Bug(?) report

[snaller]

If this is not the right forum, then I apologize, but the FAQ isn't very helpfull on this, and I've only got so much time to spare.

I reported a spam, and as far as I can see the scanner disgards the real sender and instead wants to send it to my own provider.

The header starts:

Received: from appleton5.uni2.net (appleton5.uni2.net [129.142.244.18])

by ting.uni2.net (8.12.6/8.12.6) with ESMTP id j5U8D3Lg027534

for <*removedforboardposting*>; Thu, 30 Jun 2005 10:13:03 +0200

Received: from fitch4.uni2.net (fitch4.uni2.net [130.227.52.124])

by appleton5.uni2.net (8.12.11/SQL-8.12.11-8/8.12.11) with ESMTP id j5U8788Z012560

for <*removedforboardposting*>; Thu, 30 Jun 2005 10:07:08 +0200

Received: from 59-121-50-51.dynamic.hinet.net (59-121-50-51.dynamic.hinet.net [59.121.50.51])

by fitch4.uni2.net (Postfix) with SMTP id 5E56513A1F2

for <*removedforboardposting*>; Thu, 30 Jun 2005 10:07:06 +0200 (CEST)

Received: from relate.hind cotman.intel.com (bloch.intel.com)

by snap.anglican.intel.com (8.11.7/8.11.9/d: outer.mc,v 1.L3)

with ESMTP id h066ols62859

for <jhzvkzvkr[at]fusemail.com>; Thu, 30 Jun 2005 01:07:06 -0800

It accepts the first, second and third recived lines. Then on the fourth it says "Ignored. 59.121.50.51 discarded as a forgery, using 130.227.52.124" - what?! 59.121.50.51 does resolve to 59-121-50-51.dynamic.hinet.net and to me that very much is the spammer, since 130.227.52.124 is the ISP file server.

What is the logic behind this? Or has someone figured out that if they tag a crap recive line on at the end spamcop pukes and just sends to the first name on the list. This has me wondering how many times I've reported fake reports - normally I don't know the addresses, but in this case it looke very odd (being the local isp)

[Wazoo]

If this is not the right forum, then I apologize, but the FAQ isn't very helpfull on this, and I've only got so much time to spare.

Not sure why you'd drag the FAQ into this. I'm thinking that the work that went into building the Forum Section, giving it a Titile, and a bit of description would have been enoigh to suggest that this post should have gone elsewhere.

SpamCop Reporting

How to Instructions Only - Problems and issues belong in the other specific Forum sections

Moving this to the "Reporting Help" Forum

[StevenUnderwood]

What is the logic behind this? Or has someone figured out that if they tag a crap recive line on at the end spamcop pukes and just sends to the first name on the list. This has me wondering how many times I've reported fake reports - normally I don't know the addresses, but in this case it looke very odd (being the local isp)

29784[/snapback]

First, a tracking URL would be very helpful to see what the parser is seeing. Also, do you have the MailHost configuration setup to help the parser determine what is a valid heder for your messages?

[snaller]

Not sure why you'd drag the FAQ into this. 

Because I want to report a bug. And so instead of getting an email address or a form where I could report that I'm give a FAQ. That is why. And the FAQ (overflowing with text) says to use the boards. That's why.

I'm thinking that the work that went into building the Forum Section, giving it a Titile, and a bit of description would have been enoigh to suggest that this post should have gone elsewhere.

Moving this to the "Reporting Help" Forum

29785[/snapback]

And I'm thinking that the forums are totally confusing and not helpfull. I sat starding at it for 5 minuttes wondering where the hell to put this. Especially since there doesn't seem to be a "report bugs" forum. "Reporting help" sounds like its for people who want some help with reporting (which I dont)

[snaller]

First, a tracking URL would be very helpful to see what the parser is seeing.

1. I thought tracking URLs are reports submitted? Since I just expressed my opnion that it was doing it wrong, I obviously did not submit it.

2. I fear that would reveal to much personal information.

Also, do you have the MailHost configuration setup to help the parser determine what is a valid heder for your messages?

29786[/snapback]

Nope. Never been told to, didn't know it was there or that it was required.

[Wazoo]

I'm guessing that you are making references to the www.spamcop.net FAQ .. there is an alternate version here that may help you search for things with your limited timeframe. The snippet of headers provided is really insufficient to try to "manufacture" something else to arrempt to follow the parser flow. (Yes, I coule, but like you, I'd rather spend time doing other things.)

Tracking URL: please see the FAQ here, follow the Glossary link

MailHost: has its own Forum section, has its own links on "your" preference pages

You say "reporting a bug" ... "we" are saying that at this point, you've not provided anything to work with that "is trustworthy" (for lack of a better word) ... not saying anything derogatory, just that the snippet of data offered isn't enough to "prove" anything. (And as said above, I'm not into playing games tight now.)

[StevenUnderwood]

1. I thought tracking URLs are reports submitted? Since I just expressed my opnion that it was doing it wrong, I obviously did not submit it.

2. I fear that would reveal to much personal information.

29789[/snapback]

1. Tracking URL's are for anything submitted for parsing. You can cancel the report and still provide the Tracking URL (which is available before the report is sent).

2. The personal information is munged out (you can look at the same link and see what will be shown, but without it we can not answer your questions as to why the parser stops too early. A particular instance of a parse stopping early is not a bug. Usually it is easily explained with the proper information.

