Re: Spamcop failing to detect true originating IP

Mike Easter wrote:
> John Richards wrote:
> 
>>Mike Easter wrote:
>>
>>>wskrispy wrote:
> 
> 
>>>>In any case, when I trim the source down to the bare minimum with
>>>>just the originating headers Spamcop is now accepting it (I could
>>>>have sworn I tried this a few days ago and it choked).
>>>
>>>That sounds like it might be a material change,
> 
> 
> /Might/ is an important operative word there.
> 
> 
>>How about if he just removes the headers added  by SpamAssassin?
> 
> 
> It would seem that if one only removed headers added by SA, that the
> residual wouldn't be very illegal -- but, that doesn't really compute
> very well, because it would also seem that headers added by SA wouldn't
> befuddle spamcop.
> 
> So, that causes me to question the analysis of the issue, which we are
> spending a lot more time talking about some imaginary issue which hasn't
> yet been displayed by the tracker which is the essential missing
> ingredient in this conversation we shouldn't be having yet because the
> OP failed to paste the trackers in the first place and then they failed
> to paste the trackers in the second place, and now here we are having
> some kind of complicated discussion about something that hasn't yet been
> completely defined yet.
> 
> That is a big waste of time.  If we are going to talk about what is and
> what is not likely to be breaking the rules of spamcop, we should be
> looking at the first tracker and we should be looking at the second
> tracker and we should be figuring out why some problem developed with
> the first tracker and why the 2nd tracker isn't the best way to solve
> the problem.
> 
> But instead of that, we are all typing and typing and typing and we
> don't have any view of what it is we aren't even talking about
> correctly.
> 
> 
>>Aren't these things
>>technically "material changes"?
> 
> 
> Notice that we are now talking about your description of something
> instead of your display of the real thing.
> 
> Describing something as specific as headers is silly, when we could be
> talking about the real thing instead of an inadequate attempt to
> describe the real thing.
> 

Ok man, no need to get upset. I was reluctant to post trackers because I 
was iffy about getting my client's IPs sprayed all over the place. But I 
guess there's no harm in it.

Here's a tracker from a spam that Spamcop choked on, complete with SA 
headers:

http://www.spamcop.net/sc?id=z785186974zfb5c4d04f5694f362a90b200bac251bfz

Here's output from a "show headers" link from weeks ago for a spam 
likewise including SA headers but that Spamcop did not choke on:

---BEGIN SPAMCOP OUTPUT---
Parse
 From - Wed Jun 15 14:18:45 2005
X-Account-Key: account5
X-UIDL: 91b664203ffe022b36c15fd7098eaa95
X-Mozilla-Status: 0201
X-Mozilla-Status2: 10000000
Return-path: <[email protected]>
Envelope-to: x
Delivery-date: Wed, 15 Jun 2005 12:39:09 -0400
Received: from acconci1 by 1n5-199.servernode.net with local-bsmtp (Exim 
4.43)
        id 1Diauz-0001gi-An
        for x; Wed, 15 Jun 2005 12:39:09 -0400
Received: from [62.101.126.224] (helo=acconci.com)
        by 1n5-199.servernode.net with esmtp (Exim 4.43)
        id 1Diaux-0001fo-UD
        for x; Wed, 15 Jun 2005 12:39:09 -0400
From: [email protected]
To: x
Subject: ACCOUNT ALERT
Date: Wed, 15 Jun 2005 18:42:17 +0200
MIME-Version: 1.0
Content-Type: multipart/mixed;
        boundary="----=_NextPart_000_0001_9606B4E5.67267592"
X-Priority: 3
X-MSMail-Priority: Normal
X-Spam-Level: ***
X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on
        1n5-199.servernode.net
X-Spam-Status: No, score=3.8 required=4.5 
tests=MISSING_MIMEOLE,NO_REAL_NAME,
        PRIORITY_NO_NAME,SUBJ_ALL_CAPS autolearn=no version=3.0.4
Message-Id: <[email protected]>

This is a multi-part message in MIME format.

------=_NextPart_000_0001_9606B4E5.67267592
Content-Type: text/plain;
        charset="Windows-1252"
Content-Transfer-Encoding: 7bit

We regret to inform you that your account has been suspended due to the 
violation of our site policy, more info is attached.


------=_NextPart_000_0001_9606B4E5.67267592
Content-Type: application/octet-stream;
        name="info-text.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
        filename="info-text.zip"

<snip binary junk of attached trojan-infected zip file [wsk]>
---END SPAMCOP OUTPUT---

And here's output from a "show headers" link of a spam reported (and 
digested by Spamcop) yesterday which I trimmed in the manner described 
earlier, from the same spam Spamcop did not digest with SA headers intact:

---BEGIN SPAMCOP OUTPUT---
Received: from [85.40.108.210] (helo=acconci.com)
        by 1n5-199.servernode.net with esmtp (Exim 4.43)
        id 1DsIoe-0002vp-22
        for x; Tue, 12 Jul 2005 07:20:45 -0400
From: [email protected]
To: x
Subject: Your Account is Suspended
Date: Tue, 12 Jul 2005 13:24:52 +0200
MIME-Version: 1.0
X-Priority: 3
X-MSMail-Priority: Normal
X-Spam-Exim: G0lXR5SLNg3n2MuDuSG1jq58
Content-Type: multipart/mixed; 
boundary="----=_NextPart_000_0001_54E3884D.FB9CD81E"

------=_NextPart_000_0001_54E3884D.FB9CD81E
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit


<html>
<body>
<BR><STRONG>Dear Acconci Member, </STRONG><BR>
<BR>Your e-mail account was used to send a huge amount of unsolicited 
spam messages during the recent week. If you could please take 5-10 
minutes out of your online experience and confirm the attached document 
so you will not run into any future problems with the online service.<BR>
<BR>If you choose to ignore our request, you leave us no choice but to 
cancel your membership.<BR>
<BR>Virtually yours,
<BR>The Acconci Support Team <BR>
<BR><BR><BR><BR><BR>

<BR>+++ Attachment: No Virus found
<BR>+++ Acconci Antivirus - www.acconci.com
</body>
</html>



------=_NextPart_000_0001_54E3884D.FB9CD81E--
------------=_42D3A78D.83D3022A
Content-Type: text/plain; x-avg=cert; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Description: "AVG certification"

Viruses found in the attached files.
The file readme.zip: Virus identified  I-Worm/Mytob.HL. The attachment 
was m=
oved to the virus vault.

Checked by AVG Anti-Virus.
Version: 7.0.336 / Virus Database: 267.8.12/46 - Release Date: 7/11/2005

------------=_42D3A78D.83D3022A--
.
---END SPAMCOP OUTPUT---

By the way, I seriously doubt removing SA headers constitutes a 
"material change" to Spamcop. Any reasonable application of this rule 
would confine it to body material and original headers only. If they had 
meant any change at all they would simply have said "Do not make any
changes to spam before submitting...", dispensing with "material".

Also by the way, who are you? Some kinda anti-spam maven?

--
wsk