SpamCop Discussion > No IP-address, cannot report

Full Version: No IP-address, cannot report

SpamCop Discussion > Discussions & Observations > SpamCop Reporting Help

Oriolus

Jul 30 2008, 06:49 AM

HI,
If I send a number of spams to my reporting address, sometimes one of the spams result in a message "No IP-address, cannot report", or something like that.
My problem is then that I would be willing to retry to report the spam, but there is no reference what so ever with the error message, by which I could find the original spam-mail between the lot that I reported in one bunch.
Is there a way to get something recognizable in the error message, so that I can pick the culprit out of the bunch and report it "by hand"?
TIA, Oriolus

The exact messages are:
No source IP address found, cannot proceed.
and:
Nothing to do.

dbiel

Jul 30 2008, 07:43 AM

Topic moved from > How to use .... Instructions, Tutorials > SpamCop Reporting to SpamCop Reporting Help
PM sent to inform poster of the move

Note: to provide help we need to know what method of reporting you are doing.
Quick Reporting?
And how you are submitting them.
Forward as attachment multiple at a time?

Farelf

Jul 30 2008, 07:56 AM

QUOTE(Oriolus @ Jul 30 2008, 07:49 PM)

You don't have SpamAssassin (set to "rewrite/enclose" in dealing with the headers) running somewhere in your message chain do you? Anyway, all I could suggest is "View recent reports" (via "Past Reports" tab) - if that spam was "nothing to do" then I guess nothing will be shown in there but all the others will be - with their subjects shown. So, it's a process of elimination. Pretty tedious but there will be a CAUSE of those "nothing to do" cases and you should be able to find and eliminate it - so you are not actually faced with this as a continuing process.

Oriolus

Jul 30 2008, 08:17 AM

QUOTE(dbiel @ Jul 30 2008, 02:43 PM)

Note: to provide help we need to know what method of reporting you are doing.
Quick Reporting?
And how you are submitting them.
Forward as attachment multiple at a time?

I compose a new mail addressed to my private SpamCop-address and move one or more spams into the body of this new mail (I use Outlook 2007) and press the send button. The spams will be attachments to a mail that lacks a subject line and a body.
After a while I go to http://www.spamcop.net/ and wait until I see that reports are awaiting to be sent.
If I would count every reported spam, I would be able to find back the one that didn't work, OK, but that is tedious, as you say, Farelf, but if I know which one it was and report it in the one-by-one way via the Outlook workaround form, it gets through alright. So there was nothing wrong with the spam itself, but (maybe) with the way it's offered to SpamCop.
I don't know what SpamAssassin is, so I think I don't have it

CODE

SpamCop v 2 Copyright (C) 1998-2006, IronPort Systems, Inc. All rights reserved.
Here is your TRACKING URL - it may be saved for future reference:
http://www.spamcop.net/sc?id=z2110026233zb7541dcdc7d5af608c18b68153fcbf23z
No source IP address found, cannot proceed.
Add/edit your mailhost configuration
Finding full email headers
Submitting spam via email (may work better)
Example: What spam headers should look like
Nothing to do.

Can I recall the sender or subject line from this information?
Thanks

Wazoo

Jul 30 2008, 11:06 AM

QUOTE(Oriolus @ Jul 30 2008, 08:17 AM)

Can I recall the sender or subject line from this information?

The term Tracking URL is defined in the Dictionary, the Glossary, has entries in the single-page-access-expanded SpamCop FAQ found 'here', it has entries in the SpamCop Wiki .. has been referenced countless thosuands of times within this Forum structure ... and is offered in your provided snippet along with the detail of:

CODE

Here is your TRACKING URL - it may be saved for future reference:
http://www.spamcop.net/sc?id=z2110026233zb7541dcdc7d5af608c18b68153fcbf23z

What exactly is missing in your experience that following this link does not provide you with the data you say you can't find?

Oriolus

Jul 30 2008, 11:15 AM

QUOTE(Wazoo @ Jul 30 2008, 06:06 PM)

What exactly is missing in your experience that following this link does not provide you with the data you say you can't find?

If I click at the link mentioned:
http://www.spamcop.net/sc?id=z2110026233zb...18b68153fcbf23z
I get exactly the same window, as if I didn't click at the link...

CODE

SpamCop v 2 Copyright (C) 1998-2006, IronPort Systems, Inc. All rights reserved.
Here is your TRACKING URL - it may be saved for future reference:
http://www.spamcop.net/sc?id=z2110026233zb7541dcdc7d5af608c18b68153fcbf23z
No source IP address found, cannot proceed.
Add/edit your mailhost configuration
Finding full email headers
Submitting spam via email (may work better)
Example: What spam headers should look like
Nothing to do.
Report another spam?
Welcome, Oriolus.
Your average reporting time is: 4 hours; Great!

Add fuel to your account
Please help support this service - buy some reporting fuel today. Fuel is used as you report spam to bypass the nag screen.

Forward your spam to: xxx or:
Paste headers and optionally mime separators in first box:

Paste decoded email body in second box:

Show technical details

Select all-in-one submission form

So it doesn't give me any more information than I knew already.
Or did I do something wrong?

Telarin

Jul 30 2008, 11:26 AM

Hmm, when I go to the tracking URL, the parse details come up just fine. Specifically, one line stand out:

CODE

0: Received: from [83.10.122.98] by mail.wisecontrol.com; Wed, 30 Jul 2008 13:17:32 +0100
Hostname verified: aclu98.neoplus.adsl.tpnet.pl

Possible forgery. Supposed receiving system not associated with any of your mailhosts
Will not trust anything beyond this header

No source IP address found, cannot proceed.

This may indicate a mailhost configuration problem.

Oriolus

Jul 30 2008, 11:30 AM

QUOTE(Telarin @ Jul 30 2008, 06:26 PM)

Hmm, when I go to the tracking URL, the parse details come up just fine.
This may indicate a mailhost configuration problem.

Also, if I report it (if I find the right one) in the Outlook/Eudora workaround form?
Because just then all things go well...

Wazoo

Jul 30 2008, 11:43 AM

First of all, you have exposed your 'secret' reporting address in your recent post. One FAQ entry 'here' is Password Problems, Two different password solutions.

