From Unknown.User at Invalid.Domain  Wed Feb  1 01:55:25 2006
From: Unknown.User at Invalid.Domain (Jan M. Nelken)
Date: Wed Feb  1 02:00:03 2006
Subject: [SC-Help] Re: What it is?
In-Reply-To: <drp0vt$duq$1@news.spamcop.net>
References: <droeke$3dp$1@news.spamcop.net> <43DFBEA8.7FB084C3@spamcop.net>
	<drp0vt$duq$1@news.spamcop.net>
Message-ID: <drpm16$p5r$1@news.spamcop.net>

Anon_ wrote:

> Under any circumstances, it is NOT a good idea yom "auto-open" ANYTHING - it
> could be a virus and you are "automatically" infected therefrom.

...except this is Lotus Notes action I have no control about at all. I f you 
know how to set up Lotus Notes not to open mime part - let me know.

Jan M. Nelken
From Unknown.User at Invalid.Domain  Wed Feb  1 01:56:58 2006
From: Unknown.User at Invalid.Domain (Jan M. Nelken)
Date: Wed Feb  1 02:00:06 2006
Subject: [SC-Help] Re: What it is?
In-Reply-To: <43DFBEA8.7FB084C3@spamcop.net>
References: <droeke$3dp$1@news.spamcop.net> <43DFBEA8.7FB084C3@spamcop.net>
Message-ID: <drpm42$p5r$2@news.spamcop.net>

Kenneth Brody wrote:
> "Jan M. Nelken" wrote:
>> I am getting series of Penny stock spam into my Lotus Notes in-basket. It
>> appears that payload is an attached gif which Lotus Notes is "auto-opening" -
>> but this "auto-open" only happens on this kind of spam.
>>
>> In one part I found this term: SRC="cid:OK64699DVVC@texas.net". What does
>> it mean?
> 
> That is probably part of an <img> tag, and it means that the image is an
> attachment to the e-mail.  The "cid:" part identifies the attachment based
> on the identifier that follows.  I believe that one of the attacments will
> have something like "Content-ID:" within it which matches the ID.
> 
> While Lotus may "auto-open" it, you can at least be assured that it is
> grabbing the image from the e-mail itself, rather than using a "web bug"
> off the 'net, which may uniquely identify you to the spammer.
> 

Thanks for the info. I am presuming that "texas.net" of this cid identifier is 
just a part of the string identifier and has nothing to do with texas.net domain 
if such one exists, right?

Jan M. Nelken
From nobody at devnull.spamcop.net  Wed Feb  1 05:43:38 2006
From: nobody at devnull.spamcop.net (Mike)
Date: Wed Feb  1 06:45:07 2006
Subject: [SC-Help] Re: Geocities Reporting
References: <dqo036$8t6$1@news.spamcop.net> <dqo6u0$cgc$1@news.spamcop.net>
	<43D13DBB.7643C069@spamcop.net> <dqrlfl$i5g$1@news.spamcop.net>
Message-ID: <drq6tq$2sl$1@news.spamcop.net>

I see that the redirect has been fixed...  any idea of when the full parser 
will be fixed to recognize these geocities sites in spam?  It seems to 
rarely do that.

-mike

"Ellen" <nobody@spamcop.net> wrote in message 
news:dqrlfl$i5g$1@news.spamcop.net...
>
> twas a case of multiple fat-fingers my more than one person


From spam_hjp at yahoo.com  Wed Feb  1 07:19:47 2006
From: spam_hjp at yahoo.com (Jim)
Date: Wed Feb  1 07:25:05 2006
Subject: [SC-Help] Re: Geocities Reporting
In-Reply-To: <drq6tq$2sl$1@news.spamcop.net>
References: <dqo036$8t6$1@news.spamcop.net> <dqo6u0$cgc$1@news.spamcop.net>
	<43D13DBB.7643C069@spamcop.net> <dqrlfl$i5g$1@news.spamcop.net>
	<drq6tq$2sl$1@news.spamcop.net>
Message-ID: <drq91p$47r$1@news.spamcop.net>

Mike wrote:
> I see that the redirect has been fixed...  any idea of when the full parser 
> will be fixed to recognize these geocities sites in spam?  It seems to 
> rarely do that.
> 
> -mike
> 
  Yes - I would like to know when the parser is going to be fixed for GeoCities Spam.

Also the parser seldom works for URLs that contain the "GREATLOVE",  "HAVEFUN" & 
"LOOKATTHESEGIRLS" .

I would think it would be more efficient to have the parser parse all links first time rather 
than having us hitting reload/refresh in several windows/tabs to get the results we should expect.

I believe this problem has gone on long enough.

Jim
From borgholio at storymind.com  Wed Feb  1 13:38:18 2006
From: borgholio at storymind.com (Borgholio)
Date: Wed Feb  1 16:40:03 2006
Subject: [SC-Help] Spamcop not connecting to external POP servers
Message-ID: <drr9r3$lqe$3@news.spamcop.net>

I know the mail service had issues this morning, but it seems that it's 
still having problems connecting to and downloading mail from external POP 
servers.
From MikeE at ster.invalid  Thu Feb  2 08:05:14 2006
From: MikeE at ster.invalid (Mike Easter)
Date: Thu Feb  2 11:05:03 2006
Subject: [SC-Help] Re: error: cannot parse head
References: <drsukf$op5$1@news.spamcop.net>
Message-ID: <drtain$aq$1@news.spamcop.net>

To .help & .spam;  f/ups to .help

matt wrote:
> hope this is the right place to post, sorry if it isnt

Discussion below about the functions of the different newsgroups.

> I received an email today which choked spam cop, here is an extract:

Subject: error: cannot parse head

> correcting the trailing spaces, and bringing the closing ] back up
> around the ip to bring it all into one line again meant that the email
> could be parsed, and all the spam links were found and reported.
>
> ;)

You actually aren't supposed to 'forge' a piece of mail and then submit
it to the parser and claim to have received the forged item in a correct
condition as a spam.  Such forgeries might sometimes be done
experimentally to help determine the cause of a parse failure, but then
that forged specimen's report should be cancelled.

The rules against making changes in your spam are here
http://www.spamcop.net/fom-serve/cache/125.html  How do I get started
reporting spam?  --  Changing Your Spam  - Before submitting or parsing
spam, SpamCop members should not make any material changes to the spam
which might cause SpamCop to find a link, address, or URL it normally
would not find.


Under normal conditions, the parser recognizes what is the header and
what is the body based on the header following all of the rules for
header fieldnames and for the proper folding of populated header fields
and also the rule about the proper separation of header from body
content.

If the header isn't right, the body won't be parsed and the parser might
also make an error in determining the source, and the parser alerts you
and the report can be cancelled.


Re which newsgroups are what and how to discuss a parsing problem.

The ng/s spamcop, spamcop.help, spamcop.mail are normal discussion
groups where spamcop.mail is only for discussion of spamcop mail
clients' issues and spamcop and spamcop.help are for general discussion
of spamcop issues -- but no spam posting is allowed.

The best way to post a spam is with its tracker, which looks like this
at the top of the page of a parse

Here is your TRACKING URL - it may be saved for future reference:
http://www.spamcop.net/sc?id=z868060411z9a79cc3c008187fb5c270b759a67372az

With such a tracker, anyone can access the parsing and the entire spam.

The newsgroup spamcop.spam originally was intended for posting the spams
which were not allowed to be posted in the discussion groups -- but the
problem is that news agent postings mess up the format of the original
item with the introduction of linewraps and other mischief, 'bending'
the spam and interfering with discussing it or with submitting it to the
parser.  So, in my opinion, spamcop.spam should never be used for
anything;  not for discussing and not for posting spam.

Since it isn't being used for anything, it /could/ be used to post a
spam if the spam were attached to the newsmessage as a text or .eml file
so that the linewrapping destruction would not occur.


Accordingly, I'm posting this message to spamcop.help and spamcop.spam
and making its followups to spamcop.help.

