Steve

It doesn't parse the X-Originating-IP most of the time. And that message is not displayed (except for the 1st received line in all www.@xxx.ocn.ne.jp emails with "xxx" taking the place of whatever happens to be first part of the email address. In this example, fuga is in front of the ocn.ne.jp part of the email address). This example is from an email dated 8/25/17: Steve

Delivered-To: x Received: by 10.25.215.152 with SMTP id q24csp535241lfi; Thu, 24 Aug 2017 09:51:44 -0700 (PDT) X-Received: by 10.98.139.141 with SMTP id e13mr7047592pfl.192.1503593504252; Thu, 24 Aug 2017 09:51:44 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1503593504; cv=none; d=google.com; s=arc-20160816; b=fBJmIS25wTFiKufRoEtHIR4yY+RxpAmVw1qETMO6BmHmkoD/kNAByCdzdg2gLc+9OB EV5W7bmHtpyYOl7HVu+Q27UOcRSno/9RUQBhdIGmxouQDwkxgCFfIRp8NJph2zqXl347 7y14tU6P8NQ5SD9m/X3vMXFzfyOs4l28urC/MFYWzcAyKHfeEL9/JwIOjDUIB49xSTlX jjLpRDuEe2lqlwLY6w/qa8QBqqzFZ34g7OkM6AvjNFknBhjKuyD82blBy+7nhRg0vzgH PcoRRilbtrkshECm+fbMIfB8hyLBf+mMc0M/XwX3sHY3tRsnZ7zdMP44Gc/BY7mu7pNw N4Hg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:subject:message-id:reply-to :from:date:arc-authentication-results; bh=rPAAmo/5jRgIb94r0jqE8K1b0fFvRv5wn0ibit2p+KY=; b=Qtk+gWgPsqzkTIZEX98e505OVUCCR7xNDkxlaxrk0tMknMfZQq+fA3QfzxdHMpoS5P Irze7G9SvkNz7aWjG46mTjiY6ouYdX6bh8hZfoO7TjCombVU9iu9jRnVhb8NT5jGaMCN Iy66gywmK36qdgd5TgkswLHZ42TqdLO6Wt2Sb1HqG+YzFlJXYpxOkICVe4vtIuVQ0esI s71PSMYp/ZsEi7+rqxjlJKl+dslH0dUtYeyfmKDoCFD85aTg5w3Tfb3rsV4ae3u+lDPe 5BSy12/zva0/BbIva4sZ/vWxXoYxUYAZnefPmLuB8Z/YvUy0ROjRx9aeq9pKHWtANcy5 iQwQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of www.@athena.ocn.ne.jp designates 153.149.236.41 as permitted sender) smtp.mailfrom=WWW.@athena.ocn.ne.jp Return-Path: <WWW.@athena.ocn.ne.jp> Received: from mbkd0340.ocn.ad.jp (mbkd0340.ocn.ad.jp. [153.149.236.41]) by mx.google.com with ESMTP id j125si1438059pfg.305.2017.08.24.09.51.30; Thu, 24 Aug 2017 09:51:44 -0700 (PDT) Received-SPF: pass (google.com: domain of www.@athena.ocn.ne.jp designates 153.149.236.41 as permitted sender) client-ip=153.149.236.41; Authentication-Results: mx.google.com; spf=pass (google.com: domain of www.@athena.ocn.ne.jp designates 153.149.236.41 as permitted sender) smtp.mailfrom=WWW.@athena.ocn.ne.jp Received: from mf-smf-ucb005.ocn.ad.jp (mf-smf-ucb005.ocn.ad.jp [153.149.231.4]) by mbkd0340.ocn.ad.jp (Postfix) with ESMTP id 9F0BC128035D; Fri, 25 Aug 2017 01:50:59 +0900 (JST) Received: from mf-smf-ucb005.ocn.ad.jp (mf-smf-ucb005 [153.149.231.4]) by mf-smf-ucb005.ocn.ad.jp (Postfix) with ESMTP id 7C6D760709; Fri, 25 Aug 2017 01:50:59 +0900 (JST) Received: from ntt.pod01.mv-mta-ucb026 (mv-mta-ucb026.ocn.ad.jp [153.149.142.100]) by mf-smf-ucb005.ocn.ad.jp (Switch-3.3.4/Switch-3.3.4) with ESMTP id v7OGoXcD065068; Fri, 25 Aug 2017 01:50:55 +0900 Received: from vcwebmail.ocn.ad.jp ([153.149.227.165]) by ntt.pod01.mv-mta-ucb026 with id 14qu1w0013akymp014quba; Thu, 24 Aug 2017 16:50:55 +0000 Received: from mzcstore142.ocn.ad.jp (mz-cb142p.ocn.ad.jp [114.147.59.200]) by vcwebmail.ocn.ad.jp (Postfix) with ESMTP; Fri, 25 Aug 2017 01:50:54 +0900 (JST) Date: Fri, 25 Aug 2017 01:50:54 +0900 (JST) From: Taka Benson <"WWW."@athena.ocn.ne.jp> Reply-To: Taka Benson <dhlcourierservicebej@hotmail.com> Message-ID: <1703504187.5321643.1503593454940.JavaMail.root@athena.ocn.ne.jp> Subject: Information MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-2022-JP Content-Transfer-Encoding: 7bit X-Originating-IP: [5.45.62.153] Information Contact DHL Courier for your compensation Bank card valued $1,500,000.00 USD is been registered and your ATM CARD package is under Mr. Albert Godwin's care reach him via email: (dhlcourierservicebej@hotmail.com) for more information on how to claim it. Greetings, I almost always have problems getting SC to parse the X-Originating-IP in OCN/NTT emails I receive (such as the one above). I end up having to report the emails with those IP addresses separately through SpamCop to the ISP. Why won't it recognize those IP addresses? Most originate from Benin (41.xx.xxx.xxx/197.xxx.xxx.xx). In this case, when I parsed the email again with this IP address, the X-Originating-IP resulted in the email being sent to abuse@avast.com Tracking link: https://www.spamcop.net/sc?id=z6401117976z6d5deab26600019361ed7458288314dez Steve