For the parse-result page, I'm suggesting that you either use the checkboxes provided or go into your Prefences on your logged-in ww.spamcop.net web-page and turn on Full/Technical Details. I saw the same results that Telarin saw .... there appears to a be an issue with the MailHost Configuration of your Reporting Account .. which is another whole subject, another Forum section.

Looking at it further, I'd say that those headers are a mess. I'd have to state that if your pasting into the web-form allegedly works, there is a significant difference between what you are selecting to paste in as compared to what you are including in the e-mail'd submission. Once again, the Tracking URLs of a set of corresponding submittal attempts might show the difference, but only you can provide that data.

Oriolus

Jul 30 2008, 11:58 AM

QUOTE(Wazoo @ Jul 30 2008, 06:43 PM)

First of all, you have exposed your 'secret' reporting address in your recent post.

Thank you Wazoo, I changed it, if not too late...

QUOTE(Wazoo @ Jul 30 2008, 06:43 PM)

Looking at it further, I'd say that those headers are a mess. I'd have to state that if your pasting into the web-form allegedly works, there is a significant difference between what you are selecting to paste in as compared to what you are including in the e-mail'd submission. Once again, the Tracking URLs of a set of corresponding submittal attempts might show the difference, but only you can provide that data.

I'll check the Technical details box and see what are the differences, if I get a next opportunity

StevenUnderwood

Jul 30 2008, 12:09 PM

QUOTE(Telarin @ Jul 30 2008, 12:26 PM)

Hmm, when I go to the tracking URL, the parse details come up just fine. Specifically, one line stand out:

In addition, above that area is a section showing the actual headers it is working on, including:

QUOTE

From: "Joanne Cullen" <dwwisecontrolm[at]wisecontrol.com>
To: <x>
Subject: Bring back time when girls were yours.

I assume you do not have "Show technical details" configured for your reporting. That MAY be why others see more than you do. Trick is, you need to process a new spam with that setting to make it stick.

Oriolus

Jul 30 2008, 12:29 PM

Yes, I recognize that one as one in my spam-folder. Thanks for the clue!

QUOTE(StevenUnderwood @ Jul 30 2008, 07:09 PM)

I knew about the way the sticky check box. I changed the settings for my whole account, though, and I'll check the differences between the two ways of reporting. You'll hear from me.

QUOTE(Oriolus @ Jul 30 2008, 06:58 PM)

Thank you Wazoo, I changed it, if not too late...
I'll check the Technical details box and see what are the differences, if I get a next opportunity

Here is what I found in the Outlook workaround way (just a part that may make things clear?)

CODE

Parsing header:
0: Received: from zajda-t9ddi3b8n (aclu98.neoplus.adsl.tpnet.pl [83.10.122.98]) by mwinf6603.online.nl (SMTP Server) with ESMTP id 252481C00091; Wed, 30 Jul 2008 14:17:29 +0200 (CEST)
Hostname verified: aclu98.neoplus.adsl.tpnet.pl
orange.nl received mail from sending system 83.10.122.98

1: Received: from [83.10.122.98] by mail.wisecontrol.com; Wed, 30 Jul 2008 13:17:32 +0100
Hostname verified: aclu98.neoplus.adsl.tpnet.pl
Possible forgery. Supposed receiving system not associated with any of your mailhosts
Will not trust anything beyond this header

Sounds not very promising...
If more info is wanted, I'm glad to provide it.

Wazoo

Jul 30 2008, 12:39 PM

QUOTE(Oriolus @ Jul 30 2008, 12:29 PM)

Sounds not very promising...
If more info is wanted, I'm glad to provide it.

If that last bit of data was in fact the 'same' spam as seen in the Tracking URL initially provided, it would appear not to be the same spam ...yet, the IP Address 'complained' about is the same IP Address, which would tend to point to a MailHost Configuration issue.

However, no way I can tell from this side of the screen if it's an Outlook issue or a 'handling' issue in creating your submittal contents for the different submittal actions.

Oriolus

Jul 30 2008, 12:46 PM

QUOTE(Oriolus @ Jul 30 2008, 07:29 PM)

Yes, I recognize that one as one in my spam-folder. Thanks for the clue!

I knew about the way the sticky check box. I changed the settings for my whole account, though, and I'll check the differences between the two ways of reporting. You'll hear from me.
Here is what I found in the Outlook workaround way (just a part that may make things clear?)

CODE

Sounds not very promising...
If more info is wanted, I'm glad to provide it.

This is from the one that went wrong:

CODE

Parsing header:
0: Received: from [83.10.122.98] by mail.wisecontrol.com; Wed, 30 Jul 2008 13:17:32 +0100
Hostname verified: aclu98.neoplus.adsl.tpnet.pl
Possible forgery. Supposed receiving system not associated with any of your mailhosts
Will not trust anything beyond this header
No source IP address found, cannot proceed.
Add/edit your mailhost configuration
Finding full email headers
Submitting spam via email (may work better)
Example: What spam headers should look like
Nothing to do.

This makes sense indeed.

Would you like to see the original spam mail?

BTW, things are getting mixed up, sorry.

QUOTE(Wazoo @ Jul 30 2008, 07:39 PM)

Would the original spam mail make sense?

StevenUnderwood

Jul 30 2008, 12:57 PM

QUOTE(Oriolus @ Jul 30 2008, 01:46 PM)

Would the original spam mail make sense?

No, the original spam will not help us unless we could see it still in your mail account. We get enough spam on our own.

Is mail.wisecontrol.com a new ISP for your messages to travel through? Any changes in how you receive email need to be updated in Mailhost.

Have you already configured mailhosts for that ISP? They may have changed servers since that point and need to be reconfigured.

Oriolus

Jul 30 2008, 01:09 PM

QUOTE(StevenUnderwood @ Jul 30 2008, 07:57 PM)

No, the original spam will not help us unless we could see it still in your mail account. We get enough spam on our own.

Funny

QUOTE(StevenUnderwood @ Jul 30 2008, 07:57 PM)

Is mail.wisecontrol.com a new ISP for your messages to travel through? Any changes in how you receive email need to be updated in Mailhost.

mail.wisecontrol.com has, as far as I know, nothing to do with my ISP.

QUOTE(StevenUnderwood @ Jul 30 2008, 07:57 PM)

Have you already configured mailhosts for that ISP? They may have changed servers since that point and need to be reconfigured.

I should not do that, if I understand well...