-- 
Mike Easter
kibitzer, not SC admin

From kenbrody at spamcop.net  Fri Feb  3 13:17:15 2006
From: kenbrody at spamcop.net (Kenneth Brody)
Date: Fri Feb  3 13:25:03 2006
Subject: [SC-Help] Re: What it is?
References: <droeke$3dp$1@news.spamcop.net> <43DFBEA8.7FB084C3@spamcop.net>
	<drpm42$p5r$2@news.spamcop.net>
Message-ID: <43E39E2B.34AF396F@spamcop.net>

"Jan M. Nelken" wrote:
> 
> Kenneth Brody wrote:
> > "Jan M. Nelken" wrote:
> >> I am getting series of Penny stock spam into my Lotus Notes in-basket. It
> >> appears that payload is an attached gif which Lotus Notes is "auto-opening" -
> >> but this "auto-open" only happens on this kind of spam.
> >>
> >> In one part I found this term: SRC="cid:OK64699DVVC@texas.net". What does
> >> it mean?
> >
> > That is probably part of an <img> tag, and it means that the image is an
> > attachment to the e-mail.  The "cid:" part identifies the attachment based
> > on the identifier that follows.  I believe that one of the attacments will
> > have something like "Content-ID:" within it which matches the ID.
> >
> > While Lotus may "auto-open" it, you can at least be assured that it is
> > grabbing the image from the e-mail itself, rather than using a "web bug"
> > off the 'net, which may uniquely identify you to the spammer.
> >
> 
> Thanks for the info. I am presuming that "texas.net" of this cid identifier is
> just a part of the string identifier and has nothing to do with texas.net domain
> if such one exists, right?

The "cid" value can be (almost) anything, and anything in it that looks
like a domain name is, in the case of spam, purely coincidental.  In a
real e-mail, the domain name may be added, just as the domain name is
typically added to the "message-id" value.

-- 
+-------------------------+--------------------+-----------------------------+
| Kenneth J. Brody        | www.hvcomputer.com |                             |
| kenbrody/at\spamcop.net | www.fptech.com     | #include <std_disclaimer.h> |
+-------------------------+--------------------+-----------------------------+
Don't e-mail me at: <mailto:ThisIsASpamTrap@gmail.com>

From h9vzc2i02 at sneakemail.com  Mon Feb  6 09:02:46 2006
From: h9vzc2i02 at sneakemail.com (Anon_)
Date: Mon Feb  6 12:00:03 2006
Subject: [SC-Help] phishing emails reports
Message-ID: <ds7va3$85d$1@news.spamcop.net>

where do I send manual phishing email complaints/reports?


From mikeyhsd at sport.rr.com  Mon Feb  6 17:23:29 2006
From: mikeyhsd at sport.rr.com (mikeyhsd)
Date: Mon Feb  6 18:25:02 2006
Subject: [SC-Help] Re: phishing emails reports
References: <ds7va3$85d$1@news.spamcop.net>
Message-ID: <ds8lph$n8v$1@news.spamcop.net>

where I send mine
reportphishing@antiphishing.org

mikeyhsd@sport.rr.com
"Anon_" <h9vzc2i02@sneakemail.com> wrote in message 
news:ds7va3$85d$1@news.spamcop.net...
> where do I send manual phishing email complaints/reports?
>
> 


From w7el at eznec.com  Tue Feb  7 14:02:59 2006
From: w7el at eznec.com (Roy Lewallen)
Date: Tue Feb  7 17:05:03 2006
Subject: [SC-Help] Spam that crashes Spamcop
Message-ID: <dsb5en$9u5$1@news.spamcop.net>

I've come across a spam that crashes the Spamcop cut-and-paste reporting 
system. The spam is posted in spamcop.spam with Subject of "Waterloo".

The first time I submitted it for analysis, I got the following messages 
on a blank page:

<div class="error">putRow INSERT command denied to user 
'reader'@'sc-app5.soma.ironport.com' for table 'prefs' (1142)/sc?</div>
<div class="error">putRow INSERT command denied to user 
'reader'@'sc-app5.soma.ironport.com' for table 'spams' (1142)/sc?</div>
<div class="error">putRow UPDATE command denied to user 
'reader'@'sc-app5.soma.ironport.com' for table 'prefs' (1142)/sc?</div>
<div class="error">putRow INSERT command denied to user 
'reader'@'sc-app5.soma.ironport.com' for table 'prefs' (1142)/sc?</div>

When I resubmitted it, I got the following at the top of the regular 
reporting page:

Failed to load spam header: 871276920 / 2c09a9d4399ceb5b2aa6f1c64cbc31a4
putRow DELETE command denied to user 
'reader'@'sc-app6.soma.ironport.com' for table 'unreported' 
(1142)/sc?id=z871276920z2c09a9d4399ceb5b2aa6f1c64cbc31a4z

Resubmitting again, I got the same result as immediately above.

Roy Lewallen
From nobody at devnull.spamcop.net  Tue Feb  7 16:19:23 2006
From: nobody at devnull.spamcop.net (WazoO)
Date: Tue Feb  7 17:20:02 2006
Subject: [SC-Help] Re: Spam that crashes Spamcop
References: <dsb5en$9u5$1@news.spamcop.net>
Message-ID: <dsb6da$al2$1@news.spamcop.net>

"Roy Lewallen" <w7el@eznec.com> wrote in message
news:dsb5en$9u5$1@news.spamcop.net...
> I've come across a spam that crashes the Spamcop cut-and-paste reporting
> system. The spam is posted in spamcop.spam with Subject of "Waterloo".

Status graphic placed at the top of the screen at
http://forum.spamcop.net/forums/  shows an outage.


From nobody at devnull.spamcop.net  Tue Feb  7 16:19:47 2006
From: nobody at devnull.spamcop.net (WazoO)
Date: Tue Feb  7 17:20:04 2006
Subject: [SC-Help] Re: spam reporting system error
References: <dsb62l$aa0$1@news.spamcop.net>
Message-ID: <dsb6e2$al6$1@news.spamcop.net>

"Technomage Hawke" <Technomage-hawke@127.0.0.1> wrote in message
news:dsb62l$aa0$1@news.spamcop.net...
> the following occurred while attempting to report spam:
> *************
> putRow UPDATE command denied to user 'reader'@'sc-app2.soma.ironport.com'
> for table 'prefs' (1142)/sc?

Status graphic placed at the top of the screen at
http://forum.spamcop.net/forums/  shows an outage.


From w7el at eznec.com  Tue Feb  7 15:03:21 2006
From: w7el at eznec.com (Roy Lewallen)
Date: Tue Feb  7 18:05:03 2006
Subject: [SC-Help] Re: Spam that crashes Spamcop
In-Reply-To: <dsb6da$al2$1@news.spamcop.net>
References: <dsb5en$9u5$1@news.spamcop.net> <dsb6da$al2$1@news.spamcop.net>
Message-ID: <dsb8vt$cgk$1@news.spamcop.net>



WazoO wrote:
> "Roy Lewallen" <w7el@eznec.com> wrote in message
> news:dsb5en$9u5$1@news.spamcop.net...
> 
>>I've come across a spam that crashes the Spamcop cut-and-paste reporting
>>system. The spam is posted in spamcop.spam with Subject of "Waterloo".
> 
> 
> Status graphic placed at the top of the screen at
> http://forum.spamcop.net/forums/  shows an outage.
> 

Thanks very much. Sorry for taking up the bandwidth with a false alarm.

I really dislike using forums, but I'll check there before making a 
similar report in the future.

Roy Lewallen
From nobody at devnull.spamcop.net  Tue Feb  7 17:24:13 2006
From: nobody at devnull.spamcop.net (WazoO)
Date: Tue Feb  7 18:25:01 2006
Subject: [SC-Help] Re: Spam that crashes Spamcop
References: <dsb5en$9u5$1@news.spamcop.net> <dsb6da$al2$1@news.spamcop.net>
	<dsb8vt$cgk$1@news.spamcop.net>
Message-ID: <dsba6u$dc2$1@news.spamcop.net>

"Roy Lewallen" <w7el@eznec.com> wrote in message
news:dsb8vt$cgk$1@news.spamcop.net...
> >
> > Status graphic placed at the top of the screen at
> > http://forum.spamcop.net/forums/  shows an outage.
>
> Thanks very much. Sorry for taking up the bandwidth with a false alarm.
>
> I really dislike using forums, but I'll check there before making a
> similar report in the future.

In this case, there isn't any "use" required ... it's at the top
of every Forum page, on the portal page at
http://forum.spamcop.net/forums/index.php?act=home
Just pop to the URL, graphic is there, acts as a link to
a larger pic with the rest of the statistic charts.

Issue is that when the Parsing & Reporting system has
problems, some folks can't log in, and that's if the server
is even responding.  The Forum and the charts are hosted
on a geographically separated system owned, maintained
by JT, so there is that off-site status check available.

