Jump to content

No IP-address, cannot report


Oriolus

Recommended Posts

I use Outlook 2007 (12.0.6316.5000) SP1 MSO (12.0.6213.1000) MS Office Prof, under Vista Home Premium SP1. My ISP asks me to use POP3.

A co-worker has Outlook 2007 installed.... If this is still an issue on Monday, I will do some testing from his account to see if it is Outlook related.

Link to comment
Share on other sites

That'll be interesting! Have a nice weekend :)

OK, I have installed Office 2007 on a machine at work for testing and submitted a couple of messages both by selecting them then forwarding and by opening a new message and dragging the messages in. Both ways ended up with the same headers in the same order. Using the "Message Options", some of the headers are placed differently, but the received headers are in the same order. This is similar to what I have seen in the past with other Outlook versions.

From Messqage Options:

Microsoft Mail Internet Headers Version 2.0
Received: from psmtp.com ([64.18.1.44]) by CENTMAIL.carroll-ent.com with Microsoft SMTPSVC(6.0.3790.3959);
	 Mon, 2 Jun 2008 08:57:55 -0400
Received: from source ([204.15.82.104]) by exprod6mx194.postini.com ([64.18.5.10]) with SMTP;
	Mon, 02 Jun 2008 07:57:54 CDT
DomainKey-Signature: s=devnull; d=spamcop.net; c=nofws; q=dns;
  h=Received:From:To:Subject:Date:Message-ID:Content-type:
   In-Reply-To:References;
  b=G6xeF9maxRU/aEBxdcnxJUgR5LyHn1x2hovnNbBdSHUYuHBBe7BILaOm
   G1XqB/cJC9EeVKCkXvs94V42FvzxROXEVVvKt7U0bYNVFZU879YijWJed
   t3i3/lonGP+mbMR;
Received: from 204-15-82-99.ironport.com (HELO sc-app12.spamcop.net) ([204.15.82.99])
  by sc-smtp-vip.soma.ironport.com with SMTP; 02 Jun 2008 05:57:23 -0700
From: SpamCop AutoResponder <spamcop[at]devnull.spamcop.net>
To: sunderwood[at]sbsb.com
Subject: [SpamCop] has accepted 1 email for processing
Date: Mon, 02 Jun 2008 12:57:23 GMT
Message-ID: <spamid1950319048[at]msgid.spamcop.net>
Content-type: text/plain
In-Reply-To: <CC34C49049FF1A47A8894AA45D518B3A04AFF4D9[at]centmail>
References: <CC34C49049FF1A47A8894AA45D518B3A04AFF4D9[at]centmail>
X-pstn-neptune: 0/0/0.00/0
X-pstn-levels:	 (S: 0.27691/99.80280 CV:99.0000 R:95.9108 P:95.9108 M:97.0282 C:98.6951 )
X-pstn-settings: 3 (1.0000:1.0000) s cv gt3 gt2 gt1 r p m c 
X-pstn-addresses: from <spamcop[at]devnull.spamcop.net> forward (user good) [72/6] 
Return-Path: spamid.1950319048[at]bounces.spamcop.net
X-OriginalArrivalTime: 02 Jun 2008 12:57:55.0573 (UTC) FILETIME=[4679BA50:01C8C4B0]

From forwarded message:

X-MimeOLE: Produced By Microsoft Exchange V6.5
Received:  from psmtp.com ([64.18.1.44]) by CENTMAIL.carroll-ent.com with Microsoft SMTPSVC(6.0.3790.3959); Mon, 2 Jun 2008 08:57:55 -0400
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----_=_NextPart_003_01C8C4B0.46224B80"
Received:  from source ([204.15.82.104]) by exprod6mx194.postini.com ([64.18.5.10]) with SMTP; Mon, 02 Jun 2008 07:57:54 CDT
Received:  from 204-15-82-99.ironport.com (HELO sc-app12.spamcop.net) ([204.15.82.99])  by sc-smtp-vip.soma.ironport.com with SMTP; 02 Jun 2008 05:57:23 -0700
Content-class: urn:content-classes:message
Subject: [SpamCop] has accepted 1 email for processing
Date: Mon, 2 Jun 2008 08:57:23 -0400
Message-ID: <spam________9048[at]msgid.spamcop.net>
In-Reply-To: <CC34C49049FF1A47A8894AA45D518B3A04AFF4D9[at]centmail>
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Thread-Topic: [SpamCop] has accepted 1 email for processing
Thread-Index: AcjEsEaicJriu+1oRFuheCMzwyahmA==
References: <CC34C49049FF1A47A8894AA45D518B3A04AFF4D9[at]centmail>
From: "SpamCop AutoResponder" <spamcop[at]devnull.spamcop.net>
To: "x" <x>