QUOTE(StevenUnderwood @ Jul 30 2008, 07:57 PM)

Is mail.wisecontrol.com a new ISP for your messages to travel through? Any changes in how you receive email need to be updated in Mailhost.

According to Mcafee's SiteAdvisor, wisecontrol.com seems to be a trustable Korean site with lots of clients:
http://www.siteadvisor.com/sites/wisecontrol.com/summary/
But maybe this is not the way of checking trustability of sites...

StevenUnderwood

Jul 30 2008, 01:29 PM

QUOTE(Oriolus @ Jul 30 2008, 02:02 PM)

mail.wisecontrol.com has, as far as I know, nothing to do with my ISP.

OK... One step at a time. Here are the headers from the tracking URL you provided earlier:

CODE

Received: from me-wanadoo.net (localhost [127.0.0.1])
by mwinf6603.online.nl (SMTP Server) with ESMTP id DFF0D1C00099;
Wed, 30 Jul 2008 14:17:30 +0200 (CEST)

It looks like Online.nl is your ISP and this is an internal transfer on that machine (AV scans do this, or some other reason).

CODE

Received: from mwinf6603.online.nl (mwinf6603.online.nl)
by mwinb6006 (SMTP Server) with LMTP; Wed, 30 Jul 2008 14:17:30 +0200

Here the mwinb6006 server should have be stating the IP address of the machine it is recieving from. Looking at the hostname, it could be internal to online.nl OR the hostname is (more likely) forged, which is why the IP address is needed. Both to these headers would be ignored since no IP address is provided. This is likely the line needed to be fixed and my bet is this is where the messages gets to your ISP.

CODE

Received: from [83.10.122.98] by mail.wisecontrol.com; Wed, 30 Jul 2008 13:17:32 +0100

This is the first header that says where it came from, but could be forged. If it is a valid header, the previous header should have indicated receiving the message from 221.139.3.226 which is the lookup of mail.wisecontrol.com

CODE

Received: from zajda-t9ddi3b8n (aclu98.neoplus.adsl.tpnet.pl [83.10.122.98])
by mwinf6603.online.nl (SMTP Server) with ESMTP id 252481C00091;
Wed, 30 Jul 2008 14:17:29 +0200 (CEST)

Likely forged as it has the same names/IP's as the headers above it.

Other possibilities... there are headers missing from this group or they are out of order.

Oriolus

Jul 30 2008, 02:20 PM

QUOTE(StevenUnderwood @ Jul 30 2008, 08:29 PM)

OK... One step at a time. Here are the headers from the tracking URL you provided earlier:

CODE

Received: from me-wanadoo.net (localhost [127.0.0.1])
by mwinf6603.online.nl (SMTP Server) with ESMTP id DFF0D1C00099;
Wed, 30 Jul 2008 14:17:30 +0200 (CEST)

It looks like Online.nl is your ISP and this is an internal transfer on that machine (AV scans do this, or some other reason).

CODE

Received: from mwinf6603.online.nl (mwinf6603.online.nl)
by mwinb6006 (SMTP Server) with LMTP; Wed, 30 Jul 2008 14:17:30 +0200

To clear up possible dark things:
Wanadoo.nl was bought by orange (maybe not in this spam here), but orange.nl was in turn bought by online.nl, and this story probably goes for all of them, not only .nl, but .fr and .be and others.
So, what I probably have to do, if I understan well, is to introduce online.nl (and maybe orange.nl as well) as legal isp-adresses for my accounts.

But this might not solve the problem with wisecontrol.com which resides in Korea, and has probably nothing to do with online.nl as far as I heard of, but maybe I should ask that with the helpdesk of online.nl?

QUOTE(StevenUnderwood @ Jul 30 2008, 08:29 PM)

CODE

Received: from [83.10.122.98] by mail.wisecontrol.com; Wed, 30 Jul 2008 13:17:32 +0100

CODE

Received: from zajda-t9ddi3b8n (aclu98.neoplus.adsl.tpnet.pl [83.10.122.98])
by mwinf6603.online.nl (SMTP Server) with ESMTP id 252481C00091;
Wed, 30 Jul 2008 14:17:29 +0200 (CEST)

Likely forged as it has the same names/IP's as the headers above it.

Other possibilities... there are headers missing from this group or they are out of order.

Sorry, but I only try to understand what you are explaining to me. I get lost at the place where you suspect forgery.

Would it help if I send to you the headers of an email that you sent to me? Would that distinguish ISP-related addresses from others?

The reason why I prefer to bulk send spams rather than via the Outlook workaround way, is that I need not disclose the message body when sending bulk, whereas I have to, to be able to send the html-code (if I can get hold of it: sometimes I'm not!).

StevenUnderwood

Jul 30 2008, 02:41 PM

QUOTE(Oriolus @ Jul 30 2008, 03:20 PM)

Would it help if I send to you the headers of an email that you sent to me? Would that distinguish ISP-related addresses from others?

That could help, you can send me an email to underwood+forum[at]spamcop.net and put "Forum Test" in the subject so I won't accidentally report you. I will reply to that and you can then either reply back to me with my message attached (like you do to submit your spam to spamcop) or submit the message for reporting (submit.... not quick...) and post the resulting reporting URL here. Please do not report my message

I have a feeling you are going to need to do the MailHost again for Wanadoo but I think it will fail if the headers are as you are showing them, meaning they need to fix the headers first. The email test will hopefully determine that.

Oriolus

Jul 30 2008, 03:10 PM

QUOTE(StevenUnderwood @ Jul 30 2008, 09:41 PM)

Just to be sure: I mailed you

StevenUnderwood

Jul 30 2008, 06:45 PM

QUOTE(Oriolus @ Jul 30 2008, 04:10 PM)

Just to be sure: I mailed you

For completeness, here is the reporting URL for the headers you are sending out. Your address has been munged for extra protection.

http://www.spamcop.net/sc?id=z2111389372z5...58644299b36a22z

To answer the question in the email... ultimately, you will need to do both (if the headers prove to be the issue) getting the headers fixed and making sure that the new relationship is showing in mailhost... but the headers will not be working correctly in order to complete the mailhost config.

At this point, unless you are carefully checking your reports, you may not want to use quick reporting until this is straightened out. You could be reporting incorrect sources.