As far as that goes, there were several posts in the Forum
about the "database errors after submitting my spam" also,
so even some folks that "do use" the Forum aren't seeing the
data placed on their screen either <g>


From spamtrap at dixie-soft.com  Tue Feb  7 21:32:34 2006
From: spamtrap at dixie-soft.com (Alan Brown)
Date: Tue Feb  7 21:35:14 2006
Subject: [SC-Help] Re: spam reporting system error
In-Reply-To: <dsb6e2$al6$1@news.spamcop.net>
References: <dsb62l$aa0$1@news.spamcop.net> <dsb6e2$al6$1@news.spamcop.net>
Message-ID: <dsbl81$jld$1@news.spamcop.net>

WazoO wrote:
> "Technomage Hawke" <Technomage-hawke@127.0.0.1> wrote in message
> news:dsb62l$aa0$1@news.spamcop.net...
> 
>>the following occurred while attempting to report spam:
>>*************
>>putRow UPDATE command denied to user 'reader'@'sc-app2.soma.ironport.com'
>>for table 'prefs' (1142)/sc?
> 
> 
> Status graphic placed at the top of the screen at
> http://forum.spamcop.net/forums/  shows an outage.
> 
> 

If you don't go to the forums, you don't see the graphic.  I use 
http://mailsc.spamcop.net (cookies turned on) for reporting manually 
(i.e., cut and paste of spam) and never see the graphic.

I was getting the same error as the original poster, but no graphic 
showed up indicating SpamCop was down.

                  - Alan
From nobody at devnull.spamcop.net  Tue Feb  7 22:30:25 2006
From: nobody at devnull.spamcop.net (WazoO)
Date: Tue Feb  7 23:35:03 2006
Subject: [SC-Help] Re: spam reporting system error
References: <dsb62l$aa0$1@news.spamcop.net> <dsb6e2$al6$1@news.spamcop.net>
	<dsbl81$jld$1@news.spamcop.net>
Message-ID: <dsbs52$noc$1@news.spamcop.net>

"Alan Brown" <spamtrap@dixie-soft.com> wrote in message
news:dsbl81$jld$1@news.spamcop.net...
> WazoO wrote:
> >
> > Status graphic placed at the top of the screen at
> > http://forum.spamcop.net/forums/  shows an outage.
> >
> If you don't go to the forums, you don't see the graphic.  I use
> http://mailsc.spamcop.net (cookies turned on) for reporting manually
> (i.e., cut and paste of spam) and never see the graphic.
>
> I was getting the same error as the original poster, but no graphic
> showed up indicating SpamCop was down.

I'm thinking that there might be a question in there.

What is SpamCop?
http://forum.spamcop.net/forums/index.php?act=faq&article=20

Section 8 - SpamCop's System & Active Staff
http://forum.spamcop.net/forums/index.php?act=faq&article=13


From spamtrap at dixie-soft.com  Wed Feb  8 01:30:20 2006
From: spamtrap at dixie-soft.com (Alan Brown)
Date: Wed Feb  8 01:35:03 2006
Subject: [SC-Help] Re: spam reporting system error
In-Reply-To: <dsbs52$noc$1@news.spamcop.net>
References: <dsb62l$aa0$1@news.spamcop.net> <dsb6e2$al6$1@news.spamcop.net>
	<dsbl81$jld$1@news.spamcop.net> <dsbs52$noc$1@news.spamcop.net>
Message-ID: <dsc35r$rl2$1@news.spamcop.net>

WazoO wrote:
> "Alan Brown" <spamtrap@dixie-soft.com> wrote in message
> news:dsbl81$jld$1@news.spamcop.net...
> 
>>WazoO wrote:
>>
>>>Status graphic placed at the top of the screen at
>>>http://forum.spamcop.net/forums/  shows an outage.
>>>
>>
>>If you don't go to the forums, you don't see the graphic.  I use
>>http://mailsc.spamcop.net (cookies turned on) for reporting manually
>>(i.e., cut and paste of spam) and never see the graphic.
>>
>>I was getting the same error as the original poster, but no graphic
>>showed up indicating SpamCop was down.
> 
> 
> I'm thinking that there might be a question in there.
> 
> What is SpamCop?
> http://forum.spamcop.net/forums/index.php?act=faq&article=20
> 
> Section 8 - SpamCop's System & Active Staff
> http://forum.spamcop.net/forums/index.php?act=faq&article=13
> 
> 
If you thought I had a question, you were wrong.  I merely stated what 
anyone will see on the URL I referenced (i.e., no status graphic) and 
that I observed the same problem as the original poster.

My statement was meant to clarify the incorrect impression that you left 
that the status graphic is visible in all areas of SpamCop.

              - Alan
From nobody at devnull.spamcop.net  Wed Feb  8 07:31:59 2006
From: nobody at devnull.spamcop.net (WazoO)
Date: Wed Feb  8 08:35:15 2006
Subject: [SC-Help] Re: spam reporting system error
References: <dsb62l$aa0$1@news.spamcop.net> <dsb6e2$al6$1@news.spamcop.net>
	<dsbl81$jld$1@news.spamcop.net> <dsbs52$noc$1@news.spamcop.net>
	<dsc35r$rl2$1@news.spamcop.net>
Message-ID: <dscrsf$jal$1@news.spamcop.net>

"Alan Brown" <spamtrap@dixie-soft.com> wrote in message
news:dsc35r$rl2$1@news.spamcop.net...
> WazoO wrote:
> >
> > I'm thinking that there might be a question in there.
> >
> > What is SpamCop?
> > http://forum.spamcop.net/forums/index.php?act=faq&article=20
> >
> > Section 8 - SpamCop's System & Active Staff
> > http://forum.spamcop.net/forums/index.php?act=faq&article=13
> >
> If you thought I had a question, you were wrong.  I merely stated what
> anyone will see on the URL I referenced (i.e., no status graphic) and
> that I observed the same problem as the original poster.
>
> My statement was meant to clarify the incorrect impression that you left
> that the status graphic is visible in all areas of SpamCop.

I'm at a total loss as to where / how you got an impression that
a graphic / link I placed on the Forum and Portal pages would
be seen "everywhere" ....?????


From nobody at spamcop.net  Wed Feb  8 13:04:15 2006
From: nobody at spamcop.net (Ellen)
Date: Wed Feb  8 13:20:03 2006
Subject: [SC-Help] Possible slow reponse to spam submittals
Message-ID: <dsdclg$sj$1@news.spamcop.net>

You may encounter slow responses to spam submittals. We had some system
problems overnight which have resulted in the system needing to work thru
some largish backlogs. Operations and engineering are closely monitoring the
situation. Thanks for your patience

Ellen
SpamCop

f/ups set to spamcop




From nobody at spamcop.net  Wed Feb  8 13:17:46 2006
From: nobody at spamcop.net (Ellen)
Date: Wed Feb  8 13:20:06 2006
Subject: [SC-Help] Re: spam reporting system error
References: <dsb62l$aa0$1@news.spamcop.net> <dsb6e2$al6$1@news.spamcop.net>
Message-ID: <dsdclg$sj$2@news.spamcop.net>


"WazoO" <nobody@devnull.spamcop.net> wrote in message
news:dsb6e2$al6$1@news.spamcop.net...
> "Technomage Hawke" <Technomage-hawke@127.0.0.1> wrote in message
> news:dsb62l$aa0$1@news.spamcop.net...
> > the following occurred while attempting to report spam:
> > *************
> > putRow UPDATE command denied to user
'reader'@'sc-app2.soma.ironport.com'
> > for table 'prefs' (1142)/sc?
>
> Status graphic placed at the top of the screen at
> http://forum.spamcop.net/forums/  shows an outage.
>
>

Or you could look at the spamcop.net website -- click statistics and then
towards the bottom of the page under total spam report volume, click the
link for 24 hours:

http://www.spamcop.net/spamgraph.shtml?spamstats


That is the graph that is at the top of the forum pages is it not? Why not
mention that when you answer a question such as this?



Ellen
SpamCop


From MikeE at ster.invalid  Wed Feb  8 13:33:02 2006
From: MikeE at ster.invalid (Mike Easter)
Date: Wed Feb  8 16:35:03 2006
Subject: [SC-Help] Re: spam reporting system error
References: <dsb62l$aa0$1@news.spamcop.net> <dsb6e2$al6$1@news.spamcop.net>
	<dsdclg$sj$2@news.spamcop.net>
Message-ID: <dsdo28$9v3$1@news.spamcop.net>

Ellen wrote:
> "WazoO"
>> "Technomage Hawke" 

>>> the following occurred while attempting to report spam:
>>> *************
>>> putRow UPDATE command denied to user

>> Status graphic placed at the top of the screen at
>> http://forum.spamcop.net/forums/  shows an outage.

> Or you could look at the spamcop.net website -- click statistics and
> then towards the bottom of the page under total spam report volume,
> click the link for 24 hours:
> 
> http://www.spamcop.net/spamgraph.shtml?spamstats
> 
> 
> That is the graph that is at the top of the forum pages is it not?
> Why not mention that when you answer a question such as this?


Heh.


