Re : [Assp-user] <> shows up for valid emails...

[Nathan C. <ch...@xs...>]

John,

This is the debug <> from an external spam customer sending us 
an email.

Regards
Nathan

> Please turn on debugging for a few messages, then turn it off and send me
> the .dbg file. (Please send it to jh...@cp..., not to the assp-user
> list.) For some reason Exchange is sending something that ASSP doesn't
> expect / understand. If I look at the debug file I'll know what it is and
> how to fix it.
> 
> John
> ----- Original Message ----- 
> From: "Nathan Chan" <ch...@xs...>
> To: <ass...@li...>
> Sent: Tuesday, June 24, 2003 6:41 PM
> Subject: [Assp-user] <> shows up for valid emails...
> 
> 
> > GDay All,
> >
> > Firstly John, great work on ASSP.  It does a great job here.
> >
> > This is not really a prob but more a question :
> > In my maillog, i see a lot of <> email address ie :
> > Jun-25-03 10:45:22 Connected: 63.172.79.52:1730
> > Jun-25-03 10:45:24 63.172.79.52 <> to: ha...@do... rcpt to only
> spamlovers
> >
> > But the wierd thing is, i see that occur for even my local users
> > sometimes when they send an email.  ?
> > ie. (192.168.250.1 being our exchange server internally..)
> > Jun-25-03 10:41:04 Connected: 192.168.250.1:13636
> > Jun-25-03 10:41:04 192.168.250.1 <> to: dun...@ao... whitelist
> addition:
> >
> > Can anyone explain why this happens ?
> >
> > Thanks in Advance
> > Nathan
> >
> > PS.  If this upgrade to 2.1 goes well for the next day or so, i'll start
> > adding my stats to your totaliser :)

Maillog.txt
Jun-26-03 09:59:27 Connected: 66.77.137.12:1055
Jun-26-03 09:59:29 66.77.137.12 <> to: alf...@xs... bayesian spam

