From me at privacy.net Tue Nov 1 00:51:24 2005 From: me at privacy.net (Kyle Atmore) Date: Tue Nov 1 00:55:03 2005 Subject: [SC-Help] Re: How many reports are there? In-Reply-To: References: Message-ID: Don Wannit wrote: > Frog Prince wrote: > >> "Don Wannit" wrote in message >> | Truly. Requested many times by many people, myself included. Some >> | speculation has been that the extra processing required to count 'em up >> | for everyone would be excessive. No one in a real position to know >> | (i.e. Julian) has said one way or another. >> >> You have to count/total before you can average. Drop the average >> function = >> fewer CPU cycles. >> > > ?? what average function? Aren't we talking about counting the total > number of pending spams for each individual user and displaying it on > their own personal login/reporting page? > > > I believe they're referring to the average time between submittal and reporting. I find that number useless. So, apparently, do many other people. :) From user at domain.invalid Tue Nov 1 09:06:42 2005 From: user at domain.invalid (user@domain.invalid) Date: Tue Nov 1 03:10:24 2005 Subject: [SC-Help] Re: No email acknowledgment In-Reply-To: References: Message-ID: Mike Easter wrote: >there can be a >problem with your address that SC mails to, > I do receive at the same address "user defined recipient" spam reports so ? > and there can be a problem >in your getting SC mail from your provider. > >I don't see any announcments > > From user at domain.invalid Tue Nov 1 14:39:40 2005 From: user at domain.invalid (user@domain.invalid) Date: Tue Nov 1 08:40:04 2005 Subject: [SC-Help] Re: No email acknowledgment In-Reply-To: References: Message-ID: user@domain.invalid wrote: > > there can be a problem with your address that SC mails to, There was something tricky in my mozilla junk mail control (junk thrown away into a no more existing account) and for some reason spamcop ack were high scored :/ From scamper at trisk.com Tue Nov 1 11:40:45 2005 From: scamper at trisk.com (Garen Erdoisa) Date: Tue Nov 1 13:40:02 2005 Subject: [SC-Help] Re: How many reports are there? In-Reply-To: References: Message-ID: Kyle Atmore wrote: > You know what would be incredibly useful? > > I'm a non-paid user--I just report my spam using MailWasher, then come > to spamcop to complete the reports. > > Problem is, once I log in, that screen says: > > Unreported Spam Saved: >Report Now< > You have submitted spam which has not yet been reported. Please avoid > re-reporting spam. If you have already reported this spam or do not want > to report it, please make sure to click "cancel" instead of submitting > the report! > > Great. But how many do I have sitting out there? The link >Report Now< > takes me to one of them seemingly at random. Would it be REALLY hard to > have it say: > > You have submitted 48 spams which have not yet been reported. > > Or something along those lines? > > Just suggestin'.... Just a thought; You can do this yourself by doing a bcc to another account of everything sent to spamcop via whatever means you are using. Or just have your system increment a counter for every outgoing spamcop report that would give you some idea of how many pending reports you have. Reset the count after you are done reporting stuff. Garen From h9vzc2i02 at sneakemail.com Tue Nov 1 10:57:12 2005 From: h9vzc2i02 at sneakemail.com (Anon_) Date: Tue Nov 1 14:00:04 2005 Subject: [SC-Help] Re: How many reports are there? References: Message-ID: "Garen Erdoisa" wrote in message news:dk8cnm$pcm$1@news.spamcop.net... > Kyle Atmore wrote: > > You know what would be incredibly useful? > > > > I'm a non-paid user--I just report my spam using MailWasher, then come > > to spamcop to complete the reports. > > > > Problem is, once I log in, that screen says: > > > > Unreported Spam Saved: >Report Now< > > You have submitted spam which has not yet been reported. Please avoid > > re-reporting spam. If you have already reported this spam or do not want > > to report it, please make sure to click "cancel" instead of submitting > > the report! > > > > Great. But how many do I have sitting out there? The link >Report Now< > > takes me to one of them seemingly at random. Would it be REALLY hard to > > have it say: > > > > You have submitted 48 spams which have not yet been reported. > > > > Or something along those lines? > > > > Just suggestin'.... > > Just a thought; > > You can do this yourself by doing a bcc to another account of everything > sent to spamcop via whatever means you are using. Or just have your > system increment a counter for every outgoing spamcop report that would > give you some idea of how many pending reports you have. Reset the count > after you are done reporting stuff. *** You do not have to Bcc, just Cc - SC doesn't care who else you Cc to. -- A SpamCop user and forum reader, Not Admin *** > > Garen > > > From nobody at spamcop.net Tue Nov 1 15:25:03 2005 From: nobody at spamcop.net (Ellen) Date: Tue Nov 1 15:30:03 2005 Subject: [SC-Help] 11/1/2005 Maint Window Message-ID: Maintenance Window Nov 1, 2005 During the period 14:00-18:00 -0800 we will have an outage of about 45 minutes for the installation of new hardware for the reporting system. Thank you for your patience. The email system will not affected by this maintenance window. Ellen SpamCop follow/ups to SpamCop Please propagate to the forums From nobody at spamcop.net Tue Nov 1 17:56:25 2005 From: nobody at spamcop.net (Ellen) Date: Tue Nov 1 18:00:03 2005 Subject: [SC-Help] Maint Window completed Message-ID: The maintenance window scheduled for 11/1/2005 has been completed. Thanks! Ellen SpamCop follow/ups to SpamCop Please propagate to the forums From diespammer at spamthis.net Tue Nov 1 19:23:36 2005 From: diespammer at spamthis.net (die spammer) Date: Tue Nov 1 22:25:05 2005 Subject: [SC-Help] blank spam Message-ID: is it me or is anyone else getting blank spam created by mailenium? is it the same person sending the watch ad spam. It seems that Mailenium is an email encryption add-on. From MikeE at ster.invalid Tue Nov 1 23:20:56 2005 From: MikeE at ster.invalid (Mike Easter) Date: Wed Nov 2 02:25:03 2005 Subject: [SC-Help] Re: blank spam References: Message-ID: die spammer wrote: > is it me or is anyone else getting blank spam created by mailenium? is > it the same person sending the watch ad spam. > > It seems that Mailenium is an email encryption add-on. IMO that's not a very interesting question. But, that's just me. -- Mike Easter kibitzer, not SC admin From nobody at spamcop.net Wed Nov 2 09:22:39 2005 From: nobody at spamcop.net (Ellen) Date: Wed Nov 2 09:25:03 2005 Subject: [SC-Help] System outages/instability Message-ID: Morning folks -- yes we are having system problems and operations/engineering is working the issues. You may see failures trying to log-in or other error messages. Please do not try to change your password as this will not solve the problem. The problems will probably continue sporadically. There is no ETA right now for complete resolution but this is being treated by everyone as a priority 1 situation. Thank you for your patience! The email system is not affected. I suppose the good news is that there will still be shiney new spams to report after the problems are resolved -- and that is also the bad news .... Ellen SpamCop follow-ups to SpamCop Please propagate to the forums From nobody at spamcop.net Wed Nov 2 10:19:38 2005 From: nobody at spamcop.net (N. Miller) Date: Wed Nov 2 13:20:07 2005 Subject: [SC-Help] Re: blank spam References: Message-ID: <1smm7yk7iyjs1.dlg@news.spamcop.net> On Tue, 01 Nov 2005 19:23:36 -0800, die spammer wrote: > is it me or is anyone else getting blank spam created by mailenium? is > it the same person sending the watch ad spam. > > It seems that Mailenium is an email encryption add-on. Maillenium is not an encryption add-on; it is just the Comcast mail server software. Neither does not "create" email, it just processes it; same as any other MTA. Here is the banner I get when I open a Telnet session to smtp.comcast.net on port 25: |220 comcast.net - Maillennium ESMTP/MULTIBOX sccrmhc12 #43 When you see the Comcast header lines about non-compliance with RFC 821, and adding a date, that is just the MTA telling you how it handled a particular problem it found with an incoming email. As for the blank message; that is a common problem with a particular version of spamware. It affects the sent message, not the received message; different MTAs will handle the oddity according to their local processing rules. Yahoo! Mail MTAs handle it well, adding the SpamGuard Bulk notification in the headers. Here is my latest example: http://www.spamcop.net/sc?id=z822480694z8148e83a82668f76712a5bb10dd6e8c6z Note the SpamGuard header line, "X-YahooFilteredBulk: 61.125.107.28", which would cause this to be placed in the Yahoo! Bulk folder. I have this particular SBC sub account set to forward email to my local MTA, though. Also note the truncation of the MID$; that is the sign that this particular version of this spamware is broken. All header lines after the broken MID$ were added by the aosake.net MTA. I have seen one good example of this as received at a Comcast email account; same sign of brokenness. A lot of Comcast users are complaining because the Comcast spam filters, apparently, can't handle these as well as Yahoo! Mail's SpamGuard does. -- Norman ~Shine, bright morning light, ~now in the air the spring is coming. ~Sweet, blowing wind, ~singing down the hills and valleys. From nobody at spamcop.net Wed Nov 2 10:25:19 2005 From: nobody at spamcop.net (N. Miller) Date: Wed Nov 2 13:30:04 2005 Subject: [SC-Help] Re: blank spam References: <1smm7yk7iyjs1.dlg@news.spamcop.net> Message-ID: <11vzjf615r4i5$.dlg@news.spamcop.net> On Wed, 2 Nov 2005 10:19:38 -0800, N. Miller wrote: > When you see the Comcast header lines about non-compliance with RFC 821, > and adding a date, that is just the MTA telling you how it handled a > particular problem it found with an incoming email. Silly me; I could have just grabbed the headers from the BBR forum and run them through the parser. I also noticed that the Maillenium server references RFC 822, not RFC 821. http://www.spamcop.net/sc?id=z822482916z77a62209411fcb1adc4f17c3574b515bz -- Norman ~Shine, bright morning light, ~now in the air the spring is coming. ~Sweet, blowing wind, ~singing down the hills and valleys. From MikeE at ster.invalid Wed Nov 2 15:27:53 2005 From: MikeE at ster.invalid (Mike Easter) Date: Wed Nov 2 18:30:02 2005 Subject: [SC-Help] Re: URI decoding problems? References: Message-ID: posted to spamcop.spam and spamcop.help; f/ups to spamcop.help Sir Sorcerer wrote: > This came from your URI page: > > http://r.lycos.com/r/nk>_lhxplcvg_dllvnteriu/http:\/zajmpzbxypnn.net.svxwszd > fhnzcxmjm0ogm5ywi0mdvmyzu3nwyz.closetoperffect.com [posted url wrapped by my newsagent] spamcop.spam is not a discussion group. I don't see a good way to discuss your issue in a normal discussion group like spamcop or spamcop.help, either. In the future, if you want to discuss how spamcop deobfuscates a URL found in a spam, IMO the best way to do it would be to submit the spam in question into the parser, copy the tracking URL, and paste that URL into a normal discussion group such as spamcop or spamcop.help. You could also paste the URL itself, as you did here, but that will subject it to the adverse effects of your newsagent or the newsagent of others -- which is sometimes not avoidable. The tracker represents a link to the entire spam, header and body, including the link, without any adverse newsreader effects. spamcop.spam was originally intended as a newsgroup for posting spams, before the days in which a tracking url was able to contain the entire spam. The original or earlier tracking url/s only contained access to the spam headers, so entire spams were posted