-- 
Mike Easter
kibitzer, not SC admin
From nobody at devnull.spamcop.net  Wed Feb  8 16:16:19 2006
From: nobody at devnull.spamcop.net (WazoO)
Date: Wed Feb  8 17:20:02 2006
Subject: [SC-Help] Re: spam reporting system error
References: <dsb62l$aa0$1@news.spamcop.net> <dsb6e2$al6$1@news.spamcop.net>
	<dsdclg$sj$2@news.spamcop.net>
Message-ID: <dsdqjj$bkc$1@news.spamcop.net>

"Ellen" <nobody@spamcop.net> wrote in message
news:dsdclg$sj$2@news.spamcop.net...
>
> "WazoO" <nobody@devnull.spamcop.net> wrote in message
> news:dsb6e2$al6$1@news.spamcop.net...
> >
> > Status graphic placed at the top of the screen at
> > http://forum.spamcop.net/forums/  shows an outage.
>
> Or you could look at the spamcop.net website -- click statistics and then
> towards the bottom of the page under total spam report volume, click the
> link for 24 hours:
>
> http://www.spamcop.net/spamgraph.shtml?spamstats
>
> That is the graph that is at the top of the forum pages is it not? Why not
> mention that when you answer a question such as this?

Same as the last time this conversation came up ... if the
Parsing & Reporting system is down, so is the
www.spamcop.net web-site .... such that no one can
see the graphics, no one can see the status message that
can't be posted because even the paid staff can't login ...
It's the availability of an off-site status check that's the
reason for these posts.  It's the answer to the requests and
offers that date back years to host such a thing, but was
never taken up by Julian (and later IronPort).

And should one also point out that though the web-page is
hosted on www.spamcop.net, the actual graphics are pulled
from alpha.cesmail.net, which is in the same data center as
the system hosting these newsgroups, the Forum, and the
SpamCop.net e-mail accounts????


From nobody at devnull.spamcop.net  Wed Feb  8 16:24:08 2006
From: nobody at devnull.spamcop.net (WazoO)
Date: Wed Feb  8 17:25:03 2006
Subject: [SC-Help] Re: spam reporting system error
References: <dsb62l$aa0$1@news.spamcop.net> <dsb6e2$al6$1@news.spamcop.net>
	<dsdclg$sj$2@news.spamcop.net> <dsdo28$9v3$1@news.spamcop.net>
Message-ID: <dsdr28$c0o$1@news.spamcop.net>

"Mike Easter" <MikeE@ster.invalid> wrote in message
news:dsdo28$9v3$1@news.spamcop.net...
> >
> > http://www.spamcop.net/spamgraph.shtml?spamstats
> >
> >
> > That is the graph that is at the top of the forum pages is it not?
> > Why not mention that when you answer a question such as this?
>
> Heh.

Just a couple of ancient links from the newsgroup archives ...
http://news.spamcop.net/pipermail/spamcop-list/2003-July/052059.html
http://news.spamcop.net/pipermail/spamcop-list/2003-July/051968.html



From MikeE at ster.invalid  Wed Feb  8 14:57:49 2006
From: MikeE at ster.invalid (Mike Easter)
Date: Wed Feb  8 18:00:03 2006
Subject: [SC-Help] Re: spam reporting system error
References: <dsb62l$aa0$1@news.spamcop.net> <dsb6e2$al6$1@news.spamcop.net>
	<dsdclg$sj$2@news.spamcop.net> <dsdqjj$bkc$1@news.spamcop.net>
Message-ID: <dsdt17$ddp$1@news.spamcop.net>

WazoO wrote:

> And should one also point out that though the web-page is
> hosted on www.spamcop.net, the actual graphics are pulled
> from alpha.cesmail.net, which is in the same data center as
> the system hosting these newsgroups, the Forum, and the
> SpamCop.net e-mail accounts????

I think that going straight for the 'horse's mouth' would be the best
link to the graphic.

http://alpha.cesmail.net/graphics/spamstats.gif - which is currently
served from 216.154.195.37 for me

As opposed to going to http://www.spamcop.net/spamgraph.shtml?spamstats
or http://forum.spamcop.net/forums/  to link to
http://forum.spamcop.net/forums/index.php?act=module&automodule=custom&page=stats
to fetch the .gif above.

Whenever there is trouble, it would be better to not have to pass
something around any more than necessary.


-- 
Mike Easter
kibitzer, not SC admin

From nobody at devnull.spamcop.net  Wed Feb  8 19:31:53 2006
From: nobody at devnull.spamcop.net (WazoO)
Date: Wed Feb  8 20:35:03 2006
Subject: [SC-Help] Re: spam reporting system error
References: <dsb62l$aa0$1@news.spamcop.net> <dsb6e2$al6$1@news.spamcop.net>
	<dsdclg$sj$2@news.spamcop.net> <dsdqjj$bkc$1@news.spamcop.net>
	<dsdt17$ddp$1@news.spamcop.net>
Message-ID: <dse629$jj1$1@news.spamcop.net>

"Mike Easter" <MikeE@ster.invalid> wrote in message
news:dsdt17$ddp$1@news.spamcop.net...
>
> I think that going straight for the 'horse's mouth' would be the best
> link to the graphic.
>
> http://alpha.cesmail.net/graphics/spamstats.gif - which is currently
> served from 216.154.195.37 for me

I built the page holding the 'big' pictures to hold more
than just the single graphic ... if all that's needed is a
status check, one could say that most folks would
already have things bookmarked ... but that also
falls right in line with reading before posting ..

Once gain, all I've done is provided a tool / resource ..
that has been brought up many, many times dating back
to when Julian was running everything "out of the house"


From nobody at devnull.spamcop.net  Wed Feb  8 19:48:34 2006
From: nobody at devnull.spamcop.net (WazoO)
Date: Wed Feb  8 20:50:05 2006
Subject: [SC-Help] Re: spam reporting system error
References: <dsb62l$aa0$1@news.spamcop.net> <dsb6e2$al6$1@news.spamcop.net>
	<dsdclg$sj$2@news.spamcop.net> <dsdqjj$bkc$1@news.spamcop.net>
	<dsdt17$ddp$1@news.spamcop.net>
Message-ID: <dse71i$kn3$1@news.spamcop.net>

"Mike Easter" <MikeE@ster.invalid> wrote in message
news:dsdt17$ddp$1@news.spamcop.net...
>
> I think that going straight for the 'horse's mouth' would be the best
> link to the graphic.
>
> http://alpha.cesmail.net/graphics/spamstats.gif - which is currently
> served from 216.154.195.37 for me

and the point is that the graphic at the top is that particular
view, hit with some 'size' statements to fit the screen.  It's
usually very visible that the green is gone, therefore showing
that the Reporting system is down.  Clicking on it is usually
not necessary unless one is documenting the timeframe.


From bert at iphouse.com  Fri Feb 10 00:57:42 2006
From: bert at iphouse.com (Bert Hyman)
Date: Thu Feb  9 20:00:03 2006
Subject: [SC-Help] Re: phishing emails reports
References: <ds7va3$85d$1@news.spamcop.net> <ds8lph$n8v$1@news.spamcop.net>
Message-ID: <Xns9765C0E47FCB8VeebleFetzer@216.154.195.61>

In news:ds8lph$n8v$1@news.spamcop.net "mikeyhsd" <mikeyhsd@sport.rr.com> 
wrote:

> where I send mine
> reportphishing@antiphishing.org

Neat! First I'd heard of 'em so I wasn't sure if you were kidding. 

But from http://onguardonline.gov/phishing.html

"Forward spam that is phishing for information to spam@uce.gov and to the 
company, bank, or organization impersonated in the phishing email. You 
also may report phishing email to reportphishing@antiphishing.org. The 
Anti-Phishing Working Group, a consortium of ISPs, security vendors, 
financial institutions and law enforcement agencies, uses these reports 
to fight phishing."

> 
> mikeyhsd@sport.rr.com
> "Anon_" <h9vzc2i02@sneakemail.com> wrote in message 
> news:ds7va3$85d$1@news.spamcop.net...
>> where do I send manual phishing email complaints/reports?
>>
>> 
> 
> 
> 



-- 
Bert Hyman	St. Paul, MN	bert@iphouse.com
From diespammer at spamthis.net  Sun Feb 12 22:56:39 2006
From: diespammer at spamthis.net (die spammer)
Date: Mon Feb 13 01:45:02 2006
Subject: [SC-Help] CNC-NOC.NET
Message-ID: <dsp9mt$b3j$1@news.spamcop.net>

so whats up with all the spam coming from cnc-noc.net? is anyone trying 
to stop this?
From MikeE at ster.invalid  Mon Feb 13 02:54:49 2006
From: MikeE at ster.invalid (Mike Easter)
Date: Mon Feb 13 05:55:03 2006
Subject: [SC-Help] Re: CNC-NOC.NET
References: <dsp9mt$b3j$1@news.spamcop.net>
Message-ID: <dspohd$is4$1@news.spamcop.net>

die spammer wrote:
> so whats up with all the spam coming from cnc-noc.net? is anyone
> trying to stop this?

