From jeffg at spamcop.net Wed Mar 1 23:48:44 2006 From: jeffg at spamcop.net (Jeff G.) Date: Wed Mar 1 23:50:04 2006 Subject: [SC-Help] Re: Sluggish response References: Message-ID: Jeff G. wrote: > Ejo wrote: >> Submitting spam via the web-form is very slow at the moment. > > http://forum.spamcop.net/forums/index.php?act=module&automodule=custom&page=stats > appears to show that the performance of the SpamCop Parsing and > Reporting Service went to hell in a handbasket around 21:40 EST -0500 > (02:40 UTC -0000), 54 minutes ago. Its administrators are probably > already aware of the issue. It's been over two hours now. This appears to be a bigger problem than normal. :( -- Best Regards, Jeff G. http://forum.spamcop.net/forums/index.php?act=findpost&pid=37585 From jbalazuc at free.fr Mon Mar 6 13:27:44 2006 From: jbalazuc at free.fr (=?ISO-8859-1?Q?Jo=EBl_Balazuc?=) Date: Mon Mar 6 06:28:20 2006 Subject: [SC-Help] Spam as pictures Message-ID: <440C1CB0.3070008@free.fr> Hello Mr Spamcop. The new process of pollution by spam consists to send pictures (JPG files). Forwarded to Spamcop as body in a spam report , this pictures are not analysed (ie OCRed) and the true spammer is not reported as an abuser. Any solution ? I apologize as a french speaking newbie. Joel -- Jo?l Balazuc PS : Ne jamais m'envoyer de courrier en copie cach?e : ? ma demande, il sera rebut? par mon fournisseur d'acc?s car consid?r? comme du spam. From chris.a.wright at gmail.com Mon Mar 6 17:11:37 2006 From: chris.a.wright at gmail.com (Chris Wright) Date: Mon Mar 6 12:15:04 2006 Subject: [SC-Help] Re: Spam as pictures In-Reply-To: References: Message-ID: Jo?l Balazuc wrote: > Hello Mr Spamcop. > The new process of pollution by spam consists to send pictures (JPG > files). Forwarded to Spamcop as body in a spam report , this pictures > are not analysed (ie OCRed) and the true spammer is not reported as an > abuser. Any solution ? > I apologize as a french speaking newbie. > Joel > my 0.02p (Or Euro in your case) Maybe not the contents of the pictures are scanned, but 9/10, that is just the site being spamvertised. The real info is in the header information which is parsed by SPAMCOP and does go towards tracking and stats etc. If it lists a site in the image, you could always do a manual lookup and abuse address for that site to the reports. Regards Chris From ndlover2002 at sbcglobal.net Thu Mar 9 18:13:51 2006 From: ndlover2002 at sbcglobal.net (Jeff) Date: Thu Mar 9 18:15:03 2006 Subject: [SC-Help] Spamcop Error! Message-ID: I keep getting the following error when trying to submit a Spamcop Report: Cannot send mail:smtpOpen: connect to smtp server failed (Connection refused) Leave this page open and try 'reload' in a few minutes I tried several times to wait and click refresh but it does nothing! Spamcop needs to get their technical glitches fixed, this is getting really old! This Spam e-mail is important to report because it was a phishing Scam and it wanted my account details from Chase Bank. How are the Scammers supposed to get in trouble when Spamcop can't do their job? I'll just report it manually if you can't do your job, this is pathetic!! From Unknown.User at Invalid.Domain Thu Mar 9 18:45:08 2006 From: Unknown.User at Invalid.Domain (Jan M. Nelken) Date: Thu Mar 9 18:50:02 2006 Subject: [SC-Help] Can or cannot this link be resolved? Message-ID: Tracking URL is: http://www.spamcop.net/sc?id=z893785525z78007b39eb7150585dfb33e7dd17d2fbz Spamcop states that: Resolving link obfuscation http://comradecur.peruvian.org.horehoundberg.f17263.net#jamestownbuddhist Host comradecur.peruvian.org.horehoundberg.f17263.net (checking ip) IP not found ; comradecur.peruvian.org.horehoundberg.f17263.net discarded as fake. Tracking link: http://comradecur.peruvian.org.horehoundberg.f17263.net#jamestownbuddhist No recent reports, no history available Cannot resolve http://comradecur.peruvian.org.horehoundberg.f17263.net#jamestownbuddhist However - both IE and Mozilla/Firefox bring this page without problem. Does Mozilla knows something Spamcop does not? Jan M. Nelken From wb8tyw at qsl.network Fri Mar 10 11:04:43 2006 From: wb8tyw at qsl.network (John E. Malmberg) Date: Fri Mar 10 12:10:03 2006 Subject: [SC-Help] Assume miles for wireless router range. Message-ID: There is a posting on the webforum about "Spamcop after virus / spyware attack" where it appears that the cause was an insecure wireless router. Posters to the thread should be aware that with the right equipment on the attackers side, it may be possible to access such routers from miles away. From wb8tyw at qsl.network Fri Mar 10 13:35:06 2006 From: wb8tyw at qsl.network (John E. Malmberg) Date: Fri Mar 10 14:40:02 2006 Subject: [SC-Help] Re: Assume miles for wireless router range. References: Message-ID: In article , wb8tyw@qsl.network (John E. Malmberg) writes: > There is a posting on the webforum about "Spamcop after virus / spyware > attack" where it appears that the cause was an insecure wireless router. As another data point, if a hacker has access to an insecure wireless router, it may be possible that those hackers got full access to the hardrives of the connected systems. With that type of access, they can install malware that does not need to propagate by viruses, and as such is not detectable by any scanner that looks for patterns. They can also replace the scanner programs with spoofs, which from what I understand is one of the tricks that malware has been doing for years. So at this point, since spam is still being sent, it must be assumed that the computers have been taken over by unknown programs. The only reliable fix in this case is reload all files from known good media, which on modern PCs can require a trip to an authorized repair center, because if you did not make the full recovery CDs or DVDs before the infection, you no longer have any reliable way to restore the PC to a clean state. Only an authorized repair center has that information. There is no safe way for a non-technical user to recover any information off of infected hard drives. That needs to be done by someone with the technical expertise to sort out the files that can not contain an infection, and can be very time consuming and expensive. There are tools that can replicate documents that may have malware hidden in them with out replicating the malware. It also has to be assumed that who ever put the malware on the computer has access to any information that has ever been displayed or entered in that computer. This means that critical passwords, bank account numbers, PINs, TAX information may have been stolen, and the attacker may have access to the bank and credit/debit cards of the system owner or the easy ability to do identity theft. -John wb8tyw@qsl.network Personal Opinion Only From nobody at devnull.spamcop.net Fri Mar 10 16:14:57 2006 From: nobody at devnull.spamcop.net (POP) Date: Fri Mar 10 16:15:02 2006 Subject: [SC-Help] Re: Assume miles for wireless router range. References: Message-ID: "John E. Malmberg" wrote in message news:NN3aNusoprZD@eisner.encompasserve.org... > There is a posting on the webforum about "Spamcop after virus / > spyware > attack" where it appears that the cause was an insecure > wireless router. > > Posters to the thread should be aware that with the right > equipment on the > attackers side, it may be possible to access such routers from > miles away. Isn't any kind of access a 2 way street that requires handshakes? I don't see how it would be accomplished from "miles away" if you're talking about radiated energy to the wireless sytems. Or are you talking something different? Pop From diespammer at spamthis.net Fri Mar 10 19:43:17 2006 From: diespammer at spamthis.net (die spammer) Date: Fri Mar 10 22:45:02 2006 Subject: [SC-Help] Re: Spam as pictures In-Reply-To: References: Message-ID: yep, forward the spam to spamcop then get abuse email address when the report comes back. Dont "send" the report but use the abuse email address and manually forward the spam using the abuse email address... Chris Wright wrote: > Jo?l Balazuc wrote: > >> Hello Mr Spamcop. >> The new process of pollution by spam consists to send pictures (JPG >> files). Forwarded to Spamcop as body in a spam report , this >> pictures are not analysed (ie OCRed) and the true spammer is not >> reported as an abuser. Any solution ? >> I apologize as a french speaking newbie. >> Joel >> > > my 0.02p (Or Euro in your case) > > Maybe not the contents of the pictures are scanned, but 9/10, that is > just the site being spamvertised. > > The real info is in the header information which is parsed by SPAMCOP > and does go towards tracking and stats etc. > > If it lists a site in the image, you could always do a manual lookup and > abuse address for that site to the reports. > > Regards > > Chris From diespammer at spamthis.net Fri Mar 10 19:44:48 2006 From: diespammer at spamthis.net (die spammer) Date: Fri Mar 10 22:45:03 2006 Subject: [SC-Help] Re: Can or cannot this link be resolved? In-Reply-To: References: Message-ID: > Does Mozilla knows something Spamcop does not? Know not knows From Unknown.User at Invalid.Domain Sat Mar 11 03:40:49 2006 From: Unknown.User at Invalid.Domain (Jan M. Nelken) Date: Sat Mar 11 03:45:04 2006 Subject: [SC-Help] Re: Can or cannot this link be resolved? In-Reply-To: References: Message-ID: die spammer wrote: > >> Does Mozilla knows something Spamcop does not? > > > Know not knows Although technically correct - your message was totally useless - specially in context of my question. Your application to become my personal spelling checker is regretfully rejected. Jan M. Nelken From MikeE at ster.invalid Sat Mar 11 00:51:49 2006 From: MikeE at ster.invalid (Mike Easter) Date: Sat Mar 11 03:55:03 2006 Subject: [SC-Help] Re: Can or cannot this link be resolved? References: Message-ID: Jan M. Nelken wrote: >sc?id=z893785525z78007b39eb7150585dfb33e7dd17d2fbz > http://comradecur.peruvian.org.horehoundberg.f17263.net#jamestownbuddhist # is a reserved character with a specific function in url pathways comradecur.peruvian.org.horehoundberg.f17263.net does not currently resolve. The problem is that f17263.net has funky nameservice http://www.dnsreport.com/tools/dnsreport.ch?domain=f17263.net DNS Report for f17263.net Your NS records at the parent servers are: ns1.m2812.net. [218.62.100.60] [TTL=172800] [CN] [These were obtained from m.gtld-servers.net] ERROR: You have less than two nameservers. You are required to have at least 2 nameservers per RFC 1035 section 2.2 (RFC2182 section 5 recommends at least 3 nameservers). ERROR: One or more of the nameservers listed at the parent servers are not listed as NS records at your nameservers. The problem NS records are: ns1.m2812.net. None of your nameservers returned your NS records; they could be down or unreachable, or could all be lame nameservers -- Mike Easter kibitzer, not SC admin From jbalazuc at free.fr Sat Mar 11 11:22:18 2006 From: jbalazuc at free.fr (=?ISO-8859-1?Q?Jo=EBl_Balazuc?=) Date: Sat Mar 11 04:22:20 2006 Subject: [SC-Help] Re: Spam as pictures In-Reply-To: References: Message-ID: <441296CA.3080701@free.fr> Hello Forwarding myself the spam is a bad process because the "abuse", usually the same organization as the spamer, punishes the plaintiff and not the faulty. I suffered that with AOL (all my mails to AOL domain are now discarded) and now for this reason I use Spamcop. die spammer wrote: > yep, forward the spam to spamcop then get abuse email address when the > report comes back. Dont "send" the report but use the abuse email > address and manually forward the spam using the abuse email address... > > > > > > Chris Wright wrote: > >> Jo?l Balazuc wrote: >> >>> Hello Mr Spamcop. >> >>> The new process of pollution by spam consists to send pictures (JPG >>> files). Forwarded to Spamcop as body in a spam report , this >>> pictures are not analysed (ie OCRed) and the true spammer is not >>> reported as an abuser. Any solution ? >>> I apologize as a french speaking newbie. >>> Joel >>> >> >> my 0.02p (Or Euro in your case) >> >> Maybe not the contents of the pictures are scanned, but 9/10, that is >> just the site being spamvertised. >> >> The real info is in the header information which is parsed by SPAMCOP >> and does go towards tracking and stats etc. >> >> If it lists a site in the image, you could always do a manual lookup >> and abuse address for that site to the reports. >> >> Regards >> >> Chris > > _______________________________________________ > SpamCop-Help mailing list > SpamCop-Help@news.spamcop.net > http://news.spamcop.net/mailman/listinfo/spamcop-help > > -- Jo?l Balazuc PS : Ne jamais m'envoyer de courrier en copie cach?e : ? ma demande, il sera rebut? par mon fournisseur d'acc?s car consid?r? comme du spam. From nobody at devnull.spamcop.net Sat Mar 11 04:57:51 2006 From: nobody at devnull.spamcop.net (Glenn Daniels) Date: Sat Mar 11 05:00:36 2006 Subject: [SC-Help] Re: Can or cannot this link be resolved? References: Message-ID: "Jan M. Nelken" wrote in message > Tracking URL is: > > http://www.spamcop.net/sc?id=z893785525z78007b39eb7150585dfb33e7dd17d2fbz > > Spamcop states that: > > Resolving link obfuscation > http://comradecur.peruvian.org.horehoundberg.f17263.net#jamestownbuddhist > Host comradecur.peruvian.org.horehoundberg.f17263.net (checking ip) IP not > found ; comradecur.peruvian.org.horehoundberg.f17263.net discarded as fake. > Tracking link: > http://comradecur.peruvian.org.horehoundberg.f17263.net#jamestownbuddhist > No recent reports, no history available > Cannot resolve > http://comradecur.peruvian.org.horehoundberg.f17263.net#jamestownbuddhist > > However - both IE and Mozilla/Firefox bring this page without problem. > Does Mozilla knows something Spamcop does not? > Or was the SpamCop.net parser simply presciently knowing that website had lost its hosting ISP and is now not resolving? More likely the problem was a flakey or pokey nameserver as was set to respond too slowly to resolve for the parser. It is not unusual for spamvending sites to resolve slowly: Apparently this is a "spammy" maneuver to prevent automated SpamCop.net notifies. Does not seem to have helped in this case, however, as the domain appears not to be hosted at this time. While IE and Mozilla may wait with enduring patience for a URL to resolve, the robotic parser has a preset timeout window and quickly runs out of patience with a slowly responding nameserver. I can also fancy that SpamCop.net IPAs are knowable, and as such, may be firewall blocked from accessing spamvending servers. I perceive an issue of perspective: Things may look differently depending on when you are looking and where you may be looking from. I doubt the mentioned browsers are inherently more clever than the robotic parser, but the parser is by design not permitted to "hang" interminably for an unresponsive spammy nameserver. The parser sez, "call Phydeaux, I give up": The attitude is enlightened ignorance rather than outright stupidity. Drive on! -g From chris.a.wright at gmail.com Sat Mar 11 13:59:25 2006 From: chris.a.wright at gmail.com (Chris Wright) Date: Sat Mar 11 09:00:12 2006 Subject: [SC-Help] AOL Issue Message-ID: It was mentioned in another thread, but I have never been able to find any other mention of it. I've been a user of SPAMCOP for a few years now, and have no problems with reporting of SPAM etc. A good few months back I started getting failure messages back from AOL when I used accounts that I forward SPAM from to SPAMCOP. Something along the lines of "AOL is not able to process your email because it comes from a domain that reports SPAM". Was this ever discussed on SPAMCOP? Are you aware of any other ISP's/Organizations that do similar. As I have always considered AOL one level above amoeba, it wasn't a problem to me. I contacted the AOL users via GMAIL and forwarded them a copy of the returned mail headers. Showing them that they won't allow people who report SPAM to send them mail, let alone those that send SPAM in the first place. Most were offended enough to ditch AOL, or at least complain and for everyone person I get to quit AOL, the better I feel. Does anyone know their justification for doing this? Why would people I consider responsible, or part of the fight against SPAM be targeted by AOL ? I can't see their rationale behind it? (Maybe their abuse department is far too overstretched as is, but a simple filter to ditch/bin/redirect mail from SPAMCOP abuse would suffice?). As one AOL user pointed out to me, they still get a ton of SPAM so their policies can't be that effective. Just curious as to if this was discussed previously. Regards Chris ps. Hope this is the right group for this discussion. From MikeE at ster.invalid Sat Mar 11 06:41:58 2006 From: MikeE at ster.invalid (Mike Easter) Date: Sat Mar 11 09:45:04 2006 Subject: [SC-Help] Re: AOL Issue References: Message-ID: Chris Wright wrote: > A good few months back I started getting failure messages back from > AOL when I used accounts that I forward SPAM from to SPAMCOP. I'm not clear on what you are saying yet, but at first glance it might sound like you were doing something wrong, like reporting your own provider. You didn't define the scenario with sufficient detail and clarity that I am getting the picture yet. > Something along the lines of "AOL is not able to process your email > because it comes from a domain that reports SPAM". So far that story doesn't make any sense to me yet and I know of no such AOL error message. I'm going to put an example of an AOL mailbounce message below^3, obtained from the AOL postmaster faq information page http://postmaster.info.aol.com/selfhelp/index.html You are saying you have multiple mail accounts. You are saying some of those accounts are used to forward spam [not SPAM, see below^1] to spamcop for purposes of reporting The way spam reporting is supposed to work is that the reporter submits a spam to the parser, I recommend the webparser when you are learning and fine tuning your spam reporting. I also recommend that you understand the structure of mail headers. Altho' maybe an 'ordinary' mail recipient might have less need to understand headers, someone who is taking the role of being a spam reporter, which function causes IP addresses to become blocklisted, needs to have a better understanding -- because they have a higher level of responsibility for their actions. If someone is spam reporting with spamcop, and that reporting activity is causing their own provider's IP address to become spamcop blocklisted, then that listing of their own provider is going to have trouble with its mail failing. Problems with sending mail from listed servers can occur with any provider, AOL or otherwise. > Was this ever discussed on SPAMCOP? I haven't heard of any such thing and it also doesn't make any sense. > I contacted the AOL users via GMAIL and forwarded > them a copy of the returned mail headers. A copy of the returned mail headers? You are saying you gmailed your failed recipient a copy of /what/ headers? The headers of the AOL mail to you? The headers of the mail which was rejected? Both? Showing that 'whole enchilada' [but not here, see below^2] > ps. Hope this is the right group for this discussion. It sounds like a great topic for discussion here, but you are going to have to get a lot more 'windy' and descriptive of the situation and provide some exact information or 'evidence' rather than a description of something before I understand. ^1 SPAM is the Hormel meat product, and anti-spammers and Hormel both agree that spam is not SPAM and we won't use the terms interchangeably ^2 When an occasion arises in which 'ugly' mail needs to be displayed somewhere, which ugly means such things as complete mailheaders and bodies which might have attached complete mailheaders and bodies, it is not acceptable to post such items into the discussion groups like this spamcop.help or spamcop. Originally the newsgroup spamcop.spam was created for that purpose. Nowadays we do it differently and feed the entire mail with its contiguous headers and attachments into the webparser, copy the parser's tracking url, and paste the url into the discussion group such as this. The tracking url looks like http://www.spamcop.net/sc?id=z893785525z78007b39eb7150585dfb33e7dd17d2fbz ^3 If you are having problems sending email to America Online please choose the appropriate link below so we can further help you.