I have a spam message that is parsing the headers and identifying an internal mailhost as the spam host.

I tried updating the mailhosts to see if that would help, but it did not.

Before trying to update mailhosts
http://www.spamcop.net/sc?id=z1199592161z7...59acfb64f5eacfz

After trying to update mailhosts
http://www.spamcop.net/sc?id=z1199614869zc...74544524ae51aez

No difference. I am not sure what I need to do to get this to parse correctly.

I cancelled both those reports, especially since you are claiming they are incorrect.

Have there always been 5 internal handoffs on your messages? Something inside of nortel likely changed and it will probably require a deputy to work with you on the mailhost problem. Contact them at deputies[at]admin.spamcop.net and include mailhost probelm in the subject.

I am moving this to the mailhost forum as it seems more appropriate.

And while composing my Reply, the Topic was moved by another Moderator ... second try at posting this (actually third, the first ran me into a re-boot situation at this end) ...

Both examples were from a MailHost Configured Reporting account. The initial thought was that this was going to be a MailHost Configuration issue, with the suggestions / movement of this Topic to the MailHost Configuration Forum section. However, ....

The first two Received lines leave me wondering what's really going on there. Note that a non-MailHost Configured parse results in some 'special' work also .... and on top of that, the result is basically the same ... an apparent compromised computer within "your" network does appear to be the source
<http://www.spamcop.net/sc?id=z1199640079zde447b48362d3c2cc26ae8d7af9c2c0fz>