zachariah Posted April 21, 2004 Share Posted April 21, 2004 Shoot, I accidentally just deleted the message, so I can't show you the source. I've never had this problem before. I have all my mail forwarded from my server (I have CPanel/Shell access to it) directly to my spamcop email address, and then IMAP that account. I didn't move the message around, it was put directly into my Held Mail folder by SpamCop based on an IP in the SCBL. After attempting to report it, I used Mozilla Thunderbird to view the source of hte message (which was in my Trash folder) and indeed there was no body to the message. I have two questions: Why won't it report with no body -- why does that matter? (I think I know the answer, but I want to hear from people who do know) How do I fix this if it ever happens again, or do I just let it go? Output from the reporting page: spam Header This page may be saved for future reference: http://www.spamcop.net/sc?id=z432055276z0c...49d738ef947c7fz update 68.250.111.84 0: Received: from unknown (192.168.1.101) by blade4.cesmail.net with QMQP; 21 Apr 2004 03:35:22 -0000 Internal handoff at SpamCop 1: Received: from centipede.vosn.net (205.214.76.128) by mailgate.cesmail.net with SMTP; 21 Apr 2004 03:35:21 -0000 SpamCop received mail from Award ( 205.214.76.128 ) Hostname verified: centipede.vosn.net 2: Received: from [24.190.177.20] (helo=ool-18beb114.dyn.optonline.net) by centipede.vosn.net with smtp (Exim 4.24) id 1BG8W4-0004fN-Kn for x; Tue, 20 Apr 2004 21:35:17 -0600 Award received mail from 24.190.177.20 Hostname verified: ool-18beb114.dyn.optonline.net 3: Received: from 68.250.111.84 by 24.190.177.20; Wed, 21 Apr 2004 07:26:11 +0300 Possible forgery. Supposed receiving system not associated with any of your mailhosts Will not trust anything beyond this header Trivial forgery Tracking message source: 24.190.177.20: Routing details for 24.190.177.20 [refresh/show] Cached whois for 24.190.177.20 : abuse[at]cv.net Using abuse net on abuse[at]cv.net abuse net cv.net = abuse[at]cv.net Using best contacts abuse[at]cv.net 24.190.177.20 listed in dnsbl.njabl.org ( 127.0.0.3 ) 24.190.177.20 listed in dnsbl.njabl.org ( 127.0.0.3 ) 24.190.177.20 listed in cbl.abuseat.org ( 127.0.0.2 ) 24.190.177.20 is an open proxy 24.190.177.20 not listed in plus.bondedsender.org 24.190.177.20 not listed in query.bondedsender.org 24.190.177.20 not listed in iadb.isipp.com No body provided, check format of submission If reported today, reports would be sent to: Re: 24.190.177.20 (Administrator of network where email originates) abuse [at] cv.net Link to comment Share on other sites More sharing options...
dra007 Posted April 21, 2004 Share Posted April 21, 2004 I got 6-8 messages with no body yesterday alone, in fact they break in the middle of the subject line. This issue came up before, you can manualy parse the header if you insert something like <no body provided> under the subject line.. Link to comment Share on other sites More sharing options...
Wazoo Posted April 21, 2004 Share Posted April 21, 2004 zachariah, your sample spam is of the much recently discussed type of "screwed and mangled headers" type ... scattered all over the place (and in the newsgroups) else I'd list "a" link here ... The Message-ID: line .. 4-5 characters, <D .. stuff .... the blank BCC: line .... and, of course, the "no body" syndrome ... There really isn't a "fix" per se at this point .. and modifying these to get a successful parse gets you into the "manipulating of spam" that can get you banned/fined etc. ... Link to comment Share on other sites More sharing options...
turetzsr Posted April 21, 2004 Share Posted April 21, 2004 Hi, zachariah, <snip> I have two questions: Why won't it report with no body -- why does that matter? (I think I know the answer, but I want to hear from people who do know) ...Essentially, IMHO it boils down "because that's the way Julian wants it." Since he's forgotten ten times more about how to report spam appropriately than I will ever know, I'm not going to gainsay it! How do I fix this if it ever happens again, or do I just let it go? <snip> ...Edit the e-mail body by adding text along the lines of "<original e-mail contained no body>." Link to comment Share on other sites More sharing options...
zachariah Posted April 21, 2004 Author Share Posted April 21, 2004 you can manualy parse the header if you insert something like <no body provided> under the subject line.. Thanks, I'll try that on the 2 more I just got. As for there being other threads I did a search, and poked around, but didn't find the other threads -- I did assume they were there, but gave up and made a new thread. Maybe I'll have more luck finding previously established threads the next time I need support. Thanks for trying to steer me on the right path, though. Link to comment Share on other sites More sharing options...
zachariah Posted April 21, 2004 Author Share Posted April 21, 2004 Success!! Link to comment Share on other sites More sharing options...
turetzsr Posted April 21, 2004 Share Posted April 21, 2004 Success!! ...All right! Thanks for letting us know. Link to comment Share on other sites More sharing options...
Wazoo Posted April 21, 2004 Share Posted April 21, 2004 As for there being other threads I did a search, and poked around, but didn't find the other threads Not that it's much help, but here's one that has some spam samples that compare ... especially with the Message-ID: issue ... http://forum.spamcop.net/forums/index.php?showtopic=971 Most of the large complaints are coming from those that submit in a fashion that doesn't allow your successful "manipulation", so all they see are the error messages. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.