-- I have the bounce error message I received in email- select one below -- I have the AOL specific error message (example RLY:B1) -- ^4 http://postmaster.info.aol.com/errors/index.html Error Messages RTR Blocks | HVU Blocks | DNS Blocks | RLY Blocks | ISP Blocks | HTM Blocks | FSV Blocks | IPT Blocks | GEN Blocks | SDI Blocks | DYN Blocks | CON Blocks -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Sat Mar 11 07:08:55 2006 From: MikeE at ster.invalid (Mike Easter) Date: Sat Mar 11 10:10:03 2006 Subject: [SC-Help] Re: AOL Issue References: Message-ID: Mike Easter wrote: > Chris Wright wrote: > >> A good few months back I started getting failure messages back from >> AOL when I used accounts that I forward SPAM from to SPAMCOP. >> Something along the lines of "AOL is not able to process your email >> because it comes from a domain that reports SPAM". > The way spam reporting is supposed to work is that the reporter > submits a spam to the parser, I recommend the webparser when you are > learning and fine tuning your spam reporting. I also recommend that > you understand the structure of mail headers. I was going to tell more about how spam reporting is supposed to work with the webparser. You put your spamitem with its complete headers into the webparser, not an email - I'm more familiar with how to do that with OE, but you are posting your message here with T'bird. Tbird instructions are here http://www.spamcop.net/fom-serve/cache/21.html How do I get my email program to reveal the full, unmodified email? : Netscape, Mozilla and Thunderbird Then the webparser determines the source of the email and who to notify about that and what are the spamvertiser/s and who to notify about that. It is important that if the parser should determine your own provider, that you not make such a report, but find out what is wrong, see http://www.spamcop.net/fom-serve/cache/13.html Why does SpamCop want to send a report to my own network administrator? This problem of reporting your own provider is even more of a problem if you start doing something more complicated like forwarding spam to spamcop for reporting. If you perform forwarding incorrectly, you will 'always' report your own provider, because spamcop analyzes for the source of the mail, and the source of the mail is you, your IP, your provider's IP. So, I don't recommend that reporters email submit to spamcop until they have a good understanding of mail headers and what part of the mail headers belong to their own provider and what part of the mail headers indicate the source IP. I'm currently working on a googleweb search of thunderbird with the specific phrase 'forward as attachment' because the link above doesn't address the issue satisfactorily for me. In any case, you shouldn't be using your mailagent 'improperly' to forward spam to spamcop's parser, especially if you 'forward' it improperly instead of 'forward as attachment'. If your spam reporting results in the provider's IP for your account/s becoming spamcop blocklisted, you are going to have mail failures and bounce messages which indicate the spamcop blocklisting. I am not aware of AOL using SC's blocklist or making a SCbl error message nor am I aware of AOL blocking mail from 'spam reporting domains' which concept nor term makes any sense whatsoever Why don't we start out by your putting a spam into the webparser? If you are a registered spamcop reporter you can login an use the parser at http://www.spamcop.net/ -- Mike Easter kibitzer, not SC admin From chris.a.wright at gmail.com Sat Mar 11 15:58:51 2006 From: chris.a.wright at gmail.com (Chris Wright) Date: Sat Mar 11 11:00:02 2006 Subject: [SC-Help] Re: AOL Issue In-Reply-To: References: Message-ID: Sorry Mike, I didn't explain it too well I guess. I'm an experienced SPAMCOP user/reporter, but I guess not that good at getting my message across on here :( I have many domains, email accounts etc etc. When I receive SPAM on any of them, it gets filtered out and held in a temp folder. I then report the SPAM via SPAMCOP as you would normally. (I use my abuse @ email box on yaps4u.net. I never or never have reported email coming from ANY of my domains. I also maintain a few honeypots which every now and then when I see a new SPAM attack, I'll submit those to SPAMCOP. (Perhaps my use of the word 'forward' rather than 'report' confused you. No problems at all with that part what so ever. Now a few months ago, I had emailed someone at AOL via my yaps4u.net domain. Just a normal email address, not an abuse address, but a personal email account. I was surprised to see that I got a return message from AOL saying that they would not accept ANY email from the mail server at YAPS4U.net as this email server was responsible for reporting SPAM to them. Someone else mentioned this problem in another thread (see Re: [SC-Help] Re: Spam as pictures) and that was the first I have heard of someone else mentioning it. I had previously searched the web to see if anyone else had had this problem, but with no luck. It has also been mentioned before on the DSHIELD forum but was a brief discussion as its off topic on there. As it was a few months ago, I don't have the AOL returned message to hand, but I will send off a few emails to AOL users in a moment and see if I am getting them back again. But I think they might have removed the message that they send out, but the AOL users are also reporting that they don't get my mails when I send via the YAPS4U.NET account. YAPS4U.NET was hosted on a shared server many years ago, and someone else on that same machine got the IP blacklisted on DSBL. That was a brief error and it has never appeared on any such blacklists either. The return message from AOL, redefined said 'they would not accept email from the mail server yaps4u.net as this server had been identified as responsible for reporting SPAM. I say again, reporting SPAM. The mail to the AOL user was nothing to do with SPAM, it was just a personal or business reply to them. I tried sending email from other accounts and there was no problem, it was only when I used the YAPS4U.NET domain which is the same mail server I use to report mail to SPAMCOP. I've sent a few mails to various AOL users to see what I get back, and if I get the same or similar message, I'll post it here. I'll also go back over my backups/archives and see if I can find the original return message. It did strike me as very strange at the time, and I did confirm that the message came from AOL, so it was a definite return message from their server. Regards Chris Mike Easter wrote: > Chris Wright wrote: > >> A good few months back I started getting failure messages back from >> AOL when I used accounts that I forward SPAM from to SPAMCOP. > > I'm not clear on what you are saying yet, but at first glance it might > sound like you were doing something wrong, like reporting your own > provider. > > You didn't define the scenario with sufficient detail and clarity that I > am getting the picture yet. > >> Something along the lines of "AOL is not able to process your email >> because it comes from a domain that reports SPAM". > > So far that story doesn't make any sense to me yet and I know of no such > AOL error message. I'm going to put an example of an AOL mailbounce > message below^3, obtained from the AOL postmaster faq information page > http://postmaster.info.aol.com/selfhelp/index.html > > You are saying you have multiple mail accounts. You are saying some of > those accounts are used to forward spam [not SPAM, see below^1] to > spamcop for purposes of reporting > > The way spam reporting is supposed to work is that the reporter submits > a spam to the parser, I recommend the webparser when you are learning > and fine tuning your spam reporting. I also recommend that you > understand the structure of mail headers. > > Altho' maybe an 'ordinary' mail recipient might have less need to > understand headers, someone who is taking the role of being a spam > reporter, which function causes IP addresses to become blocklisted, > needs to have a better understanding -- because they have a higher level > of responsibility for their actions. > > If someone is spam reporting with spamcop, and that reporting activity > is causing their own provider's IP address to become spamcop > blocklisted, then that listing of their own provider is going to have > trouble with its mail failing. Problems with sending mail from listed > servers can occur with any provider, AOL or otherwise. > >> Was this ever discussed on SPAMCOP? > > I haven't heard of any such thing and it also doesn't make any sense. > >> I contacted the AOL users via GMAIL and forwarded >> them a copy of the returned mail headers. > > A copy of the returned mail headers? You are saying you gmailed your > failed recipient a copy of /what/ headers? The headers of the AOL mail > to you? The headers of the mail which was rejected? Both? Showing > that 'whole enchilada' [but not here, see below^2] > >> ps. Hope this is the right group for this discussion. > > It sounds like a great topic for discussion here, but you are going to > have to get a lot more 'windy' and descriptive of the situation and > provide some exact information or 'evidence' rather than a description > of something before I understand. > > > ^1 SPAM is the Hormel meat product, and anti-spammers and Hormel both > agree that spam is not SPAM and we won't use the terms interchangeably > > ^2 When an occasion arises in which 'ugly' mail needs to be displayed > somewhere, which ugly means such things as complete mailheaders and > bodies which might have attached complete mailheaders and bodies, it is > not acceptable to post such items into the discussion groups like this > spamcop.help or spamcop. Originally the newsgroup spamcop.spam was > created for that purpose. Nowadays we do it differently and feed the > entire mail with its contiguous headers and attachments into the > webparser, copy the parser's tracking url, and paste the url into the > discussion group such as this. The tracking url looks like > http://www.spamcop.net/sc?id=z893785525z78007b39eb7150585dfb33e7dd17d2fbz > > ^3 If you are having problems sending email to America Online please > choose the appropriate link below so we can further help you.-- I have > the bounce error message I received in email- select one below -- I > have the AOL specific error message (example RLY:B1) -- specific example, on another different AOL postmaster page are about 60 > other examples^4 in 12 different classes> > > ^4 http://postmaster.info.aol.com/errors/index.html Error Messages RTR > Blocks | HVU Blocks | DNS Blocks | RLY Blocks | ISP Blocks | HTM Blocks > | FSV Blocks | IPT Blocks | GEN Blocks | SDI Blocks | DYN Blocks | CON > Blocks > > From chris.a.wright at gmail.com Sat Mar 11 16:28:27 2006 From: chris.a.wright at gmail.com (Chris Wright) Date: Sat Mar 11 11:30:02 2006 Subject: [SC-Help] Re: AOL Issue In-Reply-To: References: Message-ID: The message was along the lines of: : Connected to 64.12.138.152 but greeting failed. Remote host said: 554- (RTR:BL) http://postmaster.info.aol.com/errors/554rtrbl.html 554- AOL does not accept e-mail transactions from IP addresses which 554- send abuse reports to AOL 554 Connecting IP: 72.22.69.58 Any mail I send to AOL users now via my YAPS4U.NET domain, (72.22.69.58), just doesn't get delivered to the AOL users and I haven't seen a failure message like the one above for a while. And 72.22.69.58 hasn't appeared on any blacklists for years AFAIK. (It was on DSBL once, but was appealed and removed in hours more than days). And I know, its sounds incredulous, and unless I can find the original return receipts, it doesn't sound plausible/believable. Had I been aware of these NG's back then, I would have mentioned it. But, if the general belief is that no one has heard of it, then fair enough, it was just something that Joel Balazuc said in his message [Re: [SC-Help] Re: Spam as pictures] that got me thinking about it again. Regards Chris Mike Easter wrote: > Chris Wright wrote: > >> A good few months back I started getting failure messages back from >> AOL when I used accounts that I forward SPAM from to SPAMCOP. > > I'm not clear on what you are saying yet, but at first glance it might > sound like you were doing something wrong, like reporting your own > provider. > > You didn't define the scenario with sufficient detail and clarity that I > am getting the picture yet. > >> Something along the lines of "AOL is not able to process your email >> because it comes from a domain that reports SPAM". > > So far that story doesn't make any sense to me yet and I know of no such > AOL error message. I'm going to put an example of an AOL mailbounce > message below^3, obtained from the AOL postmaster faq information page > http://postmaster.info.aol.com/selfhelp/index.html > > You are saying you have multiple mail accounts. You are saying some of > those accounts are used to forward spam [not SPAM, see below^1] to > spamcop for purposes of reporting > > The way spam reporting is supposed to work is that the reporter submits > a spam to the parser, I recommend the webparser when you are learning > and fine tuning your spam reporting. I also recommend that you > understand the structure of mail headers. > > Altho' maybe an 'ordinary' mail recipient might have less need to > understand headers, someone who is taking the role of being a spam > reporter, which function causes IP addresses to become blocklisted, > needs to have a better understanding -- because they have a higher level > of responsibility for their actions. > > If someone is spam reporting with spamcop, and that reporting activity > is causing their own provider's IP address to become spamcop > blocklisted, then that listing of their own provider is going to have > trouble with its mail failing. Problems with sending mail from listed > servers can occur with any provider, AOL or otherwise. > >> Was this ever discussed on SPAMCOP? > > I haven't heard of any such thing and it also doesn't make any sense. > >> I contacted the AOL users via GMAIL and forwarded >> them a copy of the returned mail headers. > > A copy of the returned mail headers? You are saying you gmailed your > failed recipient a copy of /what/ headers? The headers of the AOL mail > to you? The headers of the mail which was rejected? Both? Showing > that 'whole enchilada' [but not here, see below^2] > >> ps. Hope this is the right group for this discussion. > > It sounds like a great topic for discussion here, but you are going to > have to get a lot more 'windy' and descriptive of the situation and > provide some exact information or 'evidence' rather than a description > of something before I understand. > > > ^1 SPAM is the Hormel meat product, and anti-spammers and Hormel both > agree that spam is not SPAM and we won't use the terms interchangeably > > ^2 When an occasion arises in which 'ugly' mail needs to be displayed > somewhere, which ugly means such things as complete mailheaders and > bodies which might have attached complete mailheaders and bodies, it is > not acceptable to post such items into the discussion groups like this > spamcop.help or spamcop. Originally the newsgroup spamcop.spam was > created for that purpose. Nowadays we do it differently and feed the > entire mail with its contiguous headers and attachments into the > webparser, copy the parser's tracking url, and paste the url into the > discussion group such as this. The tracking url looks like > http://www.spamcop.net/sc?id=z893785525z78007b39eb7150585dfb33e7dd17d2fbz > > ^3 If you are having problems sending email to America Online please > choose the appropriate link below so we can further help you.-- I have > the bounce error message I received in email- select one below -- I > have the AOL specific error message (example RLY:B1) -- specific example, on another different AOL postmaster page are about 60 > other examples^4 in 12 different classes> > > ^4 http://postmaster.info.aol.com/errors/index.html Error Messages RTR > Blocks | HVU Blocks | DNS Blocks | RLY Blocks | ISP Blocks | HTM Blocks > | FSV Blocks | IPT Blocks | GEN Blocks | SDI Blocks | DYN Blocks | CON > Blocks > > From MikeE at ster.invalid Sat Mar 11 14:19:21 2006 From: MikeE at ster.invalid (Mike Easter) Date: Sat Mar 11 17:20:02 2006 Subject: [SC-Help] Re: AOL Issue References: Message-ID: Chris Wright wrote: > Now a few months ago, I had emailed someone at AOL via my yaps4u.net > domain. Just a normal email address, not an abuse address, but a > personal email account. Yes. yaps4u.net belongs to you and its MX is mail.yaps4u.net which is 72.22.69.58 which is actually host373.ipowerweb.com which is actually not just an MX but also one of the many output servers in that family of ipowerweb.com servers, maybe hundreds of them. > I was surprised to see that I got a return message from AOL saying > that they would not accept ANY email from the mail server at > YAPS4U.net as this email server was responsible for reporting SPAM to > them. That doesn't make any sense and is not 'believable' or plausible or 'conceivable' on the face of it. > the AOL users are also > reporting that they don't get my mails when I send via the YAPS4U.NET > account. It is quite conceivable that a particular server's output wouldn't be AOL accepted, but not for that reason, reporting spam. > YAPS4U.NET was hosted on a shared server many years ago, and someone > else on that same machine got the IP blacklisted on DSBL. Getting listed happens. Getting listed for reporting spam doesn't happen. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Sat Mar 11 14:30:52 2006 From: MikeE at ster.invalid (Mike Easter) Date: Sat Mar 11 17:35:04 2006 Subject: [SC-Help] Re: AOL Issue References: Message-ID: Chris Wright wrote: > The message was along the lines of: > > : > Connected to 64.12.138.152 but greeting failed. > Remote host said: 554- (RTR:BL) > http://postmaster.info.aol.com/errors/554rtrbl.html > 554- AOL does not accept e-mail transactions from IP addresses which > 554- send abuse reports to AOL > 554 Connecting IP: 72.22.69.58 http://postmaster.info.aol.com/errors/554rtrbl.html Error 554 TR:BL -- EXPLANATION: - This error message indicates that a block has been placed against your IP address because we have received numerous complaints concerning mail coming from that IP address. - SOLUTION: - Please have your ISP or server administrator contact AOL for assistance. The mail administrator should request a feedback loop that will alert them to reported spam from their network. You can access the Feedback Loop request form here. http://postmaster.info.aol.com/tools/fbl.html Feedback Loop Request Form - AOL offers a feedback loop service, free of charge, to parties sending large amounts of mail to AOL members. The feedback loop (FBL) will forward any mail reported as spam originating from the associated IP addresses back to the listed email address. We highly recommend the use of a dedicated e-mail address for this purpose. The AOL member's email address will be stripped out of the header for security purposes; however, any other identifying information in the email will remain untouched. You can always check your existing feedback loops by entering your e-mail in the feedback loop check. > Any mail I send to AOL users now via my YAPS4U.NET domain, > (72.22.69.58), just doesn't get delivered to the AOL users and I > haven't seen a failure message like the one above for a while. > > And 72.22.69.58 hasn't appeared on any blacklists for years AFAIK. (It > was on DSBL once, but was appealed and removed in hours more than > days). AOL could have its own 'list' and the IP not be on other lists. -- Mike Easter kibitzer, not SC admin From chris.a.wright at gmail.com Sat Mar 11 23:39:12 2006 From: chris.a.wright at gmail.com (Chris Wright) Date: Sat Mar 11 18:40:03 2006 Subject: [SC-Help] Re: AOL Issue In-Reply-To: References: Message-ID: Mike Easter wrote: > Chris Wright wrote: >> The message was along the lines of: >> >> : >> Connected to 64.12.138.152 but greeting failed. >> Remote host said: 554- (RTR:BL) >> http://postmaster.info.aol.com/errors/554rtrbl.html >> 554- AOL does not accept e-mail transactions from IP addresses which >> 554- send abuse reports to AOL >> 554 Connecting IP: 72.22.69.58 > > http://postmaster.info.aol.com/errors/554rtrbl.html Error 554 > TR:BL -- EXPLANATION: - This error message indicates that a block has > been placed against your IP address because we have received numerous > complaints concerning mail coming from that IP address. - SOLUTION: - > Please have your ISP or server administrator contact AOL for assistance. > The mail administrator should request a feedback loop that will alert > them to reported spam from their network. You can access the Feedback > Loop request form here. > > http://postmaster.info.aol.com/tools/fbl.html Feedback Loop Request > Form - AOL offers a feedback loop service, free of charge, to parties > sending large amounts of mail to AOL members. The feedback loop (FBL) > will forward any mail reported as spam originating from the associated > IP addresses back to the listed email address. We highly recommend the > use of a dedicated e-mail address for this purpose. The AOL member's > email address will be stripped out of the header for security purposes; > however, any other identifying information in the email will remain > untouched. You can always check your existing feedback loops by entering > your e-mail in the feedback loop check. > >> Any mail I send to AOL users now via my YAPS4U.NET domain, >> (72.22.69.58), just doesn't get delivered to the AOL users and I >> haven't seen a failure message like the one above for a while. >> >> And 72.22.69.58 hasn't appeared on any blacklists for years AFAIK. (It >> was on DSBL once, but was appealed and removed in hours more than >> days). > > AOL could have its own 'list' and the IP not be on other lists. > > You have all but convinced me I was seeing things now :( I think it rather unbelievable at the time that they 'would do' such a thing. And quite a bit of searching didn't yield anything. I could have misread it for a similarly worded response, and in all honestly, that is what I probably did. It was only the mention in the other thread that got me thinking maybe I didn't. It can't have been for a high volume of mails, mostly there are personal ones with the accidental business one (my business domains are different, YAPS is my testing ground/personal rant server). Time to crawl back in my hole and I'll make sure next time I don't bin the receipt. I honestly believe you when you say it is unlikely, since I thought that at the time.. Thanks anyway, Chris From jbalazuc at free.fr Sun Mar 12 11:59:24 2006 From: jbalazuc at free.fr (=?ISO-8859-1?Q?Jo=EBl_Balazuc?