Errors encountered while reporting

[ismo]

I've reported spam many years with spamcop ( more than 5). Sometimes thare has been small hiccups which have been promptly fixed. Today (and yesterday) I've got a few spams which do not parse correctly, forwarding spam get resullt

"SpamCop encountered errors while saving spam for processing:

SpamCop could not find your spam message in this email:"

But there is spam, the common thing seems to be that they have email address user[at]europcareer.com where user part varies.

The spam is for " Current Open Position" scam.

As there is parsing error there is no reference to give here, cut&paste of headers and/or full spam are available if required.

If this were just one or two messages I would not worry but this seems to be new trend. All other spam reports are processed correctly.

br

ismo

[turetzsr]

Hi, ismo,

...Sorry to hear of your problem. What I would suggest you try is to paste the error message, between double-quote marks, into the search form near the top of any SpamCop Forum page, between the white "button" labeled "Search for -->" and the blue button labeled "GO," then press either button and peruse any promising-looking articles that are returned from the search. If you have any specific questions after reviewing those, please return here and post them and we'll try to answer. Thanks!

[SpamCopAdmin]

The error email tells the tale. It shows you exactly what you submitted.

The most common reason you get an error message is because the full headers were not present in the spam you submitted. SpamCop needs to see the entire path the message took on its way to you so it can track the spam back to the source.

SpamCop is looking for the full headers in one contiguous block of text, followed by a blank line, which signals the end of the headers, and then followed by the body text of the spam.

- Don D'Minion - SpamCop Admin -

service[at]admin.spamcop.net

[ismo]

The error email tells the tale. It shows you exactly what you submitted.

The most common reason you get an error message is because the full headers were not present in the spam you submitted. SpamCop needs to see the entire path the message took on its way to you so it can track the spam back to the source.

SpamCop is looking for the full headers in one contiguous block of text, followed by a blank line, which signals the end of the headers, and then followed by the body text of the spam.

- Don D'Minion - SpamCop Admin -

service[at]admin.spamcop.net

Well, I always have forwarded the spam messages same way : select messages, press forward , the messages are sent as attachments (Mozilla Thunderbird 17.0.8 , fedora 18 linux if that matters) . Don't understand how the headers could go wrong. There is something fishy in those spam messages, view source does not show anything special for human eye, perhaps there is something in the headers which breaks the parser. Or somebody between me and spamcop messes with the forwarded message.

Here are full headers and also start of the payload - hope it helps tracing what goes wrong. It may be that mozilla has problems with these spam messages, I don't know. My real email address is in the headers if you need to contact me directly.

br

ismo

Return-Path: <blindinglysxw[at]pado.com.br>

X-Original-To: ismo.salonen[at]codeit.fi

Delivered-To: codeit1[at]mailfront4.lau.hel.nebula.fi

Received: from mailscan.nebula.fi (mailscan4.nebula.fi [83.145.214.133])

by mailfront4.lau.hel.nebula.fi (Postfix) with ESMTP id 3EDED180435

for <ismo.salonen[at]codeit.fi>; Wed, 11 Sep 2013 02:04:51 +0300 (EEST)

Received: by mailscan.nebula.fi (Postfix, from userid 500)

id 3960261A25; Wed, 11 Sep 2013 02:04:51 +0300 (EEST)

X-spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on

mailscan4.pit.hel.nebula.fi

X-spam-Flag: YES

X-spam-Level: *****************

X-spam-Status: Yes, score=17.8 required=5.0 tests=BAYES_99,FILL_THIS_FORM,

FILL_THIS_FORM_LONG,HELO_DYNAMIC_IPADDR,RCVD_IN_BRBL_LASTEXT,RCVD_IN_PBL,

RCVD_IN_RP_RNBL,RCVD_IN_XBL,RDNS_NONE,URIBL_BLOCKED,URIBL_DBL_SPAM

autolearn=spam version=3.3.1

X-spam-Report:

* 1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

* https://senderscore.org/blacklistlookup/

* [200.6.163.250 listed in bl.score.senderscore.com]

* 3.3 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL

* [200.6.163.250 listed in zen.spamhaus.org]

* 0.4 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL

* 1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT

* [200.6.163.250 listed in bb.barracudacentral.org]

* 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.

* See http://wiki.apache.org/spamassassin/DnsBlo...sts#dnsbl-block

* for more information.

