wysiwyg Posted July 25, 2004 Share Posted July 25, 2004 I have recently sent two emails to Spamcop, via Mailwasher just like normal, but noticed the report that was generated, shows that I originated the spam. Spamcop shows the message header as: Return-Path: <mike[at]wysiwyg.co.nz> Received: from vmx2.spamcop.net (unknown [192.168.18.82]) by sc-app2.eq.ironport.com (Postfix) with ESMTP id 07D49515934 for <submit.tinmm0ubr2tqavvq[at]spam.spamcop.net>; Sat, 24 Jul 2004 20:10:06 -0700 (PDT) Received: from bm-2a.paradise.net.nz (HELO linda-2.paradise.net.nz) (202.0.58.21) by vmx2.spamcop.net with ESMTP; 24 Jul 2004 20:18:25 -0700 Received: from linda-2.paradise.net.nz (linda-2.paradise.net.nz [202.0.58.21]) by linda-2.paradise.net.nz (Paradise.net.nz) with ESMTP id <0I1E00JIH0SRRZ[at]linda-2.paradise.net.nz> for submit.TINmm0uBR2tQAvVq[at]spam.spamcop.net; Sun, 25 Jul 2004 15:10:04 +1200 (NZST) Received: from 57.220.113.252 (203-96-144-175.cable.paradise.net.nz [203.96.144.175]) by smtp-2.paradise.net.nz (Postfix) with SMTP id 568A69E4FA for <submit.TINmm0uBR2tQAvVq[at]spam.spamcop.net>; Sun, 25 Jul 2004 15:04:04 +1200 (NZST) Date: Sun, 25 Jul 2004 15:04:04 +1200 (NZST) From: mike[at]wysiwyg.co.nz To: undisclosed-recipients: ; Message-id: <20040725030404.568A69E4FA[at]smtp-2.paradise.net.nz> MIME-version: 1.0 X-Mailer: mailwasher Content-type: multipart/mixed; boundary=adefghhijklmnoppqrstuvwwxyz01233456789AA X-BLTSYMAVREINSERT: 74wZJPsDz0GJDKZ4VyiV1HL6upIA The original email header which I sent Spamcop was: Return-Path: <internetstakeslotto[at]safe-mail.net> Delivered-To: wysiwyg[at]paradise.net.nz X-Envelope-To: wysiwyg[at]paradise.net.nz Received: (qmail 27772 invoked from network); 24 Jul 2004 22:41:41 -0000 Received: from behemoth3.host4u.net (216.71.64.76) by pop3-1.paradise.net.nz with SMTP; 24 Jul 2004 22:41:41 -0000 Received: from safe-mail1870.com (cpc1-lewi1-6-0-cust145.brom.cable.ntl.com [80.6.131.145]) by behemoth3.host4u.net (8.11.6/8.11.6) with SMTP id i6OMdBD27792 for <mike[at]wysiwyg.co.nz>; Sat, 24 Jul 2004 17:39:14 -0500 Message-Id: <200407242239.i6OMdBD27792[at]behemoth3.host4u.net> From: AWARD WINNING NOTIFICATION <internetstakeslotto[at]safe-mail.net> To: mike[at]wysiwyg.co.nz Reply-To: globalfinancialhouse[at]mail2world.com Subject: PRIZE AWARD NOTIFICATION Date: Thu, 22 Jul 2004 23:38:36 +0100 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="335085e7-cf6b-4de4-bda9-f90faed15a83" Link to comment Share on other sites More sharing options...
Wazoo Posted July 25, 2004 Share Posted July 25, 2004 Let me just suggest that a Tracking URL would have shown what was submitted and what was parsed. I have yet to see the parsing engine ever make the kinds of changes you're trying to demonstrate with your snipped examples. Link to comment Share on other sites More sharing options...
petzl Posted July 25, 2004 Share Posted July 25, 2004 have recently sent two emails to Spamcop, via Mailwasher just like normal, but noticed the report that was generated, shows that I originated the spam. You have registered your mailhost? Link to comment Share on other sites More sharing options...
wysiwyg Posted July 25, 2004 Author Share Posted July 25, 2004 Let me just suggest that a Tracking URL would have shown what was submitted and what was parsed.13855[/snapback] You mean what is provided by SpamCop? http://www.spamcop.net/sc?id=z566889204zb3...9f7d437af66002z Link to comment Share on other sites More sharing options...
dbiel Posted July 25, 2004 Share Posted July 25, 2004 You mean what is provided by SpamCop? http://www.spamcop.net/sc?id=z566889204zb3...9f7d437af66002z 13857[/snapback] That is exactly what Wazoo meant. Reading the parse, it is quite clear that you have not registered your email addresses into the "MailHosts" system. The MailHosts system was setup for this very reason, to avoid reporting yourself as the source of the spam. It is highly recommended that you do not report anymore spam until you have completed the MailHost registration. Link to comment Share on other sites More sharing options...
Wazoo Posted July 25, 2004 Share Posted July 25, 2004 But, when using that Tracking URL (thanks) and then looking at the "entire spam" .. I'm more curious about the extra blank line showing between the To: and "Return-Path" lines. That break there would signal to the parser that the end of the headers was reached, and the only IP listed thus is "yours" ... end of analysis, as the rest of the header data would be seen as just distraction fodder ... Link to comment Share on other sites More sharing options...
Ellen Posted July 26, 2004 Share Posted July 26, 2004 But, when using that Tracking URL (thanks) and then looking at the "entire spam" .. I'm more curious about the extra blank line showing between the To: and "Return-Path" lines. That break there would signal to the parser that the end of the headers was reached, and the only IP listed thus is "yours" ... end of analysis, as the rest of the header data would be seen as just distraction fodder ... 13872[/snapback] As you said -- the parser sees nothing beyond the first received header when it is parsing because of the blank line after the "to" The user has no mailhosts defined. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.