=) Date: Sun Mar 12 04:59:58 2006 Subject: [SC-Help] Re: AOL Issue In-Reply-To: References: Message-ID: <4413F0FC.2030808@free.fr> Chris, You are not alone. Long time ago I reported spams to abuse at AOL. The punishment arrived quickly : I can no more send mail into AOL domain. Since I delegate reporting to Spamcop. JB Mike Easter wrote: >Chris Wright wrote: > > > >>A good few months back I started getting failure messages back from >>AOL when I used accounts that I forward SPAM from to SPAMCOP. >> >> > >I'm not clear on what you are saying yet, but at first glance it might >sound like you were doing something wrong, like reporting your own >provider. > >You didn't define the scenario with sufficient detail and clarity that I >am getting the picture yet. > > > -- Jo?l Balazuc PS : Ne jamais m'envoyer de courrier en copie cach?e : ? ma demande, il sera rebut? par mon fournisseur d'acc?s car consid?r? comme du spam. From MikeE at ster.invalid Sun Mar 12 02:03:30 2006 From: MikeE at ster.invalid (Mike Easter) Date: Sun Mar 12 05:05:12 2006 Subject: [SC-Help] Re: spamcop easy fooled twice References: Message-ID: Posted to spamcop.help & spamcop.spam; f/ups to spamcop.help Zbyszek wrote: > spamcop is easy fooled by malforming header. That bad line below is not the problem. > Received: from [97.151.64.18 ] (helo=..dearriba.com) > by smtp2.cistron.nl with esmtp ( 3.35 #1 ()) > id 786LFL-0006PT-93 that causes this: > Finding links in message body > Parsing text part > error: couldn't parse head > Message body parser requires full, accurate copy of message > More information on this error.. > no links found That problem is caused by improperly folded headerlines submitted to the parser. That line above is not the source line > Received: from 200-147-64-220.tlm.dialuol.com.br > (200-147-64-220.tlm.dialuol.com.br [200.147.64.220]) > by mx6.go2.pl (Postfix) with SMTP; > Sat, 11 Mar 2006 06:06:38 +0100 (CET) > Received: from [97.151.64.18 ] (helo=..dearriba.com) > by smtp2.cistron.nl with esmtp ( 3.35 #1 ()) > id 786LFL-0006PT-93 200.147.64.220 rDNS 200-147-64-220.tlm.dialuol.com.br is the source. It is a dynamic IP, not a server. The cistron.nl line with the 'malformed' IP is a bogus and noncompliant line. > Source of spam-2: In the 2nd spam the bad IP looks like it is in a bogus and noncompliant line, the source is 85.182.55.247 rDNS e182055247.adsl.alicedsl.de is listed in CBL and dynamic lists. > Received: from e182055247.adsl.alicedsl.de > (e182055247.adsl.alicedsl.de [85.182.55.247]) > by mx4.go2.pl (Postfix) with SMTP; > Sat, 11 Mar 2006 06:06:49 +0100 (CET) > Received: from .anu..au ([0.136.101.194 ] helo=anu..au) > by smtp1..co with esmtp > id 1A5Ys6-464135-41 Discussion moved to .help; .spam is not a discussion group If you want to talk about how spamcop parses a spam, you should post the tracker for the parse, not the spam in the spamcop.spam group. http://www.spamcop.net/sc?id=z895602741z91e2a5aa1f054524b341258fc3516f9cz Report Spam to: Re: 200.147.64.220 (Administrator of network where email originates) To: mail-abuse@cert.br (Notes) To: abuse@uol.com.br (Notes) To: denuncia#uol.com.br@devnull.spamcop.net (Notes) To: mail-abuse@nic.br (Notes) To: Internal spamcop handling: (spambr) (Notes) Re: http://freshandslim.info (Administrator of network hosting website referenced in spam) To: abuse@tucows.com (Notes) http://www.spamcop.net/sc?id=z895605060zaa4ea9ba10f0cb0863632dd6803d83e2z Report Spam to: Re: 85.182.55.247 (Administrator of network where email originates) To: postmaster@hansenet.com (Notes) To: hostmaster@hansenet.com (Notes) To: abuse@hansenet.com (Notes) Re: http://navigatorcapitalgroup.info (Administrator of network hosting website referenced in spam) To: abuse@tucows.com (Notes) Those are correct parses of the spams you posted. The problem you are describing does not apply. -- Mike Easter kibitzer, not SC admin From wb8tyw at qsl.network Mon Mar 13 10:47:28 2006 From: wb8tyw at qsl.network (John E. Malmberg) Date: Mon Mar 13 11:50:02 2006 Subject: [SC-Help] Re: Assume miles for wireless router range. References: Message-ID: In article , "POP" writes: > > "John E. Malmberg" wrote in message > news:NN3aNusoprZD@eisner.encompasserve.org... >> There is a posting on the webforum about "Spamcop after virus / >> spyware attack" where it appears that the cause was an insecure >> wireless router. >> >> Posters to the thread should be aware that with the right >> equipment on the attackers side, it may be possible to access >> such routers from miles away. > > Isn't any kind of access a 2 way street that requires handshakes? > I don't see how it would be accomplished from "miles away" if > you're talking about radiated energy to the wireless sytems. Or > are you talking something different? It can be done, and many Amateur Radio experimenters put in a lot of effort to determine how far they can go with weak signals. With a gain antenna and amplifiers on just one end, a great deal of range can be added. If you are concerned about access by a motivated person of an unencrypted WAP service, assume that they can easily do 1/4 mile with readily available and cheap equipment, and with spending a little cash they may be able to get at least a mile under ideal conditions. -John wb8tyw@qsl.network Personal Opinion Only From chris.a.wright at gmail.com Mon Mar 13 16:57:21 2006 From: chris.a.wright at gmail.com (Chris Wright) Date: Mon Mar 13 12:00:03 2006 Subject: [SC-Help] Re: Assume miles for wireless router range. In-Reply-To: References: Message-ID: John E. Malmberg wrote: > In article , > "POP" writes: >> "John E. Malmberg" wrote in message >> news:NN3aNusoprZD@eisner.encompasserve.org... >>> There is a posting on the webforum about "Spamcop after virus / >>> spyware attack" where it appears that the cause was an insecure >>> wireless router. >>> >>> Posters to the thread should be aware that with the right >>> equipment on the attackers side, it may be possible to access >>> such routers from miles away. >> Isn't any kind of access a 2 way street that requires handshakes? >> I don't see how it would be accomplished from "miles away" if >> you're talking about radiated energy to the wireless sytems. Or >> are you talking something different? > > It can be done, and many Amateur Radio experimenters put in a lot of effort to > determine how far they can go with weak signals. > > With a gain antenna and amplifiers on just one end, a great deal of range can > be added. > > If you are concerned about access by a motivated person of an unencrypted WAP > service, assume that they can easily do 1/4 mile with readily available > and cheap equipment, and with spending a little cash they may be able to get > at least a mile under ideal conditions. > > -John > wb8tyw@qsl.network > Personal Opinion Only This reminded me of an article I read many moons ago about Bluetooth. (http://www.tomsnetworking.com/2005/03/08/how_to/) Regards Chris From / at /.cn Wed Mar 15 20:29:21 2006 From: / at /.cn (Petzl) Date: Wed Mar 15 04:30:03 2006 Subject: [SC-Help] Re: Assume miles for wireless router range. References: Message-ID: "John E. Malmberg" wrote in message news:Ooj0p6q1Zzpm@eisner.encompasserve.org... > In article , > "POP" writes: >> > With a gain antenna and amplifiers on just one end, a great deal of range > can > be added. > > If you are concerned about access by a motivated person of an unencrypted > WAP > service, assume that they can easily do 1/4 mile with readily available > and cheap equipment, and with spending a little cash they may be able to > get > at least a mile under ideal conditions. > Once detection is made a van can come to "you" With an IP address can often zero in on the suburb http://www.geobytes.com/IpLocator.htm Once malware/spyware has been installed it means thugs can often find amongst everything else the postal address of the computer and the hardware used Thugs will know when you are not home and when you are Check you computer security at this Symantec site http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym If they find something they will push there own products of course My Signature in SC forum has freeware programs that should offer top security http://forum.spamcop.net/forums/index.php?showtopic=6089 Petzl From MikeE at ster.invalid Fri Mar 17 12:55:35 2006 From: MikeE at ster.invalid (Mike Easter) Date: Fri Mar 17 16:00:03 2006 Subject: [SC-Help] Re: Citibank phishing fools spamcop References: Message-ID: Read in .spam, discussing in .help, posting to .spam & .help, f/ups in .help Eric wrote: > The phishing link in the body of this email is not being parsed > properly and not being reported. > > http://citibusinessonline.da-us.c1tlbank.com/cbusol/signon.do citibusinessonline.da-us.c1tlbank.com does not resolve for my resolver, for spamcop's resolver, or for dnsstuff's nor the gtld resolvers. I think it's dead, Jim [Bones (Dr. Leonard) McCoy on the original Star Trek] > Also, when I submit the report, firefox brings me to a page in source > code instead of html, and a report sent to emailspoof@citigroup.com > goes to dev-null. Why is that? I don't know about your source code page view in FF, but the reason for devnulling the spoof addy is this: Parsing input: citigroup.com Host citigroup.com (checking ip) = 192.193.217.120 host 192.193.217.120 = citibank.com (cached) Routing details for 192.193.217.120 Report routing for 192.193.217.120: pwong@mail.citicorp.com pwong@mail.citicorp.com redirects to emailspoof@citigroup.com emailspoof@citigroup.com bounces (6 sent : 6 bounces) If a redirect addy bounces, then SC is going to devnull it. > http://www.spamcop.net/sc?id=z899512392z27f4f1df34c194a7a021036571ca6ee7z If you post the tracker only, which is all you need to do, since it provides access to the original spam in a better condition than the spam you post into .spam, there is no need to post anything to .spam. .spam is only for posting 'junk' such as complete spams, not for discussing. No complete spams are allowed in the discussion groups -- but of course trackers are. So there is no need to use the group .spam at all if you post a tracker. -- Mike Easter kibitzer, not SC admin From ndlover2002 at sbcglobal.net Fri Mar 17 18:48:26 2006 From: ndlover2002 at sbcglobal.net (Jeff) Date: Fri Mar 17 18:50:02 2006 Subject: [SC-Help] What's wrong now, Spamcop? Message-ID: I'm getting fedup with your technical glitches, they just keep being a problem! Now I have submitted spam two different times and I am NOT getting the Spamcop reports back at all!! They still have not arrived as of this evening either. How am I supposed to report Spam if your spamcop reports do not arrive?? I want this fixed ASAP, Spamcop. Someone isn't doing their job there, its rather obvious because the technical glitches keep getting worse and worse. -Jeff From bar_n0ne at hotmail.com Fri Mar 17 17:58:13 2006 From: bar_n0ne at hotmail.com (Berny) Date: Fri Mar 17 19:00:03 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: Message-ID: "Jeff" wrote in message news:dvfhs8$l8$1@news.spamcop.net... > I'm getting fedup with your technical glitches, they just keep being a > problem! Now I have submitted spam two different times and I am NOT getting > the Spamcop reports back at all!! They still have not arrived as of this > evening either. How am I supposed to report Spam if your spamcop reports do > not arrive?? > > I want this fixed ASAP, Spamcop. Someone isn't doing their job there, its > rather obvious because the technical glitches keep getting worse and worse. > > -Jeff > > Have you gone to the sc website to see if there are pending reports? I haven;t had any troubles or delays lately at all. Perhaps your ISP may be filtering outbound mail that looks spammy, most submissions qualify, and a number of people have had to find ways around their ISP to send reports in. Or perhaps your ISP is rejecting SpamCops acknowledgement mails to you as spam, Start by letting the users here know the name of your ISP. From MikeE at ster.invalid Fri Mar 17 16:09:44 2006 From: MikeE at ster.invalid (Mike Easter) Date: Fri Mar 17 19:10:02 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: Message-ID: Jeff wrote: Date: Fri, 17 Mar 2006 18:48:26 -0500 NNTP-Posting-Date: Fri, 17 Mar 2006 23:48:24 +0000 (UTC) > I'm getting fedup with your technical glitches, they just keep being a > problem! Now I have submitted spam two different times and I am NOT > getting the Spamcop reports back at all!! Sometimes that problem is not on SC's end. > I want this fixed ASAP, Spamcop. Calm down, calm down. Maybe it is a SC problem, maybe it isn't. I'm sure everyone wants things to be working as they should be. Getting into a little tanty ranty doesn't help with the diagnosis. You posted at UTC time about midnight Fri. I've sent in two submissions by email recently, one at 12:45 pm my local time and one at 3:45 pm local. Those translate to 8 & 11:45 pm UTC and those have both been returned in a timely fashion. So that 'proves' or indicates to me that the receiving, parsing, and emailing back system is working perfectly well on SC's end and all the way to my end during that timeframe which surely applies to your time of concern; so there's no need for me to go look at any posted SC information anywhere. I hereby conclude, somewhat hastily, on the basis of my own information -- that your problem is on your end -- which includes the possibility that it is on spamcop's end's connection to you in terms of 'forgetting your address' or something like that. What is far more likely is that your provider or something is interfering with your transmissions to SC or something is interfering with SC's transmissions back to you. -- Mike Easter kibitzer, not SC admin From ndlover2002 at sbcglobal.net Fri Mar 17 22:07:17 2006 From: ndlover2002 at sbcglobal.net (Jeff) Date: Fri Mar 17 22:10:02 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: I also have not been getting the reports back from submitted spam. This started 3 days ago and I have sent 5 reports with no replys from the system. The emails are reaching SpamCop See that proves I'm NOT the only one, Mike Easter!! Why don't you stop denying it, Mike and do something besides SHIFT the blame onto me like you just did, what a useless idiot you are!! Its on Spamcop's end, not the users end, wakeup idiots and do something besides blame the users all the time!! My ISP has nothing to do with it, its worked all these other times and besides I use my hotmail address, not my ISP e-mail address to receive the reports at, duh! Pretty stupid aren't you, Mike Easter?? "Thomas Weyhrauch" <4rqhy8k02@sneakemail.com> wrote in message news:5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com... > On Fri, 17 Mar 2006 18:48:26 -0500, "Jeff" > wrote: > >>Now I have submitted spam two different times and I am NOT getting >>the Spamcop reports back at all!! >>-Jeff >> > > I also have not been getting the reports back from submitted spam. This > started > 3 days ago and I have sent 5 reports with no replys from the system. The > emails > are reaching SpamCop, and I am able to finish the reports by loging into > SpamCop > and reporting the unreported spam. My ISP is Charter HSI and I will be > contacting them about this problem. > > Tom From ndlover2002 at sbcglobal.net Fri Mar 17 22:11:35 2006 From: ndlover2002 at sbcglobal.net (Jeff) Date: Fri Mar 17 22:15:03 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: Message-ID: My ISP is SBC, even though it has nothing to do with the problem. Its Spamcop that is the problem. If other users are experiencing the same thing then its on their end, not ours!! "Berny" wrote in message news:dvfif4$ur$1@news.spamcop.net... > > "Jeff" wrote in message > news:dvfhs8$l8$1@news.spamcop.net... >> I'm getting fedup with your technical glitches, they just keep being a >> problem! Now I have submitted spam two different times and I am NOT > getting >> the Spamcop reports back at all!! They still have not arrived as of this >> evening either. How am I supposed to report Spam if your spamcop reports > do >> not arrive?? >> >> I want this fixed ASAP, Spamcop. Someone isn't doing their job there, >> its >> rather obvious because the technical glitches keep getting worse and > worse. >> >> -Jeff >> >> > > Have you gone to the sc website to see if there are pending reports? > > I haven;t had any troubles or delays lately at all. > > Perhaps your ISP may be filtering outbound mail that looks spammy, most > submissions qualify, and a number of people have had to find ways around > their ISP to send reports in. > > Or perhaps your ISP is rejecting SpamCops acknowledgement mails to you as > spam, > > Start by letting the users here know the name of your ISP. > > > From MikeE at ster.invalid Fri Mar 17 19:37:07 2006 From: MikeE at ster.invalid (Mike Easter) Date: Fri Mar 17 22:40:02 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: Jeff wrote: > I also have not been getting the reports back from submitted spam. You can check the address SC has for you in Preferences. If you are logged in, this page http://www.spamcop.net/ will give you access to a link in the upper part of the page called Preferences On that linked page, there are User preferences and the 2nd is Change Email address or name If you click on that, you will see the address that SC has for you in a little window you could change if that were your purpose, which it isn't. Another troubleshooting measure would be to copy your email submission to the submit addy to some secondary address of yours to look for any evidence of something happening on the outbound. When you top posted over Tom's post you failed to trim away those parts of his message to which you weren't replying so as to contextualize clarify those to which you were and weren't replying. As a result, you failed to address at all one of his important remarks: Thomas Weyhrauch wrote: > The emails are reaching SpamCop, and I am able to finish > the reports by loging into SpamCop and reporting the unreported spam. Since you didn't address his remark, such as "I tried that, and there are no reports there." - or - "You are correct, my reports are found by logging onto the webpage as unreported" - or - "I never thought of checking that, I'll go check the webpage right now." When you top-post, your communication doesn't indicate that you read and understood each element of the post to which you are replying. In fact, it generally indicates that you only read some small part of a message, then you hit reply and started ranting again. Top posting is a very poor way of communicating in newsgroups. You are currently communicating poorly. