Jump to content

MIG

Memberp
 View Profile  See their activity

  • Posts

    353

  • Joined

  • Last visited

 Content Type 

Posts posted by MIG

    Report Ends With "Parsing Header:"

    in SpamCop Reporting Help

    Posted

    On 6/3/2019 at 4:38 AM, nh905 said:

    @MIGsee https://www.spamcop.net/sc?id=z6551810734z18e8e17fdf9218b1235dc26a129e99c9z.  Removing the period in front of the host in "Received: from localhost (127.0.0.1) by .7E3tTgaTrxrjG0@track.list-manage7.net id MgFLi65tFAWB" results in Spamcop parsing the headers properly.  I configured Mailhosts. some years ago.  

    Thanks, Norbert

    Hello Norbet,

    Sorry it's taken a while to get to this (partly thinking/pondering)

    I parsed using SC NOMAILHOSTS account 

    result: https://www.spamcop.net/sc?id=z6552696162zc69a145cc755ec5c7e058df9f70058bbz

    & I then did as you did, removed . 

    result: https://www.spamcop.net/sc?id=z6552701693z0f0a16068c0f32eb79bf213e6cee702az

    Both methods result in a successful parse

    85.119.145.133 still@mits.ru 

    54.183.130.144 abuse@hootsuite.com 

    ---------------------------------------------------------

    So, unless I'm mistaken, we've concluded the parser can process if the . is removed and or can process using a NO-MAILHOSTS configured account.

    • To SCFA & SCA (still 🤔 if they're one and the same or just share a 🛏)

    **Is the . issue a real SC issue & fixable or a perceived issue?

    ** What is it about SC accounts with MAILHOSTS configued that SC is  unable to process spams with . issue?

    Surely , as . issue keeps presenting, it fit's the criteria for: attention/review, at the very least? 

    🙏G🦗H🙏

    ----------------------------------------

    Just for interest: 

    Digging (deeper) 85.119.145.133

    https://www.abuseipdb.com/check/85.119.145.133 abuse@selectel.ru

    on 54.183.130.144

    https://www.talosintelligence.com/reputation_center/lookup?search=54.183.130.144  = ow.ly = abuse@amazonaws.com

    https://www.virustotal.com/gui/url/8ef4ed0e21da1546109e27b2b861d6ddf0bcccc8fa5a52f45866699ee3ed5db1/detection

    https://www.virustotal.com/gui/ip-address/54.67.120.65/summary

    [Resolved] Mailhost configuration problem, identified internal IP as source

    in SpamCop Reporting Help

    Posted · Edited by MIG

    7 hours ago, hank said:


    This kind of reminds me of asking my first UNIX host's sysop about a problem connecting with my acoustic coupler, vt-100 terminal, and 300 baud modem. He replied "that's trivial."
    I inquired further and he explained:  "'Trivial' means not worth my time to fix and you'll never figure it out in a million years."

    Trivial/MWMT, wonder where he is now? (Not really), rude little sod!

    Can G🦗H be nosy Hank & ask what you did with: Acoustic coupler, vt-100 terminal/300 baud modem?

    Re Richard's current fix, there's obviously a "fixable" issue, if SCF track it then the next poor buggar & the one after that and the next & so on will know, "go straight to Fleet St, don't dally.... "

    Without the info, well....? 

    I don't understand why Richard would elaborate on one fix and not another?

    I don't understand if the current fix is "Hank SC account" specific or more general?

    I don't understand?

    "Lessons in humility, these experiences are", indeed!

    PeaceLove&MungBeans!

    G🦗H 🙏

    [Resolved] Mailhost configuration problem, identified internal IP as source

    in SpamCop Reporting Help

    Posted

    4 minutes ago, hank said:

    Spamcop's Richard replied to my inquiry:

    "Added those in"

    "Apple network setup"

    "Lesson" 

    Thanks for posting back Hank🙏 & thanks Richard!!

    Added what in? 