The TrackingURL from my message to you: http://www.spamcop.net/sc?id=z2112364329z5...fd3e546a1f62e2z

Could someone verify what I think is headers in the wrong order even though the parse turns out correct in this case. Below is what I would expect the headers to look like. The number is the order from the parser.

CODE

5.Received: from mwinf6301.online.nl (mwinf6301.online.nl)
    by mwinb6006 (SMTP Server) with LMTP; Thu, 31 Jul 2008 01:41:59 +0200
2.Received: from me-wanadoo.net (localhost [127.0.0.1])
    by mwinf6301.online.nl (SMTP Server) with ESMTP id 95E835C0008B
    for <x>; Thu, 31 Jul 2008 01:41:59 +0200 (CEST)
1.Received: from c60.cesmail.net (c60.cesmail.net [216.154.195.49])
    by mwinf6301.online.nl (SMTP Server) with ESMTP id 4F0035C00088
    for <x>; Thu, 31 Jul 2008 01:41:59 +0200 (CEST)
4.Received: from unknown (HELO relay.cesmail.net) ([192.168.1.81])
  by c60.cesmail.net with ESMTP; 30 Jul 2008 19:41:58 -0400
3.Received: from SUnderwoodL (68-116-173-51.dhcp.oxfr.ma.charter.com [68.116.173.51])
    by relay.cesmail.net (Postfix) with ESMTP id DDFFF618F22
    for <x>; Wed, 30 Jul 2008 19:41:57 -0400 (EDT)

I am working on getting hte same headers from my work account (sent the same message to work) to compare because even one of the cesmail headers seems out of order As I thought... when my Exchange server receives this same message, the SpamCop headers are in the order I would expect: http://www.spamcop.net/sc?id=z2112702203z0...fba09b0b6ebd4bz

CODE

Received:  from psmtp.com ([64.18.1.116]) by CENTMAIL.carroll-ent.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 31 Jul 2008 07:35:37 -0400
Received:  from source ([216.154.195.49]) (using TLSv1) by exprod6mx216.postini.com ([64.18.5.10]) with SMTP; Thu, 31 Jul 2008 07:35:32 EDT
Received:  from unknown (HELO relay.cesmail.net) ([192.168.1.81])  by c60.cesmail.net with ESMTP; 31 Jul 2008 07:35:32 -0400
Received:  from SUnderwoodL (68-116-173-51.dhcp.oxfr.ma.charter.com [68.116.173.51]) by relay.cesmail.net (Postfix) with ESMTP id D5032618F22 for <x>; Thu, 31 Jul 2008  07:35:31 -0400 (EDT)

StevenUnderwood

Jul 31 2008, 10:55 AM

I just received your report about Outlook workaround: http://www.spamcop.net/sc?id=z2112355099zc...c7cf58f8db7d82z

Those headers look as I would expect... so it appears something is going on with HOW you are submitting these that is messing with the headers.

Can you explain again, step by step, how you prepare the spams to email for submittal?
Are you using any 3rd party program to do this?

The message I submitted for the last test in my previous post was from Outlook 2003 with an Exchange v6.5 server. I have my forwarding options on one machine set to always "Foward as Attachment" and the headers stayed as shown, similiar to your "Exchange workaround" which if I recall is you pasting into the web page.

Even without that configuration, if you select more than one message and hit forward, the messages are attached (for me) showing the same order for the headers (I just tested).

BTW, one of your messages seemed to indicate you thought I have the ability to change your mailhost configuration. I am simply another user of SpamCop. You would need to contact the deputies directly if the standard method (through the web page) does not work, but I would not feel comfortable until we solve the "roaming headers" issue.

Oriolus

Jul 31 2008, 12:40 PM

QUOTE(StevenUnderwood @ Jul 31 2008, 05:55 PM)

Can you explain again, step by step, how you prepare the spams to email for submittal?
Are you using any 3rd party program to do this?

1. The 'normal' way, not sending a number of spams in bulk, but via the Outlook/Eudora workaround way:
I find a spam in my Unwanted e-mails-folder (U-folder);
I move that mail to a folder where the body is displayed in a pane under the pane where sender's name and subject line are displayed;
I click right at the line in the upper pane with name and subject line and select from the roll down menu (translated) Message options, at which I get a window with what I would call the headers of that mail;
I select all in that window and copy selected, i.e. Ctrl-A, Crtl-C;
I switch to the SpamCop reporting site http://www.spamcop.net/sc, where we see: Report another spam? and the two panes for the workaround method:
Paste headers and optionally mime separators in first box:
<empty box 1>
Paste decoded email body in second box:
<empty box 2>
I paste what I copied into box 1 and observe what kind of message body I have to expect: text/plain, which means that I can copy the message body strait away, or differently, which means that I have to extract the body's HTML-code;
If it is differently (the second possibility: not text/plain) I almost always get the HTML-code with some effort and paste it into box 2. If I don't succeed getting the code, I copy the body as text, paste it into box 2, and apologize for not succeeding in getting the body in the right way into box 2 by means of a note that goes together with the report;
So, I report what's in box 1 and 2;
I move the spam mail from the folder to one where I keep reported spams for a while.
BTW In this way I have to more or less 'open' the spam's body which I hate.
2. The bulk way:
I have collected an amount of spams in my U-folder;
I select New Mail and select my SpamCop-reporting e-mail-address in the To:-field;
I click on the first spam in the U-folder. With Shift held, I click on the last spam in that folder. Holding down the mouse button I drag in this way all selected spams into the message pane of my New Mail;
I click on Send;
I wait a while until my reporting pane will show Unreported spam Saved: Report Now?;
=>I click the blue Report Now? and I get the (next) report to be reported;
I click the Send spam Report(s) Now-button and go back in this description to => until there is nothing more to report. ( OT: I don't get the word spam with a starting capital, very odd! )
BTW In this way I need not open any mail, so there will go no message (no matter how) back to the spammer or to some other sneaky place, where the spammer knows something more about me or gets his money for his deed.
I hope this is elaborate enough to find possible faulty actions of mine

QUOTE(StevenUnderwood @ Jul 31 2008, 05:55 PM)

The message I submitted for the last test in my previous post was from Outlook 2003 with an Exchange v6.5 server. I have my forwarding options on one machine set to always "Foward as Attachment" and the headers stayed as shown, similiar to your "Exchange workaround" which if I recall is you pasting into the web page.