Stop?  What does stop mean?  You can use a filter for your email that
identifies mail from .cn as spam.  If you control your own personal
client side filter you can do whatever with your spam you like,
including deleting it sight unseen.

If your mind is to 'coerce' .cn or more specifically cnc-noc.net to
'behave itself' vis spamsourcing or spamvertising, I'm afraid you are
out of luck.

You might be interested in reading about The Spamhaus Project and what
it does, including Spamhaus China.

http://www.spamhaus.org/index.lasso  Spamhaus tracks the Internet's
Spammers, Spam Gangs and Spam Services, provides dependable realtime
anti-spam protection for Internet networks, and works with Law
Enforcement to identify and pursue spammers worldwide.

// Spamhaus Opens Operations in China -- On May 25 2004, Beijing was
host to the opening of Spamhaus's China operations. "Our mission is to
help Chinese email and technology providers rid themselves of companies
who use the servers to send bulk unsolicited email around the globe.
Already a number of email providers in China have started to use the
Spamhaus Block List and we're getting good feedback from our partners,"
said a representative of Spamhaus based in China.  //
http://www.spamhaus.org/newsindex.lasso


SpamCop is a parsing and reporting service, the maintainer of the SCbl
spamcop blocklist, and a provider of a mail service which facilitates
spam tagging and reporting.  It doesn't have any .cn police powers or
police powers anywhere else in the world..


-- 
Mike Easter
kibitzer, not SC admin

From not at home.today  Mon Feb 13 23:29:53 2006
From: not at home.today (Ant)
Date: Mon Feb 13 18:35:02 2006
Subject: [SC-Help] Re: CNC-NOC.NET
References: <dsp9mt$b3j$1@news.spamcop.net> <dspohd$is4$1@news.spamcop.net>
Message-ID: <dsr4rv$fof$1@news.spamcop.net>

"Mike Easter" wrote:

> // Spamhaus Opens Operations in China -- On May 25 2004, Beijing was
> host to the opening of Spamhaus's China operations. "Our mission is to
> help Chinese email and technology providers rid themselves of companies
> who use the servers to send bulk unsolicited email around the globe.

Doesn't seem to have made a lot of difference. Much of my spam comes
from Chinese net space. They also need to persuade China to stop
hosting spammer's web sites. Even more spam has direct or redirected
links there.

> Already a number of email providers in China have started to use the
> Spamhaus Block List and we're getting good feedback from our partners,"
> said a representative of Spamhaus based in China.  //
> http://www.spamhaus.org/newsindex.lasso

I'm sure the Chinese are delighted that they can block inbound spam
while continuing to send it to the rest of the world.


From diespammer at spamthis.net  Mon Feb 13 20:10:45 2006
From: diespammer at spamthis.net (die spammer)
Date: Mon Feb 13 23:00:03 2006
Subject: [SC-Help] Re: CNC-NOC.NET
In-Reply-To: <dspohd$is4$1@news.spamcop.net>
References: <dsp9mt$b3j$1@news.spamcop.net> <dspohd$is4$1@news.spamcop.net>
Message-ID: <dsrkc7$pbe$1@news.spamcop.net>

> Stop?  What does stop mean?  You can use a filter for your email that
> identifies mail from .cn as spam.  If you control your own personal
> client side filter you can do whatever with your spam you like,
> including deleting it sight unseen.
> 
> If your mind is to 'coerce' .cn or more specifically cnc-noc.net to
> 'behave itself' vis spamsourcing or spamvertising, I'm afraid you are
> out of luck.
> 
> You might be interested in reading about The Spamhaus Project and what
> it does, including Spamhaus China.
> 
> http://www.spamhaus.org/index.lasso  Spamhaus tracks the Internet's
> Spammers, Spam Gangs and Spam Services, provides dependable realtime
> anti-spam protection for Internet networks, and works with Law
> Enforcement to identify and pursue spammers worldwide.
> 

Thanks for the link
From diespammer at spamthis.net  Mon Feb 13 20:16:04 2006
From: diespammer at spamthis.net (die spammer)
Date: Mon Feb 13 23:05:03 2006
Subject: [SC-Help] Re: CNC-NOC.NET
In-Reply-To: <dsr4rv$fof$1@news.spamcop.net>
References: <dsp9mt$b3j$1@news.spamcop.net> <dspohd$is4$1@news.spamcop.net>
	<dsr4rv$fof$1@news.spamcop.net>
Message-ID: <dsrkm6$ph7$1@news.spamcop.net>

> Doesn't seem to have made a lot of difference. Much of my spam comes
> from Chinese net space. They also need to persuade China to stop
> hosting spammer's web sites. Even more spam has direct or redirected
> links there.

yep, seems I report 10 spams and get 10 back. I'm wondering if they are 
testing me or testing some spam software or..... ?

Why can't someone from al quieda just bomb those servers ? whoosh.... 
dink dink dink.......  BOOOOM


> 
> 
>>Already a number of email providers in China have started to use the
>>Spamhaus Block List and we're getting good feedback from our partners,"
>>said a representative of Spamhaus based in China.  //
>>http://www.spamhaus.org/newsindex.lasso
> 
> 
> I'm sure the Chinese are delighted that they can block inbound spam
> while continuing to send it to the rest of the world.
> 
> 
From nobody at spamcop.net  Thu Feb 16 15:41:23 2006
From: nobody at spamcop.net (Ellen)
Date: Thu Feb 16 15:45:02 2006
Subject: [SC-Help] Maint Window 2/16/06
Message-ID: <dt2o2j$fj$1@news.spamcop.net>

Maintenance Window
February 16, 2006
8 PM PST -0800

The will be a maintenance window, starting at 8 PM PST -0800 and lasting
under an hour, to make some infrastructure changes. This will affect the
reporting system only. The email system will continue to operate normally.
After the maintenance completes you may notice some delays in processing as
the system works thru the backlog. Thanks for your patience.




Ellen
SpamCop

f/ups to spamcop

Please propagate to the forums.



From nobody at spamcop.net  Tue Feb 21 16:04:18 2006
From: nobody at spamcop.net (Ellen)
Date: Tue Feb 21 16:15:03 2006
Subject: [SC-Help] System maintenance window, Feb 21, 2006
Message-ID: <dtfvkp$jdi$1@news.spamcop.net>

System Maintenance Window, Tuesday Feb 21, 2006, 5PM PST -0800

There will be a maintenance window today, Feb 21 starting at 5PM PST. It
should last for approximately an hour. This affects the reporting system
only. The email system will continue to operate as usual. After the
completetion of the maintenance you may notice some delays as the system
works through the backlog. Thank you for your patience.

-- 

Ellen
SpamCop

Pls propagate to the forums.


From jeffg at spamcop.net  Tue Feb 21 19:01:22 2006
From: jeffg at spamcop.net (Jeff G.)
Date: Tue Feb 21 19:15:03 2006
Subject: [SC-Help] Re: System maintenance window, Feb 21, 2006
References: <dtfvkp$jdi$1@news.spamcop.net>
Message-ID: <dtga7a$s8s$1@news.spamcop.net>

"Ellen" <nobody@spamcop.net> wrote in message
news:dtfvkp$jdi$1@news.spamcop.net...
> System Maintenance Window, Tuesday Feb 21, 2006, 5PM PST -0800

In other terms, that's Tuesday Feb 21, 2006, 17:00 PST -0800 or Tuesday
Feb 21, 2006, 20:00 EST -0500 or Wednesday Feb 22, 2006, 01:00
UTC -0000.

> Pls propagate to the forums.

Done.

From redford_stone at INVERSE_OF_COLDmail.com  Thu Feb 23 08:38:20 2006
From: redford_stone at INVERSE_OF_COLDmail.com (Redstone)
Date: Thu Feb 23 03:40:02 2006
Subject: [SC-Help] Re: CNC-NOC.NET
References: <dsp9mt$b3j$1@news.spamcop.net> <dspohd$is4$1@news.spamcop.net>
	<dsr4rv$fof$1@news.spamcop.net> <dsrkm6$ph7$1@news.spamcop.net>
Message-ID: <Xns9773683A7B53tinlc@216.154.195.61>

die spammer <diespammer@spamthis.net> wrote in news:dsrkm6$ph7$1
@news.spamcop.net:

> 
> yep, seems I report 10 spams and get 10 back. I'm wondering if they are 
> testing me or testing some spam software or..... ?
> 
> Why can't someone from al quieda just bomb those servers ? whoosh.... 
> dink dink dink.......  BOOOOM
> 
> 


Because they both have a common enemy.. The US and all of Europe.

