Re: Spamcop failing to detect true originating IP

Mike Easter wrote:
> wskrispy wrote:
> 
>>Here's a tracker from a spam that Spamcop choked on, complete with SA
>>headers:
>>
>>
> 
> http://www.spamcop.net/sc?id=z785186974zfb5c4d04f5694f362a90b200bac251bfz
> 
> Good!  Posting a tracker is enormously important/ essential/ for these
> issues.
> 
> Received: from acconci1 by 1n5-199.servernode.net
> 
> That is the first part of the top line from the tracker.  That line is
> totally unacceptable/ noncompliant/ from the perspective of reporting
> spam.  There is nothing you can do, such as removing SA lines, which
> will restore those headers to a proper condition for reporting spam.
> 
> That line's 'from' field is supposed to contain the IP address of the
> source from which the servernode received the item.  If it doesn't,
> there *must* be some other compliant line stamped properly to
> 'represent' what is missing there.
> 
> 
>>Received: from [62.101.126.224] (helo=acconci.com)
>>        by 1n5-199.servernode.net with esmtp (Exim 4.43)
>>        id 1Diaux-0001fo-UD
>>        for x; Wed, 15 Jun 2005 12:39:09 -0400
> 
> 
> This second line can take the place of the first line;  it is a
> compliant line.
> 
> 

Yes, so why doesn't Spamcop use this second line and accept it as source IP?

And the reason the first line is unusable is: the spammer succeeded in 
his spoof (he made 1n5-199.servernode.net think it was receiving mail 
from "acconci1", which is the linux username running the mailserver on 
1n5-199.servernode.net itself!). I thought we're in the business of 
outsmarting these clowns.

--
wsk