Link to comment
Share on other sites

OK, I have installed Office 2007 on a machine at work for testing and submitted a couple of messages both by selecting them then forwarding and by opening a new message and dragging the messages in. Both ways ended up with the same headers in the same order. Using the "Message Options", some of the headers are placed differently, but the received headers are in the same order. This is similar to what I have seen in the past with other Outlook versions.

I have come across an even more amazing difference, that could cast light upon things:

Reported in two parts via the Outlook/Eudora workaround form:

SpamCop v 2 Copyright (C) 1998-2006, IronPort Systems, Inc. All rights reserved.
Here is your TRACKING URL - it may be saved for future reference:
http://www.spamcop.net/sc?id=z2124029633zd1b3646a2593fcd64f44c6e2fad4a68cz
Skip to Reports
Return-Path: <witczak[at]iag.se>
Received: from mwinf6617.online.nl (mwinf6617.online.nl)
	by mwinb6006 (SMTP Server) with LMTP; Mon, 04 Aug 2008 19:13:54 +0200
X-Sieve: Server Sieve 2.2
Received: from me-wanadoo.net (localhost [127.0.0.1])
	by mwinf6617.online.nl (SMTP Server) with ESMTP id DFC8B280008A
	for <x>; Mon,  4 Aug 2008 19:13:54 +0200 (CEST)
Received: from ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr (ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr [86.217.132.218])
	by mwinf6617.online.nl (SMTP Server) with ESMTP id AFD3C2800086
	for <x>; Mon,  4 Aug 2008 19:13:54 +0200 (CEST)
X-ME-UUID: 20080804171354720.AFD3C2800086[at]mwinf6617.online.nl
Message-ID: <0009______________________c9be[at]fngixw>
From: "gabbie michel" <witczak[at]iag.se>
To: <x>
Subject: For:<y> Britney still has cool t*tsWatch.
Date: Mon, 04 Aug 2008 15:24:31 +0000
MIME-Version: 1.0
X-Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_0006_01C8F655.02FCCED1"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
Content-Type: text/html
X-SpamCop-note: Converted to text/html by SpamCop (outlook/eudora hack)
View entire message 
Parsing header:
0: Received: from ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr (ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr [86.217.132.218]) by mwinf6617.online.nl (SMTP Server) with ESMTP id AFD3C2800086 for <x>; Mon, 4 Aug 2008 19:13:54 +0200 (CEST)
No unique hostname found for source: 86.217.132.218
orange.nl received mail from sending system 86.217.132.218
Tracking message source: 86.217.132.218:
Routing details for 86.217.132.218
[refresh/show] Cached whois for 86.217.132.218 : postmaster[at]wanadoo.fr
Using abuse net on postmaster[at]wanadoo.fr
abuse net wanadoo.fr = postmaster[at]wanadoo.fr, abuse[at]wanadoo.fr, abuse[at]orange.fr
Using best contacts postmaster[at]wanadoo.fr abuse[at]wanadoo.fr abuse[at]orange.fr
postmaster[at]wanadoo.fr bounces (205 sent : 103 bounces)
Using postmaster#wanadoo.fr[at]devnull.spamcop.net for statistical tracking.
Yum, this spam is fresh!
Message is 0 hours old
86.217.132.218 not listed in dnsbl.njabl.org
86.217.132.218 not listed in dnsbl.njabl.org
86.217.132.218 not listed in cbl.abuseat.org
86.217.132.218 listed in dnsbl.sorbs.net ( 127.0.0.10 )
86.217.132.218 not listed in accredit.habeas.com
86.217.132.218 not listed in plus.bondedsender.org
86.217.132.218 not listed in iadb.isipp.com
Finding links in message body
Parsing HTML part
Resolving link obfuscation
   http://back495.com/videos/live.html
   Host back495.com (checking ip) = 200.46.83.233
   host 200.46.83.233 = 233-83-46-200-ip.alianzaviva.net (cached)
Tracking link: http://back495.com/videos/live.html
[report history]
Resolves to 200.46.83.233
Routing details for 200.46.83.233
[refresh/show] Cached whois for 200.46.83.233 : ipadmin[at]net2net.com.pa
Using abuse net on ipadmin[at]net2net.com.pa
abuse net net2net.com.pa = ipadmin[at]net2net.com.pa, abuse[at]net2net.com.pa, postmaster[at]net2net.com.pa
Using best contacts ipadmin[at]net2net.com.pa abuse[at]net2net.com.pa postmaster[at]net2net.com.pa
Please make sure this email IS spam: 
From: "gabbie michel" <witczak[at]iag.se> (For:<y> Britney still has cool t*tsWatch.)
View full message

