Jump to content

spam with no sender source? How is that?


Outernaut
 Share

Recommended Posts

2 hours ago, Outernaut said:

I just received this spam and manually applied it to SpamCop (spamcop.net)

Hope the "Tracking URL" will help.

https://www.spamcop.net/sc?id=z6649444921z99fe2e4ed82404e339f14c6492a2f6c3z

Question:

Did this come from the internal site to where it was sent?

~O~

Your email provider  has not stamped a received FROM IP line
Although a IP is mentioned 166.181.83.113 ?

Edited by petzl
Link to comment
Share on other sites

On 9/13/2020 at 4:50 PM, petzl said:

Your email provider  has not stamped a received FROM IP line

Outernaut, I expect to see an IP somewhere in the Received line such as the following.

Received: from oksupp ([IP.add.re.ss]) by elm.nocdirect.com
On 9/13/2020 at 2:08 PM, Outernaut said:

Did this come from the internal site to where it was sent?

Without the IP address in the Received line, I would have to assume this came from the internal site directly.  Which is probably what SpamCop is doing.

Link to comment
Share on other sites

55 minutes ago, KNERD said:

You email server changed? Updated?

Link to comment
Share on other sites

11 hours ago, KNERD said:

No changes to the server. I even redid the mail host for it just now. Still same result

The mailhost update may be why both seem to be reportable now.

Tracking message source: 209.85.160.176:

Tracking message source: 103.102.237.55:

I have not noticed any delays when I update my mailhosts.

Link to comment
Share on other sites

19 hours ago, KNERD said:

No changes to the server. I even redid the mail host for it just now. Still same result

Your server IP static? Not dynamic?  The email host update has fixed issues.
https://www.spamcop.net/sc?id=z6650350477z80b0fce72a3dcf5024577c98ea9276cfz
https://www.spamcop.net/sc?id=z6650350591z4d1415e917292ee52ab3f7832ae5fa40z

Link to comment
Share on other sites

3 hours ago, KNERD said:

Just reported email again. It is not obtaining the IP address again,

One question that I am not sure if you know, you can revisit any of your tracking URLs and from my experience they will get any mailhost changes you make.  You have about 48 hours from the time the email was received by your border server to report.

blob.png.f06363a59d26cf3083143ce64b57440b.png

18 hours ago, petzl said:

Your server IP static? Not dynamic?  The email host update has fixed issues.

My email provider's IP is dynamic and I have never had a problem reporting or using mailhosts.  Then I use exim and KNERD seems to be using postfix.  Maybe SpamCop might be parsing the headers from different servers differently?

 

Edited by gnarlymarley
Link to comment
Share on other sites

On 9/22/2020 at 9:53 AM, gnarlymarley said:

One question that I am not sure if you know, you can revisit any of your tracking URLs and from my experience they will get any mailhost changes you make.  You have about 48 hours from the time the email was received by your border server to report.

 

 

I did go back and try, and it was then finding the IP address of the old message, but more than 48 hours had passed

Link to comment
Share on other sites

On 9/23/2020 at 10:03 AM, KNERD said:

I did go back and try, and it was then finding the IP address of the old message, but more than 48 hours had passed

Hmmm, I wonder if it works for you if you wait without doing anything.  Such as revising a tracking URL that didn't work after an hour or two.  If so, might be some other issue.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...