Re: email header analysis

["Peter H. Coffin" <hellsop@ninehells.com>]

On Fri, Sep 12, 2003 at 03:34:35PM -0500, Jay Moore wrote:
> In some spam I received, I found the following header: 
> 
> --------------------------------------
> Received: from 57-112.hspg-b3.cablelynx.com
> (57-112.hspg-b3.cablelynx.com [24.204.57.112])
>         by kingcull.cullmail.com (8.12.9/8.12.9) with SMTP id
> h8CJvFi2029627;
>         Fri, 12 Sep 2003 14:57:17 -0500 (CDT)
> Received: from (HELO yxe5tru) [221.96.194.116]
>         by 57-112.hspg-b3.cablelynx.com;
>         Fri, 12 Sep 2003 19:56:12 -0100
> --------------------------------------
> 
> Which is the _real_ spammer? or, are both real spammers, or open
> relays, or something else I should block? 

The second line looks bogus, but that doesn't matter much. The first one
is where you got the email from, and it doesn't much matter if you don't
want email from them because they're spammers, or if you don't want
email from them because their an open relay. Either option says you
don't want email from them.

-- 
I love ASR, you have total freedom of speech as long as it's punctuated
correctly.		    -- Chris Hacking in a.s.r