Report spam to:
Re: 86.217.132.218 (Administrator of network where email originates)
 To: postmaster#wanadoo.fr[at]devnull.spamcop.net (Notes)
 To: abuse[at]orange.fr (Notes)
 To: abuse[at]wanadoo.fr (Notes)
Re: 86.217.132.218 (User defined recipient)
 To: jl0007[at]coldrain.net (Notes)
Re: http://back495.com/videos/live.html (Administrator of network hosting website referenced in spam)
 To: ipadmin[at]net2net.com.pa (Notes)
 To: abuse[at]net2net.com.pa (Notes)
 To: postmaster[at]net2net.com.pa (Notes)

Additional notes (optional - max 2000 characters):


ATTENTION: Report only those e-mail addresses and web sites that you think your spammer has used. Avoid checking any boxes left empty unless you know that your spammer has used the addresses or sites thus identified. Each false report that you submit means wasted time for a network administrator, so take care. The last thing SpamCop wants are network administrators so accustomed to false claims that they no longer take these spam reports seriously. 







Comments for:postmaster#wanadoo.fr[at]devnull.spamcop.net (86.217.132.218) 

Return to report 
Comments for:abuse[at]orange.fr (86.217.132.218) 

Return to report 
Comments for:abuse[at]wanadoo.fr (86.217.132.218) 

Return to report 
Comments for:jl0007[at]coldrain.net (86.217.132.218) 

Return to report 
Comments for:ipadmin[at]net2net.com.pa (http://back495.com/videos/live.html) 

Return to report 
Comments for:abuse[at]net2net.com.pa (http://back495.com/videos/live.html) 

Return to report 
Comments for:postmaster[at]net2net.com.pa (http://back495.com/videos/live.html) 

Return to report 
Copyright (C) 1998-2006, IronPort Systems, Inc. All rights reserved. HTML4 / CSS2 Firefox recommended - Policies and Disclaimers 

Reported via Forwarding resulting in error(s):

SpamCop encountered errors while saving spam for processing:
SpamCop could not find your spam message in this email:

Return-Path: <<y>[at]wanadoo.nl>
Received: from sc-smtp6-inbound.soma.ironport.com (sc-smtp6-inbound.soma.ironport.com [204.15.82.72])
	   by sc-app12.soma.ironport.com (Postfix) with ESMTP id C9C4834DBD
	   for <submit.<z>[at]spam.spamcop.net>; Mon,  4 Aug 2008 11:06:04 -0700 (PDT)
X-Fozzie-Original-To: submit.<z>[at]spam.spamcop.net
X-Fozzie-Original-To: submit.<z>[at]spam.spamcop.net
Received: from smtp-4.orange.nl ([193.252.22.249])
 by vmx2.spamcop.net with ESMTP; 04 Aug 2008 11:06:04 -0700
Received: from me-wanadoo.net (localhost [127.0.0.1])
	   by mwinf6303.online.nl (SMTP Server) with ESMTP id 3B15E7000085
	   for <submit.<z>[at]spam.spamcop.net>; Mon,  4 Aug 2008 20:06:02 +0200 (CEST)
Received: from SilverBox (s5591c49c.adsl.wanadoo.nl [85.145.196.156])
	   by mwinf6303.online.nl (SMTP Server) with ESMTP id DF9F97000082
	   for <submit.<z>[at]spam.spamcop.net>; Mon,  4 Aug 2008 20:06:01 +0200 (CEST)
X-ME-UUID: 20080804180601916.DF9F97000082[at]mwinf6303.online.nl
From: "<y>" <<y>[at]wanadoo.nl>
To: "spam" <submit.<z>[at]spam.spamcop.net>
Subject: FW: <y> Britney still has cool t*tsWatch.
Date: Mon, 4 Aug 2008 20:05:31 +0200
Message-ID: <000901c8f65c$af77fe80$0e67fb80$[at]<xxx>[at]wanadoo.nl>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	   boundary="----=_NextPart_000_000A_01C8F66D.7300CE80"
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: Acj2VXjV50ZxfALKQd6Aj+rooZMsYwABrHHg
Content-Language: nl

Dit is een meerdelig bericht met een MIME-indeling.

------=_NextPart_000_000A_01C8F66D.7300CE80
Content-Type: text/plain;
	   charset="us-ascii"
Content-Transfer-Encoding: 7bit





Van: gabbie michel [mailto:witczak[at]iag.se]
Verzonden: maandag 4 augustus 2008 17:25
Aan: <y>[at]wanadoo.nl
Onderwerp: For:<y> Britney still has cool t*tsWatch.






------=_NextPart_000_000A_01C8F66D.7300CE80
Content-Type: text/html;
	   charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<meta http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 12 (filtered medium)">
<style>
<!--
 /* Font Definitions */
 [at]font-face
	   {font-family:"MS Mincho";
	   panose-1:2 2 6 9 4 2 5 8 3 4;}
[at]font-face
	   {font-family:"Cambria Math";
	   panose-1:2 4 5 3 5 4 6 3 2 4;}
[at]font-face
	   {font-family:Calibri;
	   panose-1:2 15 5 2 2 2 4 3 2 4;}
[at]font-face
	   {font-family:Tahoma;
	   panose-1:2 11 6 4 3 5 4 4 2 4;}
[at]font-face
	   {font-family:"\[at]MS Mincho";
	   panose-1:2 2 6 9 4 2 5 8 3 4;}
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
	   {margin:0cm;
	   margin-bottom:.0001pt;
	   font-size:12.0pt;
	   font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
	   {mso-style-priority:99;
	   color:blue;
	   text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	   {mso-style-priority:99;
	   color:purple;
	   text-decoration:underline;}
span.E-mailStijl17
	   {mso-style-type:personal-reply;
	   font-family:"Calibri","sans-serif";
	   color:#1F497D;}
.MsoChpDefault
	   {mso-style-type:export-only;
	   font-size:10.0pt;}
[at]page Section1
	   {size:612.0pt 792.0pt;
	   margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.Section1
	   {page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
 <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
 <o:shapelayout v:ext=3D"edit">
 <o:idmap v:ext=3D"edit" data=3D"1" />
 </o:shapelayout></xml><![endif]-->
</head>

<body bgcolor=3Dwhite lang=3DNL link=3Dblue vlink=3Dpurple>

<div class=3DSection1>

<p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>

<p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>

<div>

<div style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt =
0cm 0cm 0cm'>

<p class=3DMsoNormal><b><span =
style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'>Van:</span><=
/b><span
style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'> gabbie =
michel
[mailto:witczak[at]iag.se] <br>
<b>Verzonden:</b> maandag 4 augustus 2008 17:25<br>
<b>Aan:</b> <y>[at]wanadoo.nl<br>
<b>Onderwerp:</b> For:<y> Britney still has cool =
t*tsWatch.<o:p></o:p></span></p>