into spamcop.spam to be able to discuss a spambody issue. spamcop.spam is no longer a good place to post a spam because of what 'contamination' and bending of the original spam takes place by the newsagent, unless you have a compatible way to submit the spam into spamcop.spam newsgroup by attaching it to your news message rather than pasting it inline into the body where wrapping effects take over. The other problem with spamcop.spam usage is that no spam is allowed in the discussion groups and no discussion in the spam group. -- Mike Easter kibitzer, not SC admin From rwcs at spamcop.net Wed Nov 2 19:11:14 2005 From: rwcs at spamcop.net (BMW) Date: Wed Nov 2 19:15:03 2005 Subject: [SC-Help] Email submit problem Message-ID: I have been trying to teach my mail server to automatically forward know Spam to SC. I get a SC has encountered errors email back every time. Is there some place I can get a knowledgeable person to review SC's regurgitation. (I'm hesitant to post so much personal info on a forum) BMW From nobody at spamcop.net Wed Nov 2 19:18:40 2005 From: nobody at spamcop.net (Ellen) Date: Wed Nov 2 19:25:03 2005 Subject: [SC-Help] Re: Email submit problem References: Message-ID: "BMW" wrote in message news:dkbkj1$g3k$1@news.spamcop.net... > I have been trying to teach my mail server to automatically forward know > Spam to SC. I get a SC has encountered errors email back every time. > Is there some place I can get a knowledgeable person to review SC's > regurgitation. (I'm hesitant to post so much personal info on a forum) > You can send the specifics to deputies admin.spamcop.net If you are doing a procmail .forward it will not work. You need to teach the mailserver to enclose the spam with full headers in a new mail. Ellen From devnull at spamcop.net Thu Nov 3 11:37:37 2005 From: devnull at spamcop.net (Frog Prince) Date: Thu Nov 3 11:40:02 2005 Subject: [SC-Help] Re: How many reports are there? References: Message-ID: "Garen Erdoisa" wrote in message news:dk8cnm$pcm$1@news.spamcop.net... | Kyle Atmore wrote: | > You know what would be incredibly useful? | > | > I'm a non-paid user--I just report my spam using MailWasher, then come | > to spamcop to complete the reports. | > | > Problem is, once I log in, that screen says: | > | > Unreported Spam Saved: >Report Now< | > You have submitted spam which has not yet been reported. Please avoid | > re-reporting spam. If you have already reported this spam or do not want | > to report it, please make sure to click "cancel" instead of submitting | > the report! | > | > Great. But how many do I have sitting out there? The link >Report Now< | > takes me to one of them seemingly at random. Would it be REALLY hard to | > have it say: | > | > You have submitted 48 spams which have not yet been reported. | > | > Or something along those lines? | > | > Just suggestin'.... | | Just a thought; | | You can do this yourself by doing a bcc to another account of everything | sent to spamcop via whatever means you are using. Or just have your | system increment a counter for every outgoing spamcop report that would | give you some idea of how many pending reports you have. Reset the count | after you are done reporting stuff. The average reporting time is useless information and does nothing to improve to actual report cycle. OTOH the number of unreported spam would be useful if for no other reason than I know if I have time to finish or have to come back to do the job (much) later. Net reporting time for me would impove. From gok75 at spamcop.net Thu Nov 3 16:56:29 2005 From: gok75 at spamcop.net (mark) Date: Thu Nov 3 19:00:03 2005 Subject: [SC-Help] error reading any other mailbox but inbox Message-ID: keep getting "There was an error viewing the requested message." does that mean it's the computer I'm on temporarily? Since this is a public computer, I'll assume it. And I put in my address in the Email client just to send this message out. Will see if it made it! From diespammer at spamthis.net Thu Nov 3 16:56:18 2005 From: diespammer at spamthis.net (die spammer) Date: Thu Nov 3 20:00:11 2005 Subject: [SC-Help] Re: blank spam In-Reply-To: <1smm7yk7iyjs1.dlg@news.spamcop.net> References: <1smm7yk7iyjs1.dlg@news.spamcop.net> Message-ID: download.com does have a mailenium program available for download N. Miller wrote: > On Tue, 01 Nov 2005 19:23:36 -0800, die spammer wrote: > > >>is it me or is anyone else getting blank spam created by mailenium? is >>it the same person sending the watch ad spam. >> >>It seems that Mailenium is an email encryption add-on. > > > Maillenium is not an encryption add-on; it is just the Comcast mail server > software. Neither does not "create" email, it just processes it; same as > any other MTA. Here is the banner I get when I open a Telnet session to > smtp.comcast.net on port 25: > > |220 comcast.net - Maillennium ESMTP/MULTIBOX sccrmhc12 #43 > > When you see the Comcast header lines about non-compliance with RFC 821, > and adding a date, that is just the MTA telling you how it handled a > particular problem it found with an incoming email. > > As for the blank message; that is a common problem with a particular > version of spamware. It affects the sent message, not the received message; > different MTAs will handle the oddity according to their local processing > rules. Yahoo! Mail MTAs handle it well, adding the SpamGuard Bulk > notification in the headers. Here is my latest example: > > http://www.spamcop.net/sc?id=z822480694z8148e83a82668f76712a5bb10dd6e8c6z > > Note the SpamGuard header line, "X-YahooFilteredBulk: 61.125.107.28", which > would cause this to be placed in the Yahoo! Bulk folder. I have this > particular SBC sub account set to forward email to my local MTA, though. > > Also note the truncation of the MID$; that is the sign that this particular > version of this spamware is broken. All header lines after the broken MID$ > were added by the aosake.net MTA. I have seen one good example of this as > received at a Comcast email account; same sign of brokenness. A lot of > Comcast users are complaining because the Comcast spam filters, apparently, > can't handle these as well as Yahoo! Mail's SpamGuard does. > From diespammer at spamthis.net Thu Nov 3 16:58:56 2005 From: diespammer at spamthis.net (die spammer) Date: Thu Nov 3 20:00:17 2005 Subject: [SC-Help] Re: blank spam In-Reply-To: <11vzjf615r4i5$.dlg@news.spamcop.net> References: <1smm7yk7iyjs1.dlg@news.spamcop.net> <11vzjf615r4i5$.dlg@news.spamcop.net> Message-ID: one thing I did notice is that spancop can't handle these blank spams either without a subject and body... N. Miller wrote: > On Wed, 2 Nov 2005 10:19:38 -0800, N. Miller wrote: > > >>When you see the Comcast header lines about non-compliance with RFC 821, >>and adding a date, that is just the MTA telling you how it handled a >>particular problem it found with an incoming email. > > > Silly me; I could have just grabbed the headers from the BBR forum and run > them through the parser. I also noticed that the Maillenium server > references RFC 822, not RFC 821. > > http://www.spamcop.net/sc?id=z822482916z77a62209411fcb1adc4f17c3574b515bz > From MikeE at ster.invalid Thu Nov 3 19:25:03 2005 From: MikeE at ster.invalid (Mike Easter) Date: Thu Nov 3 22:30:06 2005 Subject: [SC-Help] Re: blank spam References: <1smm7yk7iyjs1.dlg@news.spamcop.net> Message-ID: die spammer wrote: User-Agent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.2) Gecko/20040804 Netscape/7.2 (ax) > download.com does have a mailenium program available for download die spammer wrote: > one thing I did notice is that spancop can't handle these blank spams > either without a subject and body... Here's an article discussing the preferred style of attributions and quoting in newsgroups http://members.fortunecity.com/nnqweb/nquote.html Quoting Style in Newsgroup Postings Here's an article discussing topposting & TOFU http://en.wikipedia.org/wiki/Topposting Top-posting means replying to a message above the original message. Here's an article describing what happened to cause some OE users to have trouble fighting corporate email TOFU configurations with newsgroup posts http://www.insideoe.com/faqs/why.htm#signature Why can't OE insert my signature after quoted text in replies? I don't know if there is a similar article explaining what causes a non-OE user to toppost instead of trimming and contextualizing.. -- Mike Easter kibitzer, not SC admin From nobody at spamcop.net Thu Nov 3 22:47:37 2005 From: nobody at spamcop.net (N. Miller) Date: Fri Nov 4 01:50:03 2005 Subject: [SC-Help] Re: blank spam References: <1smm7yk7iyjs1.dlg@news.spamcop.net> Message-ID: On Thu, 3 Nov 2005 19:25:03 -0800, Mike Easter wrote: > I don't know if there is a similar article explaining what causes a > non-OE user to toppost instead of trimming and contextualizing.. Netscape 7.2. Probably migrated from MSIE/MSOE, or from AOL. Or both. -- Norman ~Shine, bright morning light, ~now in the air the spring is coming. ~Sweet, blowing wind, ~singing down the hills and valleys. From nobody at spamcop.net Thu Nov 3 22:51:39 2005 From: nobody at spamcop.net (N. Miller) Date: Fri Nov 4 01:55:02 2005 Subject: [SC-Help] Re: blank spam References: <1smm7yk7iyjs1.dlg@news.spamcop.net> Message-ID: On Thu, 03 Nov 2005 16:56:18 -0800, die spammer wrote: > download.com does have a mailenium program available for download As distinguished from the "Maillenium" server used by Comcast? Not that it matters. Several way of searching for either "maillenium", or "mailenium" failed to find anything to download. -- Norman ~Shine, bright morning light, ~now in the air the spring is coming. ~Sweet, blowing wind, ~singing down the hills and valleys. From jeffg at spamcop.net Fri Nov 4 03:15:16 2005 From: jeffg at spamcop.net (Jeff G.) Date: Fri Nov 4 03:20:05 2005 Subject: [SC-Help] Re: Newsgroups beef (was Stock inflaters?) References: Message-ID: "Mike Easter" wrote in message news:di70f8$qr3$1@news.spamcop.net... > WazoO wrote: > > catch the word "diatribe" in the Title ... More specifically, for those of you playing at home, that Topic is http://forum.spamcop.net/forums/index.php?showtopic=5077 . > Yeah I saw that thread and the negatives on the nntp as well as the > forum. I tho't that might be it. What does 'brought from a PM' mean? - > that you moved something from somewhere else, but what kind of somewhere > else? PM is short for Personal Message, basically email that stays within the Web Forum and its database. Also, the tie-in between this thread's OP's actual problem (country-based blacklists not being seen to actually function) and the Web Forum would not be complete without mentioning the "Declining effectiveness of blocklists" Topic at http://forum.spamcop.net/forums/index.php?showtopic=5285 . -- Best Regards, Jeff G. I have been a SpamCop User/Member/Customer since 1999 and am a Moderator of the new web-based forums (now the primary method for getting help, http://forum.spamcop.net). Please contact me via Forum only. From MikeE at ster.invalid Fri Nov 4 02:28:43 2005 From: MikeE at ster.invalid (Mike Easter) Date: Fri Nov 4 05:30:32 2005 Subject: [SC-Help] Re: Newsgroups beef (was Stock inflaters?) References: Message-ID: Jeff G. wrote: > Also, the tie-in between this thread's OP's actual problem > (country-based blacklists not being seen to actually function) and the > Web Forum would not be complete without mentioning the "Declining > effectiveness of blocklists" Topic at > http://forum.spamcop.net/forums/index.php?showtopic=5285 . I had forgotten what the OP's original problem was a month ago. From: Keith Jillings Newsgroups: spamcop.help Subject: Stock inflaters? Date: Tue, 04 Oct 2005 01:27:59 +0100 Keith Jillings wrote: > Until recently, Spamcop has done a brilliant job. As I posted above > (and got no reply) stuff is now getting past the filters. On watching > the