Detecting Fake Relay Lines

Bad news: many spam reporting tools now ignored by ISPs due to this

Good news: Legit mail never fakes Received headers, so this is a spam signature

    Received: from [230.236.26.15] by 24.160.77.125 (Postfix) with esmtp (Exim 3.33 #1) id 4920847; Thu, 16 Sep 2004 13:23:00 -0500

No mailserver calls itself by an IP address!

SpamAssassin 3.0.0: RCVD_DOUBLE_IP_SPAM