I cannot find the way how to change the forwarding setting (I wouldn't like it standard like that, though), but, as described the effect is the same: by dragging them into the new mail, they appear as attachments.

QUOTE(StevenUnderwood @ Jul 31 2008, 05:55 PM)

Even without that configuration, if you select more than one message and hit forward, the messages are attached (for me) showing the same order for the headers (I just tested).

I don't forward my spams, I send them as attachments in a New Mail. Is that actually what's the thing that makes the headers get out of order? I wouldn't know, however, how to forward more than one mail; selecting (like I do to move them to my New Mail) an then press Forward (if possible, and what happens then?)?

QUOTE(StevenUnderwood @ Jul 31 2008, 05:55 PM)

BTW, one of your messages seemed to indicate you thought I have the ability to change your mailhost configuration. I am simply another user of SpamCop. You would need to contact the deputies directly if the standard method (through the web page) does not work, but I would not feel comfortable until we solve the "roaming headers" issue.

No, I was not expecting you to clear up my Mailhosts settings, I was thinking that you could peep into them, but that's not true, as I understand now.

Pff, that was a story! I hope you are not bored by now!

StevenUnderwood

Jul 31 2008, 10:23 PM

QUOTE(Oriolus @ Jul 31 2008, 01:40 PM)

I wouldn't know, however, how to forward more than one mail; selecting (like I do to move them to my New Mail) an then press Forward (if possible, and what happens then?)?

That is exactly what you could do... that will open a new message with all of the selected spams attached. Then you simply address it and send it off like you currently do. In theory, this SHOULD produce the same headers as what you are doing (I do it your way from time to time as well and never noticed any issues) but what you are doing also SHOULD be producing the same header order for both of the methods you described. Your examples above show that is not happening.

I am away for the weekend on dialup (checking nights only). I hope someone else can pick this up and help in my absense. The next question I would ask is what version of Outlook are you using and how are you getting your messages from your ISP's server (Exchange, IMAP, POP, etc). All of my examples have been with Microsoft Office Outlook 2003 (11.8206.8202) SP3 connected to Exchange v6.5 from either Windows XP SP3 or Windows 2003 Server R2 SP2.

Oriolus

Aug 1 2008, 05:45 AM

QUOTE(StevenUnderwood @ Aug 1 2008, 05:23 AM)

The next question I would ask is what version of Outlook are you using and how are you getting your messages from your ISP's server (Exchange, IMAP, POP, etc). All of my examples have been with Microsoft Office Outlook 2003 (11.8206.8202) SP3 connected to Exchange v6.5 from either Windows XP SP3 or Windows 2003 Server R2 SP2.

I did see you mentioning (as I thought) that you were using Outlook 2003, but now I read this sentence, it was meant for me to answer (language

...).
I use Outlook 2007 (12.0.6316.5000) SP1 MSO (12.0.6213.1000) MS Office Prof, under Vista Home Premium SP1. My ISP asks me to use POP3.
I hope this is precise enough.

StevenUnderwood

Aug 1 2008, 10:31 PM

QUOTE(Oriolus @ Aug 1 2008, 06:45 AM)

I use Outlook 2007 (12.0.6316.5000) SP1 MSO (12.0.6213.1000) MS Office Prof, under Vista Home Premium SP1. My ISP asks me to use POP3.

A co-worker has Outlook 2007 installed.... If this is still an issue on Monday, I will do some testing from his account to see if it is Outlook related.

Oriolus

Aug 2 2008, 02:43 AM

That'll be interesting! Have a nice weekend

StevenUnderwood

Aug 4 2008, 12:27 PM

QUOTE(Oriolus @ Aug 2 2008, 03:43 AM)

That'll be interesting! Have a nice weekend

OK, I have installed Office 2007 on a machine at work for testing and submitted a couple of messages both by selecting them then forwarding and by opening a new message and dragging the messages in. Both ways ended up with the same headers in the same order. Using the "Message Options", some of the headers are placed differently, but the received headers are in the same order. This is similar to what I have seen in the past with other Outlook versions.

From Messqage Options:

CODE

Microsoft Mail Internet Headers Version 2.0
Received: from psmtp.com ([64.18.1.44]) by CENTMAIL.carroll-ent.com with Microsoft SMTPSVC(6.0.3790.3959);
     Mon, 2 Jun 2008 08:57:55 -0400
Received: from source ([204.15.82.104]) by exprod6mx194.postini.com ([64.18.5.10]) with SMTP;
    Mon, 02 Jun 2008 07:57:54 CDT
DomainKey-Signature: s=devnull; d=spamcop.net; c=nofws; q=dns;
  h=Received:From:To:Subject:Date:Message-ID:Content-type:
   In-Reply-To:References;
  b=G6xeF9maxRU/aEBxdcnxJUgR5LyHn1x2hovnNbBdSHUYuHBBe7BILaOm
   G1XqB/cJC9EeVKCkXvs94V42FvzxROXEVVvKt7U0bYNVFZU879YijWJed
   t3i3/lonGP+mbMR;
Received: from 204-15-82-99.ironport.com (HELO sc-app12.spamcop.net) ([204.15.82.99])
  by sc-smtp-vip.soma.ironport.com with SMTP; 02 Jun 2008 05:57:23 -0700
From: SpamCop AutoResponder <spamcop[at]devnull.spamcop.net>
To: sunderwood[at]sbsb.com
Subject: [SpamCop] has accepted 1 email for processing
Date: Mon, 02 Jun 2008 12:57:23 GMT
Message-ID: <spamid1950319048[at]msgid.spamcop.net>
Content-type: text/plain
In-Reply-To: <CC34C49049FF1A47A8894AA45D518B3A04AFF4D9[at]centmail>
References: <CC34C49049FF1A47A8894AA45D518B3A04AFF4D9[at]centmail>
X-pstn-neptune: 0/0/0.00/0
X-pstn-levels:     (S: 0.27691/99.80280 CV:99.0000 R:95.9108 P:95.9108 M:97.0282 C:98.6951 )
X-pstn-settings: 3 (1.0000:1.0000) s cv gt3 gt2 gt1 r p m c
X-pstn-addresses: from <spamcop[at]devnull.spamcop.net> forward (user good) [72/6]
Return-Path: spamid.1950319048[at]bounces.spamcop.net
X-OriginalArrivalTime: 02 Jun 2008 12:57:55.0573 (UTC) FILETIME=[4679BA50:01C8C4B0]

