Jump to content

identified internal IP as source


JimB

Recommended Posts

Since I added my mailhost to the list it appears that I can no longer report spam. I have tried 3 different spam e-mails and I always get back the error "Mailhost configuration problem, identified internal IP as source." I work in a small company, in which I have one e-mail address. Can someone help me troubleshoot this problem?

Here is an example of a report that came back with this error.

http://www.spamcop.net/sc?id=z1109622644z8...b6836900957d40z

Thanks for your help,

Jim

Link to comment
Share on other sites

It looks like your system is messing up the received headers and keeping them all in one line. What currently looks like:

Received: from dynres.com ([192.168.1.1]) by ponto.dynres.com with Microsoft SMTPSVC(5.0.2195.5329);
	 Thu, 19 Oct 2006 00:24:09 -0700 Received:from [222.160.89.138] (helo=[222.160.89.41])
	by dynres.com with esmtp
	(envelope-from <zxcvivjxxoq[at]uhsrgv.com>)
	id 1GaTTg-0001oY-K9 
	for x; Thu, 19 Oct 2006 01:42:18 -0700

probably should look something like:

Received: from dynres.com ([192.168.1.1]) by ponto.dynres.com with Microsoft SMTPSVC(5.0.2195.5329);
	 Thu, 19 Oct 2006 00:24:09 -0700 
Received:from [222.160.89.138] (helo=[222.160.89.41])
	by dynres.com with esmtp
	(envelope-from <zxcvivjxxoq[at]uhsrgv.com>)
	id 1GaTTg-0001oY-K9 
	for x; Thu, 19 Oct 2006 01:42:18 -0700

Link to comment
Share on other sites

Have to also note that the line "X-SpamCop-note: Converted to text/html by SpamCop (outlook/eudora hack)" generally states that this spam submittal was handled manually through the web-form, using the two-part Outlook/Eudora work-around. So there is the quesion about / possibilty that the manual manipulations of pasting in the data, which may be the cause of the messed up header lines.

Link to comment
Share on other sites

As Wazoo has implied, the ""Mailhost configuration problem, identified internal IP as source." error is a red herring. There's no way the parser would handle those Received: headers - with or without mailhost configuration. Just to confirm/prove, here is a parse of the same spam without mailhosting:

http://www.spamcop.net/sc?id=z1109693213z3...3bb25c42e4e323z

The messages are a bit different but the result is the same of course.

Link to comment
Share on other sites

Thank you all for your help. I still have a few questions, though.

Steven,

Would a reasonable solution be to just edit the header once I have pasted it into the web form? I can't try it now, since the system is down, but I may try it later. Also, is this a problem that the IT guy could fix on our mail server? What are some ideas as to what to do?

Wazoo,

I simply use the <View<Options menu to get the headers from Outlook. I highlight the entire thing and Ctrl-C > Ctrl-V into the web form. I am not manually editing them at all. I will have to check to see if this is somehow screwing things up, but I think Steven is right in that our system is the issue. What do you think about me just editing the header lines to have the correct number of "Recieved" lines?

Farelf,

I could check the link (system is down), but if you got a "No IP address source found" or something along those lines, then I have seen that before. I was able to get some reports done, though. Since I added the Mailhosts thing, I have not been able to report anything.

Thank you all for your help, again. Now I have a few new things to try.

Jim

Link to comment
Share on other sites

I thought it is impossible to get proper headers out of Outlook without using a third-party utility, but nobody has mentioned that.

Has something changed that I don't know about?

The technical answer to that specific data is actually based on which version of Outlook is in question, compounded by the configuration of that Outlook installation, compounded by the configuration of the 'Exchange' type server that may be feeding this Outlook installation ....

The headers were never anywhere near the problem that the body contents were ... specifically, things like the MIME description lines that got trashed .... and as the body content no longer 'matched' the header definitions .... submittal of the 're-created' garbage never flew as a submittal, as it was very broken ...

Some versions of Outlook could be 'manipulated' via a Registry hack, other versions couldn't be fixed at all, other versions 'could' kind of work .....

Link to comment
Share on other sites

turetzsr,

Yeah, that is what I thought. I did not want to do any manual editing, but I do want to be able to report the spam.

Anyhow, today everything seems to be working fine. I have just reported 2 spam e-mails, and everything worked exactly as I expected. I am going to consider this solved for now. If I have any further problems I will open a new topic.

Maybe they fixed it when the system was down this morning.

Thanks again for all of the help.

Jim

Link to comment
Share on other sites

dynres.com' post='49457' date='Oct 20 2006, 11:30 AM']Would a reasonable solution be to just edit the header once I have pasted it into the web form? I can't try it now, since the system is down, but I may try it later. Also, is this a problem that the IT guy could fix on our mail server? What are some ideas as to what to do?

No one here can "grant" you the authority to "break the rules" .... but yes, the issue needs to be looked at and determined just where these lines are actually getting wrapped at.

I simply use the <View<Options menu to get the headers from Outlook. I highlight the entire thing and Ctrl-C > Ctrl-V into the web form. I am not manually editing them at all. I will have to check to see if this is somehow screwing things up, but I think Steven is right in that our system is the issue. What do you think about me just editing the header lines to have the correct number of "Recieved" lines?

As above, you won't get those words from here .... the real source of the wrapping has to be sorted out. If it does turn out to be some artifact from the ^C ^V process, well .....

I could check the link (system is down), but if you got a "No IP address source found" or something along those lines, then I have seen that before. I was able to get some reports done, though. Since I added the Mailhosts thing, I have not been able to report anything.

As above, this descibed error has noting to do with the MailHost Configuration of your Reporting Account ... at best, there may have some coincidence in the timing of your MailHost COnfiguration efforts and some sotware code change somewhere else ..... not sure I want to go with what the worst-case scenario might have been ...

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...