[SC-Help] Re: Bad tracking of spam from x.phoenix-dns.com

[Mike Easter]

<posted to .spam & .help;  f/ups to .help>

Gene S wrote:
> Is anybody at SC actually checking the cases of bad tracking?

A deputy sed that the design is for them to check them, but that they
are getting a lot and they're not getting checked properly.

> Spam from x.phoenix-dns.com keeps coming for a while now, but the SC
> doesn't parse the headers correctly. It keeps sending reports to
> admins of fake addresses and to bad_tracking, like in the case of
> "aga (178.233.90.121)" in the example below. Can anything be done
> about it?
>
> Received: from x.phoenix-dns.com (x.phoenix-dns.com [63.247.69.162])
>  by X (Postfix) with SMTP id CAF5939E39
>  for <hook at aktrad.ru>; Sat, 11 Jun 2005 01:14:25 +0400 (MSD)
> Received: from aga (178.233.90.121)
>  by x.phoenix-dns.com; Fri, 10 Jun 2005 17:14:23 -0400
>
> Maybe SC can add a field to the submission form to the extent "I
> believe the parser barfed, the correct source of spam is ..."?

To a human parser, I would interpret the 2nd line as bogus and I would
want SC to untrust 63.247.69.162 as a server.  It /is/ the mx for
x.phoenix-dns.com.

That would cause it to get named as a source and contribute to its being
SCbl listed.


>From a newsgroup housekeeping point of view, there are a couple of
better ways to talk about this issue than posting partial headers in
.spam.

First, it would be better to talk about it by posting the tracker for
the parse of the spam [or even a tracker for a parse of the headers
alone] -- that permits the discussants to actually see how SC is
currently parsing the same item.  The tracker stores the spam [or
headers] and when the tracker link is accessed, the item is reparsed
anew.  For example if a deputy had fixed the problem we are talking
about, we would see it.

Second, when the tracker is what is posted, it can be posted in a
'proper' discussion group, like spamcop.help or spamcop.  The ng .spam
was invented long ago before trackers were so good so that raw spam with
complete headers could be posted here to allow discussions about an
item -- because such spam postings were not allowed in the discussion
groups.  Nowadays a tracker is a better post for the complete item, so
there's no need for anything here.  Usually when I answer a post in
.spam, I 'move it' by making its/my f/ups to one of the discussion
groups.

Third, pertaining to the 1st, this is what a tracker looks like and its
environs at the top of a parsed result

Here is your TRACKING URL - it may be saved for future reference:
http://www.spamcop.net/sc?id=z774399296z5b586e5f15c5c54435849ba57a4386bbz

-- 
Mike Easter
kibitzer, not SC admin