[Resolved]Â Incorrect originating IP detected by the web report form

[TraceyC]

I've searched the forums, site, and read the FAQs but haven't found a solution to this.

I have a number of spam coming to my work address which I am trying to report with the web based tool. The parser seems to identify the next to last IP address in the headers as the originating IP, which is incorrect. It is identifying my company's e-mail server as the injection point, rather than the bottom most IP address in the full headers.

An example is here

http://www.spamcop.net/sc?id=z3511383452z7...b6e7078c32aed8z

Spamcop says

130.80.240.50 (Administrator of network where email originates)

The headers say

Received: from exprod7mx187.postini.com (HELO psmtp.com) ([64.18.2.227]) by

ironport2.chron.com with ESMTP; 19 Nov 2009 04:24:58 -0600

Received: from source ([190.162.108.53]) (using TLSv1) by

exprod7mx187.postini.com ([64.18.6.11]) with SMTP; Thu, 19 Nov 2009

10:16:03 GMT

Therefore 190.162.108.53 is the originating source. The other spam messages have different originating IPs. The Spamcop parser always thinks they come from 130.80.240.50. What might be causing this problem? Thanks.

[turetzsr]

Hi, TraceyC!

I've searched the forums, site, and read the FAQs but haven't found a solution to this.

<snip>

...Oops, I guess you (understandably) missed the SpamCop FAQ entry entitled "Why does SpamCop want to send a report to my own network administrator?"

...The solution is probably for you to complete the MailHosts configuration process. Again, see SpamCop FAQ entries "How do I configure Mailhosts for SpamCop?" and the several related links below that one.

...Good luck! And please do post here again if you need further explanation or information.

[SpamCopAdmin]

The user configured his Mailhosts and the parse is working correctly now.

- Don

[Farelf]

The user configured his Mailhosts and the parse is working correctly now.

Thanks Don, marking this "Resolved".