Parser messing up

[DavidT]

I've been putting off setting up Mailhosts because I have so many different sources of email forwared into my Spamcop account. Up to today, this hasn't been a problem, resulting in less than a handful of reports going to my own email hosts out of thousands of reported spams.

However, I just now submitted my "overnight spam" for Quick Reporting (after first scanning through it and making sure it was all spam) and when I took at look at the "SpamCop Quick Reporting data" email to see where the reports went, I found that 34 reports had been sent to my primary email host.

OK, so I guess I'll check out setting up Mailhosts, but I'm left wondering why the parser suddenly changed its behavior today, so I'll provide some tracking URLs below in case anyone can shed some light (my host is Jumpline.com, which was not the actual source of any of the messages).

http://www.spamcop.net/sc?id=z646918105z38...1876ba8726c4f6z

http://www.spamcop.net/sc?id=z646918081zd2...a7ba44af923a71z

http://www.spamcop.net/sc?id=z646917990zfc...7ec50c11a9b6bcz

http://www.spamcop.net/sc?id=z646917755z9f...dc08ae05640101z

http://www.spamcop.net/sc?id=z646917719z9d...90d7e4718cc2cfz

As you look at any of those parsing reports, you'll see entries like this:

Reports regarding this spam have already been sent:

Re: 66.84.24.227 (Administrator of network where email originates)

Reportid: 1216829622 To: abuse[at]jumpline.com

However, in that same report, you'll also see:

Tracking message source: 218.153.176.210

and

If reported today, reports would be sent to:

Re: 218.153.176.210 (Administrator of network where email originates)

abuse[at]kornet.net

So, the parser seems to know that the email originated in Korea, and yet a report was sent to my email host, which was obviously only an intermediary. Sure, I can fix this with Mailhosts, but I shouldn't have to...the parser is goofing up.

Thanks,

DT

[StevenUnderwood]

So, the parser seems to know that the email originated in Korea, and yet a report was sent to my email host, which was obviously only an intermediary. Sure, I can fix this with Mailhosts, but I shouldn't have to...the parser is goofing up.

David,

The parser was only "goofing up" during the time your reports were going through. The fact that it is showing different parses now means that it is working correctly again. This is the reason for mailhosts, internal or external problems can cause intermittant problems in determining the source of the message, usually, as you found, stopping too soon during the parse.

Where all of these came through the same host to your account, it is possible that the DNS lookup was failing for that host, causing spamcop not to trust it and stopped looking any further (as it is designed to do). This could be caused by internet connection problems at spamcops end, a change in the DNS information or a new host at your ISP's end, or any where in between.

To get specifics, you will need to contact the deputies with the Tracking URL's you provided. They may be aware of what was going on at the time the reports were made.

Good luck with the mailhost config.

[Miss Betsy]

I was all for quick reporting because spamcop always worked well for me - until just before quick reporting became available. Then the same thing happened to me - out of the blue spamcop picked my ISP on several spams for no observable reason. On further investigation, exactly what Stephen described was happening (I forget which one) and it soon went back to normal and didn't happen again. But then I felt I had to read every quick reporting autoreport to see if it had happened again, which to me was more tedious than reporting one by one.

Good luck with mailhosts.

Miss Betsy

[turetzsr]

...As an alternative to the MailHosts configuration, you could send an e-mail to the deputies (deputies <at> spamcop <dot> net) explaining the situation. Forward the URLs that are resulting in reporting your e-mail host.

...The deputies might refer you to the MailHost config, though, so be prepared. <g>

[Ellen]

...As an alternative to the MailHosts configuration, you could send an e-mail to the deputies (deputies <at> spamcop <dot> net) explaining the situation.  Forward the URLs that are resulting in reporting your e-mail host.

...The deputies might refer you to the MailHost config, though, so be prepared.  <g>

16506[/snapback]

Consider yourself referred to mailhosts :-)

[DavidT]

Consider yourself referred to mailhosts :-)

Thanks the the personal reference...at least I know where to go if I have problems with the transition. :-)

DT