Incorrect header parsing

[NightBird]

Today I received a reply on a spam report I've sent. It stated there was a bug in the header-parsing.

Received: from s016.interlize.net (s016.interlize.net [80.69.72.55])
	by nachtvogel.nl (Postfix) with ESMTP id 886FE2395D
	for <x>; Wed, 14 Jul 2004 17:42:02 +0200 (CEST)
Received: from 80.69.72.55 ([210.124.133.153])
	by s016.interlize.net (8.12.11/8.12.8) with SMTP id i6EFlDBC003626
	for <x>; Wed, 14 Jul 2004 17:47:14 +0200
X-Message-Info: klw961OKV840df79WS66ZXWAKMaceN8kNQH31sqXJrsKZY359M12
Received: (from inactive[at]210.124.133.153)
	by ithaca3.226.116.49.8 (5.77.0/4.66.1) id p02TCDmE231598;
	Wed, 14 Jul 2004 21:41:49 +0500

This lead to a report to the admin of "80.69.72.55", which is not correct. It had to go to "210.124.133.153".

[StevenUnderwood]

You have only provided a small portion of the headers so we can not determine why the parser rejected:

Received: from 80.69.72.55 ([210.124.133.153])

by s016.interlize.net (8.12.11/8.12.8) with SMTP id i6EFlDBC003626

for <x>; Wed, 14 Jul 2004 17:47:14 +0200

Do you have the tracking URL for this parse?

[NightBird]

You have only provided a small portion of the headers so we can not determine why the parser rejected:

Received: from 80.69.72.55 ([210.124.133.153])

by s016.interlize.net (8.12.11/8.12.8) with SMTP id i6EFlDBC003626

for <x>; Wed, 14 Jul 2004 17:47:14 +0200

Do you have the tracking URL for this parse?

These?

http://www.spamcop.net/sc?id=z548866838z4f...36f377cd5eeb32z

http://www.spamcop.net/mcgi?action=gettrac...rtid=1113060837

[StevenUnderwood]

From the first link:

If reported today, reports would be sent to:

Re: 210.124.133.153 (Administrator of network where email originates)

The problem could have been a passing one on the spamcop side when you parsed this message as it is now reporting what you, I, and the reported to ISP all thought was proper.

[NightBird]

From the first link:

If reported today, reports would be sent to:

Re: 210.124.133.153 (Administrator of network where email originates)

The problem could have been a passing one on the spamcop side when you parsed this message as it is now reporting what you, I, and the reported to ISP all thought was proper.

Well great, thanks for checking

Is there anyone from spamcop who can confirm there has been some kind of a problem at that moment, or that they have fixed a bug leading to this incorrect report?

[StevenUnderwood]

You could bring it to the attention of the deputies<at>spamcop.net

In the past, external problems (DNS delays and such) have caused intermittant problems, but I have not seen that as a problem recently. Does'n't mean they have not occured, however.

[Wazoo]

Is there anyone from spamcop who can confirm there has been some kind of a problem at that moment, or that they have fixed a bug leading to this incorrect report?

Not sure who might jump in and meet your criterion at this late point. At worst, you'd simply be reminded that you are ultimately responsible for which reports go out and where they are headed. As Steven has pointed out, there is always the chance that something could go wrong, the SpamCop parser being only a tool, and relying on a number of other external tools and databases .... yesterday, there were issues that caused Julian hmself to post over in the newsgroups;

Things should be returning to normal now.  We had some problems with

network congestion.

-=Julian=-

Perhaps there is/was some connection, but research now would be after the fact and as the parser is dynamic, there is probably no way to recreate the same conditions as found during your "failed" parse.