From forwarded message:

CODE

X-MimeOLE: Produced By Microsoft Exchange V6.5
Received:  from psmtp.com ([64.18.1.44]) by CENTMAIL.carroll-ent.com with Microsoft SMTPSVC(6.0.3790.3959); Mon, 2 Jun 2008 08:57:55 -0400
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----_=_NextPart_003_01C8C4B0.46224B80"
Received:  from source ([204.15.82.104]) by exprod6mx194.postini.com ([64.18.5.10]) with SMTP; Mon, 02 Jun 2008 07:57:54 CDT
Received:  from 204-15-82-99.ironport.com (HELO sc-app12.spamcop.net) ([204.15.82.99])  by sc-smtp-vip.soma.ironport.com with SMTP; 02 Jun 2008 05:57:23 -0700
Content-class: urn:content-classes:message
Subject: [SpamCop] has accepted 1 email for processing
Date: Mon, 2 Jun 2008 08:57:23 -0400
Message-ID: <spam________9048[at]msgid.spamcop.net>
In-Reply-To: <CC34C49049FF1A47A8894AA45D518B3A04AFF4D9[at]centmail>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: [SpamCop] has accepted 1 email for processing
Thread-Index: AcjEsEaicJriu+1oRFuheCMzwyahmA==
References: <CC34C49049FF1A47A8894AA45D518B3A04AFF4D9[at]centmail>
From: "SpamCop AutoResponder" <spamcop[at]devnull.spamcop.net>
To: "x" <x>

Oriolus

Aug 4 2008, 01:49 PM

QUOTE(StevenUnderwood @ Aug 4 2008, 07:27 PM)

I have come across an even more amazing difference, that could cast light upon things:
Reported in two parts via the Outlook/Eudora workaround form:

CODE

SpamCop v 2 Copyright (C) 1998-2006, IronPort Systems, Inc. All rights reserved.
Here is your TRACKING URL - it may be saved for future reference:
http://www.spamcop.net/sc?id=z2124029633zd1b3646a2593fcd64f44c6e2fad4a68cz
Skip to Reports
Return-Path: <witczak[at]iag.se>
Received: from mwinf6617.online.nl (mwinf6617.online.nl)
    by mwinb6006 (SMTP Server) with LMTP; Mon, 04 Aug 2008 19:13:54 +0200
X-Sieve: Server Sieve 2.2
Received: from me-wanadoo.net (localhost [127.0.0.1])
    by mwinf6617.online.nl (SMTP Server) with ESMTP id DFC8B280008A
    for <x>; Mon,  4 Aug 2008 19:13:54 +0200 (CEST)
Received: from ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr (ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr [86.217.132.218])
    by mwinf6617.online.nl (SMTP Server) with ESMTP id AFD3C2800086
    for <x>; Mon,  4 Aug 2008 19:13:54 +0200 (CEST)
X-ME-UUID: 20080804171354720.AFD3C2800086[at]mwinf6617.online.nl
Message-ID: <0009______________________c9be[at]fngixw>
From: "gabbie michel" <witczak[at]iag.se>
To: <x>
Subject: For:<y> Britney still has cool t*tsWatch.
Date: Mon, 04 Aug 2008 15:24:31 +0000
MIME-Version: 1.0
X-Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_0006_01C8F655.02FCCED1"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
Content-Type: text/html
X-SpamCop-note: Converted to text/html by SpamCop (outlook/eudora hack)
View entire message
Parsing header:
0: Received: from ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr (ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr [86.217.132.218]) by mwinf6617.online.nl (SMTP Server) with ESMTP id AFD3C2800086 for <x>; Mon, 4 Aug 2008 19:13:54 +0200 (CEST)
No unique hostname found for source: 86.217.132.218
orange.nl received mail from sending system 86.217.132.218
Tracking message source: 86.217.132.218:
Routing details for 86.217.132.218
[refresh/show] Cached whois for 86.217.132.218 : postmaster[at]wanadoo.fr
Using abuse net on postmaster[at]wanadoo.fr
abuse net wanadoo.fr = postmaster[at]wanadoo.fr, abuse[at]wanadoo.fr, abuse[at]orange.fr
Using best contacts postmaster[at]wanadoo.fr abuse[at]wanadoo.fr abuse[at]orange.fr
postmaster[at]wanadoo.fr bounces (205 sent : 103 bounces)
Using postmaster#wanadoo.fr[at]devnull.spamcop.net for statistical tracking.
Yum, this spam is fresh!
Message is 0 hours old
86.217.132.218 not listed in dnsbl.njabl.org
86.217.132.218 not listed in dnsbl.njabl.org
86.217.132.218 not listed in cbl.abuseat.org
86.217.132.218 listed in dnsbl.sorbs.net ( 127.0.0.10 )
86.217.132.218 not listed in accredit.habeas.com
86.217.132.218 not listed in plus.bondedsender.org
86.217.132.218 not listed in iadb.isipp.com
Finding links in message body
Parsing HTML part
Resolving link obfuscation
   http://back495.com/videos/live.html
   Host back495.com (checking ip) = 200.46.83.233
   host 200.46.83.233 = 233-83-46-200-ip.alianzaviva.net (cached)
Tracking link: http://back495.com/videos/live.html
[report history]
Resolves to 200.46.83.233
Routing details for 200.46.83.233
[refresh/show] Cached whois for 200.46.83.233 : ipadmin[at]net2net.com.pa
Using abuse net on ipadmin[at]net2net.com.pa
abuse net net2net.com.pa = ipadmin[at]net2net.com.pa, abuse[at]net2net.com.pa, postmaster[at]net2net.com.pa
Using best contacts ipadmin[at]net2net.com.pa abuse[at]net2net.com.pa postmaster[at]net2net.com.pa
Please make sure this email IS spam:
From: "gabbie michel" <witczak[at]iag.se> (For:<y> Britney still has cool t*tsWatch.)
View full message

Report spam to:
Re: 86.217.132.218 (Administrator of network where email originates)
To: postmaster#wanadoo.fr[at]devnull.spamcop.net (Notes)
To: abuse[at]orange.fr (Notes)
To: abuse[at]wanadoo.fr (Notes)
Re: 86.217.132.218 (User defined recipient)
To: jl0007[at]coldrain.net (Notes)
Re: http://back495.com/videos/live.html (Administrator of network hosting website referenced in spam)
To: ipadmin[at]net2net.com.pa (Notes)
To: abuse[at]net2net.com.pa (Notes)
To: postmaster[at]net2net.com.pa (Notes)

Additional notes (optional - max 2000 characters):


ATTENTION: Report only those e-mail addresses and web sites that you think your spammer has used. Avoid checking any boxes left empty unless you know that your spammer has used the addresses or sites thus identified. Each false report that you submit means wasted time for a network administrator, so take care. The last thing SpamCop wants are network administrators so accustomed to false claims that they no longer take these spam reports seriously.

