Jump to content

[Resolved] Incorrect originating IP detected by the web report form


TraceyC

Recommended Posts

I've searched the forums, site, and read the FAQs but haven't found a solution to this.

I have a number of spam coming to my work address which I am trying to report with the web based tool. The parser seems to identify the next to last IP address in the headers as the originating IP, which is incorrect. It is identifying my company's e-mail server as the injection point, rather than the bottom most IP address in the full headers.

An example is here

http://www.spamcop.net/sc?id=z3511383452z7...b6e7078c32aed8z

Spamcop says

130.80.240.50 (Administrator of network where email originates)

The headers say

Received: from exprod7mx187.postini.com (HELO psmtp.com) ([64.18.2.227]) by

ironport2.chron.com with ESMTP; 19 Nov 2009 04:24:58 -0600

Received: from source ([190.162.108.53]) (using TLSv1) by

exprod7mx187.postini.com ([64.18.6.11]) with SMTP; Thu, 19 Nov 2009

10:16:03 GMT

Therefore 190.162.108.53 is the originating source. The other spam messages have different originating IPs. The Spamcop parser always thinks they come from 130.80.240.50. What might be causing this problem? Thanks.

Link to comment
Share on other sites

Hi, TraceyC!

I've searched the forums, site, and read the FAQs but haven't found a solution to this.

<snip>

...Oops, I guess you (understandably) missed the SpamCop FAQ entry entitled "Why does SpamCop want to send a report to my own network administrator?"

...The solution is probably for you to complete the MailHosts configuration process. Again, see SpamCop FAQ entries "How do I configure Mailhosts for SpamCop?" and the several related links below that one.

...Good luck! And please do post here again if you need further explanation or information.

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...