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Fri Mar 17 19:41:46 2006 From: MikeE at ster.invalid (Mike Easter) Date: Fri Mar 17 22:45:02 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: Message-ID: Jeff wrote: > If other users are experiencing the > same thing then its on their end, not ours!! Mike isn't experiencing the problem. Benny isn't experiencing the problem. Tom has a problem receiving his returns, but his email submissions are reaching spamcop's parsing system. You haven't done your troubleshooting homework yet. There are tons of spamcop users reading and posting to the forum and the newsgroups and there isn't a widespread clamor about a problem, which suggests that whatever this problem is, isn't widespread at all. -- Mike Easter kibitzer, not SC admin From vxpy7do02 at sneakemail.com Fri Mar 17 20:43:56 2006 From: vxpy7do02 at sneakemail.com (anon) Date: Fri Mar 17 23:45:02 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: "Mike Easter" wrote in message news:dvfv90$7rc$1@news.spamcop.net... > Jeff wrote: >> I also have not been getting the reports back from submitted spam. > ** I also have not been getting reports back since Mar 15 middle of the afternoon (PST.) Have even tried resubmitting the spam - still nothing back. Have resubmitted stale spam - still nothing back - usually I, at least, get the 'too old' message - nothing. -- A SpamCop user and forum reader, Not Admin *** From MikeE at ster.invalid Fri Mar 17 20:56:44 2006 From: MikeE at ster.invalid (Mike Easter) Date: Sat Mar 18 00:00:02 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: anon wrote: > I also have not been getting reports back since Mar 15 middle of the > afternoon (PST.) Did you try what Tom did and go to the webparser page and see if you had unreported spam? Did you check on your email address in preferences? Did you try sending yourself a copy of the Submit address spam? I'm still not seeing any reports of this in the forums, and I'm still getting my reports back, the most recent was sent 10 minutes ago. When you submit attached spams, they are going out your provider's server to the SC submit address, being received and parsed by that system, and then the reporting links [or quick reports] are being sent back to your address of record at SC. There are several places to break in that chain. It is useful to know if the spams were received at the parser and parsed but the system of providing you with the report didn't work or if instead it appeared that the parser didn't get the submit. If the parser didn't get the submit, it is useful to know if you would get a copy of that submit to some other secondary address. -- Mike Easter kibitzer, not SC admin From ndlover2002 at sbcglobal.net Sat Mar 18 01:06:21 2006 From: ndlover2002 at sbcglobal.net (Jeff) Date: Sat Mar 18 01:10:02 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: "Mike Easter" wrote in message news:dvg3u9$amu$1@news.spamcop.net... > anon wrote: > >> I also have not been getting reports back since Mar 15 middle of the >> afternoon (PST.) > > Did you try what Tom did and go to the webparser page and see if you had > unreported spam? Yes I went to webparser page and there was unreported Spam but some were way old ones from December that I know I have reported already! > > Did you check on your email address in preferences? I just checked it and saw the following problem > Bounce error Your email address, dogs32@hotmail.com has returned a bounce: Subject: Delivery Status Notification (Failure) Reason: 5.2.3 Diagnostic-Code: smtp;552 5.2.3 This message is larger than the current system limit or the recipient's mailbox is full. Create a shorter message body or remove attachments and try sending it again. > Did you try sending yourself a copy of the Submit address spam? No I have that unchecked From Kilgallen at SpamCop.net Sat Mar 18 07:17:18 2006 From: Kilgallen at SpamCop.net (Larry Kilgallen) Date: Sat Mar 18 08:20:14 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? (sending messages too large) References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: In article , "Jeff" writes: > I just checked it and saw the following problem > >> Bounce error > Your email address, dogs32@hotmail.com has returned a bounce: > Subject: Delivery Status Notification (Failure) > Reason: 5.2.3 Diagnostic-Code: smtp;552 5.2.3 This message is larger than > the current system limit or the recipient's mailbox is full. Create a > shorter message body or remove attachments and try sending it again. That happens to me a lot, and results in the setting of the bounce flag on my main SpamCop reporting page. I pointed out to SpamCop that smaller message should be sent, rather than aggregating multiple notifications, so as not to exceed the size limits that my email account will receive. SpamCop should not presume to send arbitrarily large messages -- that is what (some) spammers do. In my case the setting of the bounce flag is the only bad effect -- I do not use the notification messages at all. I automatically discard them. From MikeE at ster.invalid Sat Mar 18 05:43:41 2006 From: MikeE at ster.invalid (Mike Easter) Date: Sat Mar 18 08:45:03 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: Jeff wrote: > "Mike Easter" >> Did you try what Tom did and go to the webparser page and see if you >> had unreported spam? > > Yes I went to webparser page and there was unreported Spam but some > were way old ones from December that I know I have reported already! But let's stay focused on the original problem, not the old unreported. Dump that. Jeff wrote: > Now I have submitted spam two different times and I am NOT > getting the Spamcop reports back at all!! They still have not > arrived as of this evening either. So, now we have determined the point in the chain I described is the step where SC mails to you. >> Did you check on your email address in preferences? > > I just checked it and saw the following problem > >> Bounce error > Your email address, dogs32@hotmail.com has returned a bounce: Clearly that creates a problem. Also it sets a bounce flag that causes SC to not send to that address until something gets reset -- but I don't know how to achieve the resetting yet. You should check your mailbox at your provider's webmail to make sure it doesn't have any problem, and also find out what your provider's size limit is on messages that can cause a bounce. >> Did you try sending yourself a copy of the Submit address spam? > > No I have that unchecked Actually I meant something different by that troubleshooting maneuver than you are replying. I think you are describing a Preferences option in which you check to have yourself sent a copy of the reports you send. I was describing CC to an address when you email the Submit address -- but that troubleshooting step is no longer necessary because we/you have identified the link in the chain which is broken. That CC of the Submit mail is a step to help determine a cause of step1 being broken, but you have already determined that it is step3 which is broken. Now we have to figure out how to unbreak step3 it by resetting the SC bounce flag. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Sat Mar 18 06:02:23 2006 From: MikeE at ster.invalid (Mike Easter) Date: Sat Mar 18 09:05:03 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: Jeff wrote: > Now I have submitted spam two different times and I am NOT > getting the Spamcop reports back at all!! They still have not > arrived as of this evening either. Mike Easter wrote: > Jeff wrote: >> I went to webparser page and there was unreported Spam > now we have determined the point in the chain I described is the > step where SC mails to you. > >>> Did you check on your email address in preferences? >> >> I just checked it and saw the following problem >> >>> Bounce error >> Your email address, dogs32@hotmail.com has returned a bounce: > > Clearly that creates a problem. Also it sets a bounce flag that > causes SC to not send to that address until something gets reset -- > but I don't know how to achieve the resetting yet. Here's what the faq sez about that http://www.spamcop.net/fom-serve/cache/231.html If that address starts bouncing or we don't receive a reply to a query sent your way, the account will be suspended. So the suspending of the account is the bounce flag I mentioned. In the forum troubleshooting description at http://forum.spamcop.net/forums/index.php?showtopic=1848 Q: I am a Spam Reporter. I am sending my Spam Submissions to the correct submit.16charANcodeNMBR[at]spam.spamcop.net email address, but I'm not getting a "Report Spam" Link or a Response. A: There are multiple points of potential failure in the email submission loop. See link to Explanation of Route between Reporter and SpamCop and where things can go wrong. TECHNICAL DETAILS are below. ... Wazoo describes the bounce problem resolution Bounce error Your email address, your secret email address here has returned a bounce: Subject: subject of problem email message here Please ensure your email account is reliable, then click below: ... which also has a 'problem resolved' button you can click to reset the suspension problem. Wazoo sez // Once the "Problem resolved" Button has been clicked, you should get a response "Bounce flag reset, thank you." Clicking the "Problem resolved" Button tells the Service that the "problem with bouncing from your secret email address has been resolved" and the Service will start to send your email to your secret email address once again. // ... which is a different description of what you said you saw, because you were describing the DSN [delivery status notification - failure] message rather than a SC message with a resolution button. Wazoo sez that bounce error message appears at the page where you would paste a spam to be parsed http://www.spamcop.net/ -- Mike Easter kibitzer, not SC admin From spamtrap at dixie-soft.com Sat Mar 18 11:35:12 2006 From: spamtrap at dixie-soft.com (Alan Brown) Date: Sat Mar 18 11:40:16 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? In-Reply-To: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: I had problems in the Tue-Thu timeframe. I didn't report anything because I have grown accustomed to these outages (SC may not call them that, but from a user perspective, it IS an outage). Databases corrupt, mail servers down, DNS problems, parser errors, you name it. Spam Cop has a history of technical problems. I've been a subscriber for about four years and a reporter much longer than that. Denial of problems until it FINALLY affects one of the SC admins seems to be par for the course. - Alan Thomas Weyhrauch wrote: > On Fri, 17 Mar 2006 18:48:26 -0500, "Jeff" wrote: > > >>Now I have submitted spam two different times and I am NOT getting >>the Spamcop reports back at all!! >>-Jeff >> > > > I also have not been getting the reports back from submitted spam. This started > 3 days ago and I have sent 5 reports with no replys from the system. The emails > are reaching SpamCop, and I am able to finish the reports by loging into SpamCop > and reporting the unreported spam. My ISP is Charter HSI and I will be > contacting them about this problem. > > Tom From MikeE at ster.invalid Sat Mar 18 11:01:02 2006 From: MikeE at ster.invalid (Mike Easter) Date: Sat Mar 18 14:05:03 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: Alan Brown wrote: > I had problems in the Tue-Thu timeframe. As long as we are sharing experiences.... I did /not/ have any problems in the Tu-Th time frame. During that timeframe I made 17 email submissions, none of which were delayed in being replied. Where by 'problem' I mean receiving back my report. That 'problem' definition does not include such as observing the parser failing to resolve a spamvertised URL, which is often observed. This thread started about email submission replies -- not all generic 'problems' amassed together. In the past when I used to submit directly to the webparser instead of by email, I found it much 'simpler' or quicker to use the webparser when it wasn't busy than when it was. > I didn't report anything > because I have grown accustomed to these outages (SC may not call them > that, but from a user perspective, it IS an outage). Outages is another term different than generic 'problems'. A recent post on Wed said this: John Anderson wrote: > An error occurred while processing your request. > Reference #97.bc2c7b3f.1142434241.d14a52 > Databases corrupt, mail servers down, DNS problems, parser errors, you name it. I'm not a SC mail client. My own spams are sent by email. I use the webparser often to discuss spams being discussed in the ng/s. I'm not seeing 'any' problems, except the occasional ones reported here, such as Wed above and this thread. > Spam Cop has a history of technical problems. I've been a subscriber > for about four years and a reporter much longer than that. Denial of > problems until it FINALLY affects one of the SC admins seems to be > par for the course. You are saying you see problems frequently. I'm saying I rarely see problems. I have no explanation for the difference in our observations. -- Mike Easter kibitzer, not SC admin From ndlover2002 at sbcglobal.net Sat Mar 18 16:10:47 2006 From: ndlover2002 at sbcglobal.net (Jeff) Date: Sat Mar 18 16:15:08 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: "I have grown accustomed to these outages (SC may not call them that, but from a user perspective, it IS an outage). Databases corrupt, mail servers down, DNS problems, parser errors, you name it. Spam Cop has a history of technical problems." Yep, that's what I was talking about, Mike Easter! They have outages and they won't admit that its happening but it IS! I'm still not getting my reports back now. Something is screwed up with Spamcop, that's for darn sure!! I shouldn't have to go to spamcop.net and report them there instead, that's a hassle dassle. I like doing it via e-mail and that is how I am accustomed to doing it too. So time to get your act together Spamcop or soon I won't be wasting time with your bullshit games any longer!! From MikeE at ster.invalid Sat Mar 18 13:41:07 2006 From: MikeE at ster.invalid (Mike Easter) Date: Sat Mar 18 16:45:03 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: Jeff wrote: > I'm still not > getting my reports back now. Fix your mailbox and after it is fixed, fix your SC blocked mail flag. > Something is screwed up with Spamcop, Something was screwed up with your mailbox. > I shouldn't have to go to spamcop.net and > report them there People with working mailboxes and no bounce flag don't have to go to the website. -- Mike Easter kibitzer, not SC admin From ndlover2002 at sbcglobal.net Sat Mar 18 17:21:10 2006 From: ndlover2002 at sbcglobal.net (Jeff) Date: Sat Mar 18 17:25:05 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: Excuse me but I DO have a working mailbox, its SPAMCOP's fault, NOT mine, get that in your brain!! I already reset the flag today and during the night, duh! "Mike Easter" wrote in message news:dvhupg$8pu$1@news.spamcop.net... > Jeff wrote: >> I'm still not >> getting my reports back now. > > Fix your mailbox and after it is fixed, fix your SC blocked mail flag. > >> Something is screwed up with Spamcop, > > Something was screwed up with your mailbox. > >> I shouldn't have to go to spamcop.net and >> report them there > > People with working mailboxes and no bounce flag don't have to go to the > website. > > > -- > Mike Easter > kibitzer, not SC admin > From nobody at devnull.spamcop.net Sat Mar 18 21:11:28 2006 From: nobody at devnull.spamcop.net (WazoO) Date: Sat Mar 18 22:15:02 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: "Mike Easter" wrote in message news:dvhldc$3cq$1@news.spamcop.net... > Alan Brown wrote: > > I had problems in the Tue-Thu timeframe. > > > I didn't report anything > > because I have grown accustomed to these outages (SC may not call them > > that, but from a user perspective, it IS an outage). > > Outages is another term different than generic 'problems'. > > A recent post on Wed said this: > > John Anderson wrote: > > An error occurred while processing your request. > > Reference #97.bc2c7b3f.1142434241.d14a52 http://forum.spamcop.net/forums/index.php?act=module&automodule=custom&page=stats was showing one of those dips/dropouts in that timeframe. Looking at that chart right now ... a dip at 0600 GMT -5 took incoming spam down to around 2, Reports to around 2.5 ... lasting about 15 minutes. Then around 1640 GMT -5 one sees a serious ramp-up in the incoming stuff. The dips have never been explained (again, there is no IronPort representation here or in the Forum, and whether the question is never asked or answers are considered non-public, nothing on this from Don/Deputies) ... so whether it's that one server out of a set went down for a bit, or just that the actual outage was short enough not to be actually seen in this graphic .. no way to tell from this side of the screen. The point is that this graphic is available, whether www.spamcop.net is up or down, so it's at least a starting point for troubleshooting. > > > Databases corrupt, mail servers down, DNS problems, parser errors, you > name it. As just described, there is a lot going on. Unfortunately, this same description leaves out that the component parts are hosted on different systems, different coasts, on hardware and software owned and mantained by different folks. > > > Spam Cop has a history of technical problems. I've been a subscriber > > for about four years and a reporter much longer than that. Denial of > > problems until it FINALLY affects one of the SC admins seems to be > > par for the course. On the other hand, over those years, there's been a lot of troubleshooting scenarios for users with issues that are itmes that the Deputies won't 'see' for themselves. The oddities in a max MTU size for some Europeon users using a certain backbone while spamcop.net was hosted in a datacenter in New York for instance. The craziness that got resolved when it was found that the complainants were all using an extra bit of software (that was never mentioned in all the complaining) .. Add-Subtract if I recall correctly .... and this is not to ignore that some other issues appear when one of the Akamai servers decides to hose things up ... > You are saying you see problems frequently. I'm saying I rarely see > problems. I have no explanation for the difference in our observations. My position is that I check the newsgroups, I check the Forum, and if there is corresponding traffic, I'll kick out an e-mail to get some attention from staff if it appears needed. Don/Deputies are geographically distributed, but still all in North America, so there is no 24 hour coverage guaranteed. On the other hand, some of us other folks have 'strange' sleep patterns, so a 'system-wide' problem will usually be noticed by someone (and again, that's the background of me placing the off-www.spamcop.net site link to show the Reporting system status graphic/link on the Forum pages) .... if it's a real 'down' issue, alarms do go off in the datacenter, IronPort has staff present to try to jump on those issues. But that's as far as the "for the public" data has gone thus far. From scamper at trisk.com Sun Mar 19 12:45:33 2006 From: scamper at trisk.com (Garen Erdoisa) Date: Sun Mar 19 14:50:04 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? In-Reply-To: References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: SpamCop Admin wrote: > Alan Brown wrote: >> -because I have grown accustomed to these outages (SC may not call them >> -that, but from a user perspective, it IS an outage). Databases corrupt, >> -mail servers down, DNS problems, parser errors, you name it. Spam Cop >> -has a history of technical problems. > > Yes, we have plenty of problems. And yes, we routinely don't believe > there is a problem until we see it for ourselves. That's because we > access SpamCop from outside just like everybody else, and we're coming > in from Canada, Idaho, Georgia, and California. If we're not > experiencing the problem, it's highly likely not a system-wide > problem. > > SpamCop is an extremely complicated living entity that needs to be > tweaked constantly to keep up with the latest spammer tricks. Plus, > our database has grown to huge proportions that the system was never > designed to handle. We are continually upgrading our software and > rewriting routines so that we can handle the load. The same applies > to the server farm that does the processing. > > Plus, we're constantly under attack, so we have to use third-party > servers to run interference for us in order to keep from getting taken > down by a