Jump to content
kolor

What part header

Recommended Posts

Hi I would like ask about spam header .Spamcop parsal refuse send me spam .

This header is incomplete. Please supply the full headers of the spam you're trying to report.
No source IP address found, cannot proceed.
 
What part start and finish header .For two form .

Share this post


Link to post
Share on other sites
Posted (edited)
6 hours ago, kolor said:

You need to cut the post (yhen past) in notes, after you copy the rest for parsing
 

Delivered-To: x
Received: by 10.223.201.136 with SMTP id f8csp2123766wrh;
        Sat, 10 Mar 2018 03:20:26 -0800 (PST)
X-Received: by 2002:a19:4f13:: with SMTP id d19-v6mr1066967lfb.59.1520680826479;
        Sat, 10 Mar 2018 03:20:26 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1520680826; cv=none;
        d=google.com; s=arc-20160816;
        b=P7TdXGavTfbFddBKoAk45QuiOQMYIy63/m8SeRSw9gq8o141uxioRpVtcyGGZLAXUd
         v5+9sp8/fPduSl8O0ipNT+8FEtUUXPNDUAoqWmOk2skh4OZL7WLHM06V2tqNRh2JTaoT
         OOVgjfAk1maFMU3XfRX+Y8uJUksZ2wQIIClfcbcB/ogzV1wyWIQGk05o/KIlDuA2Se6f
         u242J6KH1aXlRPlAoNHPHaxpFtx6Djv4yMf5cIOnNUa06HN7QSXaPxvgOk5z8z6aP1Qf
         n21KEciqCNWUsQzVDY8ylBw8F0kFtnL1AFmRusWP1Gzpd5sV+bbHeqvq1bdJNw1gjRid
         tDng==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=to:subject:message-id:date:from:reply-to:mime-version
         :dkim-signature:arc-authentication-results;
        bh=mJPni5t3wrzB2pC259Guvd85UzX0iE/CzbIPS4vPCws=;
        b=E76LVMupyIlJ2IIbta3Hw9IvXEN+PYxHLz1zNGhG60yGJqVK/BrZ2AJDAG6RKTYHR9
         vL6dEnXmXgwSRWCwEJdlKgJI8JSMV9Ang8y/5e8H4qS6EUsIyYWeOnzlnXWrXDcGK3Zg
         Fd5FkQUOURbL/S36gVI7fG1mK7hDLCHHVO6Pka2dClu0JaSr26/KS2sx/4TDzZ8hUQil
         Gk5XTijkD7Dyp8dbWwdYVHsgoEEMlF2VzZWvXUfUTpHzhKfGM0o8sGHKwiRdY1sisO8D
         txnJLD89f1VkcLojlE+HByvleR0vdesfGJH+bvAu1uvKW8kJXdJvcce1+8M805wt+Y4f
         7Jug==

Results are no whois/abuse info but a search by me gives "support[at}he.net info[at]he.net abuse[at]he.nett" for your "z_User_Notification" put ip address in these notes

As they appear to be in USA also report to phishing-report[at]us-cert[dot]gov

https://www.spamcop.net/sc?id=z6451451650z8561df195eff1c3227cf697a8f7eb239z

Edited by petzl

Share this post


Link to post
Share on other sites

ok but this is wrong address ,Sorry for my limit English understanding .

Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65])
        by mx.google.com with SMTPS id t81-v6sor677032lff.33.2018.03.10.03.20.26

 

Share this post


Link to post
Share on other sites

The issue is with this blank line here:

X-SpamCop-note: Converted to text/plain by SpamCop (outlook/eudora hack)

Delivered-To: x

Which the parser cannot find the from, to, and subject lines above that blank line.  In all my years, I have never seen a spam with the X-SpamCop-note header in it.  That blank line in the middle of the headers leads me to believe that this is a mutliple copy/paste headers, possibly from different emails.

Share this post


Link to post
Share on other sites
Posted (edited)
57 minutes ago, gnarlymarley said:

The issue is with this blank line here:


X-SpamCop-note: Converted to text/plain by SpamCop (outlook/eudora hack)

Delivered-To: x

Which the parser cannot find the from, to, and subject lines above that blank line.  In all my years, I have never seen a spam with the X-SpamCop-note header in it.  That blank line in the middle of the headers leads me to believe that this is a mutliple copy/paste headers, possibly from different emails.

only sometimes works! This one has have ONLY the headers copied from and below, the link show what needs to be posted

ARC-Authentication-Results: i=1; mx.google.com;

https://www.spamcop.net/sc?id=z6451451650z8561df195eff1c3227cf697a8f7eb239z;action=display

the "headers" above that are copied and put in notes 

Edited by petzl

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×