Comments for:postmaster#wanadoo.fr[at]devnull.spamcop.net (86.217.132.218)

Return to report
Comments for:abuse[at]orange.fr (86.217.132.218)

Return to report
Comments for:abuse[at]wanadoo.fr (86.217.132.218)

Return to report
Comments for:jl0007[at]coldrain.net (86.217.132.218)

Return to report
Comments for:ipadmin[at]net2net.com.pa (http://back495.com/videos/live.html)

Return to report
Comments for:abuse[at]net2net.com.pa (http://back495.com/videos/live.html)

Return to report
Comments for:postmaster[at]net2net.com.pa (http://back495.com/videos/live.html)

Return to report
Copyright (C) 1998-2006, IronPort Systems, Inc. All rights reserved. HTML4 / CSS2 Firefox recommended - Policies and Disclaimers

Reported via Forwarding resulting in error(s):

CODE

SpamCop encountered errors while saving spam for processing:
SpamCop could not find your spam message in this email:

Return-Path: <<y>@wanadoo.nl>
Received: from sc-smtp6-inbound.soma.ironport.com (sc-smtp6-inbound.soma.ironport.com [204.15.82.72])
       by sc-app12.soma.ironport.com (Postfix) with ESMTP id C9C4834DBD
       for <submit.<z>@spam.spamcop.net>; Mon,  4 Aug 2008 11:06:04 -0700 (PDT)
X-Fozzie-Original-To: submit.<z>@spam.spamcop.net
X-Fozzie-Original-To: submit.<z>@spam.spamcop.net
Received: from smtp-4.orange.nl ([193.252.22.249])
by vmx2.spamcop.net with ESMTP; 04 Aug 2008 11:06:04 -0700
Received: from me-wanadoo.net (localhost [127.0.0.1])
       by mwinf6303.online.nl (SMTP Server) with ESMTP id 3B15E7000085
       for <submit.<z>@spam.spamcop.net>; Mon,  4 Aug 2008 20:06:02 +0200 (CEST)
Received: from SilverBox (s5591c49c.adsl.wanadoo.nl [85.145.196.156])
       by mwinf6303.online.nl (SMTP Server) with ESMTP id DF9F97000082
       for <submit.<z>@spam.spamcop.net>; Mon,  4 Aug 2008 20:06:01 +0200 (CEST)
X-ME-UUID: 20080804180601916.DF9F97000082[at]mwinf6303.online.nl
From: "<y>" <<y>@wanadoo.nl>
To: "spam" <submit.<z>@spam.spamcop.net>
Subject: FW: <y> Britney still has cool t*tsWatch.
Date: Mon, 4 Aug 2008 20:05:31 +0200
Message-ID: <000901c8f65c$af77fe80$0e67fb80$@<xxx>@wanadoo.nl>
MIME-Version: 1.0
Content-Type: multipart/alternative;
       boundary="----=_NextPart_000_000A_01C8F66D.7300CE80"
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: Acj2VXjV50ZxfALKQd6Aj+rooZMsYwABrHHg
Content-Language: nl

Dit is een meerdelig bericht met een MIME-indeling.

------=_NextPart_000_000A_01C8F66D.7300CE80
Content-Type: text/plain;
       charset="us-ascii"
Content-Transfer-Encoding: 7bit

Van: gabbie michel [mailto:witczak[at]iag.se]
Verzonden: maandag 4 augustus 2008 17:25
Aan: <y>@wanadoo.nl
Onderwerp: For:<y> Britney still has cool t*tsWatch.

------=_NextPart_000_000A_01C8F66D.7300CE80
Content-Type: text/html;
       charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<meta http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 12 (filtered medium)">
<style>

</style>

</head>

<body bgcolor=3Dwhite lang=3DNL link=3Dblue vlink=3Dpurple>

<div class=3DSection1>

<p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>

<p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>

<div>

<div style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt =
0cm 0cm 0cm'>

<p class=3DMsoNormal><b><span =
style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'>Van:</span><=
/b><span
style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'> gabbie =
michel
[mailto:witczak[at]iag.se] <br>
<b>Verzonden:</b> maandag 4 augustus 2008 17:25<br>
<b>Aan:</b> <y>@wanadoo.nl<br>
<b>Onderwerp:</b> For:<y> Britney still has cool =
t*tsWatch.<o:p></o:p></span></p>

</div>

</div>

<p class=3DMsoNormal><o:p> </o:p></p>

<p class=3DMsoNormal><o:p> </o:p></p>

</div>

</body>

</html>

------=_NextPart_000_000A_01C8F66D.7300CE80--

The email which triggered this auto-response had the following headers:
Return-Path: <<y>@wanadoo.nl>
Received: from sc-smtp6-inbound.soma.ironport.com (sc-smtp6-inbound.soma.ironport.com [204.15.82.72])
       by sc-app12.soma.ironport.com (Postfix) with ESMTP id C9C4834DBD
       for <submit.<z>@spam.spamcop.net>; Mon,  4 Aug 2008 11:06:04 -0700 (PDT)
X-Fozzie-Original-To: submit.<z>@spam.spamcop.net
X-Fozzie-Original-To: submit.<z>@spam.spamcop.net
Received: from smtp-4.orange.nl ([193.252.22.249])
by vmx2.spamcop.net with ESMTP; 04 Aug 2008 11:06:04 -0700
Received: from me-wanadoo.net (localhost [127.0.0.1])
       by mwinf6303.online.nl (SMTP Server) with ESMTP id 3B15E7000085
       for <submit.<z>@spam.spamcop.net>; Mon,  4 Aug 2008 20:06:02 +0200 (CEST)
Received: from SilverBox (s5591c49c.adsl.wanadoo.nl [85.145.196.156])
       by mwinf6303.online.nl (SMTP Server) with ESMTP id DF9F97000082
       for <submit.<z>@spam.spamcop.net>; Mon,  4 Aug 2008 20:06:01 +0200 (CEST)
X-ME-UUID: 20080804180601916.DF9F97000082[at]mwinf6303.online.nl
From: "<y>" <<y>@wanadoo.nl>
To: "spam" <submit.<z>@spam.spamcop.net>
Subject: FW: <y> Britney still has cool t*tsWatch.
Date: Mon, 4 Aug 2008 20:05:31 +0200
Message-ID: <000901c8f65c$af77fe80$0e67fb80$@<xxx>@wanadoo.nl>
MIME-Version: 1.0
Content-Type: multipart/alternative;
       boundary="----=_NextPart_000_000A_01C8F66D.7300CE80"
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: Acj2VXjV50ZxfALKQd6Aj+rooZMsYwABrHHg
Content-Language: nl

