Re: SpamCop doesn't parse routing info correctly

Tristan Miller wrote:

> This is in line with
> what the spammer himself admits -- he makes no attempt to disguise
> his identity, freely giving out his name, birthdate, photograph, and
> often mentions that he's sending his mails from a public library
> terminal.  As I said, we're pretty sure he's mentally ill.

Oh, I see.  I'm beginning to get the picture.

> His
> e-mails consist of nothing but incoherent rants that go on for pages
> and pages about the World Socialist Party of the United States, of
> which his late father was a member.  This apparently explains his
> choice of spam recipients -- I recognize some of the e-mail addresses
> as belonging to members and departments of the WSPUS and affiliated
> parties overseas.

He is simply proselytizing his point of view to 'you' people --- who
don't want to hear it.  I'm surprised there isn't some clever way to
filter him out, depending upon what kind of filter tools you have at
your disposal.

> I've been manually reporting to Yahoo! for months and they never take
> any action.  At worst the reports are ignored, and at best I get an
> automated response.

That would be yahoo all right.  They simply consider this
'correspondence'.

>> I'm still trying to figure out why that btconnect is in there.

> My employer is receiving the spam at [email protected].  The
> spammer is sending to [email protected], an obsolete
> address which forwards to [email protected].

Ah, so!  I now understand the btconnect being in there perfectly.

> I've since set up mailhosts for my employer's SpamCop account.  The
> automatic configuration wouldn't work for
> [email protected], but the administrators waived it.

Waived?  I don't understand that yet.

> SpamCop now correctly identifies the University of Arizona IP for the
> spam.

Not according to what I see at your originally posted employer's header
example
http://www.spamcop.net/sc?id=z919793041z85093855a4505837202f64fc298ebaa6z

Supposed receiving system not associated with any of your mailhosts

If reported today, reports would be sent to:
Re: 213.123.26.90 (Administrator of network where email originates)
Internal spamcop handling: (bt)

That tracker shows a mailhosted account, but since the btconnect
mailhosting wouldn't work for some reason I don't understand, the
spamsource isn't correctly identitified.

That is, SC is still tripping on the same place for the same reason.  If
you had been successful at mailhosting the btconnect, the parse result
would be/ should be/ correct.


-- 
Mike Easter
kibitzer, not SC admin