From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from orthanc.ca ([208.79.93.154]) by ewsd; Sat Oct  3 20:32:37 -0400 2020
Received: from orthanc.ca (localhost [127.0.0.1])
	by orthanc.ca (OpenSMTPD) with ESMTP id 273f1eb0
	for <9front@9front.org>;
	Sat, 3 Oct 2020 17:32:36 -0700 (PDT)
From: Lyndon Nerenberg <lyndon@orthanc.ca>
To: 9front@9front.org
Subject: Re: [9front] =?utf-8?q?=E2=80=9Cempty=E2=80=9D_mail_(possible_unimportant_bug)?=
In-reply-to: <4A046B5D379ACFB93A9E1CC27944A9A9@sirjofri.de>
References: <4A046B5D379ACFB93A9E1CC27944A9A9@sirjofri.de>
Comments: In-reply-to sirjofri+ml-9front@sirjofri.de
   message dated "Fri, 02 Oct 2020 12:16:30 +0200."
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <74084.1601771556.1@orthanc.ca>
Content-Transfer-Encoding: quoted-printable
Date: Sat, 03 Oct 2020 17:32:36 -0700
Message-ID: <c304517acee6fe65@orthanc.ca>
List-ID: <9front.9front.org>
List-Help: <http://lists.9front.org>
X-Glyph: ➈
X-Bullshit: managed map/reduce-oriented ACPI over WEB2.0 browser-scale general-purpose-based controller 

sirjofri+ml-9front@sirjofri.de writes:

>  From gmail.com!koepketemi17ixibs Fri Oct  2 11:16:06 CES 2020
> Received: from gmail.com ([104.148.61.185]) by oat; Fri Oct  2 11:16:06 =
CES 2
> 020

That IP address has no reverse DNS.  Whois says the enclosing /24
belongs to:

  WebXury Inc WEBXURY-INC (NET-104-148-61-0-1) 104.148.61.0 - 104.148.61.2=
55

The "gmail.com" part of the Received header is what the client
supplied in the EHLO command, and is obviously bogus.

This is almost certainly a spammer validating RCPT TO addresses.  Or one
with very buggy client software.

--lyndon