Lord Richard
Jan 7 2005, 07:43 PM
Been examining the log files and Sp@mX now seems to be processing the wrong IP for the mail headers... for example:
Received: from gold.pobox.com (gold.pobox.com [208.210.124.73])
by blahblahnospam.net (Postfix) with ESMTP id 9DA08883445
Received: from gold.pobox.com (localhost [127.0.0.1])
by gold.pobox.com (Postfix) with ESMTP id 53E8F5E3D6
for <lblahblahnospam@com>; Fri, 7 Jan 2005 12:38:37 -0500 (EST)
Received: from gold (localhost [127.0.0.1])
by gold.pobox.com (Postfix) with ESMTP id 397815C583
for <rblahblahnospam.com>; Fri, 7 Jan 2005 12:38:37 -0500 (EST)
Received: from 208.210.124.73 (unknown [211.161.190.72])
by gold.pobox.com (Postfix) with SMTP id 3B6B55E32C;
Received: from age kampala (firewall.rabbitmel.com [164.116.172.119]) by 211.161.190.72 (6.1.0/5.8.0) with ESMTP id WNR49118052 for <randomemailaddresthatsnotmine@com>; Fri, 07 Jan 2005 12:33:01 -0500
Sp@mX attempts to look up and report 208.210.124.73 instead of the correct spamming IP which is 211.161.190.72
It used to work correctly before... is the 127.0.0.1 messing it up again?
Lord Richard
Jan 7 2005, 07:47 PM
Here's the related log output from Sp@mX, it's a similar output for every message it processes:
reached end of reliable IP chain
sending DNS request
found URL biodonqueen.us
found URL www.trimlife.com
claims gold.pobox.com is gold.pobox.com
dns lookup done for 1 entries
analyzing identities
gold.pobox.com identity accepted
analyzing chain
one entry in receive chain
report results
entry 0 score = 100
sending n request
208.210.124.73 is not listed in n entry
done with n request(s)
entry 0 score = 100
sending f request
208.210.124.73 is not listed in f entry
done with f request(s)
entry 0 score = 100
sending s request
208.210.124.73 is not listed in s entry
done with s request(s)
entry 0 IP 208.210.124.73 score = 100 type = mail server
adding 208.210.124.73 to lookups
lookup ip 208.210.124.73
looking in North America
connected, sending ip lookup 208.210.124.73
receiving 356 bytes from North America
disconnecting ip lookup
received net block answer NET-208-210-124-0-1
lookup ip 208.210.124.73
connected, sending ip lookup NET-208-210-124-0-1
receiving 1052 bytes from North America
disconnecting ip lookup
mci.com is do not send
mci.com is do not send
mci.com is do not send
mci.com is do not send
found domain(s)
lookup abuse biodonqueen.us
connected, sending abuse lookup biodonqueen.us
receiving 48 bytes from abuse
abuse disconnecting
POSTMASTER@BIODONQUEEN.US
found abuse address(es)
lookup abuse www.trimlife.com
connected, sending abuse lookup www.trimlife.com
receiving 82 bytes from abuse
abuse disconnecting
POSTMASTER@TRIMLIFE.COM
MIKEM@NDTEL.COM
found abuse address(es)
sending to POSTMASTER@BIODONQUEEN.US
sending to POSTMASTER@TRIMLIFE.COM
sending to MIKEM@NDTEL.COM
mysmtpserveryaynospamplease@com ESMTP Postfix (Debian/GNU)
message EMail Abuse Complaint 1/7/2005 11:37:53 AM sent to POSTMASTER@BIODONQUEEN.US, POSTMASTER@TRIMLIFE.COM, MIKEM@NDTEL.COM
SMTP server disconnects, spammer reported
Lord Richard
Jan 7 2005, 07:54 PM
Forgot to mention its version 3.1.2

Thanks in advance!