SpamCop Discussion > mschmitt's fun times

mschmitt

Mar 21 2004, 03:04 PM

I received my first spam after setting up the mailhosts: http://mailsc.spamcop.net/sc?id=z363233371...405d55efb4c132z

The first header past my mailhost was processed as:

QUOTE

Received: from [152.0.88.148] by 172.181.84.239; Sun, 21 Mar 2004 10:31:05 -0500
Possible forgery. Supposed receiving system not associated with any of your mailhosts
Please ensure that aol.com is not your own service provider.
Will not trust anything beyond this header
Forgery detected, or mailhost configuration incomplete. Please verify source IP identified.

What I wondering is does this mean that any mail server past my mail server will now get added to the SBL? So all mail from aol.com will now be considered spam?

mschmitt

Mar 21 2004, 03:08 PM

I posted this in the SpamCop Email forum by mistake. It is another case where mailhost servers are not recognized:

Before doing the mailhost configuration, I set two test mails (from Excite webmail), one to comcast.net and one to attbi.com. My accounts at both domains forward to SpamCop.

One test mail was forwarded through rwcrmxc16.comcast.net, and the other forwarded through rwcrmxc11.comcast.net.

Then I added Comcast to the mailhosts. It sent two test messages. One went through rwcrmxc11.comcast.net and the other went through sccrmxc13.comcast.net.

The mailhost page now has an entry for bigfoot.com, with Comcast mail servers. But it doesn't include rwcrmxc16.comcast.net. It doesn't even include rwcrmxc11, even through one of the test messages used that server!

I notice that every time I refresh the mailhost page, the domain lists change. I assume that it is because it is reacting to other user's submissions.

Ellen

Mar 21 2004, 03:40 PM

QUOTE(mschmitt @ Mar 21 2004, 03:08 PM)

I posted this in the SpamCop Email forum by mistake. It is another case where mailhost servers are not recognized:

Before doing the mailhost configuration, I set two test mails (from Excite webmail), one to comcast.net and one to attbi.com. My accounts at both domains forward to SpamCop.

One test mail was forwarded through rwcrmxc16.comcast.net, and the other forwarded through rwcrmxc11.comcast.net.

Then I added Comcast to the mailhosts. It sent two test messages. One went through rwcrmxc11.comcast.net and the other went through sccrmxc13.comcast.net.

The mailhost page now has an entry for bigfoot.com, with Comcast mail servers. But it doesn't include rwcrmxc16.comcast.net. It doesn't even include rwcrmxc11, even through one of the test messages used that server!

I notice that every time I refresh the mailhost page, the domain lists change. I assume that it is because it is reacting to other user's submissions.

mschmitt -- Please forward your experiences to deputies[at]spamcop.net -- I have no idea why bigfoot was in your list -- you might also copy/paste the relevant parts of the webpage into your email. Make sure to include your registered SpamCop email address so we can look at your account. Thanks

mschmitt

Mar 23 2004, 12:45 AM

Right now the mailhosts entry for Comcast HSI is:

QUOTE

Hosts/Domains:
sccrmxc15.comcast.net, sccrmxc13.comcast.net, sccrmxc14.comcast.net, c-24-2-205-47.client.comcast.net, dnsalias.net, rwcrmxc15.comcast.net, ursine.ca, rwcrmxc13.comcast.net, gw3-sandesnet.dnsalias.net, c-24-20-212-112.client.comcast.net, comcast.net, gateway-s.comcast.net, gateway-r.comcast.net

Relaying IPs:
63.240.76.58, 216.148.227.126, 204.127.202.26, 24.20.212.112, 24.2.205.47, 63.240.76.61, 204.127.198.38, 204.127.202.57, 204.127.198.26, 63.240.76.26, 216.148.227.84

I don't know about you, but it looks to me like some of these entries are not Comcast mail servers.

I believe that 24.20.212.112 and 24.2.205.47 are both client machines (cable modems). 24.20.212.112 is also associated with the gw3-sandesnet.dnsalias.net name, probably via dyndns.org? It also has the ursine.ca name.

So the question is, how did they get in the list?