</div>

</div>

<p class=3DMsoNormal><o:p> </o:p></p>

<p class=3DMsoNormal><o:p> </o:p></p>

</div>

</body>

</html>

------=_NextPart_000_000A_01C8F66D.7300CE80--




The email which triggered this auto-response had the following headers:
 Return-Path: <<y>[at]wanadoo.nl>
Received: from sc-smtp6-inbound.soma.ironport.com (sc-smtp6-inbound.soma.ironport.com [204.15.82.72])
	   by sc-app12.soma.ironport.com (Postfix) with ESMTP id C9C4834DBD
	   for <submit.<z>[at]spam.spamcop.net>; Mon,  4 Aug 2008 11:06:04 -0700 (PDT)
X-Fozzie-Original-To: submit.<z>[at]spam.spamcop.net
X-Fozzie-Original-To: submit.<z>[at]spam.spamcop.net
Received: from smtp-4.orange.nl ([193.252.22.249])
 by vmx2.spamcop.net with ESMTP; 04 Aug 2008 11:06:04 -0700
Received: from me-wanadoo.net (localhost [127.0.0.1])
	   by mwinf6303.online.nl (SMTP Server) with ESMTP id 3B15E7000085
	   for <submit.<z>[at]spam.spamcop.net>; Mon,  4 Aug 2008 20:06:02 +0200 (CEST)
Received: from SilverBox (s5591c49c.adsl.wanadoo.nl [85.145.196.156])
	   by mwinf6303.online.nl (SMTP Server) with ESMTP id DF9F97000082
	   for <submit.<z>[at]spam.spamcop.net>; Mon,  4 Aug 2008 20:06:01 +0200 (CEST)
X-ME-UUID: 20080804180601916.DF9F97000082[at]mwinf6303.online.nl
From: "<y>" <<y>[at]wanadoo.nl>
To: "spam" <submit.<z>[at]spam.spamcop.net>
Subject: FW: <y> Britney still has cool t*tsWatch.
Date: Mon, 4 Aug 2008 20:05:31 +0200
Message-ID: <000901c8f65c$af77fe80$0e67fb80$[at]<xxx>[at]wanadoo.nl>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	   boundary="----=_NextPart_000_000A_01C8F66D.7300CE80"
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: Acj2VXjV50ZxfALKQd6Aj+rooZMsYwABrHHg
Content-Language: nl

BTW: I changed different recognizable strings in <x>, <y>, or <z> etc...

Does this make sense to someone?

Link to comment
Share on other sites

Does this make sense to someone?

Yes, the messages are not properly attached to your email... the headers of your second message are NOT the the spam headers but the headers of the email they received. It sounds like you simply forwarded the spam to your submit address rather than attaching it.

From: "<y>" <<y>[at]wanadoo.nl>

To: "spam" <submit.<z>[at]spam.spamcop.net>

Subject: FW: <y> Britney still has cool t*tsWatch.

Link to comment
Share on other sites

Yes, the messages are not properly attached to your email... the headers of your second message are NOT the the spam headers but the headers of the email they received. It sounds like you simply forwarded the spam to your submit address rather than attaching it.

From: "<y>" <<y>[at]wanadoo.nl>

To: "spam" <submit.<z>[at]spam.spamcop.net>

Subject: FW: <y> Britney still has cool t*tsWatch.

Yes, you are certainly right! I did the wrong thing, I'm very sorry!

I better delete my post!

I'm lost... I've to look into the FAQ's to remember how I should handle things. Again, I'm sorry!