BTW: I changed different recognizable strings in <x>, <y>, or <z> etc...

Does this make sense to someone?

StevenUnderwood

Aug 4 2008, 02:44 PM

QUOTE(Oriolus @ Aug 4 2008, 02:49 PM)

Does this make sense to someone?

Yes, the messages are not properly attached to your email... the headers of your second message are NOT the the spam headers but the headers of the email they received. It sounds like you simply forwarded the spam to your submit address rather than attaching it.

From: "<y>" <<y>@wanadoo.nl>
To: "spam" <submit.<z>@spam.spamcop.net>
Subject: FW: <y> Britney still has cool t*tsWatch.

Oriolus

Aug 4 2008, 03:31 PM

QUOTE(StevenUnderwood @ Aug 4 2008, 09:44 PM)

Yes, you are certainly right! I did the wrong thing, I'm very sorry!
I better delete my post!

I'm lost... I've to look into the FAQ's to remember how I should handle things. Again, I'm sorry!

This is what the second code-part should have been:

CODE

Reporting via Forwarding as an attachment:

SpamCop v 2 Copyright (C) 1998-2006, IronPort Systems, Inc. All rights reserved.
Here is your TRACKING URL - it may be saved for future reference:
http://www.spamcop.net/sc?id=z2124366960z3aa112245dd63618300448808611770cz
Skip to Reports
Received: from me-wanadoo.net (localhost [127.0.0.1])
    by mwinf6617.online.nl (SMTP Server) with ESMTP id DFC8B280008A
    for <x>; Mon,  4 Aug 2008 19:13:54 +0200 (CEST)
Received: from mwinf6617.online.nl (mwinf6617.online.nl)
    by mwinb6006 (SMTP Server) with LMTP; Mon, 04 Aug 2008 19:13:54 +0200
Received: from ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr (ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr [86.217.132.218])
    by mwinf6617.online.nl (SMTP Server) with ESMTP id AFD3C2800086
    for <x>; Mon,  4 Aug 2008 19:13:54 +0200 (CEST)
Return-Path: <witczak[at]iag.se>
From: "gabbie michel" <witczak[at]iag.se>
To: <x>
Subject: For:<y> Britney still has cool t*tsWatch.
Date: Mon, 4 Aug 2008 17:24:31 +0200
Message-ID: <0009______________________c9be[at]fngixw>
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_0013_01C8F682.B5DEAD70"
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-Sieve: Server Sieve 2.2
X-ME-UUID: 20080804171354720.AFD3C2800086[at]mwinf6617.online.nl
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
Thread-Index: Acj2VXjV50ZxfALKQd6Aj+rooZMsYw==
View entire message
Parsing header:
0: Received: from ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr (ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr [86.217.132.218]) by mwinf6617.online.nl (SMTP Server) with ESMTP id AFD3C2800086 for <x>; Mon, 4 Aug 2008 19:13:54 +0200 (CEST)
No unique hostname found for source: 86.217.132.218
orange.nl received mail from sending system 86.217.132.218
Tracking message source: 86.217.132.218:
Routing details for 86.217.132.218
[refresh/show] Cached whois for 86.217.132.218 : postmaster[at]wanadoo.fr
Using abuse net on postmaster[at]wanadoo.fr
abuse net wanadoo.fr = postmaster[at]wanadoo.fr, abuse[at]wanadoo.fr, abuse[at]orange.fr
Using best contacts postmaster[at]wanadoo.fr abuse[at]wanadoo.fr abuse[at]orange.fr
postmaster[at]wanadoo.fr bounces (205 sent : 103 bounces)
Using postmaster#wanadoo.fr[at]devnull.spamcop.net for statistical tracking.
Message is 3 hours old
86.217.132.218 not listed in dnsbl.njabl.org
86.217.132.218 not listed in dnsbl.njabl.org
86.217.132.218 not listed in cbl.abuseat.org
86.217.132.218 listed in dnsbl.sorbs.net ( 127.0.0.10 )
86.217.132.218 not listed in accredit.habeas.com
86.217.132.218 not listed in plus.bondedsender.org
86.217.132.218 not listed in iadb.isipp.com
Finding links in message body
Recurse multipart:
   Parsing text part
   Parsing HTML part
Resolving link obfuscation
   http://back495.com/videos/live.html
   Host back495.com (checking ip) = 200.46.83.233
   host 200.46.83.233 = 233-83-46-200-ip.alianzaviva.net (cached)
Tracking link: http://back495.com/videos/live.html
[report history]
Resolves to 200.46.83.233
Routing details for 200.46.83.233
[refresh/show] Cached whois for 200.46.83.233 : ipadmin[at]net2net.com.pa
Using abuse net on ipadmin[at]net2net.com.pa
abuse net net2net.com.pa = ipadmin[at]net2net.com.pa, abuse[at]net2net.com.pa, postmaster[at]net2net.com.pa
Using best contacts ipadmin[at]net2net.com.pa abuse[at]net2net.com.pa postmaster[at]net2net.com.pa
Please make sure this email IS spam:
From: "gabbie michel" <witczak[at]iag.se> (For:<y> Britney still has cool t*tsWatch.)
Dit is een meerdelig bericht met een MIME-indeling.
------=_NextPart_000_0013_01C8F682.B5DEAD70
View full message
Furthermore exactly the same as in the first code-part.

I cannot judge whether this differs from the first code-part, but the result is fortunately the same.
Sorry for the embarrassing confusion.

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.