    I'm "assuming" from Richard's reply,  whatever he modified was DIFFERENT to what he modified pre "Friday at 05:25 AM"?  I wish he'd told us? I'm confused?

    I hope the: "Apple network setup changes" information is disseminated? This is annoying. 

    I'm unsure about the "Lesson", yes, certainly SCA seem to be able to "fix" everything that can be fixed, however (I'm) reluctant to have them as 1st go to, if only for the fact, I'm not sure their skills are put to good use fixing everything.

    I subscribe to: "we all fix as much as we can, escalate the unfixable". It's a method that's worked... 

    I support anyone getting help, however, if we knew what was fixed, we could guide future OPs: "go straight to square-#1, do not delay!"

    Happy but notG🦗H 🙏

    [Resolved] Mailhost configuration problem, identified internal IP as source

    in SpamCop Reporting Help

    Posted · Edited by MIG

    19 minutes ago, petzl said:

    It's working now

    What happened? Was it fixed? By whom? How? 

    Do you know Petzl? Share please? G🦗H 🙏

    Same original  SCTURL, before "it's working now", I've been trying to parse thru NO MAILHOSTS acc =

     https://www.spamcop.net/sc?id=z6551860330zfe88fc64aeb0939e3fa91be48398a4d5z - no date? What have I buggered up, can't find the missing date field? Anyone please?

    G🦗H 🙏

    Report Ends With "Parsing Header:"

    in SpamCop Reporting Help

    Posted · Edited by MIG

    1 hour ago, nh905 said:

    I am seeing an increasing number of spam with "Received: from localhost (127.0.0.1) by .<domain>", almost all from Russian.  I can consistently get Spamcop to report the spam by removing the dot before the domain, but this is time-consuming given the volume.  I am trying to automate the editing and reporting process but running into a few issues.  I reported the problem to Spamcop on May 17th but heard nothing back.  Does anyone have ideas on how to get this issue resolved by spamcop.net?  

    Thanks, Norbert

    Hi Norbet,

    May we have some SC Tracking URLs please?   From the top of the SC Parser: 

    Looks like:  https://www.spamcop.net/sc?id=z6550829312z28b288e7765aed3250e66e22878787e8z

    & are you using a SC account with MAILHOSTS configured? 

    Please let us know?

    Thanks!

    G🦗 H

    What do do with Amazon hosted spammers

    in SpamCop Reporting Help

    Posted · Edited by MIG

    2 hours ago, gnarlymarley said:

    This also does pose a question since much of the updates (such as the IP 150.107.103.51 shows) are manually entered from whois.  I believe should be automatically picked up from the whois system.  If the programmers could fix whois, I do not believe it will fully eliminate manual entries.  However, that would greatly reduce the amount of manual entries.

    Can you explain a bit more please GarlyMarly? (cause I'm not following). The table table/pinned topic I'm "promoting" is for email addys that SC NEVER identifes and NEVER will: addresses like FTC, IDPhishing, Petzl's mentioned a few good ones, Certificate agencies (I think) I keep meaning to ask him if there's more? The pinned topic/table idea came about bc "you" made a comment along the lines of "useful info" that "we" need to share, "we" being everybody and also, I stumble across email info in the forum every other fortnight... so I figured, rather than having to do laborious searches everytime I try to remember "what was that really helpful x?", a topic/table would sort the stuff🤔 I don't know that anyone other than you & me thinks it's got legs so I might just create a ss and when it's done share it & if needs updating do that whenever required... 

    Anyway, let us know please?

    Thanks G🦗H 🙏

    Abbreviations/acronyms

    in SpamCop Lounge

    Posted · Edited by MIG

    On 6/2/2019 at 3:13 PM, Lking said:

    According to Samuel Morse "S"

    Those 3 little ...s morse a word into a popup? Cool! 

    BTW, G🦗H's starting a "Bring back the https://ibb.co/D8VnBdP petition! 

    HTH

    IIRC

    (I know),  when I "look" it up I go "douh", but.... it'd be good if the "look it up" excerise was not necessary... Please?