This is what the second code-part should have been:

Reporting via Forwarding as an attachment:

SpamCop v 2 Copyright (C) 1998-2006, IronPort Systems, Inc. All rights reserved.
Here is your TRACKING URL - it may be saved for future reference:
http://www.spamcop.net/sc?id=z2124366960z3aa112245dd63618300448808611770cz
Skip to Reports
Received: from me-wanadoo.net (localhost [127.0.0.1])
	by mwinf6617.online.nl (SMTP Server) with ESMTP id DFC8B280008A
	for &lt;x&gt;; Mon,  4 Aug 2008 19:13:54 +0200 (CEST)
Received: from mwinf6617.online.nl (mwinf6617.online.nl)
	by mwinb6006 (SMTP Server) with LMTP; Mon, 04 Aug 2008 19:13:54 +0200
Received: from ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr (ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr [86.217.132.218])
	by mwinf6617.online.nl (SMTP Server) with ESMTP id AFD3C2800086
	for &lt;x&gt;; Mon,  4 Aug 2008 19:13:54 +0200 (CEST)
Return-Path: &lt;witczak[at]iag.se&gt;
From: "gabbie michel" &lt;witczak[at]iag.se&gt;
To: &lt;x&gt;
Subject: For:&lt;y&gt; Britney still has cool t*tsWatch.
Date: Mon, 4 Aug 2008 17:24:31 +0200
Message-ID: &lt;0009______________________c9be[at]fngixw&gt;
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_0013_01C8F682.B5DEAD70"
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-Sieve: Server Sieve 2.2
X-ME-UUID: 20080804171354720.AFD3C2800086[at]mwinf6617.online.nl
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
Thread-Index: Acj2VXjV50ZxfALKQd6Aj+rooZMsYw==
View entire message 
Parsing header:
0: Received: from ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr (ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr [86.217.132.218]) by mwinf6617.online.nl (SMTP Server) with ESMTP id AFD3C2800086 for &lt;x&gt;; Mon, 4 Aug 2008 19:13:54 +0200 (CEST)
No unique hostname found for source: 86.217.132.218
orange.nl received mail from sending system 86.217.132.218
Tracking message source: 86.217.132.218:
Routing details for 86.217.132.218
[refresh/show] Cached whois for 86.217.132.218 : postmaster[at]wanadoo.fr
Using abuse net on postmaster[at]wanadoo.fr
abuse net wanadoo.fr = postmaster[at]wanadoo.fr, abuse[at]wanadoo.fr, abuse[at]orange.fr
Using best contacts postmaster[at]wanadoo.fr abuse[at]wanadoo.fr abuse[at]orange.fr
postmaster[at]wanadoo.fr bounces (205 sent : 103 bounces)
Using postmaster#wanadoo.fr[at]devnull.spamcop.net for statistical tracking.
Message is 3 hours old
86.217.132.218 not listed in dnsbl.njabl.org
86.217.132.218 not listed in dnsbl.njabl.org
86.217.132.218 not listed in cbl.abuseat.org
86.217.132.218 listed in dnsbl.sorbs.net ( 127.0.0.10 )
86.217.132.218 not listed in accredit.habeas.com
86.217.132.218 not listed in plus.bondedsender.org
86.217.132.218 not listed in iadb.isipp.com
Finding links in message body
Recurse multipart:
   Parsing text part
   Parsing HTML part
Resolving link obfuscation
   http://back495.com/videos/live.html
   Host back495.com (checking ip) = 200.46.83.233
   host 200.46.83.233 = 233-83-46-200-ip.alianzaviva.net (cached)
Tracking link: http://back495.com/videos/live.html
[report history]
Resolves to 200.46.83.233
Routing details for 200.46.83.233
[refresh/show] Cached whois for 200.46.83.233 : ipadmin[at]net2net.com.pa
Using abuse net on ipadmin[at]net2net.com.pa
abuse net net2net.com.pa = ipadmin[at]net2net.com.pa, abuse[at]net2net.com.pa, postmaster[at]net2net.com.pa
Using best contacts ipadmin[at]net2net.com.pa abuse[at]net2net.com.pa postmaster[at]net2net.com.pa
Please make sure this email IS spam: 
From: "gabbie michel" &lt;witczak[at]iag.se&gt; (For:&lt;y&gt; Britney still has cool t*tsWatch.)
 Dit is een meerdelig bericht met een MIME-indeling.
 ------=_NextPart_000_0013_01C8F682.B5DEAD70
View full message
Furthermore exactly the same as in the first code-part.

I cannot judge whether this differs from the first code-part, but the result is fortunately the same.

Sorry for the embarrassing confusion.

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...