? How exactly would I add AOL? Steve Tried the instructions in the email SC sent to my Verizon address on AOL Mail and got this error: Host mtaiw-aaf07.mx.aol.com (checking ip) IP not found ; mtaiw-aaf07.mx.aol.com discarded as fake. Sorry, SpamCop has encountered errors: The email sample you submitted for s*********@v******.net (obscured for obvious reasons - spambots) appears to traverse more than one domain. Please ensure that you configure each mailhost individually and in order. Proceed here: <https://www.spamcop.net/mcgi?mhc2=Ez2CZ0s7jSOYgdKz>

Tried the instructions in the email SC sent to my Verizon address on AOL Mail and got this error: Host mtaiw-aaf07.mx.aol.com (checking ip) IP not found ; mtaiw-aaf07.mx.aol.com discarded as fake. Sorry, SpamCop has encountered errors: The email sample you submitted for s*********@v******.net (obscured for obvious reasons - spambots) appears to traverse more than one domain. Please ensure that you configure each mailhost individually and in order. Proceed here: <https://www.spamcop.net/mcgi?mhc2=Ez2CZ0s7jSOYgdKz>

Where do I go from there? I'm not sure if I have to add a new Mail Host or configure the Verizon one already present. Even then, I'm not sure which Hosts/Domain I have to choose from the drop-down menu. Steve

Yes. I am using AOL to check my Verizon mail now. How would I go about updating my mailhost? Steve

Using AOL Mail for Verizon as Verizon discontinued their webmail service. I was trying to report spam from the account on there (AOL Mail) and got this error (both sending it to the reporting address and copy & pasting it into reporting form on spamcop.net) This is my current host setup. How would I configure it so I can report spam form my Verizon address on AOL Mail? Would I have to change the Host/Domain settings? Any help is appreciated. Thanks Steve

I was reporting a spam email originating from cantv.net but the originating IP address (41.86.234.165) won't parse/provide reporting addresses. I have run a whois search on the originating IP address (41.86.234.165) and gotten the abuse contacts for said IP address. How do I configure my mailhosts to accept this so when I report emails from this ISP (cantv), IP addresses like this (41.86.234.165) also display abuse contacts to forward the spam to? This string of IP addresses 41.86.234.0 - 41.86.234.255 originates in Benin. https://www.spamcop.net/sc?id=z6201383927z31648603dc0cf041920d2b6b403ab134z Please help. Steve

I received a spam email and processed it through spamcop.net. Also, sorry if I posted the whole link parse. The link below [after spamcop determined the details of it] was not able to give me an email address that would accept the link to be reported. Instead I got this: http://www.spamcop.net/sc?id=z1333733145z6...3e5809bc2d36bez [this tracking link does not include this]: This tracking link below does include http://members.spamcop.net/sc?id=z13337331...3e5809bc2d36bez Parsing header: Finding links in message body Recurse multipart: Parsing text part Parsing HTML part Resolving link obfuscation https://www.celebmashup.com/index2.html Tracking link: https://www.celebmashup.com/index2.html [report history] ISP does not wish to receive report regarding https://www.celebmashup.com/index2.html Resolves to 83.142.25.138 Routing details for 83.142.25.138 [refresh/show] Cached whois for 83.142.25.138 : abuse[at]coreix.net Using abuse net on abuse[at]coreix.net No abuse net record for coreix.net Using best contacts abuse[at]coreix.net ISP does not wish to receive reports regarding https://www.celebmashup.com/index2.html - no date available If reported today, reports would be sent to: Re: https://www.celebmashup.com/index2.html (EXPERTS ONLY: SpamCop deputy will review this website.) Internal spamcop handling: (appeals) If I wanted to report the above link to the spamcop Deputy, how would I go about doing that since an email address was not displayed to send a report about this link to the Spamcop Deputy. I realize I received this email on Monday, 6/18. Note that I don't check the AOL account [nyanks32685[at]aol.com] that this was sent to very often. I obviously missed it if I didn't check the account for spam email a few days after I had received this email. Hope this is specific enough for you guys. Steve