    Thanks Master🙏G🦗H

    [Resolved] Mailhost configuration problem, identified internal IP as source

    in SpamCop Reporting Help

    Posted · Edited by MIG

    9 hours ago, hank said:

    1. I couldn't find it either, and I doggone well know it was there.

    2. So they made it disappear, eh? 

    3. Sure makes me look like an idiot to the folks at my ISP who I asked to look into this.

    4. They ought to insert some warning about the change into the destination page (just as someone inserted "[Resolved]" into the title of the thread.

    5. Dagnabbit.  That's not how hypertext was meant to work.    

    6. It's terrible when you can't trust an older link to take you to where it was originally intended to go.

    7. Thanks for figuring out what's been going on with the pointers.

    8. Is there still something wrong needing fixing?

    9. I'll be back if I get more error messages.

    Hey Hank,

    1. G🦗H's relieved & amused (more on that in a bit) to read your post, can't afford new glasses and, when things "disappear" G🦗H  get's easily confused, actually, G🦗H gets confused, no qualifications required, 'n, if it's spam related, G🦗H's demeanour get's a tad cranky. G🦗H  hates the bastards. 
    2.  Nodding head emoji inserted here.
    3. Absolutely not. They're the "idiots", they're responsible for their systems. However, bc, G🦗H has been (not by choice) in the "idiot" zone many, many times, G🦗H  has a "possible technical escalation - protection plan", if ever G🦗H finds "something wrong or possibly wrong" that G🦗H  may have to "prove" = PTEPP implemented, stat! 

    On the G🦗H scale of what pisses G🦗H off are: 1. spammers, 2. paid technical support who DHAFC, don't do anything, do everything to avoid doing what they're paid for, 3. major corporations, "software/hardware" drug lords, (their existence paid for by pleb consumers-us) who push products but deny any responsibility for said products. Furthermore, "gaslight" consumers and propose the "only" solution to fix a problem that's happening to you and no-one else in the entire world, 💰💰upgrade💰💰. 

    PTEPP = G🦗H copies everything! (to a notepad), names it something very memorable and moves on to the next blade of grass. When TS revert: "send data, urls, logs, "proof"?", it's a breeze.
    4. Yes. That's the logical, sensible - NORMAL action. Not too hard.
    5. Had to look up "Dagnabbit", new to G🦗H , made G🦗H laugh, a LOT! 
    Master has committed to fixing hypelinks, again, just so I'm on the same page, did "doggone" become "Dagnabbit"?
    6. It's terrible when you can't trust - fullstop!
    7. That's very kind Hank, but G🦗H can't take any credit, (I) just read things & try to understand, no understanding = G🦗H annoys everyone until clarity prevails. And when it comes to spam, escalations to 3rd pty(s) and the rest, a condition, first defined by Freud, afflicts G🦗H. 

    8. There's always something wrong, always something that needs fixing. 
    Specifically, if we're asking that question only about "mailhost-configuration-problem-identified-internal-ip-as-source", imo, the fix that's been implemented has fixed your account, I don't think (could be very wrong here) that SC will look for the same "mis-configuration" in all accounts & push a fix.
    So, the issue could "come back", for others, hopefully, they read your valuable post and hopefully, the valuable post, doesn't, in time, become a dead link, 'cause (in my world) it's really frustrating to travel 1/2 way across town and find the library relocated to a virtual space and "deaded-out" resources pre-existing some parameter defined by stupid things known only to ??? who gets paid a bonus for "breeding" dead links, as opposed to a "fixed-dead-link-bonus". G🦗H's getting an urge to watch Life of Brian, again!

    9. Good! I haven't read your other posts, (I will now) but this one's been a good ride and productive🙏

    The next person who gets "mailhost-configuration-problem-identified-internal-ip-as-source" error, the test will be, fix the account, see if issue persists, if it doesn't, it's worth proposing a review of all accounts and a fix applied.

    Best regards!