Treat them as the blackhat they are.

From redford_stone at INVERSE_OF_COLDmail.com  Thu Feb 23 09:19:23 2006
From: redford_stone at INVERSE_OF_COLDmail.com (Redstone)
Date: Thu Feb 23 04:20:02 2006
Subject: [SC-Help] Re: Test
References: <osv7s1tpd3nqemaqq2n47671229h1j4rmi@4ax.com>
	<dq1fdn$net$1@news.spamcop.net> <dq1i33$pm1$1@news.spamcop.net>
Message-ID: <Xns9773D79C11DDtinlc@216.154.195.61>

"Miss Betsy" <nobody@devnull.spamcop.net> wrote in news:dq1i33$pm1$1
@news.spamcop.net:


>>
>> At least this time I'm not in my underw*looks*, whew!
>>
>> :)
> 
> If I disregard, will I be in my 'underw*looks*'?
> 
> Miss Betsy
> 
> 


Knickers. :-)

 

From abuse at whathostingshould.be  Fri Feb 24 00:16:24 2006
From: abuse at whathostingshould.be (Galen)
Date: Fri Feb 24 00:20:03 2006
Subject: [SC-Help] 
	I'm a bit at a loss here... (9 Million questions - or less)
Message-ID: <dtm4r4$4cp$1@news.spamcop.net>

I own, along with a few other people, a recently started webhosting company. 
We have a rather strict anti-spam rule (one which basically means that if we 
get a report from you guys and it's at all proven to be correct they're out 
on their arses) but, at the same time, have a bit of a problem with privacy 
meaning we'll accept munged reports for instance and don't reveal any 
information about our users without a court order and, if they want us to 
and will pay for it, we'll even fight that for them.

Anyhow, to make a short story long...

I found the ISP section for SpamCop, signed up, configured it for hourly 
reports, and set it to the abuse@ email address. So far so good.

I want to test this. I want to see an example. I've been using SpamCop for 
ages, mostly to report UseNet spam lately, thanks for adding that. I've 
never seen the other end of things and, well, in order for things to run 
smoothly it would be good to know what we need to do, how we need to do it, 
etc...

Is there some sort of method of filing a null-valued report so that I can 
process it and see how it's done? Helpdesk doesn't fall directly in my lap 
but administration (and thus dealing with abuse reports) falls directly into 
my hands and I am accountable for such and want to ensure that I do my job 
properly. The last thing I want to see online is someone saying that the 
company who's administration/security I'm in charge of is being listed as 
blacklisted or, worse, a spam-friendly site. Well no, that's not the last 
thing I want to see but it's pretty close. I'm pretty sure the last thing I 
want to see would be, oh, something that belonged inside of me laying on the 
floor.

We use pretty robust cPanel/Fantastico/WHM software on Linux (RedHat) with 
all the various email scripts built right in with IMAP/POP3 support. (I 
think they support push now too actually.) Anyhow, If we wanted to offer the 
end-users (clients really) a choice to use the BL from SC at the server 
level... Well... How much am I looking at spending and I don't suppose 
SpamAssassin already hooks up with you? A search for information on such 
things didn't turn up a great deal really.

I guess I have techs and consulting available pretty much for free now that 
I think about it and I can likely script something if needed with the help 
of other people. (I'm one of the Microsoft MVPs and while they're generally 
Micro-centric they often tend to know a bit about other OSes as well and I 
have a background in Unix so *should* be able to figure it out if there's an 
API I can follow but no amount of searching for one for SpamAssassin has 
been forthcoming either.) So, well, if it's just a simple matter of the BL 
being a downloadable file on a regularly scheduled setting (and you don't 
mind the traffic) I could probably set it up as a CRON job to import it and 
then simply set it as an option for end-users to protect their inboxes with.

We, the site, have a goal and that is to be what hosting should be. That 
means, frankly, that we won't allow spam and do regular security checks as 
well as checking sites for malware content that could be spewing mass 
amounts of email into the 'net. To cooperate with the people who fight 
SPAM/UCE is not something we do because of any pressure or anything but it's 
something we do because it's required by our own morality. To be frank, I'm 
sick of bloated messages that I didn't ask for clogging up my own networks. 
I get, I suspect, about 5000 legitimate emails a day. (Yes, I signed up for 
everything over the years and that doesn't count newsgroups.) When there's 
an added 2.5 to 3k UCE/SPAM emails in the bunch it's really a problem. On a 
good day maybe about 75% of email traffic here is legitimate... Most days 
aren't good days. The people who host with our company will NOT be allowed 
to contribute to that mess. Rather than wait until it's a problem we'd like 
to start now and do it properly/effectively.

That's about enough of that other than one last question. Are there any 
other vendors here who might have some sort of form mail that they'd be 
interested in at least letting me look at? When/if we get a complaint then 
it *should* follow a standard procedure with the email ports being closed 
for that domain for 24 hours for investigation and then the subject (if 
proven to be a case where the client is the offender) site(s) being disabled 
or email ports being re-opened and the reporting agency being notified of 
our findings. I'll happily modify something if you have some sort of form 
you'd be willing to let me look at.

Anyhow, this is my first post to this newsgroup...

Hah! Wait, no... One last question...

Is anyone dumb enough to actually come in and SPAM this newsgroup? I hate to 
say it but there would be some humor in that, not from the act but from the 
uproar that it'd likely cause and the immediate call-to-action by the people 
who seem to frequent here. (Yes, I read a bunch prior to posting - such is 
the only way one should operate in NGs in my opinion.)

So, thanks... Thanks a whole lot. For the year's of service and for 
hopefully getting this figured out.

Galen
-- 
http://www.whathostingshould.be - We are what hosting SHOULD be. 


From MikeE at ster.invalid  Fri Feb 24 06:23:53 2006
From: MikeE at ster.invalid (Mike Easter)
Date: Fri Feb 24 09:25:02 2006
Subject: [SC-Help] 
	Re: I'm a bit at a loss here... (9 Million questions - or less)
References: <dtm4r4$4cp$1@news.spamcop.net>
Message-ID: <dtn4tl$m3e$1@news.spamcop.net>

Galen wrote:

> a recently started webhosting
> company.

> I found the ISP section for SpamCop, signed up, configured it for
> hourly reports, and set it to the abuse@ email address. So far so
> good.

I'm not clear on what you configured to receive.  You configured to
receive reports about 'something' at some abuse@ address -- but I'm not
sure you will get reports, based on the below.

The way SC determines how to notify for a spam is to derive the
spamsource IP and find its regional internet provider listed contact, ie
arin, ripe, afrinic, lacnic, krnic, jpnic, whatever.  The domainname of
the contact might be used to obtain the abuse.net reg'd contact.

More importantly, for your purposes, for the spamvertiser, SC resolves
the IP of the spamvertised site, uses the RIR to determine a contact.
SC does not make notifies based simply on some domainname.

For example and for purposes of illustration, if SC were going to notify
as if the body of your message contained a spamvertiser, it would derive
this:

Parsing input: http://www.whathostingshould.be
Host www.whathostingshould.be (checking ip) = 69.16.211.62
host 69.16.211.62 (getting name) = creston.dailydns.com.
Routing details for 69.16.211.62
[refresh/show] Cached whois for 69.16.211.62 : abuse@liquidweb.com
Using abuse net on abuse@liquidweb.com
abuse net liquidweb.com = abuse@liquidweb.com
Using best contacts abuse@liquidweb.com

That liquidweb notify is based on the arin lookup for the IP block

whois -h whois.arin.net 69.16.211.62 ...
OrgName:    Liquid Web
NetRange:   69.16.192.0 - 69.16.223.255
OrgAbuseEmail:  abuse@liquidweb.com

> Is there some sort of method of filing a null-valued report so that I
> can process it and see how it's done?

I forge spams all the time and submit them to the parser and then cancel
the report.  That doesn't cause a report to get mailed, but it
demonstrates how SC would notify.  What are you trying to get notified
about?

The spamvertiser notify doesn't carry any penalty, just a notify to the
provider as described.  The spamsource counts toward the SCbl.

> Is anyone dumb enough to actually come in and SPAM this newsgroup?

Sure.  Tracking newsgroup spam is exceedingly difficult and more often
than not impossible.  A spamvertiser can be bulletproof, so if there is
an untraceable news spam which is spamvertising a bulletproof site,
nothing will happen.


