with headers forged to appear to be from 
> an IANA reserved netblock. The latest was "from" 111.120.227.30, which I 
> understand from Sam Spade to be included in RESERVED-8. (here's an excerpt 
> from Sam Spade)
> 
> NetRange:   96.0.0.0 - 123.255.255.255                        
> CIDR:       96.0.0.0/4, 112.0.0.0/5, 120.0.0.0/6 
> NetName:    RESERVED-8
> NetHandle:  NET-96-0-0-0-1
> NetType:    IANA Reserved
> 
> I have a suspicion that anything apparently from a reserved netblock is 
> probably forged, and thus probably spam. If so, I can use such netblock 
> information to supplement my spam filters - but are my suspicions true?

If you haven't gone through the mailhosts setup on the SpamCop web
pages, the parser is almost certainly following valid, but untrusted,
headers and getting the wrong source.

Set up mailhosts.

Please post a tracking link, or the full spam in spamcop.spam, if you
still see problems.

-- 
Evidence shows Cyveillance abuse internet resources.
I recommend unchecking their box in SpamCop reports.
Cyveillance are part of the problem.
They are not part of the solution.