Denial of Service attack. Sometimes those servers have > problems, which in turn cause problems for people in one part of the > world that aren't seen by people in other places. > > The days of Julian running his one-man show out of his home are long > gone. It takes an entire team to manage SpamCop these days. Servers > fail, mistakes get made, bad stuff happens. Such is life among > savages. > > On the bright side, we're making good progress in getting the database > and the subroutines under control. We're experiencing way fewer > sudden outages. And during all this, SpamCop still manages to process > some 3 Million spams a day on average. I'd say that's pretty good for > a system with problems. > > - Don D'Minion - SpamCop Admin - Personally, and professionally I think you guys are doing a great job. I've experienced system outages with spamcop also, but realize that no system is perfect. However from what I've seen the problems are taken care of in a timely manner when they happen and are fairly rare from my perspective. I have yet to hear of any parsing and reporting service other than spamcop that even comes close to doing what spamcop is doing. Spamcop continues to have my vote of confidence. Garen From chris.a.wright at gmail.com Sun Mar 19 20:40:17 2006 From: chris.a.wright at gmail.com (Chris Wright) Date: Sun Mar 19 15:45:02 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? In-Reply-To: References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: SpamCop Admin wrote: > Alan Brown wrote: >> -because I have grown accustomed to these outages (SC may not call them >> -that, but from a user perspective, it IS an outage). Databases corrupt, >> -mail servers down, DNS problems, parser errors, you name it. Spam Cop >> -has a history of technical problems. > > Yes, we have plenty of problems. And yes, we routinely don't believe > there is a problem until we see it for ourselves. That's because we > access SpamCop from outside just like everybody else, and we're coming > in from Canada, Idaho, Georgia, and California. If we're not > experiencing the problem, it's highly likely not a system-wide > problem. > > SpamCop is an extremely complicated living entity that needs to be > tweaked constantly to keep up with the latest spammer tricks. Plus, > our database has grown to huge proportions that the system was never > designed to handle. We are continually upgrading our software and > rewriting routines so that we can handle the load. The same applies > to the server farm that does the processing. > > Plus, we're constantly under attack, so we have to use third-party > servers to run interference for us in order to keep from getting taken > down by a Denial of Service attack. Sometimes those servers have > problems, which in turn cause problems for people in one part of the > world that aren't seen by people in other places. > > The days of Julian running his one-man show out of his home are long > gone. It takes an entire team to manage SpamCop these days. Servers > fail, mistakes get made, bad stuff happens. Such is life among > savages. > > On the bright side, we're making good progress in getting the database > and the subroutines under control. We're experiencing way fewer > sudden outages. And during all this, SpamCop still manages to process > some 3 Million spams a day on average. I'd say that's pretty good for > a system with problems. > > - Don D'Minion - SpamCop Admin - Personally, having used SPAMCOP for a number of years, I have had very little problems. Those that I did have I was notified about at the time or soon thereafter. I cannot believe the attitude of Jeff on this thread, more so, I can't believe how tolerant Mike Easter has been in his reply to him. If I had have been Mike, Jeff would have been KF'd a long time ago and his rants accepted of someone who is very ignorant of the situation. I would suggest to Jeff if reading this, that he calms down, gets a grip of the situation and tries to understand the complicated system involved. Does he know how many users there are of SPAMCOP? Does he realise what a tiny percentage himself and the 'other people' who have reported a problem are? Does he not think that if this were such a major problem then there would be massive signal to noise on the web/forums/newsgroups? I don't object so much to his problem, as that seems to be genuine. But his total lack of understanding of the problem is amazing, and his tone despite being font rather than vocal based is just down right rude. He claims to have shouted for help, but didn't even have the decency to read the FAQ and find out that his specific problem already appears to be noted, documented and it appears a solution being worked upon. I'd say thumbs up to SPAMCOP and ask Jeff to slow down, take stock. IMHO of course, which for some don't count for toffee. Regards Chris From spam_hjp at yahoo.com Sun Mar 19 15:51:46 2006 From: spam_hjp at yahoo.com (Jim) Date: Sun Mar 19 15:55:03 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? In-Reply-To: References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: > > Does he know how many users there are of SPAMCOP? I would like to know how many users of SpamCop there are. What percentage of spam reports are coming from users versus Spam traps. From scamper at trisk.com Sun Mar 19 14:08:16 2006 From: scamper at trisk.com (Garen Erdoisa) Date: Sun Mar 19 16:10:04 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? In-Reply-To: References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: Jim wrote: > >> >> Does he know how many users there are of SPAMCOP? > > I would like to know how many users of SpamCop there are. What > percentage of spam reports are coming from users versus Spam traps. My thoughts on the issue: No idea how many users spamcop has. However for the percentages of spam it's not an exact figure, but if you look at the statistical charts for daily use, it shows for the last 24 hours about 856k messages reported by people. This is a constantly changing number. If you take what Don D'Minion just mentioned in his post that spamcop handles about 3 million message per day on average, that suggests a current ratio of about 1/4th to 1/3rd are human reports, and to 2/3rds to 3/4ths are spamtrap reports or other sources such as data feeds from spam filter software. The spamtrap data is not included on the statistics charts they make available to the public. Those charts mostly indicate spamcop usage patterns by people, not total spam processed by spamcop, nor do they indicate anything about total spam on the Internet. My .02 Garen From MikeE at ster.invalid Sun Mar 19 15:46:44 2006 From: MikeE at ster.invalid (Mike Easter) Date: Sun Mar 19 18:50:03 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: Garen Erdoisa wrote: > The spamtrap data is not included on the statistics charts they make > available to the public. How do you know that? I always assumed that it did. Or rather that the statistics were some 'subset' of the total spam processed, but not necessarily the subset corresponding to a subset of reporter only reports and excluding spamtraps. One sentence on the stats page sez "These numbers now reflect only a small fraction of total spam being processed by SpamCop, but they are still representative of the total." One observation supporting your no spamtrap data is that if you look at today's stats, the number of reports about equals the number of spams -- so if you say that spamtraps don't generate a report, then that observation would correlate with no spamtraps in the stats. But if you look at a year or other longer period than a day, you see that the reports exceed the number of spams significantly -- so then the presumption becomes that of saying that any given spam generates a number of reports. Then, before you presume too much, you have to ask how the reports are counted. If a report goes to 4 addresses, is that 4 reports or 1? Or 2? One about source? X addresses about source? Y addresses about spamvertiser? So then, once you/I start realizing that I don't know how we are counting reports, then it becomes possible for spamtraps to be in the mix of the statistics even tho' they don't generate reports. Or, is a 'report' a reported spamsource contributing to the SCbl even if nothing is mailed? If so, then spamtraps would generate a reported spamsource 'report' non-report just like a quickreport generates a spamsource report /and/ a mailed report to the spamsource provider. Maybe a report is anything that has a reportid number, and presumably even a spamtrap report has a reportid. To me, there are a lot of unknowns about how the stats are generated, and since the admins don't care to elaborate on the mechanics, everyone ends up guessing based on assumptions which may or not be valid. > Those charts mostly indicate spamcop usage > patterns by people, not total spam processed by spamcop, -- Mike Easter kibitzer, not SC admin From scamper at trisk.com Sun Mar 19 16:58:51 2006 From: scamper at trisk.com (Garen Erdoisa) Date: Sun Mar 19 19:00:03 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? In-Reply-To: References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: Mike Easter wrote: > Garen Erdoisa wrote: > >> The spamtrap data is not included on the statistics charts they make >> available to the public. > > How do you know that? I always assumed that it did. Or rather that the > statistics were some 'subset' of the total spam processed, but not Quote from http://members.spamcop.net/spamstats.shtml These graphs show the number of messages submitted as spam along with the number of reports consumated regarding those messages. This data reflects more about SpamCop's usage patterns than it does about the spam. These numbers now reflect only a small fraction of total spam being processed by SpamCop, but they are still representative of the total. It's pretty clear to me with that statement on the website that the graphs do not include spamtrap data or data from other sources. Combine that with what Don D'Minion just admitted in his post further up in this thread about spamcop processing about 3 million emails per day, the rest is deductive reasoning based on the information I have available. > necessarily the subset corresponding to a subset of reporter only > reports and excluding spamtraps. One sentence on the stats page sez > "These numbers now reflect only a small fraction of total spam being > processed by SpamCop, but they are still representative of the total." > > One observation supporting your no spamtrap data is that if you look at > today's stats, the number of reports about equals the number of spams -- > so if you say that spamtraps don't generate a report, then that > observation would correlate with no spamtraps in the stats. > > But if you look at a year or other longer period than a day, you see > that the reports exceed the number of spams significantly -- so then the > presumption becomes that of saying that any given spam generates a > number of reports. Then, before you presume too much, you have to ask > how the reports are counted. If a report goes to 4 addresses, is that 4 > reports or 1? Or 2? One about source? X addresses about source? Y > addresses about spamvertiser? > > So then, once you/I start realizing that I don't know how we are > counting reports, then it becomes possible for spamtraps to be in the > mix of the statistics even tho' they don't generate reports. Or, is a > 'report' a reported spamsource contributing to the SCbl even if nothing > is mailed? If so, then spamtraps would generate a reported spamsource > 'report' non-report just like a quickreport generates a spamsource > report /and/ a mailed report to the spamsource provider. Maybe a report > is anything that has a reportid number, and presumably even a spamtrap > report has a reportid. > > To me, there are a lot of unknowns about how the stats are generated, > and since the admins don't care to elaborate on the mechanics, everyone > ends up guessing based on assumptions which may or not be valid. Don D'Minion just stated in his post further up in this thread that spamcop process about 3 million spams per day. Again, the rest is just deductive reasoning. He's posting as a spamcop admin, so I would tend to trust his statement as being somewhat factual since he does have access to insider knowledge. > >> Those charts mostly indicate spamcop usage >> patterns by people, not total spam processed by spamcop, > > Garen From MikeE at ster.invalid Sun Mar 19 16:21:58 2006 From: MikeE at ster.invalid (Mike Easter) Date: Sun Mar 19 19:25:03 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: Garen Erdoisa wrote: > Mike Easter wrote: >> Garen Erdoisa wrote: >> >>> The spamtrap data is not included on the statistics charts they make >>> available to the public. >> >> How do you know that? I always assumed that it did. Or rather that >> the statistics were some 'subset' of the total spam processed, but >> not > Quote from http://members.spamcop.net/spamstats.shtml Not only did I read that par, I cited a sentence from it. But I will leave the par cited below so that we can all look at it again. > > These graphs show the number of messages submitted as spam along with > the number of reports consumated regarding those messages. This data > reflects more about SpamCop's usage patterns than it does about the > spam. These numbers now reflect only a small fraction of total spam > being processed by SpamCop, but they are still representative of the > total. > > It's pretty clear to me with that statement on the website that the > graphs do not include spamtrap data or data from other sources. Data from other sources? That isn't even being debated here. The data is reflective of spamcop spam, not some other spam. But the par above and the information from the rest of that page and others doesn't convince me of what is apparently 'clear' to you that the graphs do not include spamtrap data. There isn't anything in the par you cited that sez anything about spamtrap data one way or the other. The par only sez that the data shows a small fraction of spam being processed. It gives no clue about which fraction. > Combine that with what Don D'Minion just admitted in his post further > up in this thread about spamcop processing about 3 million emails per > day, the rest is deductive reasoning based on the information I have > available. The fact that he used the term 3 million and the fact that the stats show less only confirms that there is a subset, which is what the sentence I cited said, not how the subset is 'chosen'. > Don D'Minion just stated in his post further up in this thread that > spamcop process about 3 million spams per day. Again, the rest is just > deductive reasoning. I am debating the quality or accuracy of your deductive reasoning. > He's posting as a spamcop admin, so I would tend > to trust his statement as being somewhat factual since he does have > access to insider knowledge. I'm not saying his information isn't factual -- I'm saying you are making unwarranted assumptions from the 3 million term, from the subset concept, and from the numbers shown on the graph. I don't know how it makes any difference one way or another if we are looking at a set of stats and the stats don't represent all of the data which data or which fraction of which data is 'left out' if it is acknowledged that all of the data isn't there. In fact, only a 'small fraction' of the data is shown. A /small/ fraction? Is a small fraction 1% or 10% or 50% or what? A 'fraction' implies a fraction or a part, which one might think of as being 'not all' but a 'significant' or noticeable fraction -- certainly not a 'sizeable' fraction. But when you start saying a *small* fraction, it makes me think of something perhpas less than 25% or even below 10% -- whereas a 'tiny' fraction might be more in the 1% range. If the 3 million figure were actually representative of the last week or so, during which 5 million spams were shown on the 7 day graph, then the fraction would be about 25% -- and saying 25% is a 'small' fraction would be OK with me. But, I think that if you were to 'insist' on saying that the graph is showing some subset of reporter reports and no spamtraps, or insist on saying that the graph is showing all of the reporter reports and no spamtrap reports and therefore 75% of the spam processed is from spamtraps, then I would 'insist' on saying your assumptions are unwarranted. -- Mike Easter kibitzer, not SC admin From scamper at trisk.com Sun Mar 19 19:06:24 2006 From: scamper at trisk.com (Garen Erdoisa) Date: Sun Mar 19 21:10:02 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? In-Reply-To: References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: Mike Easter wrote: > Garen Erdoisa wrote: >> Mike Easter wrote: >>> Garen Erdoisa wrote: >>> >>>> The spamtrap data is not included on the statistics charts they make >>>> available to the public. >>> How do you know that? I always assumed that it did. Or rather that >>> the statistics were some 'subset' of the total spam processed, but >>> not > >> Quote from http://members.spamcop.net/spamstats.shtml > > Not only did I read that par, I cited a sentence from it. But I will > leave the par cited below so that we can all look at it again. > >> >> These graphs show the number of messages submitted as spam along with >> the number of reports consumated regarding those messages. This data >> reflects more about SpamCop's usage patterns than it does about the >> spam. These numbers now reflect only a small fraction of total spam >> being processed by SpamCop, but they are still representative of the >> total. >> >> It's pretty clear to me with that statement on the website that the >> graphs do not include spamtrap data or data from other sources. > > Data from other sources? That isn't even being debated here. The data > is reflective of spamcop spam, not some other spam. > > But the par above and the information from the rest of that page and > others doesn't convince me of what is apparently 'clear' to you that the > graphs do not include spamtrap data. > > There isn't anything in the par you cited that sez anything about > spamtrap data one way or the other. The par only sez that the data > shows a small fraction of spam being processed. It gives no clue about > which fraction. > >> Combine that with what Don D'Minion just admitted in his post further >> up in this thread about spamcop processing about 3 million emails per >> day, the rest is deductive reasoning based on the information I have >> available. > > The fact that he used the term 3 million and the fact that the stats > show less only confirms that there is a subset, which is what the > sentence I cited said, not how the subset is 'chosen'. > >> Don D'Minion just stated in his post further up in this thread that >> spamcop process about 3 million spams per day. Again, the rest is just >> deductive reasoning. > > I am debating the quality or accuracy of your deductive reasoning. > >> He's posting as a spamcop admin, so I would tend >> to trust his statement as being somewhat factual since he does have >> access to insider knowledge. > > I'm not saying his information isn't factual -- I'm saying you are > making unwarranted assumptions from the 3 million term, from the subset > concept, and from the numbers shown on the graph. > > I don't know how it makes any difference one way or another if we are > looking at a set of stats and the stats don't represent all of the data > which data or which fraction of which data is 'left out' if it is > acknowledged that all of the data isn't there. In fact, only a 'small > fraction' of the data is shown. > > A /small/ fraction? Is a small fraction 1% or 10% or 50% or what? A > 'fraction' implies a fraction or a part, which one might think of as > being 'not all' but a 'significant' or noticeable fraction -- certainly > not a 'sizeable' fraction. But when you start saying a *small* > fraction, it makes me think of something perhpas less than 25% or even > below 10% -- whereas a 'tiny' fraction might be more in the 1% range. > > If the 3 million figure were actually representative of the last week or > so, during which 5 million spams were shown on the 7 day graph, then the > fraction would be about 25% -- and saying 25% is a 'small' fraction > would be OK with me. > > But, I think that if you were to 'insist' on saying that the graph is > showing some subset of reporter reports and no spamtraps, or insist on > saying that the graph is showing all of the reporter reports and no > spamtrap reports and therefore 75% of the spam processed is