Jump to content
Sign in to follow this  
paul.hunt

No source IP address found, cannot proceed

Recommended Posts

I have been getting this "error" more frequently lately on spams that I post by copying the raw source from my email client. This method usually works, and always in the past, but lately not always. I can't see the difference in the headers between the ones that wokd and the ones that don't.

Example, here is the earliest Received: line from a recent spam that Spamcop said had no source IP:

Received: from unknown (HELO [60.23.151.61]) ([60.23.151.61])

by mxip27a.cluster1.charter.net with ESMTP; 25 Sep 2006 11:47:57 -0400

Share this post


Link to post
Share on other sites
1: Received: from mxip27a.cluster1.charter.net (mxip27a.cluster1.charter.net [209.225.28.184]) by mxsf09.cluster1.charter.net (8.12.11.20060308/8.12.11) with ESMTP id k8PFlaeG018506 for <x>; Mon, 25 Sep 2006 11:48:13 -0400

Hostname verified: mxip27a.cluster1.charter.net

Possible forgery. Supposed receiving system not associated with any of your mailhostsWill not trust anything beyond this header

No source IP address found, cannot proceed.

The line in red is the problem. Either you have not set up mailhosts, or your ISP has added a server that is not currently listed. I would try setting up your mailhosts again and see if that fixes the problem.

Share this post


Link to post
Share on other sites
The line in red is the problem. Either you have not set up mailhosts, or your ISP has added a server that is not currently listed. I would try setting up your mailhosts again and see if that fixes the problem.

Ah, ha. Thank you. Yes, I hadn't paid attention, but that spam had hit a different email address, one I hadn't added a mailhost for. Reporting works now that I have.

Interestingly that line you showed in red does NOT appear on the page when SpamCop rejects the report attempt. It only shows "No source IP address found, cannot proceed".

Share this post


Link to post
Share on other sites
Interestingly that line you showed in red does NOT appear on the page when SpamCop rejects the report attempt. It only shows "No source IP address found, cannot proceed".

Do you have the "Show Full / Technical Details" selected in your Preferences as found on your logged-in www.spamcop.net page?

Share this post


Link to post
Share on other sites

I am having the same problem. It also says the receiving mailhost isn't associated with any of my known mailhosts. The receiving mailhost on one I got today is listed as vms169127.mailsrvcs.net, which is an unfamiliar name that I assume is associated with Verizon although my POP server is incoming.verizon.net. But others that got through without a problem are vms169123.mailsrvcs.net, vms169121.mailsrvcs.net, and vms051.mailsrvcs.net Why are some being recognized and others aren't?

Share this post


Link to post
Share on other sites

They have most likely been added by verizon recently. You can email the additional servers to the deputies and they can usually add them to that list pretty quickly.

Share this post


Link to post
Share on other sites

I received 2 of these that have come from my website host who has NOT added any mail servers.

Here's an example:

X-Virus-Scan: Scanned by clamdmail 0.15 (no viruses);
  Fri, 06 Oct 2006 09:29:18 +0000
Received: from igld-84-228-47-158.inter.net.il (HELO INTEL) (84.228.47.158)
  by 10-166-152-66-dedicated.multacom.com with SMTP; 6 Oct 2006 09:29:17 -0000
Received-SPF: none (10-166-152-66-dedicated.multacom.com: domain at 2die4.com does not designate permitted sender hosts)
	identity=mailfrom; client-ip=84.228.47.158;
	envelope-from=&lt;marlin[at]2die4.com&gt;;
Message-ID: &lt;{DIGIT}{DIGIT}{DIGIT}{DIGIT}{DIGIT}{DIGIT}{DIGIT}{DIGIT}{DIGIT}{DIGIT}{DIGIT}{DIGIT}{DIGIT}{DIGIT}.7BB9378A21[at]LILWT&gt;
From: "Uucp" &lt;adolphus[at]moscowmail.com&gt;
To: &lt;x&gt;
Subject:  Up to 500% more volume - Cover her in it if you want  
Date: Fri, 6 Oct 2006 18:27:44 +0200
MIME-Version: 1.0
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
Thread-Index: r7mpuPat2eqdJrbvoXZQsEKzBo96cK4YM1MG
Content-Type: text/html;
		charset="Windows-1251"
Content-Transfer-Encoding: 7bit

&lt;html&gt;
&lt;body bgcolor=#ffffff&gt;
&lt;font color=#fefefe&gt;yb rough whose dole &lt;/font&gt; &lt;br&gt;
Longer orgasms - The longest most intense orgasms of your life &lt;br&gt;
&lt;font color=#fefefe&gt;else gala afraid leak &lt;/font&gt; &lt;br&gt;
 Rock hard erections - Erections like steel &lt;br&gt;
&lt;font color=#fefefe&gt;bandit names meat mgmt &lt;/font&gt; &lt;br&gt;
 Increased sexual desire - Enhanced libido &lt;br&gt;
&lt;font color=#fefefe&gt;roost wp buff evolve &lt;/font&gt; &lt;br&gt;
 Ejaculate like a porn star - Stronger ejaculation (watch where your aiming) &lt;br&gt;
&lt;font color=#fefefe&gt;starr perry dust men &lt;/font&gt; &lt;br&gt;
 Multiple orgasms - Cum again and again &lt;br&gt;
&lt;font color=#fefefe&gt;flew news mushy bwana &lt;/font&gt; &lt;br&gt;
 Up to 500% more volume - Cover her in it if you want  &lt;br&gt;
&lt;font color=#fefefe&gt;make stir brags we'll &lt;/font&gt; &lt;br&gt;
 Sweeter tasting sperm - Studies show it improves the flavor  &lt;br&gt;
&lt;a href="http://trounces.net/spurm/?accbaz"&gt;You can try it now&lt;/a&gt;
&lt;/body&gt;
&lt;/html&gt;

Any ideas?

Share this post


Link to post
Share on other sites
I received 2 of these that have come from my website host who has NOT added any mail servers.

Here's an example:

Any ideas?

I don't know what you are asking, actually. Who/what did all the (assumed) munging?

Where's the Tracking URL (which may be what your question was really about?)

Share this post


Link to post
Share on other sites

I don't have a tracking URL. My host runs SpamAssasain, so when I click on "original message before SpamAssassin", I use that information to send a report. I did that here and the above text is what was given to me. I replaced my email address with an 'x', but the rest is as it was sent to me.

When I paste that data into the parser, I get the error that there is no source IP and it cannot complete th report. I'm wondering why I find some issues like this... is it the formatting of the header? Can I do anything to make this data parsable?

Share this post


Link to post
Share on other sites
Here's an example:
I parsed your example with a non-Mailhosted account, resulting in Tracking URL http://www.spamcop.net/sc?id=z1097698991z9...be2dfc7dd0c4fcz, which gave me the following:
Sorry, this email is too old to file a spam report. You must report spam within 2 days of receipt. This mail was received on 6 Oct 2006 09:29:17 -0000

Message is 3.6 days old

...

If reported today, reports would be sent to:

Re: 84.228.47.158 (Administrator of IP block - statistics only)

abuse[at]smile.net.il

What Tracking URL did you try to use?

Share this post


Link to post
Share on other sites
aaah, that's WHY is does not work... :ph34r:
Very droll ... the "Reporting Sever Status" graphic (for those who have it enabled) of course revealed a dropout, numbers of which have occurred previously, with earlier parser versions.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×