Re: Spamcop Misreading Headers

On Tue, 5 Jul 2005 08:33:06 -0400, Ellen wrote:

> "N. Miller" <[email protected]> wrote in message
> news:[email protected]...
>> On Mon, 4 Jul 2005 11:47:54 -0400, McWebber wrote:
>>
>>> With the headers below, Spamcop parses it and skips the real header and
>>> picks the fake 179.243.186.188 as the IP to lart.
>>> abuse#[email protected] and for some reason doesn't want to
> lart
>>> [email protected] for  217.157.61.45 which is the ultimate source of
> the
>>> spam
>>
>> Interesting. Sam Spade is not fooled, but running your headers results in
>> this tracker:
>>
>> http://www.spamcop.net/sc?id=z782224777z0a198f6cfa8ad5016f6589da2edfd169z
>>
> 
> If you set up your mailhosts then the parser doesn't have a problem.

I can't run somebody else's spam through my parser with mailhosts set up.
But trying to jigger the headers so that they would be rational for my
mailhosts, then running through my old account with mailhosts configured,
and I get:

http://www.spamcop.net/sc?id=z782506773z1e602d8276030386033a40bb6bef35ccz

In the first tracker that I posted, SC wants to report the bogus IP address
as a source, in the second tracker, SC wants to report the valid IP address
as the source. All I did was to modify the top Received line. The SC
account I used to generate those headers does not have mailhosts configure;
if it did, the tracker for the original headers utterly fail to parse:

http://www.spamcop.net/sc?id=z782507836zc92355c79390ec7bcf81dd298e73130cz

But, yes, I can see that McWebber needs to configure mailhosts. That surely
would fix his problem.

-- 
Norman
~Shine, bright morning light,
~now in the air the spring is coming.
~Sweet, blowing wind,
~singing down the hills and valleys.