On 3/29/06, <b class="gmail_sendername">Peter Corlett</b> <<a href="mailto:abuse@cabal.org.uk">abuse@cabal.org.uk</a>> wrote:<div><span class="gmail_quote"></span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br>[I'm wearing my personal hat here.]<br><br>I'm getting a *flood* of spam coming in from Yahoo! mailservers, both to my<br>personal and work addresses. It seems that Yahoo! don't care. Here's the<br>response to me piping a sample one through Spamcop:
<br><br> <a href="http://abuse.mooli.org.uk/yahoospam">http://abuse.mooli.org.uk/yahoospam</a><br><br>Yahoo claim "After investigation, we have determined that this email message<br>did not originate from the Yahoo! Mail system. It appears that the sender of
<br>this message forged the header information to give the impression that it<br>came from the Yahoo! Mail system."<br><br>The spam headers claim otherwise:<br><br>Received: from <a href="http://mrout3.yahoo.com">mrout3.yahoo.com
</a> ([<a href="http://216.145.54.173">216.145.54.173</a>])<br> by <a href="http://relay-1.mail.uksolutions.net">relay-1.mail.uksolutions.net</a> with esmtp (Exim 4.50)<br> id 1FJbCW-0002Ag-IV<br> for
<a href="mailto:sales@uksolutions.co.uk">sales@uksolutions.co.uk</a>; Wed, 15 Mar 2006 18:58:29 +0000<br><br>As does DNS and whois:<br><br>abuse@mooli:~$ host <a href="http://216.145.54.173">216.145.54.173</a><br>173.54.145.216.in-addr.arpa
domain name pointer <a href="http://mrout3.yahoo.com">mrout3.yahoo.com</a>.<br>abuse@mooli:~$ host <a href="http://mrout3.yahoo.com">mrout3.yahoo.com</a><br><a href="http://mrout3.yahoo.com">mrout3.yahoo.com</a> has address
<a href="http://216.145.54.173">216.145.54.173</a><br>abuse@mooli:~$ whois <a href="http://216.145.54.173">216.145.54.173</a><br><br>OrgName: Yahoo! Inc.<br>OrgID: YAHOOI-2<br>Address: 701 First Avenue<br>City: Sunnyvale
<br>StateProv: CA<br>PostalCode: 94089<br>Country: US<br>[etc]<br><br>Doing double-DNS lookups of the IP addresses on other spams also give<br><a href="http://yahoo.com">yahoo.com</a> hostnames, and they're typically in DNSBLs for being sources of
<br>spam and a useless abuse address.<br><br>So, which IP blocks shall I null-route then? Or is there anybody here from<br>Yahoo! with a clue? (OK, you can all stop laughing now.)</blockquote><div><br>Ewww. <a href="http://p4pnet.net">
p4pnet.net</a> is part of a company Yahoo acquired that is still in the<br>process of being integrated. :(<br><br>Personally, I'd just null-route the blocks--I'm sure it'll decrease the load<br>on the Internet as a whole while Yahoo works on trying to clean up their
<br>acquisitions. Of course, that's me speaking for myself, and not in any<br>way shape or form speaking for my employer. ^_^;;<br><br>There are spam clueful people at Yahoo from the NANAE and anti-spam<br>communities--when stuff like this shows up in public forums, it does get
<br>noticed and passed along. I agree, it would be better if it could garner<br>the right level of attention without being called out in public forums like <br>this, though.<br><br>Matt<br></div><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
--<br>PGP key ID E85DC776 - finger <a href="mailto:abuse@mooli.org.uk">abuse@mooli.org.uk</a> for full key<br></blockquote></div><br>