-- 
Mike Easter
kibitzer, not SC admin

From MikeE at ster.invalid  Fri Feb 24 06:38:25 2006
From: MikeE at ster.invalid (Mike Easter)
Date: Fri Feb 24 09:40:03 2006
Subject: [SC-Help] 
	Re: I'm a bit at a loss here... (9 Million questions - or less)
References: <dtm4r4$4cp$1@news.spamcop.net> <dtn4tl$m3e$1@news.spamcop.net>
Message-ID: <dtn5os$mnt$1@news.spamcop.net>

Mike Easter wrote:
> Galen wrote:
>
>> a recently started webhosting
>> company.
>
>> I found the ISP section for SpamCop, signed up, configured it for
>> hourly reports, and set it to the abuse@ email address.

> More importantly, for your purposes, for the spamvertiser, SC resolves
> the IP of the spamvertised site, uses the RIR to determine a contact.
> SC does not make notifies based simply on some domainname.
>
> For example and for purposes of illustration, if SC were going to
> notify as if the body of your message contained a spamvertiser, it
> would derive this:
>
> Parsing input: http://www.whathostingshould.be
> Host www.whathostingshould.be (checking ip) = 69.16.211.62
> host 69.16.211.62 (getting name) = creston.dailydns.com.
> Routing details for 69.16.211.62
> [refresh/show] Cached whois for 69.16.211.62 : abuse@liquidweb.com

In addition to that, there are about 92 other domainnames occupying
69.16.211.62 rDNS creston.dailydns.com

If any of them were spamvertised, the notify would go to liquidweb.  My
source of information about that isn't necessarily accurate or uptodate,
for example that source doesn't show whathostingshould.be at this time

As I check on the registration for whathostingshould.be - I see that it
has recently changed.  It was reg'd Jan 9, but it was updated Feb 12 and
your name, address, & gmail appear, along with your G3 organization.  So
I'm thinking that maybe the IP for the site changed or something which
causes my lookup for all of the sites at 69.16.211.62 to not be
completely accurate.

-- 
Mike Easter
kibitzer, not SC admin

From abuse at whathostingshould.be  Fri Feb 24 10:16:38 2006
From: abuse at whathostingshould.be (Galen)
Date: Fri Feb 24 10:20:02 2006
Subject: [SC-Help] 
	Re: I'm a bit at a loss here... (9 Million questions - or less)
References: <dtm4r4$4cp$1@news.spamcop.net> <dtn4tl$m3e$1@news.spamcop.net>
	<dtn5os$mnt$1@news.spamcop.net>
Message-ID: <dtn80f$obc$1@news.spamcop.net>

In news:dtn5os$mnt$1@news.spamcop.net,
Mike Easter had this to say:

>>> a recently started webhosting
>>> company.
>>
>>> I found the ISP section for SpamCop, signed up, configured it for
>>> hourly reports, and set it to the abuse@ email address.
>
>> More importantly, for your purposes, for the spamvertiser, SC
>> resolves the IP of the spamvertised site, uses the RIR to determine
>> a contact. SC does not make notifies based simply on some domainname.
>>
>> For example and for purposes of illustration, if SC were going to
>> notify as if the body of your message contained a spamvertiser, it
>> would derive this:
>>
>> Parsing input: http://www.whathostingshould.be
>> Host www.whathostingshould.be (checking ip) = 69.16.211.62
>> host 69.16.211.62 (getting name) = creston.dailydns.com.
>> Routing details for 69.16.211.62
>> [refresh/show] Cached whois for 69.16.211.62 : abuse@liquidweb.com
>
> In addition to that, there are about 92 other domainnames occupying
> 69.16.211.62 rDNS creston.dailydns.com
>
> If any of them were spamvertised, the notify would go to liquidweb.
> My source of information about that isn't necessarily accurate or
> uptodate, for example that source doesn't show whathostingshould.be
> at this time
>
> As I check on the registration for whathostingshould.be - I see that
> it has recently changed.  It was reg'd Jan 9, but it was updated Feb
> 12 and your name, address, & gmail appear, along with your G3
> organization.  So I'm thinking that maybe the IP for the site changed
> or something which causes my lookup for all of the sites at
> 69.16.211.62 to not be completely accurate.

I based it on the IP address and the source of the nameservers should be 
altered to reflect the kgiii.info information and *ideally* the abuse 
reports would go to me rather than my providers or, at least, to our abuse 
address in the form or hourly reports. (Or at least that's how it seems to 
work and that's what the FAQs said to do unless I missed something.) When 
that option came up then I'd be the "third party interested..." tick box I 
assume as my server space is only leased and on leased IP addresses, etc...

So, I can't think of any way to test it. And yeah, that information's 
correct.

Galen
-- 
http://www.whathostingshould.be - We are what hosting SHOULD be. 


From MikeE at ster.invalid  Fri Feb 24 08:01:48 2006
From: MikeE at ster.invalid (Mike Easter)
Date: Fri Feb 24 11:05:02 2006
Subject: [SC-Help] 
	Re: I'm a bit at a loss here... (9 Million questions - or less)
References: <dtm4r4$4cp$1@news.spamcop.net> <dtn4tl$m3e$1@news.spamcop.net>
	<dtn5os$mnt$1@news.spamcop.net> <dtn80f$obc$1@news.spamcop.net>
Message-ID: <dtnal7$pse$1@news.spamcop.net>

Let me artificially create a dialogue here to clarify something.

Mike Easter wrote:
> Galen wrote:
>
>> a recently started webhosting
>> company.
>
>> I found the ISP section for SpamCop, signed up, configured it for
>> hourly reports, and set it to the abuse@ email address. So far so
>> good.
>
> I'm not clear on what you configured to receive.  You configured to
> receive reports about 'something' at some abuse@ address -- but I'm
> not sure you will get reports, based on the below.


Galen wrote:
> I based it on the IP address and the source of the nameservers should
> be altered to reflect the kgiii.info information and *ideally* the
> abuse reports would go to me rather than my providers or, at least,
> to our abuse address in the form or hourly reports. (Or at least
> that's how it seems to work and that's what the FAQs said to do
> unless I missed something.) When that option came up then I'd be the
> "third party interested..." tick box I assume as my server space is
> only leased and on leased IP addresses, etc...
>
> So, I can't think of any way to test it. And yeah, that information's
> correct.

The 'testing' part may be less important than the 'predictable' part.  I
think /maybe/ you are trying to get reports about a particular IP
address 69.16.211.62.  If you can demonstrate to SC admin that you are
entitled to get reports about something, let's say kgii.info, then I
think you will be able to get reports based on such as this:

dns kgiii.info
Mail for kgiii.info is handled by kgiii.info
Canonical name: kgiii.info
Addresses:
  69.16.211.62

but it is actually easier to show your 3rd party interest in all reports
about 69.16.211.62 based on its association with whathostingshould.be
than kgii, because I can see whathosting is you, whereas it looks like
kgii is someone else.

So, does that mean that you wanted all reports about 69.16.211.62  to go
to the abuse <at> kgii.info?  Or something else?  Actually it isn't
important to /me/ what the notify address should be, I'm just guessing
at how you should set it up regarding how or what you are expecting to
be notified about.  Maybe a deputy will jump in here or you can clarify
things.  SC does not notify by domain names, but by IP or by IP block.


-- 
Mike Easter
kibitzer, not SC admin

From abuse at whathostingshould.be  Sun Feb 26 03:02:57 2006
From: abuse at whathostingshould.be (Galen)
Date: Sun Feb 26 03:05:16 2006
Subject: [SC-Help] 
	Re: I'm a bit at a loss here... (9 Million questions - or less)
References: <dtm4r4$4cp$1@news.spamcop.net> <dtn4tl$m3e$1@news.spamcop.net>
	<dtn5os$mnt$1@news.spamcop.net> <dtn80f$obc$1@news.spamcop.net>
	<dtnal7$pse$1@news.spamcop.net>
Message-ID: <dtrnb6$akd$1@news.spamcop.net>

In news:dtnal7$pse$1@news.spamcop.net,
Mike Easter had this to say:

 My reply is at the bottom of your sent message:

> Let me artificially create a dialogue here to clarify something.
>
> Mike Easter wrote:
>> Galen wrote:
>>
>>> a recently started webhosting
>>> company.
>>
>>> I found the ISP section for SpamCop, signed up, configured it for
>>> hourly reports, and set it to the abuse@ email address. So far so
>>> good.
>>
>> I'm not clear on what you configured to receive.  You configured to
>> receive reports about 'something' at some abuse@ address -- but I'm
>> not sure you will get reports, based on the below.
>
>
> Galen wrote:
>> I based it on the IP address and the source of the nameservers should
>> be altered to reflect the kgiii.info information and *ideally* the
>> abuse reports would go to me rather than my providers or, at least,
>> to our abuse address in the form or hourly reports. (Or at least
>> that's how it seems to work and that's what the FAQs said to do
>> unless I missed something.) When that option came up then I'd be the
>> "third party interested..." tick box I assume as my server space is
>> only leased and on leased IP addresses, etc...
>>
>> So, I can't think of any way to test it. And yeah, that information's
>> correct.
>
> The 'testing' part may be less important than the 'predictable' part.
> I think /maybe/ you are trying to get reports about a particular IP
> address 69.16.211.62.  If you can demonstrate to SC admin that you are
> entitled to get reports about something, let's say kgii.info, then I
> think you will be able to get reports based on such as this:
>
> dns kgiii.info
> Mail for kgiii.info is handled by kgiii.info
> Canonical name: kgiii.info
> Addresses:
>  69.16.211.62
>
> but it is actually easier to show your 3rd party interest in all
> reports about 69.16.211.62 based on its association with
> whathostingshould.be than kgii, because I can see whathosting is you,
> whereas it looks like kgii is someone else.
>
> So, does that mean that you wanted all reports about 69.16.211.62  to
> go to the abuse <at> kgii.info?  Or something else?  Actually it isn't
> important to /me/ what the notify address should be, I'm just guessing
> at how you should set it up regarding how or what you are expecting to
> be notified about.  Maybe a deputy will jump in here or you can
> clarify things.  SC does not notify by domain names, but by IP or by
> IP block.

abuse <at> whathostingshould.be is where I'm hoping to get them to go. 
Anyhow, I *think* I'm just going to lease two more, slap up an certificate, 
and assign the other IP address solely to the email service. Then, 
hopefully, I'd have even greater control... Actually, assuming all goes 
well, I'll just re-route NS2.KGIII.INFO to the new IP address rather than 
messing with the email servers. As one will still be up, propagation 
shouldn't be hampered for existing or new clients. I'll keep plugging away 
at it at any rate. Thanks so far. <g>

Galen
-- 
http://www.whathostingshould.be - We are what hosting SHOULD be. 


From devnull at devnull.ntl.com  Sun Feb 26 14:12:56 2006
From: devnull at devnull.ntl.com (M)
Date: Sun Feb 26 09:15:07 2006
Subject: [SC-Help] Spamcop robot emails
Message-ID: <dtsd19$lfe$1@news.spamcop.net>

I keep getting the above (3 in 2 days) saying account configuration 
success, but I havent done anything to generate these emails, is somone 
else doing something to generate these or is there a bug/problem with the 
robot? 


From Kilgallen at SpamCop.net  Sun Feb 26 08:24:25 2006
From: Kilgallen at SpamCop.net (Larry Kilgallen)
Date: Sun Feb 26 09:25:03 2006
Subject: [SC-Help] Re: Spamcop robot emails
References: <dtsd19$lfe$1@news.spamcop.net>
Message-ID: <OasLCzg7tiuM@eisner.encompasserve.org>

In article <dtsd19$lfe$1@news.spamcop.net>, "M" <devnull@devnull.ntl.com> writes:

> I keep getting the above (3 in 2 days) saying account configuration 
> success, but I havent done anything to generate these emails, is somone 
> else doing something to generate these or is there a bug/problem with the 
> robot? 

Have you run them through the SpamCop parser to validate that they
actually come from SpamCop ?
From MikeE at ster.invalid  Sun Feb 26 12:27:27 2006
From: MikeE at ster.invalid (Mike Easter)
Date: Sun Feb 26 15:30:03 2006
Subject: [SC-Help] Re: Embedded images in spam not parsing
References: <dtsuel$u5g$1@news.spamcop.net>
Message-ID: <dtt2v5$ut$1@news.spamcop.net>

Posted to .spam and .help, f/ups to .help

nighthawke wrote:
> Been getting spam that has no text in body, just a image.
> Ideas on how to deal with it?

That is a stock spam which has no links in the body anyway, even in the
graphic -- all that is reported or reportable is the spamsource, which
SC offers to do.


Posting a spam in spamcop.spam is no longer a good way to talk about it.
The proper way is to submit the spamitem to the parser and copy the
tracker and paste it into the message like this...

http://www.spamcop.net/sc?id=z886176374zc7aaf7af28290083688330b31690d8baz

Finding links in message body
Recurse multipart:
   Recurse multipart:
      Parsing text part
      Parsing HTML part
      No html links found, trying text parse
   Ignored image/gif part
no links found

Report Spam to:
Re: 83.19.92.210 (Administrator of network where email originates)
   To: abuse@tpnet.pl (Notes)
   To: abuse@telekomunikacja.pl (Notes)
   To: webmaster@telekomunikacja.pl (Notes)
   To: postmaster@telekomunikacja.pl (Notes)

<open proxy source, report cancelled>


... which is a tracker for your spamitem and demonstrates perfectly
exactly what the parser does with the item, and it also provides access
to the complete spam in the 'view entire message' section.  After
parsing, the report can be submitted or cancelled depending on whether
it has been reported or not.

When you put a spam into this newsgroup -- first of all it is the wrong
group to be discussing a spam.  .spam is not a discussion group, it is a
'junk' group which used to be used to post spam, since raw spam is not
allowed in the discussion groups spamcop or .help.

Second of all it bends or breaks the spam formatting.  So then if we
want to see what the result of the parser is on the spamitem, it has to
be reconfigured or formatted by hand -- which is tedious and
unnecessary.  It didn't use to be bent or broken until you put it into
your news message and then your newsreader started wrapping its lines
and ruining its header and body by spurious returns for the EOLs.  No
good.

Don't post spams in .spam.  Don't post spams in the discussion groups.
Don't discuss spam in .spam.  Discuss spam in the discussion groups and
give access to the spam with a tracker as above.


-- 
Mike Easter
kibitzer, not SC admin

From MikeE at ster.invalid  Sun Feb 26 13:39:24 2006
From: MikeE at ster.invalid (Mike Easter)
Date: Sun Feb 26 16:40:02 2006
Subject: [SC-Help] Re: No source IP address found, cannot proceed
References: <1t5402184f6tmkuqii3445qo5tf1hj29nt@4ax.com>
Message-ID: <dtt762$39s$1@news.spamcop.net>

Posted to spamcop.help & .spam;  f/ups to spamcop.help

Michael Fullerton wrote:
> I have been getting several "No source IP address found, cannot
> proceed" from spams today. Any ideas as to how this could happen?

Your mailserver isn't stamping the IP in the Received: traceline
properly.  No good.

> Does
> this mean my server is sending the spam or is this a disturbing new
> development?

It isn't the spam's fault, it is your server at kappa.asmallorange.com

> Here's an example header:

The best way to discuss this is to post a tracker for the spamitem into
a discussion group spamcop or spamcop.help and to not post anything in
spamcop.spam which is a 'junk' group, not discussion, which used to be
used to post only spams until the tracker became a better way.

http://www.spamcop.net/sc?id=z886211920z1c6de6ffa42ae6bf695366f7f9ea8a9fz


See my discussion about the posting in this other recent ng message:
news://news.spamcop.net/dtt2v5$ut$1@news.spamcop.net



-- 
Mike Easter
kibitzer, not SC admin

From devnull at devnull.ntl.com  Tue Feb 28 17:18:39 2006
From: devnull at devnull.ntl.com (M)
Date: Tue Feb 28 12:20:03 2006
Subject: [SC-Help] Re: Spamcop robot emails
References: <dtsd19$lfe$1@news.spamcop.net>
	<OasLCzg7tiuM@eisner.encompasserve.org>
Message-ID: <du20lf$sq5$1@news.spamcop.net>

>
> Have you run them through the SpamCop parser to validate that they
> actually come from SpamCop ?

Ran it through it would appear to be genuine
http://www.spamcop.net/sc?id=z887601356z848e84ed3075347378802e451623658cz

Just had another of these emails again this morning, there is not body to 
them, I suspect its related to the mailhosts, since I use a redirector host 
mine.nu I am wondering if anyone adds a new host to this I get one of these 
emails.

any thoughts? 


From borgholio at storymind.com  Tue Feb 28 09:48:24 2006
From: borgholio at storymind.com (Borgholio)
Date: Tue Feb 28 12:50:03 2006
Subject: [SC-Help] D'oh!  Whitelist problems....
Message-ID: <du22fk$tjp$1@news.spamcop.net>

I accidentally selected about 100 spam messages and clicked "Release and 
Whitelist" instead of "Report as Spam".  Any way to undo that, or am I stuck 
going through the entire whitelist, page by page, and deleting everything to 
start over fresh?