batches that arrive daily, it seems almost all to be these pesky > "This stock is about to explode" scans. > > They comes mostly from countries that are in my country blacklist - > yet they get past the filter. How is that? Has Spamcop got a > problem? That thread started out confusing me and then later I turned it into the newsgroup beef. Somewhere the business about blackholes.us being out of commission came up, but in general that was mostly an argumentative thread. The forum topic 5285 which started about this Wednesday is also a thread which has some friction going on. The OP in 5285 whose handle there is mshalperin is contending that the vast majority of his spam is being filtered by SA and not the blocklists. But, then his contention temporarily turned into some doubt that anything reported ever became SCbl/ed and Steve U's revelation of SC's usage of SA first instead of the blocklists was new to me. Clearly mshalperin's spams are almost all SA blocked, not by blocklists, which is a very different experience than my own observations and filtration I don't use SC mail, but my own spamfilter SpamPal has similarities to the SC mail configuration of many, because I use numerous blocklists which are available to SC mail users and I also use country blocks, which is employed differently by my SP than blackholes.us, and I also use a body regex plugin filter which could be compared to SA. My point is that my spam filtration 'catches' or positives are completely different from mshalperin's. The vast majority of my spams are caught by my blocklists and a larger minority is caught by country filters than the regex filter [compare to SA] on the body. As a separate issue from the discussion of the nature of mshalperin's filter positives, for some reason or another, WazoO and Keith Jillings and mshalperin don't seem to get along. -- Mike Easter kibitzer, not SC admin From diespammer at spamthis.net Fri Nov 4 16:40:25 2005 From: diespammer at spamthis.net (die spammer) Date: Fri Nov 4 19:45:02 2005 Subject: [SC-Help] Re: blank spam In-Reply-To: References: <1smm7yk7iyjs1.dlg@news.spamcop.net> Message-ID: to continue to post off topic.... this is not going to really help my issue but .... the top post is the most important. a first person reply should be at the top. the previous post or "quote does not need to be necessarily in the reply since it "follows" a previous post. reposting everything since the original post is a waste of newsgroup space. I seem to be perfectly ok wether there is top posts or bottom posts, but thats just me. No OE here.... I use Netscape needing previous posts at the top of every post is for lazy unintelligent unconservative #@$#$#%#$. Now back to are regularly scheduled topic.... Mike Easter wrote: > die spammer wrote: > User-Agent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.2) > Gecko/20040804 Netscape/7.2 (ax) > > >>download.com does have a mailenium program available for download > > > > die spammer wrote: > >>one thing I did notice is that spancop can't handle these blank spams >>either without a subject and body... > > > > Here's an article discussing the preferred style of attributions and > quoting in newsgroups http://members.fortunecity.com/nnqweb/nquote.html > Quoting Style in Newsgroup Postings > > Here's an article discussing topposting & TOFU > http://en.wikipedia.org/wiki/Topposting Top-posting means replying to a > message above the original message. > > Here's an article describing what happened to cause some OE users to > have trouble fighting corporate email TOFU configurations with newsgroup > posts http://www.insideoe.com/faqs/why.htm#signature Why can't OE > insert my signature after quoted text in replies? > > > I don't know if there is a similar article explaining what causes a > non-OE user to toppost instead of trimming and contextualizing.. > > > From MikeE at ster.invalid Fri Nov 4 17:15:22 2005 From: MikeE at ster.invalid (Mike Easter) Date: Fri Nov 4 20:20:03 2005 Subject: [SC-Help] Re: blank spam References: <1smm7yk7iyjs1.dlg@news.spamcop.net> Message-ID: die spammer wrote: > the previous post or "quote does not need to be necessarily > in the reply since it "follows" a previous post. only in your 'mind' does it follow, not in reality or in clarity. Newsgroups have many stumbling blocks in communicating. You/we need to do everything 'in your/our power' to facilitate the communication. Just because you are thinking about something you recently read doesn't mean it is currently in the mind or understanding of the next reader. In addition, it is most often the case that the topposter doesn't actually accurately address what s/he is trying to address, because the words are slightly off the mark and nonresponsive. The reply misses the earlier statement a little bit because the topposter is 'recalling' what was said and the recall is inaccurate, imperfect. > reposting everything > since the original post is a waste of newsgroup space. The only thing which would be 'reposted' or cited is/are the precise words to which you are replying. Not 'everything.' Bottom posting is a very very bad problem in its own right and we are not discussing bottom posting. We are discussing trimmed contextualized vs untrimmed noncontextualized. You are the one reposting everything below you and wasting space. I am trimming and contextualizing for both of us. -- Mike Easter kibitzer, not SC admin From nobody at spamcop.net Fri Nov 4 22:27:51 2005 From: nobody at spamcop.net (N. Miller) Date: Sat Nov 5 01:30:03 2005 Subject: [SC-Help] Re: blank spam References: <1smm7yk7iyjs1.dlg@news.spamcop.net> Message-ID: <13gxgd35d963m.dlg@news.spamcop.net> On Fri, 04 Nov 2005 16:40:25 -0800, die spammer wrote: > to continue to post off topic.... this is not going to really help my > issue but .... > > the top post is the most important. a first person reply should be at > the top Not necessarily. The common rule of courtesy still applies, "When in Rome..." http://www.google.com/search?q=top+posting+bad The Usenet has been around longer than the web, and many news groups as well. Top posting was highly discouraged in those days. The practice has held over in many current NNTP groups, and one is well advised to follow local custom. Bottom posting is a business email feature promoted by the way that Microsoft set up their mail clients. While it works for business correspondence, do keep in mind that such correspondence is, usually, one-to-one, and the correspondents can easily track the content of the thread. News group posting is a public posting to multiple recipients, not all of whom will have the complete picture for assorted technical reasons; which is the rationale for bottom posting. It provides a natural, conversational context, in logical order. "Should be" is a religious tautology, which tends to lead to major dustups in news groups. "Should always be bottom posting", "should always be top posting". If it makes you happy, just keep on top posting, but don't proselytize. You will only encourage a flame war. And also keep in mind, many die-hard bottom posters will just silently "plonk" you if you insist on top posting in groups where it is discouraged, so you might not get the same attention that you would get by "going with the flow". -- Norman ~Shine, bright morning light, ~now in the air the spring is coming. ~Sweet, blowing wind, ~singing down the hills and valleys. From sph at sph.dk Wed Nov 9 18:25:44 2005 From: sph at sph.dk (sph) Date: Wed Nov 9 12:30:02 2005 Subject: [SC-Help] response directly? from yahoo Message-ID: It appears that I´ve recieved a couple of automated responses to spam reports directly from yahoo. It is my understanding that any response would be send to spamcop, and then forwarded to me. As far as I remeber Yahoo was hosting spamvertized pages, and not actually the spammers. I´m not a proficient header interpreter, but I do see spamcop mentioned in them. I have pasted one of the headers below (without my own mail adress). My question is: Is it true that spamhosts can reply directly (without some sort of hidden code)?. Received: from appleton6.uni2.net (appleton6.uni2.net [129.142.244.20]) by ting.uni2.net (8.12.6/8.12.6) with ESMTP id jA95uPLg032287 for ; Wed, 9 Nov 2005 06:56:25 +0100 Received: from vmx1.spamcop.net (vmx1.spamcop.net [204.15.82.27]) by appleton6.uni2.net (8.12.11/SQL-8.12.11-8/8.12.11) with ESMTP id jA95uNIN002853 for ; Wed, 9 Nov 2005 06:56:24 +0100 Received: from sc-app1.ironport.com (HELO spamcop.net) (204.15.82.20) by vmx1.spamcop.net with SMTP; 08 Nov 2005 21:56:23 -0800 X-SpamCop-Reply-Ids: 1548721265 X-Spamcop-Return-Path: Received: from vmx2.spamcop.net (vmx2.spamcop.net [204.15.82.29]) by sc-app1.soma.ironport.com (Postfix) with ESMTP id 389101A6DF for ; Tue, 8 Nov 2005 21:55:01 -0800 (PST) Received: from mrout1.corp.ukl.yahoo.com (217.12.1.87) by vmx2.spamcop.net with ESMTP; 08 Nov 2005 21:55:00 -0800 Received: from kanasvr1.cc.ukl.yahoo.com (kanasvr1.cc.ukl.yahoo.com [217.12.1.199]) by mrout1.corp.ukl.yahoo.com (8.13.4/8.13.4/y.out) with SMTP id jA95rrkC075842 for ; Wed, 9 Nov 2005 05:54:00 GMT DomainKey-Signature: a=rsa-sha1; s=serpent; d=yahoo-inc.com; c=nofws; q=dns; h=precedence:auto-submitted:date:to:subject:from:reply-to: mime-version:content-type:content-transfer-encoding:x-mailer; b=K5xtfUE427sQAPx9VUWZ7enMlRAV5L/FajPBEZD5n115otJWyEs3JRfbs+db/fLe Message-Id: <200511090554.jA95rrkC075842@mrout1.corp.ukl.yahoo.com> From nobody at devnull.spamcop.net Wed Nov 9 17:23:19 2005 From: nobody at devnull.spamcop.net (WazoO) Date: Wed Nov 9 18:25:03 2005 Subject: [SC-Help] SpamCop Forum is down Message-ID: It actually went down for a bit early this morning with some SQL errors showing ... then I couldn't even talk to the server. JT was notified, but said that it'd be a couple of hours before he could get anything done. Strangely, something happened and it was back on-line about 15 minutes later ...??? I got caught up, did some grocery shopping .. came back, caught up again, got around to making some coffee, poured a cup, and promptly fell asleep ... Jeff G. called to advise that there were some sever issues with the Forum .. killed off that 'exciting' game I'd fallen asleep playing, logged onto the Forum and found that the 'user' experience wasn't near as bad as the Admin issues. Anyway, I had stated that I had been becoming suspicious of a drive problem, looking at some system message log files, I'm convinced of that now ... kicked an e-mail to JT ... last thing seen on the forum server was; Broadcast message from root (console) (Wed Nov 9 17:26:10 2005): The system is going down for reboot NOW! and it has yet to come back up .. I still can't login in directly either ... so have to make an assumption that either an fsck is in operation at present or even that a hard drive replacement is under way (no response from JT yet) Just posting what I know, guessing at some other things, best I can do for now from here .... From nobody at devnull.spamcop.net Wed Nov 9 19:35:15 2005 From: nobody at devnull.spamcop.net (WazoO) Date: Wed Nov 9 20:40:11 2005 Subject: [SC-Help] Forum is up Was: Re: SpamCop Forum is down References: Message-ID: "WazoO" wrote in message news:dku0d7$d4g$1@news.spamcop.net... > > Broadcast message from root (console) (Wed Nov 9 17:26:10 2005): > The system is going down for reboot NOW! > > and it has yet to come back up .. I still can't login in directly > either ... so have to make an assumption that either an > fsck is in operation at present or even that a hard drive > replacement is under way (no response from JT yet) > Just posting what I know, guessing at some other things, > best I can do for now from here .... Other than a bit of cryptic "working on it" message ... problem has been resolved. From bar_n0ne at hotmail.com Thu Nov 10 15:51:34 2005 From: bar_n0ne at hotmail.com (Berny) Date: Thu Nov 10 