.dbg file  (pyxis being the exchange server)
* connect ip=66.77.137.12 relay=<> *
25 Jun 03 23:59:27 <34>Jun-26-03 09:59:27 Connected: 66.77.137.12:1055
25 Jun 03 23:59:27 <6>25 Jun 03 23:59:27 <2>doing <220 pyxis.xsidata.com.au Microsoft ESMTP MAIL Service, Version: 5.0.2195.5329 ready at  Thu, 26 Jun 2003 09:47:41 +1000 
>
25 Jun 03 23:59:27 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=122
25 Jun 03 23:59:27 <3>25 Jun 03 23:59:27 <6>IO::Socket::INET=GLOB(0x40474340) HASH(0x40475318) l=122
wrote: (122)<>
25 Jun 03 23:59:27 <6>25 Jun 03 23:59:28 <2>doing <EHLO mail.ijs.com
>
25 Jun 03 23:59:28 <15>gl: <EHLO mail.ijs.com
>
sq: IO::Socket::INET=GLOB(0x40472fd8) l=25
25 Jun 03 23:59:28 <3>25 Jun 03 23:59:28 <6>IO::Socket::INET=GLOB(0x40472fd8) HASH(0x40475cfc) l=25
wrote: (25)<>
25 Jun 03 23:59:28 <6>25 Jun 03 23:59:28 <2>doing <250-pyxis.xsidata.com.au Hello [192.168.250.254]
>
25 Jun 03 23:59:28 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=50
doing <250-TURN
>
25 Jun 03 23:59:28 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=10
doing <250-ATRN
>
25 Jun 03 23:59:28 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=10
doing <250-SIZE 15360000
>
25 Jun 03 23:59:28 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=19
doing <250-ETRN
>
25 Jun 03 23:59:28 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=10
doing <250-PIPELINING
>
25 Jun 03 23:59:28 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=16
doing <250-DSN
>
25 Jun 03 23:59:28 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=9
doing <250-ENHANCEDSTATUSCODES
>
25 Jun 03 23:59:28 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=25
doing <250-8bitmime
>
25 Jun 03 23:59:28 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=14
doing <250-BINARYMIME
>
25 Jun 03 23:59:28 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=16
doing <250-CHUNKING
>
25 Jun 03 23:59:28 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=14
doing <250-VRFY
>
25 Jun 03 23:59:28 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=10
doing <250-X-EXPS GSSAPI NTLM LOGIN
>
25 Jun 03 23:59:28 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=30
doing <250-X-EXPS=LOGIN
>
25 Jun 03 23:59:28 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=18
doing <250-AUTH GSSAPI NTLM LOGIN
>
25 Jun 03 23:59:28 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=28
doing <250-AUTH=LOGIN
>
25 Jun 03 23:59:28 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=16
doing <250-X-LINK2STATE
>
25 Jun 03 23:59:28 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=18
doing <250-XEXCH50
>
25 Jun 03 23:59:28 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=13
doing <250 OK
>
25 Jun 03 23:59:28 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=8
25 Jun 03 23:59:28 <3>25 Jun 03 23:59:28 <6>IO::Socket::INET=GLOB(0x40474340) HASH(0x40475318) l=334
wrote: (334)<toolong>
25 Jun 03 23:59:28 <6>25 Jun 03 23:59:28 <2>doing <MAIL FROM:<> SIZE=1359
>
25 Jun 03 23:59:28 <15>gl: <MAIL FROM:<> SIZE=1359
>
sq: IO::Socket::INET=GLOB(0x40472fd8) l=24
25 Jun 03 23:59:28 <3>25 Jun 03 23:59:28 <6>IO::Socket::INET=GLOB(0x40472fd8) HASH(0x40475cfc) l=24
wrote: (24)<>
25 Jun 03 23:59:28 <6>25 Jun 03 23:59:28 <2>doing <250 2.1.0 <>....Sender OK
>
25 Jun 03 23:59:28 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=27
25 Jun 03 23:59:28 <3>25 Jun 03 23:59:28 <6>IO::Socket::INET=GLOB(0x40474340) HASH(0x40475318) l=27
wrote: (27)<>
25 Jun 03 23:59:28 <6>25 Jun 03 23:59:28 <2>doing <RCPT TO:<alf...@xs...>
>
25 Jun 03 23:59:28 <15>gl: <RCPT TO:<alf...@xs...>
>
sq: IO::Socket::INET=GLOB(0x40472fd8) l=39
25 Jun 03 23:59:28 <3>25 Jun 03 23:59:28 <6>IO::Socket::INET=GLOB(0x40472fd8) HASH(0x40475cfc) l=39
wrote: (39)<>
25 Jun 03 23:59:28 <6>25 Jun 03 23:59:28 <2>doing <250 2.1.5 alf...@xs... 
>
25 Jun 03 23:59:28 <30>sq: IO::Socket::INET=GLOB(0x40474340) l=40