from > spamtraps, then I would 'insist' on saying your assumptions are > unwarranted. > > Mike; I have a respect for your mind, thought processes and opinions. Though I don't post that often, I do read these boards and have read many of your posts. I really don't think that we are in disagreement here, as I stated in my post quoting myself "These are my thoughts on this issue". That means that it's my opinion. No where in it did I say or even suggest that my opinion was a fact. You seem to have inferred otherwise. Garen From MikeE at ster.invalid Sun Mar 19 18:34:59 2006 From: MikeE at ster.invalid (Mike Easter) Date: Sun Mar 19 21:35:02 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: Garen Erdoisa wrote: > I really don't think that we are in disagreement here, as I stated in > my post quoting myself "These are my thoughts on this issue". That > means that it's my opinion. No where in it did I say or even suggest > that my opinion was a fact. You seem to have inferred otherwise. Oh, I see. I tho't maybe you had some other information as a basis for your opinion. If I'm understanding you correctly, you are saying "On the basis of this, I think the stats reflect reporter reports and not spamtrap reports." Then I have another question. Do you think that the stats reflect a 'sizeable percentage' of the reporter reports, and therefore one could surmise that 75% of the 3 million spams are derived from spamtraps, or do you think that the stats only reflect a small percentage of the reporter reports, and therefore one would surmise that a much much smaller percentage than 75% of the 3 million are derived from spamtraps? Along the lines of what Jim was asking: Jim wrote: >> Does he know how many users there are of SPAMCOP? > > I would like to know how many users of SpamCop there are. What > percentage of spam reports are coming from users versus Spam traps. -- Mike Easter kibitzer, not SC admin From scamper at trisk.com Sun Mar 19 20:43:27 2006 From: scamper at trisk.com (Garen Erdoisa) Date: Sun Mar 19 22:45:04 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? In-Reply-To: References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: Mike Easter wrote: > Garen Erdoisa wrote: > >> I really don't think that we are in disagreement here, as I stated in >> my post quoting myself "These are my thoughts on this issue". That >> means that it's my opinion. No where in it did I say or even suggest >> that my opinion was a fact. You seem to have inferred otherwise. > > Oh, I see. I tho't maybe you had some other information as a basis for > your opinion. > > If I'm understanding you correctly, you are saying "On the basis of > this, I think the stats reflect reporter reports and not spamtrap > reports." It's my opinion (and assumption) that green data on the charts currently reflect spam submitted by reporters, excluding spamtrap data and data from other sources such as spamfilter data feeds. It's also my opinion (and assumption) that the blue line on that charts represent the number of reports to various abuse desks generated when reporters choose to submit. I have looked at those charts for a couple of years off and on, and for a time (well over a year ago) it looked like the charts were showing both spamtrap and reporter data for a while, that suddenly dropped off, so I think spamcop has in the past changed the data sets on the fly without indicating the change to the rest of us. Again, that's just my opinion and assumption. I never asked spamcop for clarification and didn't really care at the time. That data has since scrolled off the chart so isn't relevant any longer anyway. > > Then I have another question. Do you think that the stats reflect a > 'sizeable percentage' of the reporter reports, and therefore one could > surmise that 75% of the 3 million spams are derived from spamtraps, or I currently think that the charts show 100% of the reporter reports, and 0% of data from spamtrap sources and other data sources. I do know for a fact that spamcop has other data sources than reporters and spamtraps. Unless a spamcop admin wants to pipe in and clarify the issue, as far as I'm concerned that assumption stands for the purposes of this discussion in this thread. I could change my opinion at any time if new information becomes available. To clarify something here when I say "other data sources" I'm including things like data sources other than spamtraps which include but are not necessarily limited to things like distributed spam feeds from both SpamAssassin (with a plugin) and Spmabouncer spamfilter software. Possibly others though I don't know of any offhand. Such distributed spam data feeds wouldn't necessarily be considered in the same category as a spamtrap though it's similar in nature it would most likely be treated differently since the data feeds are coming from real email accounts in many if not most cases. I don't know if that data is included on the charts or not, but at this time I's my opinion and assumption that it's not included on those charts. Those spamfilters are also capable of automatic submission of normal reports that are later confirmed by the users. Somewhere on these boards a long time ago I read a post about Spam Assassin that stated it had it's own reporting address for the filter itself. Spambouncer definitely has it's own reporting address for the spam filter that is completely independent from a "reporter" account. From my perspective (from the outside), it's like a black hole address. Stuff fed to it is never seen again by me. Only spamcop admins would have access to that data feed. I know this for a fact because I wrote that section of code in the spambouncer and use spambouncer to auto submit spam that meat the appropriate criteria to spamcop for accounts on my domain that are so enabled. I also know for a fact that others use spambouncer in this mode. I've helped others set this up. I don't know how many use Spam Assassin like this, and I haven't actually looked at that hard code, but from what I have read on usenet and these spamcop boards I can make a reasonable assumption at this point in time that people use Spam Assassin to do the same thing as I do with Spambouncer. Based on all of that, I can make a reasonable assumption that such data feeds are not included on the charts because I would have expected to have seen a significant increase in the data on the charts when those feeds when live if they were included in the data shown on the charts. The charts did show an increase around last October to November, but not really enough to say one way or another if the increase was due to those data feeds going live or due to other things going on. (By live I mean stable release of Spambouncer vs beta testing). To be honest I've never asked spamcop for more information about this and didn't really care. Still don't. I care more that they have the data available to make use of than how it affects the statistics they choose to display to the public. I think that based on Don's statement, I can make a reasonable assumption that spamtrap data is not currently included on the charts. But yes, it's just assumptions and opinions we are talking about here. i.e.: educated guesses. I don't know how many users spamcop has, and I don't really care. That would have a bearing on the statistics though, since you could then infer how many average reports per person per day are submitted, which might be interesting to know. > do you think that the stats only reflect a small percentage of the > reporter reports, and therefore one would surmise that a much much > smaller percentage than 75% of the 3 million are derived from spamtraps? > > Along the lines of what Jim was asking: > > Jim wrote: >>> Does he know how many users there are of SPAMCOP? >> I would like to know how many users of SpamCop there are. What >> percentage of spam reports are coming from users versus Spam traps. > > With all of that said, I think I'm more curious now than I was before this thread about just how spamcop derives it's data for the charts. I'd also like to see more charts that do show a spam feed breakdown from various data sources. reporters, spamtraps, spamassassin & spambouncer distributed feeds, etc. I doubt spamcop will do that though I guess we could ask them to. Who knows, maybe if enough people show an interest in that sort of data they'll do it. Garen From ndlover2002 at sbcglobal.net Sun Mar 19 22:51:50 2006 From: ndlover2002 at sbcglobal.net (Jeff) Date: Sun Mar 19 22:55:02 2006 Subject: [SC-Help] Re: To Chris References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: I suggest Chris that you shut the FUCK UP!! Mind your own business and fuck off. I'm not putting up with your atttitude either! I'm not ignorant, I've studied computers and know way more than you could possibly imagine so shutup and get lost! This was NEVER addresssed to you, little nervy bastard!! From ndlover2002 at sbcglobal.net Sun Mar 19 22:54:12 2006 From: ndlover2002 at sbcglobal.net (Jeff) Date: Sun Mar 19 22:55:06 2006 Subject: [SC-Help] Re: AOL Issue References: Message-ID: Then don't use AOL, dumbass! AOL SUCKS! You're quite ignorant if you use AOL!! AOL is for newbies. Advanced people like me, use a REAL ISP, you obviously are the ignorant one, not me so don't try to label me again, understand idiot of the day??? "Chris Wright" wrote in message news:duul3k$7kp$1@news.spamcop.net... > It was mentioned in another thread, but I have never been able to find any > other mention of it. > > I've been a user of SPAMCOP for a few years now, and have no problems with > reporting of SPAM etc. > > A good few months back I started getting failure messages back from AOL > when I used accounts that I forward SPAM from to SPAMCOP. > > Something along the lines of "AOL is not able to process your email > because it comes from a domain that reports SPAM". > > Was this ever discussed on SPAMCOP? > > Are you aware of any other ISP's/Organizations that do similar. > > As I have always considered AOL one level above amoeba, it wasn't a > problem to me. I contacted the AOL users via GMAIL and forwarded them a > copy of the returned mail headers. Showing them that they won't allow > people who report SPAM to send them mail, let alone those that send SPAM > in the first place. Most were offended enough to ditch AOL, or at least > complain and for everyone person I get to quit AOL, the better I feel. > > Does anyone know their justification for doing this? > > Why would people I consider responsible, or part of the fight against SPAM > be targeted by AOL ? > > I can't see their rationale behind it? (Maybe their abuse department is > far too overstretched as is, but a simple filter to ditch/bin/redirect > mail from SPAMCOP abuse would suffice?). > > As one AOL user pointed out to me, they still get a ton of SPAM so their > policies can't be that effective. > > > Just curious as to if this was discussed previously. > > Regards > > Chris > > ps. Hope this is the right group for this discussion. From Kilgallen at SpamCop.net Sun Mar 19 21:55:49 2006 From: Kilgallen at SpamCop.net (Larry Kilgallen) Date: Sun Mar 19 23:00:01 2006 Subject: [SC-Help] Re: To Chris References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: In article , "Jeff" writes: > off. I'm not putting up with your atttitude either! I'm not ignorant, I've > studied computers and know way more than you could possibly imagine so > shutup and get lost! This was NEVER addresssed to you, little nervy > bastard!! I have not been following this, but someone who had studied computers adequately would know how to send something only to the person to whom it was addressed, such that it could not be read by others. On the other hand, if it was posted to a public forum, it is for public discussion. From chris.a.wright at gmail.com Mon Mar 20 07:36:11 2006 From: chris.a.wright at gmail.com (Chris Wright) Date: Mon Mar 20 02:40:15 2006 Subject: [SC-Help] Re: To Chris In-Reply-To: References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: Jeff wrote: > I suggest Chris that you shut the FUCK UP!! Mind your own business and fuck > off. I'm not putting up with your atttitude either! I'm not ignorant, I've > studied computers and know way more than you could possibly imagine so > shutup and get lost! This was NEVER addresssed to you, little nervy > bastard!! > > > > LMFAO - Thanks for confirming your brain size, IQ and show size are all in perfect harmony. With an attitude like that, its no wonder you can't understand the basics of the problem, let alone the reason for the problem, and why it only effects you. Take a day off, grow up some, or go find a forum more suited to you age/maturity. (That might actually involve going back to paper and pens if you are even capable of using them). Studied computers my arse... The studied gives you away, a McDonalds employee who happens to own a computer does not count as an expert (though not to discriminate against McDonalds staff). You sent a mail to a public forum, expect a public answer. Thanks for the early morning laugh. When I have to get up early in the morning to get the kids stuff ready for school (unlike you, I reached puberty, got past that, had kids etc), seeing your email made me appreciate that there are less fortunate people in the world and so, life can be that bad. Regards Chris From chris.a.wright at gmail.com Mon Mar 20 08:50:14 2006 From: chris.a.wright at gmail.com (Chris Wright) Date: Mon Mar 20 03:55:04 2006 Subject: [SC-Help] Re: AOL Issue In-Reply-To: References: Message-ID: You really are just making a fool out of yourself. Keep digging. Read my post again, and you'll find that I don't use AOL. You'll also find that AOL are so far down my preference list that you'll be down there with them. So yet again you show your inability to understand even the most basic of problems. Hurry up, you'll be needing to get ready for school quite soon. To save yourself further embarrassment, I'd quit posting for a few years if I were you. And you did it again, the "Advanced people like me" statement had us all laughing. Chris Jeff wrote: > Then don't use AOL, dumbass! AOL SUCKS! You're quite ignorant if you use > AOL!! AOL is for newbies. Advanced people like me, use a REAL ISP, you > obviously are the ignorant one, not me so don't try to label me again, > understand idiot of the day??? > > "Chris Wright" wrote in message > news:duul3k$7kp$1@news.spamcop.net... >> It was mentioned in another thread, but I have never been able to find any >> other mention of it. >> >> I've been a user of SPAMCOP for a few years now, and have no problems with >> reporting of SPAM etc. >> >> A good few months back I started getting failure messages back from AOL >> when I used accounts that I forward SPAM from to SPAMCOP. >> >> Something along the lines of "AOL is not able to process your email >> because it comes from a domain that reports SPAM". >> >> Was this ever discussed on SPAMCOP? >> >> Are you aware of any other ISP's/Organizations that do similar. >> >> As I have always considered AOL one level above amoeba, it wasn't a >> problem to me. I contacted the AOL users via GMAIL and forwarded them a >> copy of the returned mail headers. Showing them that they won't allow >> people who report SPAM to send them mail, let alone those that send SPAM >> in the first place. Most were offended enough to ditch AOL, or at least >> complain and for everyone person I get to quit AOL, the better I feel. >> >> Does anyone know their justification for doing this? >> >> Why would people I consider responsible, or part of the fight against SPAM >> be targeted by AOL ? >> >> I can't see their rationale behind it? (Maybe their abuse department is >> far too overstretched as is, but a simple filter to ditch/bin/redirect >> mail from SPAMCOP abuse would suffice?). >> >> As one AOL user pointed out to me, they still get a ton of SPAM so their >> policies can't be that effective. >> >> >> Just curious as to if this was discussed previously. >> >> Regards >> >> Chris >> >> ps. Hope this is the right group for this discussion. > > From ndlover2002 at sbcglobal.net Mon Mar 20 06:33:17 2006 From: ndlover2002 at sbcglobal.net (Jeff) Date: Mon Mar 20 06:35:17 2006 Subject: [SC-Help] Re: To Chris References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: FUCK OFF LOSER!! I don't need your shitty ass and I'm not immature so fuck off!! BASTARD!! My brain is fine by the way and you can go to hell with the devil!! Losers attack me and you are just as immature so don't try to act above me because you are not. Mind your own business for the billionth time, fucking prick! Go fuck some gay guys, what a laughable joke you are, LMAO. "Chris Wright" wrote in message news:dvlm0u$bqh$1@news.spamcop.net... > Jeff wrote: >> I suggest Chris that you shut the FUCK UP!! Mind your own business and >> fuck off. I'm not putting up with your atttitude either! I'm not >> ignorant, I've studied computers and know way more than you could >> possibly imagine so shutup and get lost! This was NEVER addresssed to >> you, little nervy bastard!! >> >> >> >> > LMFAO - Thanks for confirming your brain size, IQ and show size are all > in perfect harmony. > > With an attitude like that, its no wonder you can't understand the basics > of the problem, let alone the reason for the problem, and why it only > effects you. > > > Take a day off, grow up some, or go find a forum more suited to you > age/maturity. (That might actually involve going back to paper and pens > if you are even capable of using them). > > Studied computers my arse... The studied gives you away, a McDonalds > employee who happens to own a computer does not count as an expert (though > not to discriminate against McDonalds staff). > > You sent a mail to a public forum, expect a public answer. > > Thanks for the early morning laugh. When I have to get up early in the > morning to get the kids stuff ready for school (unlike you, I reached > puberty, got past that, had kids etc), seeing your email made me > appreciate that there are less fortunate people in the world and so, life > can be that bad. > > > Regards > > Chris From chris.a.wright at gmail.com Mon Mar 20 11:44:05 2006 From: chris.a.wright at gmail.com (Chris Wright) Date: Mon Mar 20 06:45:03 2006 Subject: [SC-Help] Re: To Chris In-Reply-To: References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: Do you have any toys left in your pram? Jeff wrote: > FUCK OFF LOSER!! I don't need your shitty ass and I'm not immature so fuck > off!! > > BASTARD!! > > My brain is fine by the way and you can go to hell with the devil!! > > Losers attack me and you are just as immature so don't try to act above me > because you are not. > > Mind your own business for the billionth time, fucking prick! Go fuck some > gay guys, what a laughable joke you are, LMAO. > > > "Chris Wright" wrote in message > news:dvlm0u$bqh$1@news.spamcop.net... >> Jeff wrote: >>> I suggest Chris that you shut the FUCK UP!! Mind your own business and >>> fuck off. I'm not putting up with your atttitude either! I'm not >>> ignorant, I've studied computers and know way more than you could >>> possibly imagine so shutup and get lost! This was NEVER addresssed to >>> you, little nervy bastard!! >>> >>> >>> >>> >> LMFAO - Thanks for confirming your brain size, IQ and show size are all >> in perfect harmony. >> >> With an attitude like that, its no wonder you can't understand the basics >> of the problem, let alone the reason for the problem, and why it only >> effects you. >> >> >> Take a day off, grow up some, or go find a forum more suited to you >> age/maturity. (That might actually involve going back to paper and pens >> if you are even capable of using them). >> >> Studied computers my arse... The studied gives you away, a McDonalds >> employee who happens to own a computer does not count as an expert (though >> not to discriminate against McDonalds staff). >> >> You sent a mail to a public forum, expect a public answer. >> >> Thanks for the early morning laugh. When I have to get up early in the >> morning to get the kids stuff ready for school (unlike you, I reached >> puberty, got past that, had kids etc), seeing your email made me >> appreciate that there are less fortunate people in the world and so, life >> can be that bad. >> >> >> Regards >> >> Chris > > From no.spam.4.me at xs4all.nl Mon Mar 20 17:43:03 2006 From: no.spam.4.me at xs4all.nl (Nico Bartels) Date: Mon Mar 20 11:45:03 2006 Subject: [SC-Help] Re: To Chris References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: <4smt12h6nsigalj9dntscbbr3q8h5v0j9i@nbartels.net> On Mon, 20 Mar 2006 06:33:17 -0500, "Jeff" wrote: >FUCK OFF LOSER!! I don't need your shitty ass and I'm not immature so fuck >off!! I can see clearly who is the loser here... -- |\ | | \|ico Panic now and avoid the rush! From jzeitlin at spamcop.net Mon Mar 20 13:21:25 2006 From: jzeitlin at spamcop.net (=?ISO-8859-1?Q?E=F6nw=EB?