06:55:10 2005 Subject: [SC-Help] Re: response directly? from yahoo References: Message-ID: See below: "sph" wrote in message news:dktbeq$201$1@news.spamcop.net... > It appears that I´ve recieved a couple of automated responses to spam > reports directly from yahoo. It is my understanding that any response would > be send to spamcop, and then forwarded to me. As far as I remeber Yahoo was > hosting spamvertized pages, and not actually the spammers. I´m not a > proficient header interpreter, but I do see spamcop mentioned in them. I > have pasted one of the headers below (without my own mail adress). > My question is: > Is it true that spamhosts can reply directly (without some sort of hidden > code)?. > > Received: from appleton6.uni2.net (appleton6.uni2.net [129.142.244.20]) > by ting.uni2.net (8.12.6/8.12.6) with ESMTP id jA95uPLg032287 > for ; Wed, 9 Nov 2005 06:56:25 +0100 right here is where apleton uni/net recieved the reply from SC: > Received: from vmx1.spamcop.net (vmx1.spamcop.net [204.15.82.27]) > by appleton6.uni2.net (8.12.11/SQL-8.12.11-8/8.12.11) with ESMTP id > jA95uNIN002853 > for ; Wed, 9 Nov 2005 06:56:24 +0100 > Received: from sc-app1.ironport.com (HELO spamcop.net) (204.15.82.20) > by vmx1.spamcop.net with SMTP; 08 Nov 2005 21:56:23 -0800 > X-SpamCop-Reply-Ids: 1548721265 > X-Spamcop-Return-Path: > Received: from vmx2.spamcop.net (vmx2.spamcop.net [204.15.82.29]) > by sc-app1.soma.ironport.com (Postfix) with ESMTP id 389101A6DF > for ; Tue, 8 Nov 2005 21:55:01 -0800 (PST) Here SC received the reply from Yahoo: > Received: from mrout1.corp.ukl.yahoo.com (217.12.1.87) > by vmx2.spamcop.net with ESMTP; 08 Nov 2005 21:55:00 -0800 > Received: from kanasvr1.cc.ukl.yahoo.com (kanasvr1.cc.ukl.yahoo.com > [217.12.1.199]) > by mrout1.corp.ukl.yahoo.com (8.13.4/8.13.4/y.out) with SMTP id > jA95rrkC075842 > for ; Wed, 9 Nov 2005 05:54:00 GMT > DomainKey-Signature: a=rsa-sha1; s=serpent; d=yahoo-inc.com; c=nofws; q=dns; > h=precedence:auto-submitted:date:to:subject:from:reply-to: > mime-version:content-type:content-transfer-encoding:x-mailer; > b=K5xtfUE427sQAPx9VUWZ7enMlRAV5L/FajPBEZD5n115otJWyEs3JRfbs+db/fLe > Message-Id: <200511090554.jA95rrkC075842@mrout1.corp.ukl.yahoo.com> > > The mail to you originated from Yahoo, was sent (and addressed) to SpamCop, and forwarded to you Yahoo did not reply directly to your usual email address. From keegi at dot.invalid Thu Nov 10 15:46:01 2005 From: keegi at dot.invalid (Keegi) Date: Thu Nov 10 08:50:03 2005 Subject: [SC-Help] Bounce error Message-ID: Hi, Spamcop's Report Spam page declares (instead of usual spam reporting form): ---- Bounce error Your email address, @spamcop.net has returned a bounce: Subject: Delivery Status Notification (Failure) Reason: 5.1.0 - Unknown address error 550-'5.5.0 Permanent failure, closing connection. c5si1502657qbc' Please ensure your email account is reliable, then click below: [Problem resolved] ---- Well, from the given information it is not entirely clear, what should I do. I have definitely not resolved any problems with any of my e-mail accounts, so clicking that button does not seem right... The e-mail address that it reports to bounce, is my spamcop's e-mail address, so if there is problem with that account, who should I talk with? Or was it just temporary SMTP server failure and I should go on? Regards, Keegi From MikeE at ster.invalid Thu Nov 10 05:47:48 2005 From: MikeE at ster.invalid (Mike Easter) Date: Thu Nov 10 08:50:06 2005 Subject: [SC-Help] Re: response directly? from yahoo References: Message-ID: Replying to sph, not Berny, just using Berny's post to make additional remarks Berny wrote: > "sph" > right here is where apleton uni/net recieved the reply from SC: which was sent to a reports address with the reportid munged below >> for > Here SC received the reply from Yahoo: >> for reportid munge seen again with one less x. The reportid currently has 10 decimal digits. > The mail to you originated from Yahoo, was sent (and addressed) to > SpamCop, and forwarded to you Yahoo did not reply directly to your > usual email address. The xxxxxxxx above munged out the reportid number. The report email from SC to the provider uses the reportid as the username of the From/Reply-To. That is a mechanism for the provider to respond^1 to the reporter who has been one-way 'anonymized' by the report process. The provider emails the reportid username of the reporter at the reports.spamcop.net address which spamcop handles by forwarding it to the reporter who corresponds to the reportid. Only SC knows which reporter corresponds to the reportid username, and SC also knows the email address of that reporter to be able to forward the report. Altho' we are discussing some partial and munged headers, those headers correspond to an email which not only is addressed to the reporter corresponding to the reportid, but the mail would also contain a link to the tracker of the item which was reported. In addition, the reportid itself can be 'converted' or used to access^2 the tracker, but only by the logged in reporter of the reportid. ^1 http://www.spamcop.net/fom-serve/cache/96.html How do I get in touch with the person who filed the complaint? ^2 http://forum.spamcop.net/forums/index.php?showtopic=4498 how to get a Tracking URL from a Report ID -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Thu Nov 10 06:35:09 2005 From: MikeE at ster.invalid (Mike Easter) Date: Thu Nov 10 09:40:07 2005 Subject: [SC-Help] Re: Bounce error References: Message-ID: Keegi wrote: > Your email address, @spamcop.net has returned a bounce: > Or was it just temporary SMTP server failure and I should go on? If a testmail works and/or if it is getting mail, I would check resolved assuming a temporary glitch. -- Mike Easter kibitzer, not SC admin From sph at sph.dk Thu Nov 10 20:25:07 2005 From: sph at sph.dk (sph) Date: Thu Nov 10 14:30:22 2005 Subject: [SC-Help] Re: response directly? from yahoo References: Message-ID: "Mike Easter" and "Berny" wrote > [two fine answers] Thank you both for your answers. Now I understand a little better how it works. And by the way; the number of X´s in the munged E-mail adresses were arbitrary and not corresponding to the actual number of characters. Sorry if it caused confusion. From nobody at spamcop.net Thu Nov 10 13:56:59 2005 From: nobody at spamcop.net (Ellen) Date: Thu Nov 10 15:40:03 2005 Subject: [SC-Help] Re: Bounce error References: Message-ID: "Keegi" wrote in message news:dkviur$886$1@news.spamcop.net... > Hi, Spamcop's Report Spam page declares (instead of usual spam reporting > form): > ---- > Bounce error > Your email address, @spamcop.net has returned a bounce: > Subject: Delivery Status Notification (Failure) > Reason: 5.1.0 - Unknown address error 550-'5.5.0 Permanent failure, > closing connection. c5si1502657qbc' > > Please ensure your email account is reliable, then click below: > [Problem resolved] > ---- > > Well, from the given information it is not entirely clear, what should I > do. I have definitely not resolved any problems with any of my e-mail > accounts, so clicking that button does not seem right... > > The e-mail address that it reports to bounce, is my spamcop's e-mail > address, so if there is problem with that account, who should I talk > with? Or was it just temporary SMTP server failure and I should go on? > That shows up when the system attempts to send mail -- a response to spam submissions for example -- to the email address you registered with the system. It might be a transient failure -- click the link to re-enable the account and see if it happens again. If it doesn't happen again it was transient and you can ignore it. If it continues to happen then there is some reason why SC cannot successfully send mail to that address and then you can write to service admin.spamcop.net and include your registered SC email address and Don will work with you on getting the issue resolved. Ellen SpamCop From keegi at dot.invalid Fri Nov 11 08:07:21 2005 From: keegi at dot.invalid (Keegi) Date: Fri Nov 11 01:10:02 2005 Subject: [SC-Help] Re: Bounce error In-Reply-To: References: Message-ID: Mike Easter wrote: > If a testmail works and/or if it is getting mail, I would check > resolved > assuming a temporary glitch. > Ellen wrote: > > system. It might be a transient failure -- click the link to re-enable the > account and see if it happens again. If it doesn't happen again it was > transient and you can ignore it. If it continues to happen then there is Thanks, the test mail to my spamcop address seems to work (gets forwarded, too). Marked as resolved, and so far everything seems to be ok and working. > when the system attempts to send mail -- a response to spam > submissions for example -- to the email address you registered > with the system. I assume that the problem/glitch was with the forwarding address? It should be working (it's a gmail address), and actually it really seems to work. If it might be some other address I registered some years ago, then I might need help determining which one it is... but I could not find any reference to other addresses in my SpamCop options, so I assume the problem was with the forwarding address. Keegi From reko.turja at liukuma.net Fri Nov 11 09:36:19 2005 From: reko.turja at liukuma.net (Reko Turja) Date: Fri Nov 11 02:40:02 2005 Subject: [SC-Help] Spamcop cannot parse the URI Message-ID: FYI, the following message (and several similar I've gotten lately) is unparseable: http://www.spamcop.net/sc?id=z825522961z9f7cf345ebab398197d3945005a7feb4z -Reko From nobody at devnull.spamcop.net Fri Nov 11 04:19:08 2005 From: nobody at devnull.spamcop.net (Glenn Daniels) Date: Fri Nov 11 04:20:03 2005 Subject: [SC-Help] Re: Spamcop cannot parse the URI References: Message-ID: "Reko Turja" wrote > FYI, the following message (and several similar I've gotten lately) is > unparseable: > > http://www.spamcop.net/sc?id=z825522961z9f7cf345ebab398197d3945005a7feb4z > Universal Resource Locator? URI? Ummm... it parsed just fine. It is just that when the parser gets to the spamvending URL, the behavior becomes a bit unpredictable, almost as if the robot has a mind of its own. To complicate life, your URL has a double whammy on it. It is not exactly a legitimate spamvending URL. It is in fact a redirector to a spamvending URL by way of a script. And it happens that even if the actual URL were there, no reports would be sent because the ISPs hosting the spammergang operations have a long history of "acting" on notifies by dribbling them away into the bit bucket. If I have the choice, I choose to personally alert Lycos to what is going on. And I forget the SpamCop notify. I leave it to Lycos to protect their good name, I don't make it my business to give them a bad name. Is easy to come by a bad reputation, is much more difficult to protect a good one. I am wanting to cut Lycos every possible advantage in addressing their spam problem. I am not convinced that they are at all agreeable to the recent glut of tripod.com spam. Try being a little patient with them, give it some time... Cheers, glenn PS: I posted them your URL. Later today that URL will not be working. -g From MikeE at ster.invalid Fri Nov 11 07:25:37 2005 From: MikeE at ster.invalid (Mike Easter) Date: Fri Nov 11 10:30:10 2005 Subject: [SC-Help] Re: Spamcop cannot parse the URI References: Message-ID: Reko Turja wrote: > FYI, the following message (and several similar I've gotten lately) is > unparseable: > www.spamcop.net/sc?id=z825522961z9f7cf345ebab398197d3945005a7feb4z At the time I parsed it, SC does not offer to resolve the link http://ileashantlsengee.tripod.com If I put the link in the parser alone, it resolves to 209.202.240.100 and rec/s reporting to abuse@lycos.com If I use a GET on the site, lycos/tripod tells me the site is 'banned' The document has moved