On Sun, 06 Mar 2011 22:32:02 +0100 Karsten Bräckelmann <guent...@rudersport.de> wrote:
> On Sun, 2011-03-06 at 12:48 -0800, JP Kelly wrote: > > I'm not familiar enough to tell if an address is forged or not. > > Here is the scoring from one of the spam messages from > > autoconf...@amazon.com which I suspect tainted AWL: > > Nope. The originating IP isn't even close to the Amazon net-block, let > alone in the same /16. Unless the AWL has changed, it's based on the first non-private IP address, which is usually not trustworthy and in this case is a forged amazon address. I haven't checked recently, there was some talk of changing it to the first trusted address. Either nothing happened or this is an old SA version.