=) Date: Mon Mar 20 13:25:02 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: <3jst12d0fkofhkkc5rpecodoslevru4igb@4ax.com> On Fri, 17 Mar 2006 20:43:56 -0800, "anon" wrote: >"Mike Easter" wrote in message >news:dvfv90$7rc$1@news.spamcop.net... >> Jeff wrote: >>> I also have not been getting the reports back from submitted spam. >** >I also have not been getting reports back since Mar 15 middle of the >afternoon (PST.) >Have even tried resubmitting the spam - still nothing back. >Have resubmitted stale spam - still nothing back - usually I, at least, get >the 'too old' message - nothing. I'm not having any problems, at all, which suggests to me that Mike's original hypothesis is correct: It's at the ISPs of those who are having problems, not at SpamCop. -- E?nw? (SpamCop subscriber, not staff/admin) From vxpy7do02 at sneakemail.com Mon Mar 20 11:03:34 2006 From: vxpy7do02 at sneakemail.com (anon) Date: Mon Mar 20 14:05:03 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> <3jst12d0fkofhkkc5rpecodoslevru4igb@4ax.com> Message-ID: "E?nw?" wrote in message news:3jst12d0fkofhkkc5rpecodoslevru4igb@4ax.com... > On Fri, 17 Mar 2006 20:43:56 -0800, "anon" > wrote: > >>"Mike Easter" wrote in message >>news:dvfv90$7rc$1@news.spamcop.net... >>> Jeff wrote: >>>> I also have not been getting the reports back from submitted spam. > >>** >>I also have not been getting reports back since Mar 15 middle of the >>afternoon (PST.) > >>Have even tried resubmitting the spam - still nothing back. > >>Have resubmitted stale spam - still nothing back - usually I, at least, >>get >>the 'too old' message - nothing. > > I'm not having any problems, at all, which suggests to me that Mike's > original hypothesis is correct: It's at the ISPs of those who are having > problems, not at SpamCop. ** SC adm said my hotmail had been bouncing (for no discernable reason), so the account was suspended. -- A SpamCop user and forum reader, Not Admin *** > -- > E?nw? > (SpamCop subscriber, not staff/admin) From ericw at spamcop.net Mon Mar 20 21:15:09 2006 From: ericw at spamcop.net (Eric) Date: Mon Mar 20 16:20:03 2006 Subject: [SC-Help] Re: Citibank phishing fools spamcop References: Message-ID: "Mike Easter" wrote in news:dvf7o5$p2l$1@news.spamcop.net: > I don't know about your source code page view in FF, but the reason > for devnulling the spoof addy is this: > > Parsing input: citigroup.com > Host citigroup.com (checking ip) = 192.193.217.120 > host 192.193.217.120 = citibank.com (cached) > Routing details for 192.193.217.120 > Report routing for 192.193.217.120: pwong@mail.citicorp.com > pwong@mail.citicorp.com redirects to emailspoof@citigroup.com > emailspoof@citigroup.com bounces (6 sent : 6 bounces) > > If a redirect addy bounces, then SC is going to devnull it. I sent a manual report to emailspoof@citigroup.com and got an autoresponse back in a couple minutes. Perhaps spamcop is misintrepeting the autoresponse as a bounce? > http://www.spamcop.net/sc?id=z899512392z27f4f1df34c194a7a021036571ca6ee > 7z > > If you post the tracker only, which is all you need to do, since it > provides access to the original spam in a better condition than the > spam you post into .spam, there is no need to post anything to .spam. > .spam is only for posting 'junk' such as complete spams, not for > discussing. No complete spams are allowed in the discussion groups -- > but of course trackers are. So there is no need to use the group > .spam at all if you post a tracker. I will remember that in the future. From ericw at spamcop.net Mon Mar 20 21:23:41 2006 From: ericw at spamcop.net (Eric) Date: Mon Mar 20 16:25:03 2006 Subject: [SC-Help] Request for help? Message-ID: I just received the email below, and it got routed into my junk folder in Outlook. I'm not sure why this was sent to me, as I do not recognize the email address. Return-Path: Delivered-To: spamcop-net-xxxx@spamcop.net Received: (qmail 26964 invoked from network); 20 Mar 2006 20:05:03 -0000 X-Spam-Checker-Version: SpamAssassin 3.1.1 (2006-03-10) on blade4 X-Spam-Level: X-Spam-Status: hits=0.0 tests=none version=3.1.1 Received: from unknown (192.168.1.101) by blade4.cesmail.net with QMQP; 20 Mar 2006 20:05:03 -0000 Received: from smtpout-3202.bay.webtv.net (209.240.205.137) by mailgate.cesmail.net with SMTP; 20 Mar 2006 20:05:02 -0000 Received: from storefull-3156.bay.webtv.net (bay-6me-tv-1a-natpool- 1.bay.webtv.net [209.240.207.249]) by smtpout-3202.bay.webtv.net (WebTV_Postfix+sws) with ESMTP id 63690D8D8 for ; Mon, 20 Mar 2006 12:05:02 -0800 (PST) Received: (from production@localhost) by storefull-3156.bay.webtv.net (8.8.8-wtv-f/mt.gso.26Feb98) id MAA26923; Mon, 20 Mar 2006 12:05:02 -0800 (PST) X-WebTV-Signature: 1 ETAtAhRPuGGdKNGy+vnsGNU+lDYxvZh8LwIVAKfz+z4rJWZtq7nS7wS9mnNXY9aw From: jecsby@webtv.net (jean e) Date: Mon, 20 Mar 2006 12:05:01 -0800 To: xxxx@spamcop.net Subject: SPAM COP Message-ID: <363-441F0AED-16190@storefull-3156.bay.webtv.net> Content-Disposition: Inline Content-Type: Text/Plain; Charset=US-ASCII Content-Transfer-Encoding: 7Bit MIME-Version: 1.0 (WebTV) X-SpamCop-Checked: 192.168.1.101 209.240.205.137 209.240.207.249 Could you help me? I haven't gotten my Spam Reports back for about a week now. How do I find out what the problem is? I wrote Spamcop but got no answere. ........... Jean From MikeE at ster.invalid Mon Mar 20 13:25:22 2006 From: MikeE at ster.invalid (Mike Easter) Date: Mon Mar 20 16:30:03 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> <3jst12d0fkofhkkc5rpecodoslevru4igb@4ax.com> Message-ID: anon wrote: > SC adm said my hotmail had been bouncing (for no discernable reason), > so the account was suspended. Once upon a time I belonged to a mailing list whose listserv server had trouble interacting [actually getting mx information] from EL's servers for some very complex and 'curious' reasons. As a result of that, very often the mailing list items would be delayed by hours, or days, or the server would give up because of excessive delays. The situation was made more complex because no one else on the mailing list was having any trouble receiving the list's mail, and no one else I knew at EL was having any trouble receiving their mailing lists. So the problem was with the 'peculiarities' of the configuration of the listserver and the configuration of EL's mx information. That listserv had a 'process' by which it kept track of the mails which failed, so that they could be retrieved by their item number, and it had another process based on repeated failures which would unsubscribe the recipient whose mails were failing -- after a test probe also failed. Because there was such a problem with the listserver getting the EL mx/es, it was common that the probing process woud take place, in addition to the problems with much delayed mail and the problems with mail which actually failed delivery, but in spite of that, I was never actually unsubbed. There's a point to that story because there were a lot of glitches between the list server and my provider's server, but no unsubbing or the equivalent of 'account suspended'. In the case of SC, if there is even a temporary glitch, then the account is suspended. That has advantages and disadvantages; but the principle disadvantage is that maybe it is too easy for the account to become suspended. Maybe it should be a little 'harder' or more complicated. The current system assumes that the account is going to be either feeding spams to the webparser, or perhaps there is also an alert when the regular reporter goes to the tracking url to complete the report. That means that those who are doing everything by 'remote control' of such as quick submits and no visiting of the webparser or the reporting tracker wouldn't even know the account had been suspended because there wouldn't be a 'trigger' to notify them. They would have to notice the absence of something -- namely SC replies to quick reporting.. -- Mike Easter kibitzer, not SC admin From devnull at spamcop.net Mon Mar 20 16:42:39 2006 From: devnull at spamcop.net (Frog Prince) Date: Mon Mar 20 16:45:02 2006 Subject: [SC-Help] Re: To Chris References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: "Jeff" \ | FUCK OFF LOSER!! I don't need your shitty ass and I'm not immature so fuck | off!! | | BASTARD!! | | My brain is fine by the way and you can go to hell with the devil!! | | Losers attack me and you are just as immature so don't try to act above me | because you are not. | | Mind your own business for the billionth time, fucking prick! Go fuck some | gay guys, what a laughable joke you are, LMAO. The Japanese judge a person's intelligence and education by the number of Kanji they known. Base on that measure and using English ... is that the sum total of your vocabulary? From MikeE at ster.invalid Mon Mar 20 15:51:32 2006 From: MikeE at ster.invalid (Mike Easter) Date: Mon Mar 20 18:55:03 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> <3jst12d0fkofhkkc5rpecodoslevru4igb@4ax.com> Message-ID: Mike Easter wrote: > The current system assumes that the account is going to be either > feeding spams to the webparser, or perhaps there is also an alert when > the regular reporter goes to the tracking url to complete the report. Doh! The regular reporter wouldn't be going to the tracking url to complete the report because there wouldn't be any mail with a tracking url. The regular reporter needs to be able to do 2 things somehow: - notice that s/he isn't getting SC replies to the email submissions - know to go to the webparser if s/he isn't getting SC replies So does the quick email reporter. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Mon Mar 20 16:11:28 2006 From: MikeE at ster.invalid (Mike Easter) Date: Mon Mar 20 19:15:04 2006 Subject: [SC-Help] Re: Request for help? References: Message-ID: Eric wrote: > I just received the email below, and it got routed into my junk > folder in Outlook. Presumably you have a spamcop mail account which filters for you and you pop from the SC mailbox. The headers don't say that it would be tagged as spam by SC's filters, so it was message ruled by your OL into its Junk folder. You should examine your rules carefully if you don't know why this item was so ruled. Maybe you have a whitelist system for which everything that isn't known is Junk. > I'm not sure why this was sent to me, as I do not > recognize the email address. S/he must've found your addy somewhere around here and decided that you were the person s/he wanted to email the question. > Could you help me? I haven't gotten my Spam Reports back for about a > week now. How do I find out what the problem is? I wrote Spamcop but > got no answere. We've just been discussing that if something causes a bounce from SC to the user, then the reporting account becomes suspended. The user is supposed to find that out by going to the webparser at http://www.spamcop.net/ logged in. -- Mike Easter kibitzer, not SC admin From SkyKing140 at webtv.net Mon Mar 20 20:05:43 2006 From: SkyKing140 at webtv.net (Jim Martin) Date: Mon Mar 20 20:20:02 2006 Subject: [SC-Help] Re: Request for help? References: Message-ID: <25085-441F5167-2972@storefull-3238.bay.webtv.net> Jean (j e c s b y @ w . .) is a valued WebTv user who is also frustrated with what is happening with those of us who are forced to use HotMail as our mailserver (WebTv, MSNTV and computer users that use MSN as their ISP). I have already posted Don's response in two active WebTv forums so the newer gmail or stuff better than that should be looking pretty attractive to us webbies, Jim From SpamCopMember at webtv.net Mon Mar 20 20:36:36 2006 From: SpamCopMember at webtv.net (JIm Martin) Date: Mon Mar 20 20:50:02 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: Message-ID: <27376-441F58A4-2873@storefull-3232.bay.webtv.net> -Jeff, I am just a WebTv user but it appears as though your tiny feelings have been hurt. If you choose to use SpamCop to report spams one by one rather than using your SpamCop reporting page, you obviously do not seem to have the ability to learn anything here. Please do us all a favor and learn how to make manual spam reports, ok? Jim SkyKing140@spamcop.net ---- (the above addy is filtered by SpamCop) From jecsby at webtv.net Mon Mar 20 18:03:25 2006 From: jecsby at webtv.net (jean e) Date: Mon Mar 20 21:20:01 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: Message-ID: <11498-441F5EED-1511@storefull-3151.bay.webtv.net> I haven't gotten my spam Reports back now, for a week. I've written SPAM COP three times and no answer. . I just read in another group that others are having the same problem. I don't think it's on this end. My ISP is MSNTV. ......... Jean From jecsby at webtv.net Mon Mar 20 18:05:19 2006 From: jecsby at webtv.net (jean e) Date: Mon Mar 20 21:20:09 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? (Tom) References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> Message-ID: <11498-441F5F5F-1512@storefull-3151.bay.webtv.net> How do you log on to Spam cop, to report SPAM? ......... Jean From MikeE at ster.invalid Mon Mar 20 18:22:41 2006 From: MikeE at ster.invalid (Mike Easter) Date: Mon Mar 20 21:25:02 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? (Tom) References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> <11498-441F5F5F-1512@storefull-3151.bay.webtv.net> Message-ID: jean e wrote: > How do you log on to Spam cop, to report SPAM? . This page http://www.spamcop.net/ looks different whether you are logged in or not. To login you need the password you were given with the account for the email addy. -- Mike Easter kibitzer, not SC admin From jecsby at webtv.net Mon Mar 20 18:39:32 2006 From: jecsby at webtv.net (jean e) Date: Mon Mar 20 21:50:02 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <11498-441F5F5F-1512@storefull-3151.bay.webtv.net> Message-ID: <11498-441F6764-1514@storefull-3151.bay.webtv.net> I just got this back from Spam Cop ...........Jean > > My SPAMCOP reports stopped coming back about a week ago. Can you help me find the problem? This is my reporting address. submit.O2pk8PIkcPz3sAUN@spam.spamcop.net On Wednesday, March 15, 2006, our mail to you was rejected by WebTV, which automatically caused your account with us to be suspended. I don't know if they're still blocking our mail or not. I removed the suspension from your account so you can try reporting spam again. If you don't get our responses, you should log into your account at http://www.spamcop.net/ to see if our mail has bounced again. - Don - From scamper at trisk.com Mon Mar 20 20:34:51 2006 From: scamper at trisk.com (Garen Erdoisa) Date: Mon Mar 20 22:35:04 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? In-Reply-To: <11498-441F6764-1514@storefull-3151.bay.webtv.net> References: <11498-441F5F5F-1512@storefull-3151.bay.webtv.net> <11498-441F6764-1514@storefull-3151.bay.webtv.net> Message-ID: jean e wrote: > I just got this back from Spam Cop > ...........Jean >> > My SPAMCOP reports stopped coming back about a week ago. Can you help me > find the problem? > > This is my reporting address. > > [snipped] You should keep your reporting address confidential between just you and spamcop. Since you disclosed it on a public forum, I'd recommend as soon as you can to register a new reporting address which will at the same time retire the old reporting address. In response to your how to logon, and report spam question posted earlier: When you first access spamcop there is a "logon" button displayed in the upper right part of the web page. You can use that to logon using the username and password you selected during registration. This username/password combination is independent of your reporting address. To submit spam you have a couple of options. One is to just paste a copy of the raw spam (including all headers) into the spamcop parser. Another is to forward the spam as an attachment to your reporting address. Either way will generate an acknowledgment email from spamcop which will have a web link in it that you can use to view and confirm or cancel the report. You can also access unreported spam by browsing to spamcop.net, then select the "report spam" tab on the web page. If you bookmark that "report spam" page it should make it easier for you since you can just use the bookmark after that. > [snip] Hope this helps with your problem. Regards; Garen Erdoisa P.S.: Note: I'm a long time spamcop user, not a spamcop admin. From devnull at spamcop.net Mon Mar 20 23:26:08 2006 From: devnull at spamcop.net (Frog Prince) Date: Mon Mar 20 23:50:03 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <11498-441F5F5F-1512@storefull-3151.bay.webtv.net> <11498-441F6764-1514@storefull-3151.bay.webtv.net> Message-ID: I've had problems with hotmail.com so I switched to another primary account. I'm having NO problem with mail to that account but still getting the bounce mail message. From vxpy7do02 at sneakemail.com Mon Mar 20 20:48:26 2006 From: vxpy7do02 at sneakemail.com (anon) Date: Mon Mar 20 23:50:08 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? References: <11498-441F5EED-1511@storefull-3151.bay.webtv.net> Message-ID: "jean e" wrote in message news:11498-441F5EED-1511@storefull-3151.bay.webtv.net... >I haven't gotten my spam Reports back now, for a week. I've written > SPAM COP three times and no answer. ** Maybe these two non responses are related. Are you writing from the same mailbox that the responses are supposed to go to?? You are probably not getting any response because THAT mailbox is refusing ALL mail. Try contacting deputies-at-spamcop.net from another mailbox so that the replies go to a different mailbox than the SC responses are (not) going to. (I was not getting any response to my spam submittals and the deputy said that the response mailbox was bouncing their responses - therefore they suspended my account.) -- A SpamCop user and forum reader, Not Admin *** > . > I just read in another group that others are having the same problem. I > don't think it's on this end. My ISP is MSNTV. > ......... Jean > From billrubin at prodigy.net Thu Mar 23 23:34:24 2006 From: billrubin at prodigy.net (Bill) Date: Thu Mar 23 23:35:03 2006 Subject: [SC-Help] Phish mail usually not reported to real site Message-ID: <442376D0.D58115E9@prodigy.net> I notice that when I pass phish mail that I've received through Spamcop, it typically does not end up reporting it to the owner of the website that is being spoofed. I personally think that ebay/Paypal mail should always been sent to spoof@ebay/paypal, etc. The only times it seems to get reported to the actual site is when there is a link to that site in the email. The user should have a way of telling Spamcop "this is phish mail" and selecting where it gets sent to, as well as the FBI or whoever investigates these things. Bill From scamper at trisk.com Thu Mar 23 22:39:43 2006 From: scamper at trisk.com (Garen Erdoisa) Date: Fri Mar 24 00:40:03 2006 Subject: [SC-Help] Re: Phish mail usually not reported to real site In-Reply-To: <442376D0.D58115E9@prodigy.net> References: <442376D0.D58115E9@prodigy.net> Message-ID: Bill wrote: > I notice that when I pass phish mail that I've received through > Spamcop, it typically does not end up reporting it to the owner > of the website that is being spoofed. I personally think that > ebay/Paypal mail should always been sent to spoof@ebay/paypal, > etc. The only times it seems to get reported to the actual site > is when there is a link to that site in the email. The user I've noticed that about paypal and ebay also. It seems that in the case of paypal and ebay, both of them don't like the format of spamcop reports. For those, I do a separate report directly to spoof@ebay/paypal in addition to spamcop, then try to remember to uncheck anything spamcop has routed their way. I also forward copies phish emails to reportphishing [at] antiphishing [dot] org which has both paypal, ebay, and many other financial institutions as sponsors. According to their website they do interface internationally with law enforcement as well to help get phishing sites shut down as soon as possible. Unfortunately it seems that 10 new zombie sites pop up for every one that gets shut down these days. Spamcop I feel is mostly useful for notifying the abuse desks of affected sites (as a courtesy) about new sources of spam originating from networks under their