http://www.tripod.lycos.com/bin/membership/bannedsite?member=ileashantlsengee The page you are attempting to access has been removed because it violated Tripod's Terms of Service. Please check out Tripod's Help system for more information. where Tripod's help sez you can't use your home page to spamvertise. So I would say lycos/tripod squashed the spamvertised link. -- Mike Easter kibitzer, not SC admin From jeffg at spamcop.net Sat Nov 12 08:48:27 2005 From: jeffg at spamcop.net (Jeff G.) Date: Sat Nov 12 09:20:21 2005 Subject: [SC-Help] Re: SC been down for 2 hours References: Message-ID: "Jim" wrote in message news:dl4pgm$9t4$2@news.spamcop.net... > SpamCop been down for 2 hours Make that 3 hours now. You can track it with http://forum.spamcop.net/forums/index.php?showtopic=5247 QUOTE(SpamCopAdmin in http://forum.spamcop.net/forums/index.php?showtopic=5247 @ Nov 12 2005, 08:23 AM EST -0500) "At 06:20 Mountain Standard Time, SpamCop is completely down. I don't know what the problem is, but the pagers have been set off. Now we wait. - Don D'Minion - SpamCop Admin -" Please note that only the SpamCop Parsing and Reporting Service is affected. The outage appears to have started around 05:55 EST -0500 (10:55 UTC -0000, 02:55 PST -0800). -- Thanks and Best Regards, Jeff G. I have been a SpamCop User/Member/Customer since 1999 and am a Moderator of the new web-based forums (now the primary method for getting help, http://forum.spamcop.net). Please contact me via Forum only. From jeffg at spamcop.net Sat Nov 12 09:18:45 2005 From: jeffg at spamcop.net (Jeff G.) Date: Sat Nov 12 09:20:45 2005 Subject: [SC-Help] Re: SC been down for 2 hours References: Message-ID: "Jeff G." wrote in message news:dl4tei$cle$1@news.spamcop.net... > "Jim" wrote in message > news:dl4pgm$9t4$2@news.spamcop.net... > > SpamCop been down for 2 hours > > Make that 3 hours now. Sorry about the time on that post (gremlins took about 27min). -- Best Regards, Jeff G. I have been a SpamCop User/Member/Customer since 1999 and am a Moderator of the new web-based forums (now the primary method for getting help, http://forum.spamcop.net). Please contact me via Forum only. From jeffg at spamcop.net Sat Nov 12 10:11:46 2005 From: jeffg at spamcop.net (Jeff G.) Date: Sat Nov 12 10:15:09 2005 Subject: [SC-Help] Re: SC been down for 2 hours References: Message-ID: "Jeff G." wrote in message news:dl4tei$cle$1@news.spamcop.net... > "Jim" wrote in message > news:dl4pgm$9t4$2@news.spamcop.net... > > SpamCop been down for 2 hours > > Make that 3 hours now. You can track it with > http://forum.spamcop.net/forums/index.php?showtopic=5247 It appears to have been back up since 09:40 EST -0500 (14:40 UTC -0000, 06:40 PST -0800, half an hour ago). -- Best Regards, Jeff G. I have been a SpamCop User/Member/Customer since 1999 and am a Moderator of the new web-based forums (now the primary method for getting help, http://forum.spamcop.net). Please contact me via Forum only. From jeffg at spamcop.net Sat Nov 12 11:08:13 2005 From: jeffg at spamcop.net (Jeff G.) Date: Sat Nov 12 11:10:04 2005 Subject: [SC-Help] Re: SC been down for 2 hours References: Message-ID: "Jeff G." wrote in message news:dl50nj$fh5$2@news.spamcop.net... > "Jeff G." wrote in message > news:dl4tei$cle$1@news.spamcop.net... > > "Jim" wrote in message > > news:dl4pgm$9t4$2@news.spamcop.net... > > > SpamCop been down for 2 hours > > > > Make that 3 hours now. You can track it with > > http://forum.spamcop.net/forums/index.php?showtopic=5247 > > It appears to have been back up since 09:40 EST -0500 (14:40 UTC -0000, > 06:40 PST -0800, half an hour ago). [quote=SpamCopAdmin,Nov 12 2005, 10:55 AM EST -0500] "The system is back up now. There may be some email delays while the system works through the backlog of spam, but everything is working normally again. - Don D'Minion - SpamCop Admin -" -- Best Regards, Jeff G. I have been a SpamCop User/Member/Customer since 1999 and am a Moderator of the new web-based forums (now the primary method for getting help, http://forum.spamcop.net). Please contact me via Forum only. From MikeE at ster.invalid Tue Nov 15 10:13:26 2005 From: MikeE at ster.invalid (Mike Easter) Date: Tue Nov 15 13:15:03 2005 Subject: [SC-Help] Re: what is the differents References: Message-ID: Posted to spamcop.help & .mail. F/ups to .help blabla@bla.com wrote: Newsgroups: spamcop.mail Wrong newsgroup. See below^1. . > I have no idea what the differents is between paying and non paying > users. You are talking about paying and non-paying reporters in the spamcop mail discussion group. All spamcop mailusers pay for the service described at http://www.spamcop.net/ces/individuals.shtml SpamCop Email System for Individuals > I paid a couple of time, except for money, i still lose just > as much time as when i paid. > CAn anyone tell me the differents between the nag and non nag, > because i can?t see it The differences between being a paid reporter vs being a free reporter are that the paid reporter - gets rid of the nag wait for standard free reporting - can add additional notifies to a spamcop report - can 'appeal' to SC to 'please' notify a provider who wouldn't be - can access a db of your reports That is described here http://www.spamcop.net/fom-serve/cache/288.html Upgrade to a premium member account The nag wait has a minimum, but it can be lengthened by busy-ness I think. The additional notifies and appeals are described here http://www.spamcop.net/fom-serve/cache/126.html How should I select the recipients for my spam report? The cost of fuel which is consumed by paid reporting is $1/meg described at the first link. ^1 SC newsgroup purposes: spamcop and spamcop.help - discussions of spam and spamcop spamcop.mail - discussions of spamcop mail service spamcop.geeks - geekier discussions spamcop.social - social discussions spamcop.routing - discussions of routing database spamcop.spam - no discussion, raw spam and other only -- Mike Easter kibitzer, not SC admin From w7el at eznec.com Tue Nov 15 11:07:51 2005 From: w7el at eznec.com (Roy Lewallen) Date: Tue Nov 15 14:10:03 2005 Subject: [SC-Help] Broken reporting address Message-ID: I just got an email telling me that an abuse address the SpamCop report was sent to is invalid. I've posted the email at spamcop.spam. Hope this is a reasonable way to report the bad address - I couldn't find anything in the FAQ about another way to do it. It's amazing, this is the first report I've gotten like this in tens of thousands of spam reports. You folks go great work! Roy Lewallen From MikeE at ster.invalid Tue Nov 15 11:17:57 2005 From: MikeE at ster.invalid (Mike Easter) Date: Tue Nov 15 14:20:03 2005 Subject: [SC-Help] Re: Broken reporting address References: Message-ID: Roy Lewallen wrote: > I just got an email telling me that an abuse address the SpamCop > report was sent to is invalid. I've posted the email at spamcop.spam. > Hope this is a reasonable way to report the bad address - I couldn't > find anything in the FAQ about another way to do it. It's amazing, > this is the first report I've gotten like this in tens of thousands > of spam reports. You folks go great work! I looked around for this post of yours before I posted into spamcop about the address, but I didn't find it until after I posted. If you go over to the spamcop ng, you can pick up the discussion there. -- Mike Easter kibitzer, not SC admin From jeffg at spamcop.net Tue Nov 15 14:59:28 2005 From: jeffg at spamcop.net (Jeff G.) Date: Tue Nov 15 15:00:04 2005 Subject: [SC-Help] Re: what is the differents References: Message-ID: "Mike Easter" wrote in message news:dld8fr$7mj$1@news.spamcop.net... > The differences between being a paid reporter vs being a free reporter > are that the paid reporter > > - gets rid of the nag wait for standard free reporting > - can add additional notifies to a spamcop report > - can 'appeal' to SC to 'please' notify a provider who wouldn't be > - can access a db of your reports Please don't forget the Report History feature also being only available to paying customers. References: Report History at http://forum.spamcop.net/forums/index.php?showtopic=4473&st=0&p=29916&#ReportHistory and SpamCop Report Types at http://forum.spamcop.net/forums/index.php?showtopic=5232 . Also, please see http://www.m-w.com/dictionary/difference . -- Thanks and Best Regards, Jeff G. I have been a SpamCop User/Member/Customer since 1999 and am a Moderator of the new web-based forums (now the primary method for getting help, http://forum.spamcop.net). Please contact me via Forum only. From info at dHosted.com Thu Nov 17 14:14:12 2005 From: info at dHosted.com (DHosted Admin) Date: Thu Nov 17 08:15:03 2005 Subject: [SC-Help] My Hosting Companie Rulez Message-ID: From info at dHosted.com Thu Nov 17 14:16:10 2005 From: info at dHosted.com (DHosted Admin) Date: Thu Nov 17 08:20:07 2005 Subject: [SC-Help] My peoples done care i'm goza advertize here anyway : Message-ID: From info at dHosted.com Thu Nov 17 14:16:52 2005 From: info at dHosted.com (DHosted Admin) Date: Thu Nov 17 08:20:11 2005 Subject: [SC-Help] Free Mega Secure Hosting Message-ID: From Support at dHosted.com Thu Nov 17 14:18:39 2005 From: Support at dHosted.com (Dhosted Support) Date: Thu Nov 17 08:20:13 2005 Subject: [SC-Help] Post 1000 Message to any Newsgroups Promoting my site and earn $250.00 Message-ID: From RobertW at danjonengineering.com Thu Nov 17 08:39:36 2005 From: RobertW at danjonengineering.com (Robert Williams) Date: Thu Nov 17 11:45:06 2005 Subject: [SC-Help] Dead Links??? Message-ID: Where do we report dead links? I reported a SPAM e-mail and received an e-mail from that domain's System Administrator stating that the e-mail wasn't deliverable. Here is the e-mail and header info I received: Microsoft Mail Internet Headers Version 2.0 Received: from vmx1.spamcop.net ([204.15.82.27]) by with Microsoft SMTPSVC(5.0.2195.6713); Thu, 17 Nov 2005 08:26:53 -0800 Received: from sc-app3.ironport.com (HELO spamcop.net) (204.15.82.22) by vmx1.spamcop.net with SMTP; 17 Nov 2005 08:30:30 -0800 X-SpamCop-Reply-Ids: 1558650829 X-Spamcop-Return-Path: Received: from vmx1.spamcop.net (vmx1.spamcop.net [204.15.82.27]) by sc-app3.soma.ironport.com (Postfix) with ESMTP id C520B142F8 for <1558650829@reports.spamcop.net>; Thu, 17 Nov 2005 08:29:10 -0800 (PST) Received: from smtp6.wanadoo.fr (193.252.22.25) by vmx1.spamcop.net with ESMTP; 17 Nov 2005 08:29:05 -0800 Received: by mwinf0602.wanadoo.fr (SMTP Server) id 5DD961C000C6; Thu, 17 Nov 2005 17:29:04 +0100 (CET) Date: Thu, 17 Nov 2005 17:29:04 +0100 (CET) X-ME-UUID: 20051117162904324.4F2A21C000C6@mwinf0602.wanadoo.fr From: MAILER-DAEMON@wanadoo.fr (Mail Delivery System) Subject: Undelivered Mail Returned to Sender To: 1558650829@reports.spamcop.net MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="547F21C000C8.1132244944/wanadoo.fr" Content-Transfer-Encoding: 8bit Message-Id: <20051117162904.5DD961C000C6@mwinf0602.wanadoo.fr> Return-Path: spamcop@devnull.spamcop.net X-ORFilter: mail checked by ORFilter Service 5.0.2.38529 - www.martijnjongen.com/orfilter X-ORFilter: 50 points for keyword cialis using match method charonly X-ORFilter: Total score = 50 X-OriginalArrivalTime: 17 Nov 2005 16:26:53.0343 (UTC) FILETIME=[B8399AF0:01C5EB93] --547F21C000C8.1132244944/wanadoo.fr Content-Description: Notification Content-Type: text/plain --547F21C000C8.1132244944/wanadoo.fr Content-Description: Delivery report Content-Type: message/delivery-status --547F21C000C8.1132244944/wanadoo.fr Content-Description: Undelivered Message Content-Type: message/rfc822 Content-Transfer-Encoding: 8bit Received: from me-wanadoo.net (localhost [127.0.0.1]) by mwinf0602.wanadoo.fr (SMTP Server) with ESMTP id 547F21C000C8 for ; Thu, 17 Nov 2005 17:29:04 +0100 (CET) Received: from melp-rtp01-a (unknown [10.234.12.164]) by mwinf0602.wanadoo.fr (SMTP Server) with ESMTP id 4F2A21C000C6 for ; Thu, 17 Nov 2005 17:29:04 +0100 (CET) X-ME-UUID: 20051117162904324.4F2A21C000C6@mwinf0602.wanadoo.fr Received: from abuse-front01-ad1-a (abuse-front01-ad1-a.wanadoo.fr [10.234.96.29]) by melp-rtp01-a (Postfix) with ESMTP id 1C3B257C for ; Thu, 17 Nov 2005 17:28:59 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by abuse-front01-ad1-a (Postfix) with ESMTP id 0A1A425E711 for ; Thu, 17 Nov 2005 17:28:59 +0100 (CET) To: abusecyrus@wanadoo.fr From: 1558650829@reports.spamcop.net Subject: [ASf:190] [SpamCop (82.122.118.211) id:1558650829]revolutionary Date: Thu, 17 Nov 2005 17:28:59 +0100 Message-ID: <20051117_162859_069957.1558650829@reports.spamcop.net> MIME-Version: 1.0 Content-type: multipart/alternative; boundary="Message-Boundary-by-Mail-Sender-1132244939" --Message-Boundary-by-Mail-Sender-1132244939 Content-Type: multipart/alternative; boundary="Part-Message-Boundary-by-Mail-Sender-1132244939_2" --Part-Message-Boundary-by-Mail-Sender-1132244939_2 Content-type: text/plain Content-transfer-encoding: 8bit --Part-Message-Boundary-by-Mail-Sender-1132244939_2 Content-type: text/html Content-transfer-encoding: 8bit --547F21C000C8.1132244944/wanadoo.fr-- Your message did not reach some or all of the intended recipients. Subject: [ASf:190] [SpamCop (82.122.118.211) id:1558650829]revolutionary Sent: 11/17/2005 8:29 AM The following recipient(s) could not be reached: abusecyrus@wanadoo.fr on 11/17/2005 8:29 AM The e-mail system was unable to deliver the message, but did not report a specific reason. Check the address and try again. If it still fails, contact your system administrator. < wanadoo.fr #5.0.0 X-SMTP-Server; User unknown> Thanks RW From MikeE at ster.invalid Thu Nov 17 09:18:33 2005 From: MikeE at ster.invalid (Mike Easter) Date: Thu Nov 17 12:20:03 2005 Subject: [SC-Help] Re: Dead Links??? References: Message-ID: Robert Williams wrote: > Where do we report dead links? This subject is a routing issue; but the purpose of the routing ng is for someone who has researched a routing issue to present an argument or case for a different notify than that which would pertain by the normal SC notify derivation or different from what has been entered manually into the routing db. > I reported a SPAM e-mail and received > an e-mail from that domain's System Administrator stating that the > e-mail wasn't deliverable. In spite of all that you have posted here, what is going on at wanadoo's end isn't altogether apparent. The basics of this are that a userIP 82.122.118.211 rDNS ANice-252-1-24-211.w82-122.abo.wanadoo.fr of Wanadoo France was a spamsource -- and indeed it is multilisted as spamsource and proxytrojan. The further basics are that the ripe derived and abuse.net notifies are postmaster@wanadoo.fr AND abuse@wanadoo.fr for not only the /24 82.122.118.0 - 82.122.118.255 -- but also the 82.122.0.0/16 ie AS3215 The further experience is that SC notifies to the pm bounce a lot, 205 sent : 103 bounces, [meaning of 308, 103 bounced] so SC uses a devnull handling to the pm and sends its notify to the abuse username. Of the information which you were provided in the bounce, one particle is the reportid 1558650829. That reportid 'belongs' to you and only to you. If you use it with sufficient skill, you would be able to see the item, its parsing, and its reporting. No one else can see that but you, but you could use it to derive a tracker link which /would/ show us all that. The point of that is that if I or someone would see the parsing reporting information, the most likely thing they would see would be that the report was sent to abuse at wanadoo and the pm devnull addy. What you posted here was a failure of a notify to abusecyrus. My guesswork so far indicates that no notify was sent to abusecyrus; so my further guesswork and supposition is that mail to abuse is either copied or redirected to abusecyrus by an internal and unseen wanadoo process not reflected in all of what you posted here. So, then the question comes down to whether or not anyone here 'cares' whether or not wanadoo can be notified better or not -- that is, does anyone care to develop a better abuse notify for wanadoo.fr than that which is existent I for one do not. Wandoo is a huge .fr provider and has a responsibility to look after its abuse addresses. I don't think SC has some kind of special obligation to ferret out some 'alternate' address if some of wanadoo's 'manufactured' notifies go astray because of wanadoo's handling. In this type of case, having a mail to a different address than was emailed to have delivery trouble doesn't strike me as needing to be fixed. -- Mike Easter kibitzer, not SC admin From nobody at spamcop.net Thu Nov 17 12:58:45 2005 From: nobody at spamcop.net (Ellen) Date: Thu Nov 17 14:45:05 2005 Subject: [SC-Help] Re: Dead Links??? References: Message-ID: "Robert Williams" wrote in message news:dlibv3$5uq$1@news.spamcop.net... > Where do we report dead links? I reported a SPAM e-mail and received an > e-mail from that domain's System Administrator stating that the e-mail > wasn't deliverable. > > > It looks like abuse@wanadoo.fr must be running some sort of auto-distribution behind their abuse address and sent the report on to an address that is bouncing. There is nothing that we can do about this since as far as I know abuse@wanadoo.fr works OK and we did not directly send a report to the abusecyrus@wanadoo.fr address. Ellen SpamCop From RobertW at danjonengineering.com Thu Nov 17 13:06:42 2005 From: RobertW at danjonengineering.com (Robert Williams) Date: Thu Nov 17 16:15:03 2005 Subject: [SC-Help] RE: Dead Links??? Message-ID: Thank you Ellen, that is exactly what I was looking for. I just wanted to make sure that IF SC was sending to that address, that SC could change or remove it. BUT, since you aren't then no worries. I'm not sure what Mike was going into in that previous response, I'm sure he TRIED helping, but if he's not SC Admin, he really shouldn't be replying to SC Help issues. Again, thank you Ellen. RW "Ellen" wrote in message news:... > > > "Robert Williams" wrote in message > news:dlibv3$5uq$1@news.spamcop.net... > > Where do we report dead links? I reported a SPAM e-mail and > > received an e-mail from that domain's System Administrator stating > > that the e-mail wasn't deliverable. > > > > > > > > It looks like abuse@wanadoo.fr must be running some sort of > auto-distribution behind their abuse address and sent the report on to > an address that is bouncing. There is nothing that we can do about > this since as far as I know abuse@wanadoo.fr works OK and we did not > directly send a report to the abusecyrus@wanadoo.fr address. > > Ellen > SpamCop > > From bait-423c86b2-42ff9001 at good.julianhaight.com Thu Nov 17 14:52:30 2005 From: bait-423c86b2-42ff9001 at good.julianhaight.com (Chris F. Willoughby) Date: Thu Nov 17 17:55:02 2005 Subject: [SC-Help] somewhat odd e-mail Message-ID: http://www.spamcop.net/sc?id=z828226282ze700d41a2402759f0e60f0de3548bc8ez I'm not quite sure what to make of this e-mail. Feels like either spam or phish but I'm not sure. Chris -- Unhandled exceptions are the bane of my existance. From SC.10.myspamgobbler at spamcowboy.net Thu Nov 17 15:38:13 2005 From: SC.10.myspamgobbler at spamcowboy.net (Brian) Date: Thu Nov 17 18:45:03 2005 Subject: [SC-Help] Re: somewhat odd e-mail In-Reply-To: References: Message-ID: Chris F. Willoughby http://www.spamcop.net/sc?id=z828226282ze700d41a2402759f0e60f0de3548bc8ez > > I'm not quite sure what to make of this e-mail. Feels like either spam or phish but I'm not sure. > > Chris Looks like no bogosity in the headers, even though SC gags a bit. canonical name gateway1.scom.com. aliases 242.200.162.212.in-addr.arpa ukayd01.scom.com ukaym02.scom.com addresses 212.162.200.242 Registrant: S.Com Group plc Buckingham House Buckingham Street Aylesbury, ZZ HP20 2LA UK Domain Name: SCOM.COM Administrative Contact: Jones, Martin martinj@SCOM.COM Buckingham House, Buckingham Street Aylesbury, HP20 ZLA UK UK +44 1296 311411 Record expires on 14-Nov-2012. Record created on 15-Nov-1994. Database last updated on 17-Nov-2005 18:28:17 EST. Domain servers in listed order: NS1.EU.CONCERT.NET 195.99.66.211 NS2.EU.CONCERT.NET 195.99.65.212 Phone numbers are from Dallas, TX From http://www.scom.com contact pages: United States - Dallas S.Com Inc. 15851 Dallas Parkway, Suite 500 Addison TX 75001-6016 United States of America (t) +1 972 308-8516 (f) +1 972 308-8536 (e) response@scom.com The company looks legit, but don't know about their spamminess. Have you been job hunting or looking to hire? -- Brian SC.10.myspamgobbler@spamcowboy.net From post.please.this.email.is.not.valid at example.com Thu Nov 17 18:57:00 2005 From: post.please.this.email.is.not.valid at example.com (DougW) Date: Thu Nov 17 20:00:02 2005 Subject: [SC-Help] Re: Get paid to promote my site References: Message-ID: "D Host Promo" <> spammed... .. Can you say joejob, sure you can.. I'll let the abuse desk at cox know. ..... .. Path: news.spamcop.net!not-for-mail From: D Host Promo Newsgroups: spamcop.help Subject: Get paid to promote my site Date: Thu, 17 Nov 2005 14:17:43 +0000 Organization: SpamCop Lines: 27 Message-ID: NNTP-Posting-Host: ip68-107-197-11.mc.at.cox.net Content-Type: text/html X-Trace: news.spamcop.net 1132233496 31109 68.107.197.11 (17 Nov 2005 13:18:16 GMT) X-Complaints-To: news[]news.spamcop.net NNTP-Posting-Date: Thu, 17 Nov 2005 13:18:16 +0000 (UTC) X-Newsreader: BNews2004v201 Xref: news.spamcop.net spamcop.help:93210 From bait-423c86b2-42ff9001 at good.julianhaight.com Fri Nov 18 03:14:35 2005 From: bait-423c86b2-42ff9001 at good.julianhaight.com (Chris F. Willoughby) Date: Fri Nov 18 06:15:03 2005 Subject: [SC-Help] Re: somewhat odd e-mail References: Message-ID: I don't live in the UK nor would be looking for a job there.. So, I'm not sure how this person would have found my information. :) Chris "Brian" wrote in message news:dlj4du$mqs$1@news.spamcop.net... > Looks like no bogosity in the headers, even though SC gags a bit. > > canonical name gateway1.scom.com. > aliases 242.200.162.212.in-addr.arpa > ukayd01.scom.com > ukaym02.scom.com > addresses 212.162.200.242 > > Registrant: > S.Com Group plc > Buckingham House Buckingham Street > Aylesbury, ZZ HP20 2LA > UK > > The company looks legit, but don't know about their spamminess. Have you > been job hunting or looking to hire? > > > -- > Brian > SC.10.myspamgobbler@spamcowboy.net From bait-423c86b2-42ff9001 at good.julianhaight.com Fri Nov 18 03:16:55 2005 From: bait-423c86b2-42ff9001 at good.julianhaight.com (Chris F. Willoughby) Date: Fri Nov 18 06:20:03 2005 Subject: [SC-Help] Re: somewhat odd e-mail References: Message-ID: "Brian" wrote in message news:dlj4du$mqs$1@news.spamcop.net... > S.Com Inc. > 15851 Dallas Parkway, Suite 500 > Addison > TX 75001-6016 > United States of America > > > (t) +1 972 308-8516 > (f) +1 972 308-8536 > (e) response@scom.com > > The company looks legit, but don't know about their spamminess. Have you > been job hunting or looking to hire? > > > -- > Brian > SC.10.myspamgobbler@spamcowboy.net Damn, I just noticed the bit about Dallas, TX. No, I haven't been actively looking for work recently.. and wouldn't be looking around there anyway. Hmm, I guess I'll just ignore it and see if anything else comes along. Chris From smims at sunstoneinc.com Fri Nov 18 14:45:26 2005 From: smims at sunstoneinc.com (smims@sunstoneinc.com) Date: Fri Nov 18 15:47:44 2005 Subject: [SC-Help] Steville Mims is out of the office. Message-ID: I will be out of the office starting Fri 11/18/2005 and will not return until Wed 11/30/2005. Steville Mims is no longer with Sunstone, Inc. For EDI related matters, please send to edi@sunstoneinc.com, jclarke@sunstoneinc.com or call Johanna Clarke, 847-470-3120. All other IT requests, send to helpdesk@sunstoneinc.com, 847-965-1700, xt. 331. From smims at sunstoneinc.com Sat Nov 19 04:01:00 2005 From: smims at sunstoneinc.com (smims@sunstoneinc.com) Date: Sat Nov 19 05:04:25 2005 Subject: [SC-Help] Steville Mims is out of the office. Message-ID: I will be out of the office starting Fri 11/18/2005 and will not return until Thu 09/30/2010. Steville Mims is no longer with Sunstone, Inc. For EDI related matters, please send to edi@sunstoneinc.com, jclarke@sunstoneinc.com or call Johanna Clarke, 847-470-3120. All other IT requests, send to helpdesk@sunstoneinc.com, 847-965-1700, xt. 331. From nobody at spamcop.net Sat Nov 19 06:34:45 2005 From: nobody at spamcop.net (SJones) Date: Sat Nov 19 06:35:21 2005 Subject: [SC-Help] Re: Steville Mims is out of the office. In-Reply-To: References: Message-ID: On or about 11/19/2005 5:01 AM, smims@sunstoneinc.com penned the following: > > > > I will be out of the office starting Fri 11/18/2005 and will not return > until Thu 09/30/2010. > > Steville Mims is no longer with Sunstone, Inc. > > For EDI related matters, please send to edi@sunstoneinc.com, > jclarke@sunstoneinc.com or call Johanna Clarke, 847-470-3120. > > All other IT requests, send to helpdesk@sunstoneinc.com, 847-965-1700, xt. > 331. > Wonder why he'll be returning in 2010. -- All spam & UCE are reported. From post.please.this.email.is.not.valid at example.com Sat Nov 19 09:54:34 2005 From: post.please.this.email.is.not.valid at example.com (DougW) Date: Sat Nov 19 10:55:04 2005 Subject: [SC-Help] Re: Steville Mims is out of the office. References: Message-ID: SJones did pass the time by typing: > On or about 11/19/2005 5:01 AM, smims@sunstoneinc.com penned the following: >> I will be out of the office starting Fri 11/18/2005 and will not return >> until Thu 09/30/2010. > Wonder why he'll be returning in 2010. Parole date? :) -- DougW From MikeE at ster.invalid Sat Nov 19 08:40:53 2005 From: MikeE at ster.invalid (Mike Easter) Date: Sat Nov 19 11:45:03 2005 Subject: [SC-Help] Re: Steville Mims is out of the office. References: Message-ID: SJones wrote: > Wonder why he'll be returning in 2010. mailman.126.1132394606.169.spamcop-help@news.spamcop.net is not the same as mailman.125.1132346861.169.spamcop-help@news.spamcop.net > I will be out of the office starting Fri 11/18/2005 and will not > return until Wed 11/30/2005. > I will be out of the office starting Fri 11/18/2005 and will not > return until Thu 09/30/2010. One is a T'day break; the other is a prison hitch. -- Mike Easter kibitzer, not SC admin From Ilgaz at spamcop.net Sun Nov 20 06:30:34 2005 From: Ilgaz at spamcop.net (Ilgaz Ocal) Date: Sat Nov 19 23:35:03 2005 Subject: [SC-Help] Strange stuff going on (my mail got 8192 spamcop reports,counting) Message-ID: Hi, I am a spamcop customer and serverlogistics customer. Saying as it could be related. I woke up, Eudora shows 8100 unread messages in my stepfathers site mail which I maintain. It is fhzre@fhzregvyznp.pbz (rot13) The link given in "bounce" mail is: http://www.spamcop.net/w3m?action=checkblock&ip=67.43.163.77 It is "shared hosting" from a known company does Mac Xserve hosting (www.serverlogistics.com ) , I don't think they are involved in spam of any kind. In any case, contact address should not be "him". I have no clue what is happening. Some endless cycle? I just woke up so sorry if I missed some details and my english as usual :) Ilgaz From MikeE at ster.invalid Sat Nov 19 20:47:53 2005 From: MikeE at ster.invalid (Mike Easter) Date: Sat Nov 19 23:50:03 2005 Subject: [SC-Help] Re: Strange stuff going on (my mail got 8192 spamcop reports,counting) References: Message-ID: Ilgaz Ocal wrote: > I am a spamcop customer and serverlogistics customer. Saying as it > could be related. The blocklisted major output server 67.43.163.77 rDNS osiris.serverlogistics.com is also the incoming MX IP for serverlogistics AKA mail.serverlogistics.net .... so it is conceivable that you could be reporting your own provider. > I woke up, Eudora shows 8100 unread messages in my stepfathers site > mail which I maintain. It is fhzre@fhzregvyznp.pbz (rot13) The mailserver for sumertilmac.com is also the serverlogistics server mentioned above. So, the reporting of spam to that account could also be misreported as the server above. I have no idea what the unread messages are about. Do you? > The link given in "bounce" mail is: > > http://www.spamcop.net/w3m?action=checkblock&ip=67.43.163.77 It is bad for the server to be so listed: 67.43.163.77 listed in bl.spamcop.net SpamCop users have reported system delisted automatically in approximately 1 hours System has been listed for less than 24 hours Reporter listing a server is suspicious for a bad reporter reporting hir own server. > It is "shared hosting" from a known company does Mac Xserve hosting > (www.serverlogistics.com ) , I don't think they are involved in spam > of any kind. > > In any case, contact address should not be "him". > > I have no clue what is happening. Some endless cycle? > > I just woke up so sorry if I missed some details and my english as > usual :) -- Mike Easter kibitzer, not SC admin From Ilgaz at spamcop.net Sun Nov 20 07:34:39 2005 From: Ilgaz at spamcop.net (Ilgaz Ocal) Date: Sun Nov 20 00:35:03 2005 Subject: [SC-Help] Re: Strange stuff going on (my mail got 8192 spamcop reports,counting) References: Message-ID: On 2005-11-20 06:47:53 +0200, "Mike Easter" said: > Ilgaz Ocal wrote: > >> I am a spamcop customer and serverlogistics customer. Saying as it >> could be related. > > The blocklisted major output server 67.43.163.77 rDNS > osiris.serverlogistics.com is also the incoming MX IP for > serverlogistics AKA mail.serverlogistics.net > > .... so it is conceivable that you could be reporting your own provider. But I didn't report anything :) I even gave up quick reporting a while ago. You know what? Serverlogistics is also a spamcop customer (as company) I guess. Their mail got Spamcop blocking list enabled. > >> I woke up, Eudora shows 8100 unread messages in my stepfathers site >> mail which I maintain. It is fhzre@fhzregvyznp.pbz (rot13) > > The mailserver for sumertilmac.com is also the serverlogistics server > mentioned above. So, the reporting of spam to that account could also > be misreported as the server above. > > I have no idea what the unread messages are about. Do you? Sorry for late reply as even Eudora lost its mind while trying to get these mails. I digged it's mailbox file, pasting here (all identical) Incoming message... Subject: Delivery failure to ... Date: Sat, 19 Nov 2005 15:24:09 -0800 PST From: "Mail Delivery Subsystem" To: >From ???@??? Sun Nov 20 07:11:54 2005 Received: from IMAIL_LOCAL (unverified [localhost]) by serverlogistics.com (SurgeMail 3.5b3) with ESMTP id 6071098 for ; Sat, 19 Nov 2005 15:24:09 -0800 PST Return-Path: <> Date: Sat, 19 Nov 2005 15:24:09 -0800 PST From: "Mail Delivery Subsystem" X-AutoResponder: mailer-daemon To: Subject: Delivery failure to ... MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="surge_1132442649_serverlogistics.com" X-Server: High Performance Mail Server - http://surgemail.com r=-1195071323 Message-ID: <1132442649_3371@osiris.serverlogistics.com> X-Rcpt-To: When trying to deliver your message, the mail server at serverlogistics.com encountered problems with the following addresses: For , Open Error 0sec (553 Your IP address 67.43.163.77 is blackholed by bl.spamcop.net. Please see http://spamcop.net/w3m?action=checkblock&ip=67.43.163.77) For a more detailed explanation see http://netwinsite.com/surgemail/deliver_failed.htm Reporting-MTA: dns; serverlogistics.com ____ OK now I understand what happened! It is the worst thing can ever happen. I had a mail for him from Novell Myrealbox before. I somehow enabled 'When this account receives an incoming email, send a notification email to the address below:" to his myrealbox account. So, when he gets mail,notification is sent to myrealbox, myrealbox bounces mail to his mail.... Bah, endless cycle. What prevented me from figuring it out is, even Eudora lost its mind while trying to get/cache 12000 mails. I will notify serverlogistics admin about this amazing possibility. Looks like it is serverlogistics flooding its own customer. Thank you Mike for waking me up! I was about to take down site as I suspected the PHP mail form is hacked or something! Really thanks Ilgaz > >> The link given in "bounce" mail is: >> >> http://www.spamcop.net/w3m?action=checkblock&ip=67.43.163.77 > > It is bad for the server to be so listed: > > 67.43.163.77 listed in bl.spamcop.net > SpamCop users have reported system > delisted automatically in approximately 1 hours > System has been listed for less than 24 hours > > Reporter listing a server is suspicious for a bad reporter reporting hir > own server. So is it normal to get that mail to a normal user (not even postmaster@sumertilmac.com) as admin of entire serverlogistics? > >> It is "shared hosting" from a known company does Mac Xserve hosting >> (www.serverlogistics.com ) , I don't think they are involved in spam >> of any kind. >> >> In any case, contact address should not be "him". >> >> I have no clue what is happening. Some endless cycle? >> >> I just woke up so sorry if I missed some details and my english as >> usual :) From SC.10.myspamgobbler at spamcowboy.net Sat Nov 19 23:48:05 2005 From: SC.10.myspamgobbler at spamcowboy.net (Brian) Date: Sun Nov 20 02:55:04 2005 Subject: [SC-Help] Re: Steville Mims is out of the office. In-Reply-To: References: Message-ID: Mike Easter wrote: > SJones wrote: > >> Wonder why he'll be returning in 2010. > > mailman.126.1132394606.169.spamcop-help@news.spamcop.net is not the same > as mailman.125.1132346861.169.spamcop-help@news.spamcop.net > >> I will be out of the office starting Fri 11/18/2005 and will not >> return until Wed 11/30/2005. > >> I will be out of the office starting Fri 11/18/2005 and will not >> return until Thu 09/30/2010. > > One is a T'day break; the other is a prison hitch. > > Steville Mims is no longer with Sunstone, Inc. -- Brian SC.10.myspamgobbler@spamcowboy.net From ggrotyohannNOSPAM at hotmail.com Sun Nov 20 07:56:02 2005 From: ggrotyohannNOSPAM at hotmail.com (Greg Grotyohann) Date: Sun Nov 20 08:00:06 2005 Subject: [SC-Help] Resolving link obfuscation Message-ID: Why can't SpamCop always resolve links for spam related web-sites. See: http://members.spamcop.net/sc?id=z829056778zf56d92241e0f9639248f3c6b0c6d27cfz I can get to the web-site with no problem. Thanks, Greg From Kilgallen at SpamCop.net Sun Nov 20 07:57:57 2005 From: Kilgallen at SpamCop.net (Larry Kilgallen) Date: Sun Nov 20 09:00:03 2005 Subject: [SC-Help] Re: Resolving link obfuscation References: Message-ID: In article , "Greg Grotyohann" writes: > Why can't SpamCop always resolve links for spam related web-sites. See: > http://members.spamcop.net/sc?id=z829056778zf56d92241e0f9639248f3c6b0c6d27cfz I > can get to the web-site with no problem. In some cases the spammer has arranged DNS so that links do not resolve for requests from SpamCop's IP address range. From MikeE at ster.invalid Sun Nov 20 06:03:59 2005 From: MikeE at ster.invalid (Mike Easter) Date: Sun Nov 20 09:05:04 2005 Subject: [SC-Help] Re: Resolving link obfuscation References: Message-ID: Greg Grotyohann wrote: > Why can't SpamCop always resolve links for spam related web-sites. The 'why' isn't disclosed by SC's programmer, so the rest of us guess based on the observed varieties of behavior toward the deobfuscated link. In this case SC finds and deobfuscates. Each time we use this tracker [removing your 'members' subdomain and replacing with www for the general public] http://www.spamcop.net/sc?id=z829056778zf56d92241e0f9639248f3c6b0c6d27cfz > I can get to the web-site with no problem. In the course of fooling with your tracker for pasting in here, I 'happened' to run the parse twice. The first time the parser made no effort to resolve the link, the 2nd time the parser resolved the link correctly