Re: Reporting My own IP?

The Father Mind of DM Industries wrote:
> Okay so now that we have more or
> less established there is a problem with the parser, what now?

It now appears to be fixed.

Sometimes I think that when we are discussing what is wrong with the
parser, Julian is lurking in the ng and tweaking code down there in the
dungeon or wherever he does that stuff.

It appears that the parser is all better.  I just forged an item to test
an item very similar to the one we were discussing which parses
correctly now, except that the .br IP I made up /isn't/ listed in the
CBL, and SC now gets it right anyway.

http://www.spamcop.net/sc?id=z743280656z9b76c1afbc70fc2bed3634ca9d8acdc4z

So, now when SC sez 'looks like a forgery' - it makes sense.  The
'forgery' is comparing the 'from' IP with the domainname of the 'by'
field -- which doesn't 'compute' - so the 'by' must be 'forged'.  Here's
the pertinent section.   And, SC doesn't 'jump backwards' and 'unaccept'
something which it had already accepted earlier

<snip>
Received:  from 201-26-32-156.dsl.telesp.net.br
(201-26-32-156.dsl.telesp.net.br [201.26.32.156]) by
server-03.dmindustries.net (Postfix) with SMTP id 500211445B for <x>;
Wed, 16 Mar 2005 15:36:35 -0800 (PST)
201.26.32.156 found
host 201.26.32.156 (getting name) = 201-26-32-156.dsl.telesp.net.br.
201-26-32-156.dsl.telesp.net.br is 201.26.32.156
64.81.88.120 not listed in dnsbl.njabl.org
64.81.88.120 not listed in cbl.abuseat.org
64.81.88.120 not listed in dnsbl.sorbs.net
64.81.88.120 is not an MX for babcomm.totalsystemcontrol.com
64.81.88.120 is an MX for server-03.dmindustries.net
Possible spammer: 201.26.32.156
201.26.32.156 is not an MX for 201-26-32-156.dsl.telesp.net.br
host 201-26-32-156.dsl.telesp.net.br (checking ip) = 201.26.32.156
host server-03.dmindustries.net (checking ip) = 64.81.88.120
64.81.88.120 not listed in dnsbl.njabl.org
64.81.88.120 not listed in cbl.abuseat.org
64.81.88.120 not listed in dnsbl.sorbs.net
   Chain test:server-03.dmindustries.net =? server-03.dmindustries.net
   server-03.dmindustries.net and server-03.dmindustries.net have same
hostname - chain verified
Possible relay: 64.81.88.120
64.81.88.120 not listed in relays.ordb.org.
64.81.88.120 has already been sent to relay testers
Received line accepted

<ME: the acceptance of that line means that 64 isn't the source anymore,
now the new potential source is 201>

Received:  from ms-smtp-05.texas.rr.com ([24.93.47.44]) by
mx3.charta2N.ca (iPlanet Messaging Server 5.2 Patch 2 (built Jul 14
2004)) with ESMTP id <[email protected]> for x (ORCPT x);
Wed, 16 Mar 2005 15:23:52 -0800
24.93.47.44 found
host 24.93.47.44 = ms-smtp-05.texas.rr.com (cached)
ms-smtp-05.texas.rr.com is 24.93.47.44
201.26.32.156 not listed in dnsbl.njabl.org
201.26.32.156 not listed in cbl.abuseat.org
201.26.32.156 not listed in dnsbl.sorbs.net
201.26.32.156 is not an MX for server-03.dmindustries.net
201.26.32.156 is not an MX for 201-26-32-156.dsl.telesp.net.br
201.26.32.156 is not an MX for mx3.charta2N.ca
201.26.32.156 is not an MX for server-03.dmindustries.net
201.26.32.156 not listed in dnsbl.njabl.org
Possible spammer: 24.93.47.44
host mx3.charta2N.ca (checking ip) ip not found ; mx3.charta2N.ca
discarded as fake.
24.93.47.44 is not an MX for mx3.charta2N.ca
201.26.32.156 is not an MX for mx3.charta2N.ca

<ME: in that blob, SC is finding out that it can't chain from the 201
'from' to its respective 'by' -- and so it breaks the chain.  It also
isn't listed in any proxy db/s, but that doesn't matter, SC figgered it
out anyway.

Looks like a forgery
Tracking message source: 201.26.32.156:

<ME: SC has the source and it didn't jump backwards to the 64, which was
crazy before>



-- 
Mike Easter
kibitzer, not SC admin