Text 180, 64 rader
Skriven 2005-01-11 20:05:30 av Frank Vest (1:124/6308.1)
    Kommentar till text 179 av Gerald Miller (1:342/512)
Ärende: Header
==============
On (11 Jan 05) Gerald Miller wrote to Frank Vest...

Hello Gerald,

 GM> Now, I can't explain all the "Useless qmail received line" unless it
 GM> was because of line wrap...

I'd say you are right.

 GM> I can't verify that "165.146.39.191" is the originating IP.  I may
 GM> have to run all the "Possible abuse address" through a WhoIs to get
 GM> the originating IP (what's ".jp" ?  Japan?).

 GM> Could you install the Spam Abuse program on your machine and run your
 GM> header through it to see if you can get the same results as I have
 GM> posted above?

Done. Here's the results:

----------------- cut -----------------
**********
Parsing:
Sender (or dispatching mailserver) IP:207.115.63.32
He/she/it has said to be :yipvme.prodigy.net
Receiving mailserver [by]:mta827.mail.sc5.yahoo.com
**********
Parsing:
Sender (or dispatching mailserver) IP:165.146.39.191
He/she/it has said to be :mydomain.com
Receiving mailserver [by]:yipvme.prodigy.net
For e-mail: <flv@sbcglobal.net>
The trusting level of this Received line: is 25%
flv@sbcglobal.net doesn't seem to have valid MX records
**********
Parsing:
Sender (or dispatching mailserver) IP:150.88.44.218
He/she/it has said to be :nk3.mx.aol.com
Receiving mailserver [by]:nk4.hotmail.com
The mailserver that received that mail is nk4.hotmail.com which is
different from the one who delivered the mail in the previous
Received: line, which is mydomain.com
This line seems forged - Analysis interrupted
The trusting level of this Received line: is 0%
165.146.39.191 is the last valid ip, probably the spammer?
***** RESULTS ******
- 165.146.39.191(rndf-146-39-191.telkomadsl.co.za): Spam source
Searching for abuse addresses in the cache
No hits in the cache

Possible abuse address: wilsonvm@telkom.co.za
Possible abuse address: postmaster@telkomadsl.co.za
Possible abuse address: abuse@saix.net
---------------- cut -----------------

Regards,
Frank

http://pages.sbcglobal.net/flv
http://biseonline.com/r19

... Weather News Flash:   It finally froze over, folks!!!!!

--- PPoint 3.01
 * Origin: Holy Cow! I'm A Point!! (1:124/6308.1)