Outernaut Posted September 13, 2020 Share Posted September 13, 2020 I just received this spam and manually applied it to SpamCop (spamcop.net) Hope the "Tracking URL" will help. https://www.spamcop.net/sc?id=z6649444921z99fe2e4ed82404e339f14c6492a2f6c3z Question: Did this come from the internal site to where it was sent? ~O~ Quote Link to comment Share on other sites More sharing options...
petzl Posted September 13, 2020 Share Posted September 13, 2020 (edited) 2 hours ago, Outernaut said: I just received this spam and manually applied it to SpamCop (spamcop.net) Hope the "Tracking URL" will help. https://www.spamcop.net/sc?id=z6649444921z99fe2e4ed82404e339f14c6492a2f6c3z Question: Did this come from the internal site to where it was sent? ~O~ Your email provider has not stamped a received FROM IP line Although a IP is mentioned 166.181.83.113 ? Edited September 13, 2020 by petzl Quote Link to comment Share on other sites More sharing options...
gnarlymarley Posted September 15, 2020 Share Posted September 15, 2020 On 9/13/2020 at 4:50 PM, petzl said: Your email provider has not stamped a received FROM IP line Outernaut, I expect to see an IP somewhere in the Received line such as the following. Received: from oksupp ([IP.add.re.ss]) by elm.nocdirect.com On 9/13/2020 at 2:08 PM, Outernaut said: Did this come from the internal site to where it was sent? Without the IP address in the Received line, I would have to assume this came from the internal site directly. Which is probably what SpamCop is doing. Quote Link to comment Share on other sites More sharing options...
KNERD Posted September 20, 2020 Share Posted September 20, 2020 (edited) I am getting the same thing as of today, and I am my own email provider https://www.spamcop.net/sc?id=z6650350477z80b0fce72a3dcf5024577c98ea9276cfz https://www.spamcop.net/sc?id=z6650350591z4d1415e917292ee52ab3f7832ae5fa40z Edited September 20, 2020 by KNERD Quote Link to comment Share on other sites More sharing options...
petzl Posted September 20, 2020 Share Posted September 20, 2020 55 minutes ago, KNERD said: I am getting the same thing as of today, and I am my own email provider https://www.spamcop.net/sc?id=z6650350477z80b0fce72a3dcf5024577c98ea9276cfz https://www.spamcop.net/sc?id=z6650350591z4d1415e917292ee52ab3f7832ae5fa40z You email server changed? Updated? Quote Link to comment Share on other sites More sharing options...
KNERD Posted September 21, 2020 Share Posted September 21, 2020 3 hours ago, petzl said: You email server changed? Updated? No changes to the server. I even redid the mail host for it just now. Still same result Quote Link to comment Share on other sites More sharing options...
gnarlymarley Posted September 21, 2020 Share Posted September 21, 2020 11 hours ago, KNERD said: No changes to the server. I even redid the mail host for it just now. Still same result The mailhost update may be why both seem to be reportable now. Tracking message source: 209.85.160.176: Tracking message source: 103.102.237.55: I have not noticed any delays when I update my mailhosts. Quote Link to comment Share on other sites More sharing options...
Outernaut Posted September 21, 2020 Author Share Posted September 21, 2020 On 9/13/2020 at 3:50 PM, petzl said: Your email provider has not stamped a received FROM IP line Although a IP is mentioned 166.181.83.113 ? Just a note to say thanks - it's great having pro's explain things. Quote Link to comment Share on other sites More sharing options...
petzl Posted September 21, 2020 Share Posted September 21, 2020 19 hours ago, KNERD said: No changes to the server. I even redid the mail host for it just now. Still same result Your server IP static? Not dynamic? The email host update has fixed issues.https://www.spamcop.net/sc?id=z6650350477z80b0fce72a3dcf5024577c98ea9276cfzhttps://www.spamcop.net/sc?id=z6650350591z4d1415e917292ee52ab3f7832ae5fa40z Quote Link to comment Share on other sites More sharing options...
KNERD Posted September 22, 2020 Share Posted September 22, 2020 Yes it is static IP address. Just reported email again. It is not obtaining the IP address again, Quote Link to comment Share on other sites More sharing options...
gnarlymarley Posted September 22, 2020 Share Posted September 22, 2020 (edited) 3 hours ago, KNERD said: Just reported email again. It is not obtaining the IP address again, One question that I am not sure if you know, you can revisit any of your tracking URLs and from my experience they will get any mailhost changes you make. You have about 48 hours from the time the email was received by your border server to report. 18 hours ago, petzl said: Your server IP static? Not dynamic? The email host update has fixed issues. My email provider's IP is dynamic and I have never had a problem reporting or using mailhosts. Then I use exim and KNERD seems to be using postfix. Maybe SpamCop might be parsing the headers from different servers differently? Edited September 22, 2020 by gnarlymarley Quote Link to comment Share on other sites More sharing options...
KNERD Posted September 23, 2020 Share Posted September 23, 2020 On 9/22/2020 at 9:53 AM, gnarlymarley said: One question that I am not sure if you know, you can revisit any of your tracking URLs and from my experience they will get any mailhost changes you make. You have about 48 hours from the time the email was received by your border server to report. I did go back and try, and it was then finding the IP address of the old message, but more than 48 hours had passed Quote Link to comment Share on other sites More sharing options...
gnarlymarley Posted September 29, 2020 Share Posted September 29, 2020 On 9/23/2020 at 10:03 AM, KNERD said: I did go back and try, and it was then finding the IP address of the old message, but more than 48 hours had passed Hmmm, I wonder if it works for you if you wait without doing anything. Such as revising a tracking URL that didn't work after an hour or two. If so, might be some other issue. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.