Nope. Never been told to, didn't know it was there or that it was required.

29789[/snapback]

It currently is not required, but highly advisable, especially if you have seen reports heading to your ISP. It defines what a valid path to your mailbox looks like so spamcop can save the lookup steps (which can be affected by outside influences, down servers for instance) and start with the last defined header. In this case it would probably have trusted the header in question and sent the report off to hinet.

[snaller]

I'm guessing that you are making references to the www.spamcop.net FAQ ..

Yes I'm using spamcop.net, I'm sorry if they are linking to something else.

  The snippet of headers provided is really insufficient to try to "manufacture" something else to arrempt to follow the parser flow.

That is unfortunate beacuse that is all there was (of course there was subject/date and body but that shouldn't be relevant)

You say "reporting a bug" ... "we" are saying that at this point, you've not provided anything to work with that "is trustworthy" (for lack of a beter word) ... not saying anything derogatory, just that the snippet of data offered isn't enough to "prove" anything.  (And as said above, I'm not into playing games tight now.)

29790[/snapback]

It wasn't a snippet of data, it was the complete routing information.

But I was mostly trying to be helpfull in making a better and bug free product, but if you don't give a s^^it, I don't.

I just deleted the receive line and it generated a more credible complaint.

I don't plan to read this thread anymore, if you want something you can email me (I'm assuming the spamcop people can see the email addresses used for registering)

[turetzsr]

Especially since there doesn't seem to be a "report bugs" forum. "Reporting help" sounds like its for people who want some help with reporting (which I dont)

29787[/snapback]

...Well, actually, in terms of our peer-to-peer support here, you do. It may look like a bug to you but it is actually something the parser does to try to find the source of the spam without tripping on a spammer trick to fool the parser. To do that, it has to make certain assumptions. The best question for you to ask us to help you would be: why does the parser do this and what can I do to help the parser get the right answer for my situation? That's the question StevenUnderwood tried to answer. And for us to see what the parser is doing with your spam's headers, we need to look at the parser results, which we can only see by navigating to the data via the tracking URL.

But I was mostly trying to be helpfull in making a better and bug free product, but if you don't give a s**t, I don't.

29787[/snapback]

...Then why did you come here (not the forum, per se, but to SpamCop to lodge your complaint or bug report or whatever you wish to call it) in the first place? Attitude readjustment alert! Also, the four-letter word reduces any credibility you might have had and will reduce the chance of your accomplishing anything by turning off people who find it objectionable.

I don't plan to read this thread anymore, if you want something you can email me (I'm assuming the spamcop people can see the email addresses used for registering)

29792[/snapback]

...No, I can't and, anyway, I wouldn't communicate with you via e-mail as it is not secure. Besides, you've started a thread in this forum and it doesn't make sense to start numerous separate communication threads via e-mail when this one is already here.

If this is not the right forum, then I apologize, but the FAQ isn't very helpfull on this, and I've only got so much time to spare.

29784[/snapback]

...The FAQ to which there is a link on the first page of the forums here (Pinned: Original SpamCop FAQ Plus - Read before Posting) is more helpful -- although OP does not plan to return, others with same problem who happen across this thread should look for a link on that FAQ labeled "Why does SpamCop want to send a report to my own network administrator?"

[Wazoo]

I'm guessing that you are making references to the www.spamcop.net FAQ ..

Yes I'm using spamcop.net, I'm sorry if they are linking to something else.

Interesting, after just having gone through the process of renaming the "Forum FAQ" here to read "SpamCop FAQ" to allegedly solve some confusion ....

That is unfortunate beacuse that is all there was (of course there was subject/date and body but that shouldn't be relevant)

It wasn't a snippet of data, it was the complete routing information.

So you say. From this side of the screen, there are users that have "been around" for many years, there are users that touched their first keyboard yesterday, their are users that choose to use their own definitions for words that they picked up somewhere ... so you say "that's all there was" ... I'm standing on that only a snippet was provided....

But I was mostly trying to be helpfull in making a better and bug free product, but if you don't give a s^^it, I don't.

Asking for actual data is a long way from "don't give a hoot" ... thowing a bit of a hissy fit doesn't work either.

I just deleted the receive line and it generated a more credible complaint.

And apparently setting yourself up for possible problems based on admitting to violating the "Reporting Rules" that you agreed to when signing up to ise the SpamCop tool-set. Data also available in either version of the FAQ you'd care to research.

I don't plan to read this thread anymore, if you want something you can email me (I'm assuming the spamcop people can see the email addresses used for registering)

Doesn't work like that here. You don't want to follow up on your query, that's your decision. At present, there are only two people with access to look at your "data" here. As stated previously and emphasized here, if it isn't worth your time to offer a complete data set, not sure why you think it's worth 'my' time to chase you down and make the same request for data in another venue.

[Jeff G.]

For s's&g's, I dummied up a test submission regarding this issue, which can be found at http://www.spamcop.net/sc?id=z780561915zd7...c364a0f949fe7az, and then cancelled it so that none of you would be tempted to "Send spam Report(s) Now".

The resulting parse finds the correct source 59.121.50.51 and offers to send the report to the correct party spam<at>ms1.hinet.net.

snaller and others could do the same thing the next time they find a similar problem.