Re: Spamcop failing to detect true originating IP

Ellen wrote:
> "wskrispy" <[email protected]> wrote in message news:db1fa1>
> 
>>Here's a tracker from a spam that Spamcop choked on, complete with SA
>>headers:
>>
>>http://www.spamcop.net/sc?id=z785186974zfb5c4d04f5694f362a90b200bac251bfz
>>
> 
> 
> Assuming that these are the received headers as delivered by your
> ISP/hosting company server to your mailbox, there is *no* IP in the topmost
> received header showing your ISP mailserver receiving the mail:
> 
> Received: from acconci1 by 1n5-199.servernode.net with local-bsmtp (Exim
> 4.43)
> id 1DsR07-0000Yn-17 for x; Tue, 12 Jul 2005 16:05:08 -0400
> 
> SpamCop cannot extract useful information from that header.
> 
> The next receved header has no IP either:
> 
> Received: from localhost by 1n5-199.servernode.net
> with SpamAssassin (version 3.0.4);
> Tue, 12 Jul 2005 16:05:08 -0400
> 
> Therefore there is no way that SC has determine the source of the spam.
> 
> Looking at the report history for your account, I see several more spams
> where your server failed to record the IP of the connecting server which is
> attempting to deliver the spam. It has nothing to do with SpamAssassin and
> the SA X-headers.
> 
> For some reason and for some spams, your server will print 2 received
> headers as above rather than showing the connecting IP as it does for other
> spams:
> 
> Received: from [85.40.108.210] (helo=acconci.com)
>        by 1n5-199.servernode.net with esmtp (Exim 4.43)
>        id 1Drjnp-000154-8l
>        for x; Sun, 10 Jul 2005 17:57:34 -0400
> From: [email protected]
> To: x
> Subject: Your Account is Suspended For Security Reasons
> 
> You will have to discuss this with your ISP/hosting company admin/tech
> support to find out what the problem is.  It may be that if some other user
> at the ISP/hosting company is sending the spam/virus/phish that the headers
> are as above as the mail was just shuffled around internally.
> 
> Ellen
> SpamCop
> 

Thanks for the response, Ellen. I must say I'm a bit confused at this 
point. No doubt I need to bone up a bit more on spam lore, not to 
mention smtp basics, etc.,.

 From one vantage point I'm almost tempted to say that, well, it looks 
like the spammer has outwitted Spamcop. You say "there is no way that SC 
has (can) determine the source of the spam". If that's so, wouldn't you 
agree the spammer has found a spoofing method that confounds Spamcop? 
This server is a Virtual Private Server under a hosting company. I 
administer it for an artist's studio. I'm a retired programmer, not an 
Admin. But I know enough to get LANs up and running and to provide basic 
WWW/FTP/Email services and troubleshoooting for small businesses. As far 
as I can tell, this server is configured with typical options and its 
primary mailer program (Exim) is not writing anything unusual to emails, 
nor deleting or scrambling headers.

On the other hand, the hosting company originally providing this VPS, 
after a period of good service, totally crashed and burned (as so many 
companies in the lower price tiers do) and was "merged" with a provider 
called "WebHostPlus". WebHostPlus has a shady past (it is apparently run 
by a group of NYC-area Russian emigrés with Russian-mobster-like 
business ties) and I have been meaning to move my client (the artist's 
studio) to a different provider. I wonder if WebHostPlus is low enough 
to sell a certain service to spammers whereby they can appear as an 
internal user to VPS accounts?

If I were a proper Admin I'd probably already have this sorted out. I 
think I'll take a look at the server logs, try to see if anyone from 
strange IPs has been logging in or hijacking daemons in some way. I'll 
let you know what I discover.

---
wsk