25 Jun 03 23:59:28 <3>25 Jun 03 23:59:28 <6>IO::Socket::INET=GLOB(0x40474340) HASH(0x40475318) l=40
wrote: (40)<>
25 Jun 03 23:59:28 <6>25 Jun 03 23:59:28 <2>doing <DATA
>
25 Jun 03 23:59:28 <15>gl: <DATA
>
25 Jun 03 23:59:28 <361>sq: IO::Socket::INET=GLOB(0x40472fd8) l=6
25 Jun 03 23:59:28 <3>25 Jun 03 23:59:28 <6>IO::Socket::INET=GLOB(0x40472fd8) HASH(0x40475cfc) l=6wrote: (6)<>
25 Jun 03 23:59:28 <6>25 Jun 03 23:59:28 <2>doing <354 Start mail input; end with <CRLF>.<CRLF>
>
25 Jun 03 23:59:28 <30>25 Jun 03 23:59:28 <301>sq: IO::Socket::INET=GLOB(0x40474340) l=46
25 Jun 03 23:59:28 <3>25 Jun 03 23:59:28 <6>IO::Socket::INET=GLOB(0x40474340) HASH(0x40475318) l=46
wrote: (46)<>
25 Jun 03 23:59:28 <6>25 Jun 03 23:59:29 <2>doing <Subject: Undeliverable mail: Don't =?iso-8859-1?B?YmUgc2k=?=lly
>
25 Jun 03 23:59:29 <18>doing <From: MAI...@ma...
>
25 Jun 03 23:59:29 <18>doing <To: <alf...@xs...>
>
25 Jun 03 23:59:29 <18>doing <Date: Wed, 25 Jun 2003 16:35:40 -0700
>
25 Jun 03 23:59:29 <18>doing <Message-ID: <rec...@ma...>
>
25 Jun 03 23:59:29 <18>doing <MIME-Version: 1.0
>
25 Jun 03 23:59:29 <18>doing <Content-Type: multipart/report; report-type=delivery-status;
>
25 Jun 03 23:59:29 <18>doing < boundary="_===2287449====mail.ijs.com===_"
>
25 Jun 03 23:59:29 <18>doing <
>
25 Jun 03 23:59:29 <18>25 Jun 03 23:59:29 <32>doing <
>
25 Jun 03 23:59:29 <27>doing <--_===2287449====mail.ijs.com===_
>
25 Jun 03 23:59:29 <27>doing <Content-Type: text/plain
>
25 Jun 03 23:59:29 <27>doing <
>
25 Jun 03 23:59:29 <27>doing <Failed to deliver to '<dor...@bu...>'
>
25 Jun 03 23:59:29 <27>doing <external processing failed
>
25 Jun 03 23:59:29 <27>doing <
>
25 Jun 03 23:59:29 <27>doing <
>
25 Jun 03 23:59:29 <27>doing <--_===2287449====mail.ijs.com===_
>
25 Jun 03 23:59:29 <27>doing <Content-Type: message/delivery-status
>
25 Jun 03 23:59:29 <27>doing <
>
25 Jun 03 23:59:29 <27>doing <Reporting-MTA: dns; mail.ijs.com
>
25 Jun 03 23:59:29 <27>doing <
>
25 Jun 03 23:59:29 <27>doing <Original-Recipient: rfc822;<dor...@bu...>
>
25 Jun 03 23:59:29 <27>doing <Final-Recipient: system;
>
25 Jun 03 23:59:29 <27>doing <Action: failed
>
25 Jun 03 23:59:29 <27>doing <Status: 5.0.0
>
25 Jun 03 23:59:29 <27>doing <
>
25 Jun 03 23:59:29 <27>doing <--_===2287449====mail.ijs.com===_
>
25 Jun 03 23:59:29 <27>doing <Content-Type: text/rfc822-headers
>
25 Jun 03 23:59:29 <27>doing <
>
25 Jun 03 23:59:29 <27>doing <Received: from [24.190.215.166] (HELO melin.nu)
>
25 Jun 03 23:59:29 <27>doing <  by mail.ijs.com (CommuniGate Pro SMTP 3.4.8)
>
25 Jun 03 23:59:29 <27>doing <  with ESMTP id 2287447 for dor...@bu...; Wed, 25 Jun 2003 16:35:37 -0700
>
25 Jun 03 23:59:29 <27>doing <Message-ID: <2.2...@xs...>
>
25 Jun 03 23:59:29 <27>doing <X-Mailer: Windows Eudora Pro Version 2.2 (32)
>
25 Jun 03 23:59:29 <27>doing <To: dor...@bu...
>
25 Jun 03 23:59:29 <27>doing <From: "Alfonzo Ellis" <alf...@xs...>
>
25 Jun 03 23:59:29 <27>doing <Date: Thu, 26 Jun 2003 03:47:54 +0400
>
25 Jun 03 23:59:29 <27>doing <Subject: Don't =?iso-8859-1?B?YmUgc2k=?=lly
>
25 Jun 03 23:59:29 <27>doing <MIME-Version: 1.0
>
25 Jun 03 23:59:29 <27>doing <Content-Type: text/html
>
25 Jun 03 23:59:29 <27>doing <Content-Transfer-Encoding: base64
>
25 Jun 03 23:59:29 <27>doing <
>
25 Jun 03 23:59:29 <27>doing <--_===2287449====mail.ijs.com===_--
>
25 Jun 03 23:59:29 <27>doing <.
>
25 Jun 03 23:59:29 <27>25 Jun 03 23:59:29 <31>25 Jun 03 23:59:29 <362>25 Jun 03 23:59:29 <19>25 Jun 03 23:59:29 <366>25 Jun 03 23:59:29 <34>Jun-26-03 09:59:29 66.77.137.12 <> to: alf...@xs... bayesian spam
25 Jun 03 23:59:29 <28>25 Jun 03 23:59:29 <29>25 Jun 03 23:59:29 <13>closing IO::Socket::INET=GLOB(0x40474340)
25 Jun 03 23:59:29 <13>closing IO::Socket::INET=GLOB(0x40472fd8)
25 Jun 03 23:59:29 <3>25 Jun 03 23:59:29 <6>25 Jun 03 23:59:36 <6>25 Jun 03 23:59:36 <8>25 Jun 03 23:59:39 <1>25 Jun 03 23:59:39 <14>25 Jun 03 23:59:39 <14>Connected: IO::Socket::INET=GLOB(0x40478cc0) -- IO::Socket::INET=GLOB(0x40475b34)