hsc message board > Still a few snags

hsc message board > Main > hsc Software Support

Codger

Jun 16 2004, 02:04 PM

Sad but true:

QUOTE

Thank you for contacting the AT&T Internet Investigations and Security Services
team. After careful review of the headers that were forwarded to us, we have
determined that the junk or virus E-mail about which you have complained does not
emanate from an AT&T WorldNet Service account.

Here's the header and first few lines from the SpamX generated complaint:

QUOTE

Received: from 204.127.198.6 (unknown[218.190.178.219](misconfigured sender))
by rwcrmxc13.comcast.net (rwcrmxc13) with SMTP
id <20040615104948r1300p7fd6e>; Tue, 15 Jun 2004 10:51:06 +0000
X-Originating-IP: [218.190.178.219]
X-Message-Info: M535YYRVTxwf914rPYFxagZUE253XBY632arwOgujOMR584
Received: from 77.253.76.244 by ip-8-588-17-53.x.magneticseven@attbi.com (AppleMailServer 47.3.7.8) id 179200425287 via NDR; Sat, 19 Jun 2004 02:59:41 -0500
Reply-To: "Alex Engel" <magneticseven@attbi.com>
From: "Alex Engel" <magneticseven@attbi.com>
To: "Magneticseven" <magneticseven@attbi.com>
Subject: breadroot ovid
Date: Sat, 19 Jun 2004 04:56:41 -0300
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--=_mjBg44IKThym45q"

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>

Here's the SpamX log:

QUOTE

Processing breadroot ovid
204.127.198.6 Is Not Listed In Internet Lookups
Received Answer
Evaluating Answer For 204.127.198.6
Received Net Block Answer NET-204-127-198-0-1
Received Answer
Evaluating Answer For NET-204-127-198-0-1
Finding Domains
Found Domain ATTBI.COM
Found Domain ATT.COM
Found Domain ATT.NET
Found Domain NIPAWEB.VIP.ATT.NET
Received Answer
Evaluating Answer For ABUSE.NET
Finding Email Addresses
ABUSE@ATTBI.COM
Received Answer
Evaluating Answer For ABUSE.NET
Finding Email Addresses
ABUSE@ATT.NET
Received Answer
Evaluating Answer For ABUSE.NET
Finding Email Addresses
Received Answer
Evaluating Answer For ABUSE.NET
Finding Email Addresses
Finished With NET-204-127-198-0-1
Spammer Successfully Reported!
Deleting breadroot ovid

As you can see, SpamX didn't find the originating IP [218.190.178.219].

Jeff Hendrickson

Jun 21 2004, 02:33 PM

Thanks Codger, I'll run this later today, and see what gives...

Jeff Hendrickson

Jun 22 2004, 12:42 AM

Yepper, the '204.127.198.6 (unknown[218.190.178.219](misconfigured sender))' goofed the SpamX header parser.

SpamX should have picked up 218.190.178.219 and sent an abuse complaint to abuse@hgcbroadband.com.

Thanks for this report, I'll put this in the list of to dos....

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.