* [uRIs: europcareer.com]

* 1.7 URIBL_DBL_SPAM Contains an URL listed in the DBL blocklist

* [uRIs: europcareer.com]

* 3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100%

* [score: 1.0000]

* 0.8 RDNS_NONE Delivered to internal network by a host with no rDNS

* 2.0 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr

* 1)

* 0.0 FILL_THIS_FORM Fill in a form with personal information

* 3.4 FILL_THIS_FORM_LONG Fill in a form with personal information

Received: from residencial-200.6.163.250.costanet.com.co (unknown [200.6.163.250])

by mailscan.nebula.fi (Postfix) with ESMTP id 296B6620D6

for <ismo.salonen[at]codeit.fi>; Wed, 11 Sep 2013 02:04:46 +0300 (EEST)

Message-ID: <522F9D2F.902070[at]codeit.fi>

Date: Tue, 10 Sep 2013 18:04:44 -0500

From: <ismo.salonen[at]codeit.fi>

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en; rv:1.9.2.12) Gecko/20101027 Thunderbird/3.1.6

MIME-Version: 1.0

To: <ismo.salonen[at]codeit.fi>

Subject: [spam] Employment Opportunity

Content-Type: text/plain; charset=UTF-8; format=flowed

Content-Transfer-Encoding: 7bit

X-spam-Prev-Subject: Employment Opportunity

We are looking for fresh, fun and friendly people to join our great team.

Shifts are Monday - Friday with weekend hours on request.

Working schedule is no more than 2 hours a day and no later than 6 pm.

The only experience we require is your own.

[Farelf]

Unfortunately that data is of absolutely NO BENEFIT in diagnosing possible problems with the parsing. Why? The forum software eliminates "white space" to the left of posted text and it is that very white space that is necessary to parse headers - it indicates a continuation of the previous line and without it the parse will surely fail.

You need to log-in to your reporting account and paste in the spam in the submission box to be found in the "Report spam" tab**. Then capture the Tracking URL to post here - if the parse fails you must copy the URL during the session, I don't think you can retrieve it for a failed parse once the page has been dismissed.

**You should copy the spam ("View source") from your mail application - as I think you did to get the above - and paste it straight in to the form. Using Notepad or other editors as an intermediate step may interfere with line wrapping or otherwise "mangle" the text.

I have "corrected" your text and can confirm, using that member page submission method, that if the white space was in all the right places that spam should parse OK:

http://www.spamcop.net/sc?id=z5562845442z1...2a65450880ce52z

If your source does the same, we can eliminate malformed headers in the received spam as a problem (also subsequent processing by your network). Malformed headers entering your network was never particularly likely but does need to be eliminated as a possible cause. As does the subsequent processing within your network (mailscan.nebula.fi) - that is a far more likely culprit, it seems to me.

Hope this helps ...

[SpamCopAdmin]

I need to see the entire error email you're getting from SpamCop.

That shows exactly what you are submitting, which will tell me what the problem is.

Parsing the spam manually is of no value because it doesn't tell us what you're submitting by email.

- Don D'Minion - SpamCop Admin -

- Service[at]Admin.SpamCop.net -

[ismo]

The error message is

SpamCop encountered errors while saving spam for processing:

SpamCop could not find your spam message in this email:

<headers snipped, they do not contain anything special.>

But the message body part looks suspicious, last 6 lines of headers visible :

X-Priority: 3

X-Mailer: PHPMailer 5.1 (phpmailer.sourceforge.net)

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit

Content-Type: text/plain; charset="iso-8859-2"

X-spam-Prev-Subject: Virtual Manager Vacancy

V2UgYXJlIGxvb2tpbmcgZm9yIGZyZXNoLCBmdW4gYW5kIGZyaWVuZGx5IHBlb3BsZSB0byBq

b2luIG91ciBncmVhdCB0ZWFtLiAKU2hpZnRzIGFyZSBNb25kYXkgLSBGcmlkYXkgd2l0aCB3

ZWVrZW5kIGhvdXJzIG9uIHJlcXVlc3QuCldvcmtpbmcgc2NoZWR1bGUgaXMgbm8gbW9yZSB0

aGFuIDIgaG91cnMgYSBkYXkgYW5kIG5vIGxhdGVyIHRoYW4gNiBwbS4KVGhlIG9ubHkgZXhw

and so on. Something between me and spamcop messes with the contents. It could be 1)thunderbird. 2)postfix 3) my isp

or something else. I forwarded the spam to my local mailbox and there it is already corrupted. So what's wrong with thunderbird or postfix, any ideas ? I'll start reading postfix manual, so far it has always worked reliably. It could also be thunderbird but why would it act wierdly only with some messages ?

So this is not spamcop error, sorry for thinking so, it must be somewhere here.

br

ismo

[SpamCopAdmin]

I need to see a complete copy of the error EMAIL from SpamCop.

As I said, it shows us what you have submitted.

If you will send it to me by email, I will look into it for you. Service[at]SpamCop.net

- Don D'Minion - SpamCop Admin -

- Service[at]Admin.SpamCop.net -

[MisterBill]

I'm also seeing this problem, and it's occurring with email sent by Mailwasher and the piece of mail being tossed likely had multiple pieces of spam in it, all of which are presumably lost. Are you still interested in receiving a copy of the email to investigate? Sadly, I don't think it contains what was sent, which would be useful.

[turetzsr]

Hi, MisterBill,

...You needn't wait for an answer to your question here directly from Don (SpamCopAdmin); he appears to welcome all inquiries. You can reach him either at the address he posted or at the more general address accessible to the "entire team" (we don't know how many people that is currently) of SpamCop Deputies, deputies[at]admin.spamcop.net.

...Good luck!