and derived a notify address Tracking link: http://www.bright-3.com/signs.asp Resolves to 220.247.158.29 If reported today, reports would be sent to: Re: http://www.bright-3.com/signs.asp (Administrator of network hosting website referenced in spam) abuse@sparqnet.net abuse@e-power.com.tw postmaster@e-power.com.tw There is a longer discussion in the forum about why one result one time and a different another http://forum.spamcop.net/forums/index.php?showtopic=4085 SpamCop reporting of spamvertized URLs, Viewpoint(s) I might also add that it is not of great value to report a spamvertiser to the unresponsive spamhaused ePower .tw provider. For ePower spamhaus has 4 listings, 3 /32 single IPs and a /24 -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Sun Nov 20 06:58:15 2005 From: MikeE at ster.invalid (Mike Easter) Date: Sun Nov 20 10:00:02 2005 Subject: [SC-Help] Re: Strange stuff going on (my mail got 8192 spamcop reports,counting) References: Message-ID: Ilgaz Ocal wrote: > "Mike Easter" >> The blocklisted major output server 67.43.163.77 rDNS >> osiris.serverlogistics.com is also the incoming MX IP for >> serverlogistics AKA mail.serverlogistics.net >>> The link given in "bounce" mail is: >>> >>> http://www.spamcop.net/w3m?action=checkblock&ip=67.43.163.77 >> >> It is bad for the server to be so listed: >> >> 67.43.163.77 listed in bl.spamcop.net >> SpamCop users have reported system >> delisted automatically in approximately 1 hours >> System has been listed for less than 24 hours >> >> Reporter listing a server is suspicious for a bad reporter reporting >> hir own server. > > So is it normal to get that mail to a normal user (not even > postmaster@sumertilmac.com) as admin of entire serverlogistics? What I was trying to say in my snippages from the SCbl listing [currently the server has now autodelisted] was that it was bad for an output [and what is also in this case an input server] to be listed because that affects so many of the server's user senders. I was also trying to say that we are looking at spamcop reporters reporting a server. Since the parser is designed to not report servers but instead a user IP behind the server, and if we can't see the evidence, we are left to guess at the various causes of a server being reported by reporters or a reporter. Especially a server which is also an input server, MX. One of those guesses is a reporter reporting hir own provider. There's nothing about what I was saying about that above that answers your question [which I don't really understand] > So is it normal to get that mail to a normal user (not even > postmaster@sumertilmac.com) as admin of entire serverlogistics? SC's notify for 67.43.163.77 would be abuse@xfernet.net because of the arin contact. If a user at sumertilmac sent a spam, I would have to know the output server to know how SC would notify. SC doesn't notify on the basis of a domainname. -- Mike Easter kibitzer, not SC admin From majg12uk at yahoo.co.uk Mon Nov 21 22:43:40 2005 From: majg12uk at yahoo.co.uk (Mark Jones) Date: Mon Nov 21 23:27:57 2005 Subject: [SC-Help] Yahoo! Mail bouncing Spamcop replies to reports Message-ID: Logging in to Spamcop I received the following notice: "Bounce error Your email address, majg12uk@yahoo.co.uk has returned a bounce: Subject: Delivery Status Notification (Failure) Reason: 5.4.7 - Delivery expired (message too old) [Default] 451-'mta121.mail.ukl.yahoo.com Resources temporarily unavailable. Please try again later. UP Email not accepted for policy reasons. Please visit http://help.yahoo.com/help/us/mail/defer/defer-04.html [#4.16.4:190].' Please ensure your email account is reliable, then click below" The link to Yahoo help explains that it could be because of Yahoo's anti-phishing detection. As I regularly report phishing emails to Spamcop any replies from Spamcop will bounce if they are caught by Yahoo's ant-phishing technology. I wrote to Yahoo! using the form at the following link http://add.yahoo.com/fast/help/us/mail/cgi_defer (who knows if they will read it) the following: "I am not a representative of Spamcop.net but a user so I do not have the info requested above nor a copy of the email in question. "I did receive a notice from Spamcop.net at their website that an email sent to my Yahoo address bounced - probably because it contained a copy of a phishing email I reported to spamcop. Please note that if Yahoo Mail will bounce emails from Spamcop on this basis it makes Spamcop unusable with Yahoo Mail and vice-versa. To correct this you could update your anti-phishing filters to allow email from Spamcop (which often contain copies of phishing emails reported to Spamcop). "Without this my use of Yahoo! Mail is seriously impaired as I am a dedicated Spamcop user." It might be good if Spamcop contacted them at the same form to provide the necessary info to stop this happening. From MikeE at ster.invalid Mon Nov 21 15:47:24 2005 From: MikeE at ster.invalid (Mike Easter) Date: Mon Nov 21 23:28:26 2005 Subject: [SC-Help] Re: Yahoo! Mail bouncing Spamcop replies to reports References: Message-ID: Mark Jones wrote: > Your email address, majg12uk@yahoo.co.uk has returned a bounce: > UP Email not accepted for policy reasons. > http://help.yahoo.com/help/us/mail/defer/defer-04.html > As I regularly report phishing emails to > Spamcop any replies from Spamcop will bounce if they are caught by > Yahoo's ant-phishing technology. How so? If you email report/submit to spamcop, what SC sends to the yahoo addy is a trackerlink and some headers in the body. Those headers are simply the headers of the mail sent which contains the phish or spam in the body, not the phish or the spam or the phish or the spam's headers. How do you theorize the trackerlink [for a spam or phish] + sending headers thereof will trip yahoo's antiphish [or fraud or viruses also mentioned at the top link] tech? -- Mike Easter kibitzer, not SC admin From majg12uk at SPAMBLOCKERyahoo.co.uk Tue Nov 22 00:33:02 2005 From: majg12uk at SPAMBLOCKERyahoo.co.uk (Mark Jones) Date: Mon Nov 21 23:29:00 2005 Subject: [SC-Help] Re: Yahoo! Mail bouncing Spamcop replies to reports References: Message-ID: Mike Easter wrote: > Mark Jones wrote: > >> Your email address, majg12uk@yahoo.co.uk has returned a bounce: > >> UP Email not accepted for policy reasons. >> http://help.yahoo.com/help/us/mail/defer/defer-04.html > >> As I regularly report phishing emails to >> Spamcop any replies from Spamcop will bounce if they are caught by >> Yahoo's ant-phishing technology. > > How so? > > If you email report/submit to spamcop, what SC sends to the yahoo addy > is a trackerlink and some headers in the body. Those headers are simply > the headers of the mail sent which contains the phish or spam in the > body, not the phish or the spam or the phish or the spam's headers. > > How do you theorize the trackerlink [for a spam or phish] + sending > headers thereof will trip yahoo's antiphish [or fraud or viruses also > mentioned at the top link] tech? > > > I apologise, I could have been clearer in explaining that the phishing email did not originate from or contain links pertaining to Yahoo! servers and so the corresponding Spamcop *report* is not going to Yahoo!. What I meant was the email address that I use to send reports to and receive replies from Spamcop is based at Yahoo! so, therefore, *responses from ISPs* (that often contain the original reported spam/phish) are sent to Spamcop and redirected by Spamcop to my Yahoo! address. It is these that I presume were blocked by Yahoo! anti-phishing filters and caused the bounce back to Spamcop. Hope that clarifies. Mark From bud at telus.net Tue Nov 22 10:07:49 2005 From: bud at telus.net (Bud) Date: Tue Nov 22 13:10:03 2005 Subject: [SC-Help] Re: Dead Links??? References: Message-ID: "Robert Williams" wrote in message news:dlirjs$gfh$1@news.spamcop.net... > I'm not sure what Mike was going into in that previous response, I'm sure > he > TRIED helping, but if he's not SC Admin, he really shouldn't be replying > to > SC Help issues. This is not to dismiss all the other posters to this forum but; I for one, have learned more from Mike Easter's responses to posts no matter where they appear, than all the anti-spam forums and ngs that I have visited since becoming a SC user. Some of his analyses go over my head but in every post there is something I take away that I didn't have before. In my opinion, this news group would be poorer without him. -- Bud From devnull at spamcop.net Tue Nov 22 22:27:14 2005 From: devnull at spamcop.net (Frog Prince) Date: Tue Nov 22 23:00:03 2005 Subject: [SC-Help] Re: Dead Links??? References: Message-ID: "Bud" | > I'm not sure what Mike was going into in that previous response, I'm sure | > he TRIED helping, but if he's not SC Admin, he really shouldn't be replying | > to SC Help issues. | | | This is not to dismiss all the other posters to this forum but; | I for one, have learned more from Mike Easter's responses to posts no matter | where they appear, than all the anti-spam forums and ngs that I have visited | since becoming a SC user. Some of his analyses go over my head but in every | post there is something I take away that I didn't have before. In my | opinion, this news group would be poorer without him. | -- | Bud | | Hear! Hear! From nobody at devnull.spamcop.net Wed Nov 23 13:29:19 2005 From: nobody at devnull.spamcop.net (Pop) Date: Wed Nov 23 13:30:03 2005 Subject: [SC-Help] Re: Dead Links??? References: Message-ID: "Frog Prince" wrote in message news:dm0p9i$385$1@news.spamcop.net... : : "Bud" : : | > I'm not sure what Mike was going into in that previous response, I'm : sure : | > he TRIED helping, but if he's not SC Admin, he really shouldn't be : replying : | > to SC Help issues. : | : | : | This is not to dismiss all the other posters to this forum but; : | I for one, have learned more from Mike Easter's responses to posts no : matter : | where they appear, than all the anti-spam forums and ngs that I have : visited : | since becoming a SC user. Some of his analyses go over my head but in : every : | post there is something I take away that I didn't have before. In my : | opinion, this news group would be poorer without him. : | -- : | Bud : | : | : Hear! Hear! : : If you just fix a problem today, it's likely to come back tomorrow, and then you start the process all over again. If you understand the problem, THEN you can avoid it happening again, plus not have to go thru the process again. My opinion, anyway. Pop From gkafrg at microsoft.com Sun Nov 27 23:57:01 2005 From: gkafrg at microsoft.com (Dzon) Date: Sun Nov 27 17:00:03 2005 Subject: [SC-Help] Wier bieten Message-ID: a.. Sarge a.. Verkaufs und Marktstande a.. Bauholz a.. Saunenholz a.. Holzprodukte fur Ihren Garten a.. Verpackungen a.. Produkte aus Aluminiumprofil http://www.medison.lt/index.php?lang=de&mID=2 From beachkid at cesmail.net Mon Nov 28 07:52:23 2005 From: beachkid at cesmail.net (Beach Kid) Date: Mon Nov 28 07:55:03 2005 Subject: [SC-Help] Strange Subject Line Message-ID: Can anybody tell me what is up with the following subject line? I have been getting 2, 3, or more emails per day with similar titled subject lines. Subject: $BM7$S463P$GNx?MBe9T$N;E;v$r$7$^$;$s$+(B Beach Kid From post.please.this.email.is.not.valid at example.com Mon Nov 28 19:37:41 2005 From: post.please.this.email.is.not.valid at example.com (DougW) Date: Mon Nov 28 20:40:03 2005 Subject: [SC-Help] Re: Strange Subject Line References: Message-ID: Beach Kid did pass the time by typing: > Can anybody tell me what is up with the following subject line? I > have been getting 2, 3, or more emails per day with similar titled > subject lines. > > Subject: $BM7$S463P$GNx?MBe9T$N;E;v$r$7$^$;$s$+(B > > Beach Kid b0rked spamware. Or it's not standard ASCII (like russian or Chinese) and your email reader doesn't understand it. -- DougW