[Resolved] Received Line: Special Characters in front of "from"

[Umamageswaran]

Hi,

I have been receiving spam where there are special characters like * or Dot being placed in the Received line before "from".

Example:

"Received:

* from MN2-GA-u-0017.mc.onolab.com (MN2-GA-u-0017.mc.onolab.com [62.42.36.18] (may be forged)) by chemistry.chem.utah.edu (8.13.7/8.13.7) with SMTP id kAICgFXJ006877 for <xxxxxx[at]chem.utah.edu>; Sat, 18 Nov 2006 05:42:20 -0700

* (qmail 21146 invoked from network); Sat, 18 Nov 2006 13:41:51 +0100

* from unknown (HELO aywa) (62.42.64.47) by MN2-GA-u-0017.mc.onolab.com with SMTP; Sat, 18 Nov 2006 13:41:51 +0100"

When I copy and paste the header in Reporting spam section, It gives me the following error message:

"Parsing header:

Received:

no from

Ignored

No source IP address found, cannot proceed."

I delete the special character in front of "from" so that you software could parse the header. I was wondering whether your software be modified to automatically ignore these special characters and parse the received line.

thanks,

Uma

[Farelf]

... I delete the special character in front of "from" so that you software could parse the header. I was wondering whether your software be modified to automatically ignore these special characters and parse the received line....

Hi Uma, the issue is with your copying and pasting process - the "special characters" seem to be indicating a line wrap. Try looking through How to Submit spam for Reporting, Generic instructions, especially the link from there How do I get my email program to reveal the full, unmodified email?. It is not permissable to edit the header to "make it work". That goes against the integrity of the process (and specific prohibition in "the rules"). If you can't sort it out, come back with the details of how you are trying to submit - what applications you are using and so on - from the "How to ask a question" section If it's something to do with data manipulation, copying/pasting, transmittal, identify the tools in question, version numbers and Operating System can be critical to get an appropriate answer.

And if that's a real email address you are using as a user name, do you want to change it? It will get harvested. Yep, there's a link about that too - Change of Username

[StevenUnderwood]

I have been receiving spam where there are special characters like * or Dot being placed in the Received line before "from".

Example:

"Received:

* from MN2-GA-u-0017.mc.onolab.com (MN2-GA-u-0017.mc.onolab.com [62.42.36.18] (may be forged)) by chemistry.chem.utah.edu (8.13.7/8.13.7) with SMTP id kAICgFXJ006877 for <xxxxxx[at]chem.utah.edu>; Sat, 18 Nov 2006 05:42:20 -0700

* (qmail 21146 invoked from network); Sat, 18 Nov 2006 13:41:51 +0100

* from unknown (HELO aywa) (62.42.64.47) by MN2-GA-u-0017.mc.onolab.com with SMTP; Sat, 18 Nov 2006 13:41:51 +0100"

That display looks remarkably like the SpamCop webmail application when you use the "Show all headers" link. Those headers are not in RFC compliant form. Webmail also has a link labeled: Message Source that opens a new window with the RFC compliant form. I don't think that second link is available in the default installation of Horde IMP, the package that SpamCop's webmail is using.

If you can tell us who your provider is, we might already have instructions for getting the full headers int he correct format. Otherwise, you may need to contact your support group. Some places do not provide this function, however. Tufts.edu's system also uses IMP and does have the Message Source link but soes not have a way to forward that information. Manual submission on the web page would be necessary for their system.

[Umamageswaran]

Thank you for letting me know. I have changed my user id.

That display looks remarkably like the SpamCop webmail application when you use the "Show all headers" link. Those headers are not in RFC compliant form. Webmail also has a link labeled: Message Source that opens a new window with the RFC compliant form. I don't think that second link is available in the default installation of Horde IMP, the package that SpamCop's webmail is using.

Yes, that's true. I have been using the "Show all headers" link. I have now started using the "Message Source" link where the characters are not displayed.

thanks,

Uma

[turetzsr]

Yes, that's true. I have been using the "Show all headers" link. I have now started using the "Message Source" link where the characters are not displayed.

Hi, Uma!

...Thanks for taking the time to post the good news. Based on this, I shall mark this thread as "Resolved."