No source IP address found, cannot proceed

[paul.hunt]

I have been getting this "error" more frequently lately on spams that I post by copying the raw source from my email client. This method usually works, and always in the past, but lately not always. I can't see the difference in the headers between the ones that wokd and the ones that don't.

Example, here is the earliest Received: line from a recent spam that Spamcop said had no source IP:

Received: from unknown (HELO [60.23.151.61]) ([60.23.151.61])

by mxip27a.cluster1.charter.net with ESMTP; 25 Sep 2006 11:47:57 -0400

[agsteele]

Received: from unknown (HELO [60.23.151.61]) ([60.23.151.61])

by mxip27a.cluster1.charter.net with ESMTP; 25 Sep 2006 11:47:57 -0400

Hi Paul!

You'll need to provide a tracking URL for anyone to be able to comment.

Instructions are here: http://forum.spamcop.net/forums/index.php?showtopic=4498

Andrew

[paul.hunt]

You'll need to provide a tracking URL for anyone to be able to comment.

Thanks Andrew,

http://www.spamcop.net/sc?id=z1079018710za...91d2de32127737z

[Telarin]

1: Received: from mxip27a.cluster1.charter.net (mxip27a.cluster1.charter.net [209.225.28.184]) by mxsf09.cluster1.charter.net (8.12.11.20060308/8.12.11) with ESMTP id k8PFlaeG018506 for <x>; Mon, 25 Sep 2006 11:48:13 -0400

Hostname verified: mxip27a.cluster1.charter.net

Possible forgery. Supposed receiving system not associated with any of your mailhostsWill not trust anything beyond this header

No source IP address found, cannot proceed.

The line in red is the problem. Either you have not set up mailhosts, or your ISP has added a server that is not currently listed. I would try setting up your mailhosts again and see if that fixes the problem.

[paul.hunt]

The line in red is the problem. Either you have not set up mailhosts, or your ISP has added a server that is not currently listed. I would try setting up your mailhosts again and see if that fixes the problem.

Ah, ha. Thank you. Yes, I hadn't paid attention, but that spam had hit a different email address, one I hadn't added a mailhost for. Reporting works now that I have.

Interestingly that line you showed in red does NOT appear on the page when SpamCop rejects the report attempt. It only shows "No source IP address found, cannot proceed".

[Farelf]

Paul, your tracking URL above - http://www.spamcop.net/sc?id=z1079018710za...91d2de32127737z was "live". I hit the [CANCEL] button. Some rascal could have fun at your expense (and possibly bother other innocent parties) if they got to the thing. Just submit the spam again if you want to report it.

[Wazoo]

Interestingly that line you showed in red does NOT appear on the page when SpamCop rejects the report attempt. It only shows "No source IP address found, cannot proceed".

Do you have the "Show Full / Technical Details" selected in your Preferences as found on your logged-in www.spamcop.net page?

[AlphaCentauri]

I am having the same problem. It also says the receiving mailhost isn't associated with any of my known mailhosts. The receiving mailhost on one I got today is listed as vms169127.mailsrvcs.net, which is an unfamiliar name that I assume is associated with Verizon although my POP server is incoming.verizon.net. But others that got through without a problem are vms169123.mailsrvcs.net, vms169121.mailsrvcs.net, and vms051.mailsrvcs.net Why are some being recognized and others aren't?

[Telarin]

They have most likely been added by verizon recently. You can email the additional servers to the deputies and they can usually add them to that list pretty quickly.

[btech]

I received 2 of these that have come from my website host who has NOT added any mail servers.

Here's an example:

X-Virus-Scan: Scanned by clamdmail 0.15 (no viruses);
  Fri, 06 Oct 2006 09:29:18 +0000
Received: from igld-84-228-47-158.inter.net.il (HELO INTEL) (84.228.47.158)
  by 10-166-152-66-dedicated.multacom.com with SMTP; 6 Oct 2006 09:29:17 -0000
Received-SPF: none (10-166-152-66-dedicated.multacom.com: domain at 2die4.com does not designate permitted sender hosts)
	identity=mailfrom; client-ip=84.228.47.158;
	envelope-from=<marlin[at]2die4.com>;
Message-ID: <{DIGIT}{DIGIT}{DIGIT}{DIGIT}{DIGIT}{DIGIT}{DIGIT}{DIGIT}{DIGIT}{DIGIT}{DIGIT}{DIGIT}{DIGIT}{DIGIT}.7BB9378A21[at]LILWT>
From: "Uucp" <adolphus[at]moscowmail.com>
To: <x>
Subject:  Up to 500% more volume - Cover her in it if you want  
Date: Fri, 6 Oct 2006 18:27:44 +0200
MIME-Version: 1.0
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
Thread-Index: r7mpuPat2eqdJrbvoXZQsEKzBo96cK4YM1MG
Content-Type: text/html;
		charset="Windows-1251"
Content-Transfer-Encoding: 7bit

<html>
<body bgcolor=#ffffff>
<font color=#fefefe>yb rough whose dole </font> <br>
Longer orgasms - The longest most intense orgasms of your life <br>
<font color=#fefefe>else gala afraid leak </font> <br>
 Rock hard erections - Erections like steel <br>
<font color=#fefefe>bandit names meat mgmt </font> <br>
 Increased sexual desire - Enhanced libido <br>
<font color=#fefefe>roost wp buff evolve </font> <br>
 Ejaculate like a porn star - Stronger ejaculation (watch where your aiming) <br>
<font color=#fefefe>starr perry dust men </font> <br>
 Multiple orgasms - Cum again and again <br>
<font color=#fefefe>flew news mushy bwana </font> <br>
 Up to 500% more volume - Cover her in it if you want  <br>
<font color=#fefefe>make stir brags we'll </font> <br>
 Sweeter tasting sperm - Studies show it improves the flavor  <br>
<a href="http://trounces.net/spurm/?accbaz">You can try it now</a>
</body>
</html>

Any ideas?

[Wazoo]

I received 2 of these that have come from my website host who has NOT added any mail servers.

Here's an example:

Any ideas?

I don't know what you are asking, actually. Who/what did all the (assumed) munging?

Where's the Tracking URL (which may be what your question was really about?)

[btech]

I don't have a tracking URL. My host runs SpamAssasain, so when I click on "original message before SpamAssassin", I use that information to send a report. I did that here and the above text is what was given to me. I replaced my email address with an 'x', but the rest is as it was sent to me.

When I paste that data into the parser, I get the error that there is no source IP and it cannot complete th report. I'm wondering why I find some issues like this... is it the formatting of the header? Can I do anything to make this data parsable?

[Jeff G.]

Here's an example:

I parsed your example with a non-Mailhosted account, resulting in Tracking URL http://www.spamcop.net/sc?id=z1097698991z9...be2dfc7dd0c4fcz, which gave me the following:

Sorry, this email is too old to file a spam report. You must report spam within 2 days of receipt. This mail was received on 6 Oct 2006 09:29:17 -0000

Message is 3.6 days old

...

If reported today, reports would be sent to:

Re: 84.228.47.158 (Administrator of IP block - statistics only)

abuse[at]smile.net.il

What Tracking URL did you try to use?

[Wazoo]

May or may not be connected .. just something I noted .... the parser version number was updated today ...

[btech]

I'll make note if it happens in the future.

[karlisma]

.... the parser version number was updated today ...

aaah, that's WHY is does not work...

[Farelf]

aaah, that's WHY is does not work...

Very droll ... the "Reporting Sever Status" graphic (for those who have it enabled) of course revealed a dropout, numbers of which have occurred previously, with earlier parser versions.