On Thu, 12 Nov 2015 21:25:58 -0600 "Jay West" <jw...@classiccmp.org> wrote:
> Apologies, not sure how that got through. > > Maybe a listmember got address-book-malware. Will see if the headers reveal > anything that is easy to spot. I'm a member of spamcop and submitted all of the spam posts to spamcop (since becoming a member, I've submitted over 15,000 spams to them). At any rate, here's the detail of who posted it - and the ISP who got the spam post: -------------------------------------------- Here are the results of your submission: Processing spam: From: kateli...@trouts.org Subject: Fw: new message 0: Received: from huey.classiccmp.org ([199.188.211.196]:24115) by biz170.inmotionhosting.com with esmtp (Exim 4.85) (envelope-from <cctalk-boun...@classiccmp.org>) id 1Zx1HS-002Mnq-NF for lbick...@bickleywest.com; Thu, 12 Nov 2015 15:27:51 -0800 Hostname verified: huey.classiccmp.org inmotionhosting.com received mail from sending system 199.188.211.196 1: Received: from huey.classiccmp.org (localhost [127.0.0.1]) by huey.classiccmp.org (Postfix) with ESMTP id 51C3C2073F99; Thu, 12 Nov 2015 17:27:41 -0600 (CST) Internal handoff or trivial forgery 2: Received: from mx2.ezwind.net (unknown [172.20.1.95]) by huey.classiccmp.org (Postfix) with ESMTP id CB3BD2073F8F; Thu, 12 Nov 2015 17:27:38 -0600 (CST) Internal handoff or trivial forgery 3: Received: from mx2.ezwind.net (localhost [127.0.0.1]) by mx2.ezwind.net (Postfix) with ESMTP id B14D74E6AA; Thu, 12 Nov 2015 17:27:38 -0600 (CST) Internal handoff or trivial forgery 4: Received: from mailout.ish.de (mailout.ish.de [80.69.98.247]) by mx2.ezwind.net (Postfix) with ESMTP id 5855C4E6B4; Thu, 12 Nov 2015 17:27:37 -0600 (CST) Hostname verified: mailout.ish.de warning:Possible forgery. Supposed receiving system not associated with any of your mailhosts Will not trust this Received line. Tracking message source:199.188.211.196: Cached whois for 199.188.211.196 : n...@xiolink.com Using abuse net on n...@xiolink.com abuse net xiolink.com = ab...@xiolink.com Using best contacts ab...@xiolink.com warning:Yum, this spam is fresh! Message is 0 hours old 199.188.211.196 not listed in cbl.abuseat.org 199.188.211.196 not listed in dnsbl.sorbs.net Spam report id 6380971842 sent to: ab...@xiolink.com May be saved for future reference: http://www.spamcop.net/sc?id=z6193526037z09bcbf8ca61934833a230d5cac9df43dz Processing spam: From: kateli...@trouts.org Subject: Fw: new message 0: Received: from huey.classiccmp.org ([199.188.211.196]:34299) by biz170.inmotionhosting.com with esmtp (Exim 4.85) (envelope-from <cctalk-boun...@classiccmp.org>) id 1Zx1J4-002O8P-9m for lbick...@bickleywest.com; Thu, 12 Nov 2015 15:29:30 -0800 Hostname verified: huey.classiccmp.org inmotionhosting.com received mail from sending system 199.188.211.196 1: Received: from huey.classiccmp.org (localhost [127.0.0.1]) by huey.classiccmp.org (Postfix) with ESMTP id 6C13E2073F84; Thu, 12 Nov 2015 17:29:29 -0600 (CST) Internal handoff or trivial forgery 2: Received: from mx1.ezwind.net (unknown [172.20.1.26]) by huey.classiccmp.org (Postfix) with ESMTP id E9D542073F6B for <cctalk@classiccmp.org>; Thu, 12 Nov 2015 17:29:27 -0600 (CST) Internal handoff or trivial forgery 3: Received: from mx1.ezwind.net (localhost [127.0.0.1]) by mx1.ezwind.net (Postfix) with ESMTP id 974C34E743 for <cctalk@classiccmp.org>; Thu, 12 Nov 2015 17:29:28 -0600 (CST) Internal handoff or trivial forgery 4: Received: from eu1.nethat.com (eu1.nethat.com [81.223.254.166]) by mx1.ezwind.net (Postfix) with ESMTP id 247FF4E718 for <cctalk@classiccmp.org>; Thu, 12 Nov 2015 17:29:27 -0600 (CST) Hostname verified: eu1.nethat.com warning:Possible forgery. Supposed receiving system not associated with any of your mailhosts Will not trust this Received line. Tracking message source:199.188.211.196: Cached whois for 199.188.211.196 : n...@xiolink.com Using abuse net on n...@xiolink.com abuse net xiolink.com = ab...@xiolink.com Using best contacts ab...@xiolink.com warning:Yum, this spam is fresh! Message is 0 hours old 199.188.211.196 not listed in cbl.abuseat.org 199.188.211.196 not listed in dnsbl.sorbs.net Spam report id 6380971843 sent to: ab...@xiolink.com -------------------------------------- Cheers, Lyle -- 73 AF6WS Bickley Consulting West Inc. http://bickleywest.com "Black holes are where God is dividing by zero"
