Have Yahoo! gone pink?
abuse at cabal.org.uk
Wed Mar 29 21:28:26 UTC 2006
[I'm wearing my personal hat here.]
I'm getting a *flood* of spam coming in from Yahoo! mailservers, both to my
personal and work addresses. It seems that Yahoo! don't care. Here's the
response to me piping a sample one through Spamcop:
Yahoo claim "After investigation, we have determined that this email message
did not originate from the Yahoo! Mail system. It appears that the sender of
this message forged the header information to give the impression that it
came from the Yahoo! Mail system."
The spam headers claim otherwise:
Received: from mrout3.yahoo.com ([220.127.116.11])
by relay-1.mail.uksolutions.net with esmtp (Exim 4.50)
for sales at uksolutions.co.uk; Wed, 15 Mar 2006 18:58:29 +0000
As does DNS and whois:
abuse at mooli:~$ host 18.104.22.168
22.214.171.124.in-addr.arpa domain name pointer mrout3.yahoo.com.
abuse at mooli:~$ host mrout3.yahoo.com
mrout3.yahoo.com has address 126.96.36.199
abuse at mooli:~$ whois 188.8.131.52
OrgName: Yahoo! Inc.
Address: 701 First Avenue
Doing double-DNS lookups of the IP addresses on other spams also give
yahoo.com hostnames, and they're typically in DNSBLs for being sources of
spam and a useless abuse address.
So, which IP blocks shall I null-route then? Or is there anybody here from
Yahoo! with a clue? (OK, you can all stop laughing now.)
PGP key ID E85DC776 - finger abuse at mooli.org.uk for full key
More information about the NANOG