    🙏G🦗H🙏

    SCF Email notification/s

    in SpamCop Lounge

    Posted · Edited by MIG

    1 hour ago, Lking said:

    With the email column in 1) set to on  take a close look at the options when you "follow" a thread.

    I can not see your account settings so I am some what limited to suggestions.

    Thank you Master, I'm grateful for your input:

    1 email per week with all new content, over the past 18 months I've also selected 1 email per day, blah, blah, blah - every so often I change around in the hope my actions will bring on "movement  at the station"🐎

    Notification settings:

    SCF NOTIFICATIONS SSETTINGS.jpg

    All options - buttons - whatever can be toggled, I have, same reason - hoping something fires

    settings-notifications-options.jpg

    If it's just too weird Master, don't worry, time spent on more important things is probably the best choice.

    I'll bug you about something else, never fear😉

    As it's never worked maybe insects aren't supposed to get Mail?

    🙏G🐜H

    [Resolved] Mailhost configuration problem, identified internal IP as source

    in SpamCop Reporting Help

    Posted · Edited by MIG

    4 hours ago, hank said:

    1. where did (forums.sonic.net) Ankh get: https://www.spamcop.net/sc?id=z6551256550z0ed85f5a7d03a6f2cbf8b615d226c5f0z from?
    Posted earlier in this thread.
    2. I haven't had any more of those bounces since Spamcop support found and fixed the mailhost configuration problems, so maybe the headers aren't an issue any more.

    Hello Hank, '

    Thanks for posting back!

    For the life of me I cannot find: https://www.spamcop.net/sc?id=z6551256550z0ed85f5a7d03a6f2cbf8b615d226c5f0z on Page 1, which is where you logged the issue & included the SCF tracking URLs.

    hank.jpg

    I'm not asking because I don't you believe, but, because I looked at your comment:  "Sonic forum folks asked for example of malformed headers here, saying the ones he sees look ok"

    I looked at Ankh's post & checked what Petzl checked...

    I did think the fact your account has been sorted may be why the original URLs were no longer reporting the original error, but, when I look at the tracking URLs you posted, on page 1, I cannot find - https://www.spamcop.net/sc?id=z6551256550z0ed85f5a7d03a6f2cbf8b615d226c5f0z, when I look at SCF Page 2 - I can find it 3 times, and those are: when Petzl looks at it & references it, when I look at it & reference it & when I reference it, asking the question, "where did it come from?"...

    I guess the only way to help out the Sonic folks with a bodgy header is wait until another one appears, or, we could ask Richard to "break" your SC account for the purposes of "testing". Whadda ya reckon ?Too risky😱? Richard won't be up for it🤭. Maybe we just need to be thankful we've got more info on this particular issue, 'n, that will help others who hit the same wall?

    Oh, and if that SCFTU IS on Page 1, G🦗H needs glasses and apologizes unreservedly!

    Cheers!

    G🦗H

    [Resolved] Mailhost configuration problem, identified internal IP as source

    in SpamCop Reporting Help

    Posted

    1 hour ago, hank said:

    One of the Sonic forum folks aske for an example of malformed headers here, saying the ones he sees look ok:

    https://forums.sonic.net/viewtopic.php?f=5&t=2047&p=45755#p45755

    Hey Hank,

    Welcome back🙂!

    Re [ https://www.spamcop.net/sc?id=z6551256550z0ed85f5a7d03a6f2cbf8b615d226c5f0z ] 

    1. I agree with Petzl - this looks ok, however, just so I'm clear, where did (forums.sonic.net) Ankh get:  https://www.spamcop.net/sc?id=z6551256550z0ed85f5a7d03a6f2cbf8b615d226c5f0z from?

    • Was Ankh given SC Tracking URLs that generated:

    "Mailhost configuration problem, identified internal IP as source
    Mailhost: Please correct this situation - register every email address where you receive spam
    No source IP address found, cannot proceed.    " 

    Error/s, when parsed?

    Please let us know?

    Cheers! 

     G🦗H

     

     

     

×
×
  • Create New...