control. It's not much use for notifying an abuse desk about a spam problem when the abuse desk doesn't care. Those types of sites tend to be hard coded into spamfilters if they let it go long enough, which are 100 times harder to get out of than a mere DNS blocklist, since a spamfilter has to go through a publish cycle and have people actually install the updates. What those abuse desks choose to do with the reports they receive is entirely up to them. If they do nothing, the affected IP's eventually end up being blocked or filtered one way or another. So eventually the problem is taken care of by them, or by the rest of us collectively. > should have a way of telling Spamcop "this is phish mail" and > selecting where it gets sent to, as well as the FBI or whoever > investigates these things. You can add user defined recipients in your settings. Look in preferences, report handling options, Public standard report recipients It's just a comma separated list of email address which will let you check/uncheck for each spam report. It used to default to unchecked, but spamcop made a change (maybe a bug that they haven't fixed yet) that now has those all default to checked. Because of that, I took most of them off of mine since I found myself sometimes inadvertently sending spam reports to the wrong places when I got in a hurry because of forgetting to uncheck a box in that list. > > Bill Garen From MikeE at ster.invalid Fri Mar 24 01:19:53 2006 From: MikeE at ster.invalid (Mike Easter) Date: Fri Mar 24 04:20:09 2006 Subject: [SC-Help] Re: Phish mail usually not reported to real site References: <442376D0.D58115E9@prodigy.net> Message-ID: Bill wrote: > I notice that when I pass phish mail that I've received through > Spamcop, it typically does not end up reporting it to the owner > of the website that is being spoofed. A spamcop notify of the provider for URL in a spam is supposed to be about that site being *spamvertised*. The entity being spoofed is *not* supposed to be getting a apsmcop spamvertiser notify, and in fact the spoofed entity would 'qualify' as an innocent bystander, vis a spamcop notify whose purpose is to advise the provider that their client is spamvertising. The spoofed entity would be a 3rd party to notify. > I personally think that > ebay/Paypal mail should always been sent to spoof@ebay/paypal, > etc. Whether the spoofed entity is notified by a spamcop 3rd party notify or by a manual notify is the discretion of the paid spamcop reporter. The free reporter doesn't get to use 3rd party spamcop notifies. > The only times it seems to get reported to the actual site > is when there is a link to that site in the email. And those spamcop notifies are *not * appropriate, since the spoofed entity is not a spamvertiser. > The user > should have a way of telling Spamcop "this is phish mail" and > selecting where it gets sent to, as well as the FBI or whoever > investigates these things. The paid spamcop reporter can add additional notifies. That is described here: http://www.spamcop.net/fom-serve/cache/126.html How should I select the recipients for my spam report? -- Other email addresses (members only, experts only) -- SpamCop will make no assertions about the administrator's role, so you should include some of your own comments in the "additional notes" space. Explain why you think they should review the spam report. You can put up to four email addresses into this field Notice the part about assertions about the role of the notified. A normal SC notification is an official spamcop 'accusation' that the object of the notification is that the URL client is a spamvertiser. The spoofed entity is *not* a spamvertiser. The spoofed entity's spoof address is an appropriate notify, for example either manually by a free reporter or as a 3rd party by a spamcop reporter, but not an appropriate spamcop report in the regular sense. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Fri Mar 24 01:33:18 2006 From: MikeE at ster.invalid (Mike Easter) Date: Fri Mar 24 04:35:03 2006 Subject: [SC-Help] Re: Phish mail usually not reported to real site References: <442376D0.D58115E9@prodigy.net> Message-ID: Garen Erdoisa wrote: > I do a separate report directly to > spoof@ebay/paypal in addition to spamcop, Yes.. > then try to remember to > uncheck anything spamcop has routed their way. Yes.. > I also forward copies > phish emails to reportphishing [at] antiphishing [dot] org which has > both paypal, ebay, and many other financial institutions as sponsors. Yes -- Mike Easter kibitzer, not SC admin From fullerm at spam.killer.remove.cyber-matrix.com Fri Mar 24 08:31:52 2006 From: fullerm at spam.killer.remove.cyber-matrix.com (Michael Fullerton) Date: Fri Mar 24 10:35:03 2006 Subject: [SC-Help] No longer getting back spam reporting link emails Message-ID: I am no longer getting back spam reporting link emails. I recently did some changes to my email accounts and there might have been a few bounces but I can login to SC and there are no alerts. My ISPs do not block any email. ___ VirusCop - Free Windows virus reporting utility http://www.viruscop.org/ From elg at none.com Fri Mar 24 09:44:31 2006 From: elg at none.com (El Guapo) Date: Fri Mar 24 10:45:03 2006 Subject: [SC-Help] URL Not being Resolved Message-ID: I have received over a dozen e-mails yesterday advertising a website called buldoser.info, or a derivative. Each time, spamcop reports the url cannot be resolved, but the website pops right up in my browser. What is going on? Cannot resolve http://buldoser.info/al/022/ Cannot resolve http://buldoser.info/al/024/ I apologize for listing the actual site name if that is not allowed or discouraged. I'm sure someone will point out my faux pax if that is the case. From MikeE at ster.invalid Fri Mar 24 08:18:46 2006 From: MikeE at ster.invalid (Mike Easter) Date: Fri Mar 24 11:20:04 2006 Subject: [SC-Help] Re: No longer getting back spam reporting link emails References: Message-ID: Michael Fullerton wrote: > I am no longer getting back spam reporting link emails. I recently did > some changes to my email accounts and there might have been a few > bounces but I can login to SC and there are no alerts. My ISPs do not > block any email. Try putting your own address or alternate address of yours as an additional To or CC to the submit and see if you get that. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Fri Mar 24 08:34:54 2006 From: MikeE at ster.invalid (Mike Easter) Date: Fri Mar 24 11:35:02 2006 Subject: [SC-Help] Re: URL Not being Resolved References: Message-ID: El Guapo wrote: > I have received over a dozen e-mails yesterday advertising a website > called buldoser.info, or a derivative. Each time, spamcop reports the > url cannot be resolved, but the website pops right up in my browser. > > What is going on? > > Cannot resolve http://buldoser.info/al/022/ > Cannot resolve http://buldoser.info/al/024/ > > I apologize for listing the actual site name if that is not allowed or > discouraged. I'm sure someone will point out my faux pax if that is > the case. My resolver resolves buldoser.info -- SC's resolver doesn't. There's a problem with the .info zone nameservice at this time. See below. dnsstuff's resolver doesn't. dnsstuff also has an ISP cache tool. Quite a number of ISPs have the IP for buldoser, including my own, which explains why I would be able to get the IP 58.20.176.18 and why a GET or a browser function would work for me. The dnsstuff story sez that when the root-server goes to the ULTRADNS.info nameserver that it gets no response. That is what is currently broken. So, the nameservice is flawed at the next to the highest levels. If a system can't get the IP, then the webserver can't be queried. If your provider's nameserver already has the IP, there's no need to get it at the high levels. There can be a webpage on a server, but if the user's nameservice doesn't know the IP address, it isn't going to work. If your ISP's nameserver has the IP, you can get the webpage. But, if it didn't, then the process would be to go to the root server which tells it which nameserver to get the information. If that nameserver doesn't give the answer, the link is dead because of the nameservice problem. That name is supposed to have 4 nameservers. buldoser.info NS (Nameserver) managedns3.estboxes.com buldoser.info NS (Nameserver) managedns4.estboxes.com buldoser.info NS (Nameserver) managedns1.estboxes.com buldoser.info NS (Nameserver) managedns2.estboxes.com You are supposed to be able to find out that information like this: How I am searching: Searching for buldoser.info A record at b.root-servers.net [192.228.79.201]: Got referral to TLD6.ULTRADNS.CO.UK. [took 95 ms] Searching for buldoser.info A record at TLD6.ULTRADNS.CO.UK. [198.133.199.11]: Reports that no A records exist. [took 29 ms] Answer: No A records exist for buldoser.info. [Neg TTL=7200 seconds] Details: TLD6.ULTRADNS.CO.UK. (an authoritative nameserver for info.) says that there are no A records for buldoser.info. The E-mail address in charge of the info. zone is: domadmin@ultradns.net. -- Mike Easter kibitzer, not SC admin From fullerm at spam.killer.remove.cyber-matrix.com Fri Mar 24 10:10:41 2006 From: fullerm at spam.killer.remove.cyber-matrix.com (Michael Fullerton) Date: Fri Mar 24 12:15:03 2006 Subject: [SC-Help] Re: No longer getting back spam reporting link emails References: Message-ID: "Mike Easter" wrote: >Michael Fullerton wrote: >> I am no longer getting back spam reporting link emails. I recently did >> some changes to my email accounts and there might have been a few >> bounces but I can login to SC and there are no alerts. My ISPs do not >> block any email. > >Try putting your own address or alternate address of yours as an >additional To or CC to the submit and see if you get that. I just tried it and I got the CC email. The link also came back so I guess complaining here works. (: ___ VirusCop - Free Windows virus reporting utility http://www.viruscop.org/ From post.please.this.email.is.not.valid at example.com Sat Mar 25 17:22:53 2006 From: post.please.this.email.is.not.valid at example.com (DougW) Date: Sat Mar 25 18:25:04 2006 Subject: [SC-Help] false positive? Message-ID: I'm getting spamcop returning spamsign for 216.145.48.34 That's Yahoo's corp-o-rat boxen, where the autoacks come from mail-abuse[]cc.yahoo-inc.com Just for your info/giggles/birdcage liner.... -- DougW From MikeE at ster.invalid Sat Mar 25 15:32:02 2006 From: MikeE at ster.invalid (Mike Easter) Date: Sat Mar 25 18:35:03 2006 Subject: [SC-Help] Re: false positive? References: Message-ID: DougW wrote: > I'm getting spamcop returning spamsign for 216.145.48.34 > That's Yahoo's corp-o-rat boxen, where the autoacks come from > mail-abuse[]cc.yahoo-inc.com 216.145.48.34 rDNS mail-relay1.yahoo.com listed in bl.spamcop.net spam traps users have reported system as a source of spam past 18.5 days, it has been listed 7 times for a total of 9.4 days other reporteds: 216.145.49.15 not listed So, that output server spends about half its time SCbl/ed. -- Mike Easter kibitzer, not SC admin From post.please.this.email.is.not.valid at example.com Sun Mar 26 02:06:43 2006 From: post.please.this.email.is.not.valid at example.com (DougW) Date: Sun Mar 26 03:10:17 2006 Subject: [SC-Help] Re: false positive? References: Message-ID: Mike Easter did pass the time by typing: > DougW wrote: >> I'm getting spamcop returning spamsign for 216.145.48.34 >> That's Yahoo's corp-o-rat boxen, where the autoacks come from >> mail-abuse[]cc.yahoo-inc.com > > 216.145.48.34 rDNS mail-relay1.yahoo.com > listed in bl.spamcop.net > spam traps > users have reported system as a source of spam > past 18.5 days, it has been listed 7 times for a total of 9.4 days > > other reporteds: 216.145.49.15 not listed > > So, that output server spends about half its time SCbl/ed. ooookay.. I'll just whitelist the mail-abuse@ and be done with it. From fullerm at spam.killer.remove.cyber-matrix.com Sun Mar 26 08:11:14 2006 From: fullerm at spam.killer.remove.cyber-matrix.com (Michael Fullerton) Date: Sun Mar 26 10:15:03 2006 Subject: [SC-Help] Re: No longer getting back spam reporting link emails References: Message-ID: Michael Fullerton wrote: >"Mike Easter" wrote: > >>Michael Fullerton wrote: >>> I am no longer getting back spam reporting link emails. I recently did >>> some changes to my email accounts and there might have been a few >>> bounces but I can login to SC and there are no alerts. My ISPs do not >>> block any email. >> >>Try putting your own address or alternate address of yours as an >>additional To or CC to the submit and see if you get that. > >I just tried it and I got the CC email. The link also came back so I >guess complaining here works. (: There is still a problem. I sent in two reports early this morning and nothing has arrived yet. I have had this problem sporadically for the last month or so. It has gotten really bad this last several days. ___ VirusCop - Free Windows virus reporting utility http://www.viruscop.org/ From MikeE at ster.invalid Sun Mar 26 07:30:29 2006 From: MikeE at ster.invalid (Mike Easter) Date: Sun Mar 26 10:35:03 2006 Subject: [SC-Help] Re: No longer getting back spam reporting link emails References: Message-ID: Michael Fullerton wrote: > Michael Fullerton >> "Mike Easter" >>> Michael Fullerton wrote: >>>> I am no longer getting back spam reporting link emails. I recently >>>> did some changes to my email accounts and there might have been a >>>> few bounces but I can login to SC and there are no alerts. My ISPs >>>> do not block any email. >>> >>> Try putting your own address or alternate address of yours as an >>> additional To or CC to the submit and see if you get that. >> >> I just tried it and I got the CC email. The link also came back so I >> guess complaining here works. (: > > There is still a problem. I sent in two reports early this morning and > nothing has arrived yet. I have had this problem sporadically for the > last month or so. It has gotten really bad this last several days. You may have more than one pattern of trouble. Troubleshooting inconsistent problems requires that the entire troubleshooting operation be performed each time, or during a problem and also not a problem. You have to keep checking the SC login and make sure there are no alerts. You have to keep CCing an address you control. Trying a 'trick' and not having the problem show itself during the troubleshooting trick doesn't actually contribute to understanding the solution or making a diagnosis. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Sun Mar 26 07:48:17 2006 From: MikeE at ster.invalid (Mike Easter) Date: Sun Mar 26 10:50:03 2006 Subject: [SC-Help] Re: No longer getting back spam reporting link emails References: Message-ID: Michael Fullerton wrote: > I > guess complaining here works. (: A word on smileys, since you make yours like a friend of mine who is a .nz kiwi -- which is 'upside down' or 'left handed' as well as 'abbreviated' The most popular smiley is made with the eyes on the left, a nose, and then the smile :-) I most often use a winking smiley ;-) The ever-popular and lovely wife, mother, radiohost and computer columnist Kim Komando has been known to use the abbreviated smiley, which is missing a nose, except Kim made hers in the normal right-handed fashion. :) I searched thru' Kim's website and newsletter archives to see if I could find an example of the 'short' noseless smiley, but I couldn't. She has written articles and made giant lists of different emoticons in which she displays the 'correct' or classic smiley :-) so perhaps the copy of the KK newsletter which a friend of mine sent me with the little noseless smiley was an error or something. So, in summary, I would encourage a right handed classic smiley -- a left handed one causes the parenthesis to look like a frown or unsmiley, and then the emoticon 'reader' has to re-orient themselves about the smile vs frown based on the eyes which are missing a nose. Overall, the confusion interferes with the instant 'impact' of an emoticon. An emoticon is supposed to convey an 'immediate' message in a picture, not a sense of confused interpretation of a 'mixed message'. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Sun Mar 26 08:02:06 2006 From: MikeE at ster.invalid (Mike Easter) Date: Sun Mar 26 11:05:03 2006 Subject: [SC-Help] Re: No longer getting back spam reporting link emails References: Message-ID: Mike Easter wrote: > I searched thru' Kim's website and newsletter archives to see if I > could find an example of the 'short' noseless smiley, but I couldn't. I found it. She signs off every one of her newsletters with a Kim :) I'll see you tomorrow with another great tip! Kim :) Tomorrow's tip is all about burning CDs. So you don't want to miss it. Kim :) -- Mike Easter kibitzer, not SC admin From hywel.jenkins at gmail.com Sun Mar 26 17:58:48 2006 From: hywel.jenkins at gmail.com (Hywel Jenkins) Date: Sun Mar 26 12:00:03 2006 Subject: [SC-Help] Unkown Error: 10 Message-ID: Anyone know what this really means? I've been getting it for about 8 hours, but now SpamCop has POP'd twenty or so messages from my main POP account, but it seems to have lost them all: Inbox and Held Mail are both empty, but the messages have, apparently, been deleted. -- Hywel http://kibo.org.uk/ From post.please.this.email.is.not.valid at example.com Sun Mar 26 13:10:20 2006 From: post.please.this.email.is.not.valid at example.com (DougW) Date: Sun Mar 26 14:15:03 2006 Subject: [SC-Help] spamcop hiccup Message-ID: Resolving link obfuscation http://.birchwet.net#surfeitpostwar Tracking link: http://.birchwet.net#surfeitpostwar No recent reports, no history available Cannot resolve http://.birchwet.net#surfeitpostwar This among others. All the same format http://www.spamcop.net/sc?id=z906776672z250d55850ad822b2ba8aec97192b1686z -- DougW From MikeE at ster.invalid Sun Mar 26 11:45:35 2006 From: MikeE at ster.invalid (Mike Easter) Date: Sun Mar 26 14:50:02 2006 Subject: [SC-Help] Re: spamcop hiccup References: Message-ID: That's not a SC hiccup, that's a spammer barf. DougW wrote: > Resolving link obfuscation > http://.birchwet.net#surfeitpostwar The chars '<' and '>' are special and 'unsafe' chars not to be used in that way in a url. Also, the '#' is a special char whose use is only appropriate in the right way -- which is *not* attached to the toplevel domainname. Here's one place about that kind of information http://www.blooberry.com/indexdot/html/topics/urlencoding.htm RFC 1738: Uniform Resource Locators (URL) specification -- What characters need to be encoded and why? -- "Reserved characters" -- "Unsafe characters" > Tracking link: http://.birchwet.net#surfeitpostwar > No recent reports, no history available > > Cannot resolve http://.birchwet.net#surfeitpostwar www.spamcop.net/sc?id=z906776672z250d55850ad822b2ba8aec97192b1686z Spammers do all kinds of illegal and 'inappropriate' things with their url/s because they know that browsers are very error tolerant. I can't imagine a browser being so error tolerant as to acquire that link. Here's a message I posted in an EL support group earlier today about writing in the message body: Mike Easter wrote: Subject: How to create a new news message > For those who don't understand the important difference between the > subject and the body of a news message. > > The body of the news message is an extremely important element. The > body is where the message's real content should reside, and the body's > content should be designed so that when someone answers the message, > important questions and observations have been stated. This enables > the contextualization of an answer to follow those words when/if a > reply is made. > > The subject of the message has a different function. It's job is to > 'reference' the content of the body succinctly, in a terse way, the > way a paragraph or section of an outline might define the content in > a few words. The subject is not the place to ask the question or to > make the statement -- with an empty body or a body which fails to > convey the 'message' of the message. > > When learning how to write subjects and bodies for a new message, a > good method is to write the body first. By doing so, you get all of > the important information properly located there. Then, after the > entire message has been placed into the body, the subject can be > created to 'characterize' that body's content. That prevents the > 'problem' of starting a message in the subject, asking the question > or making the statement there, and then having 'nothing else to say' > in the body. -- Mike Easter kibitzer, not SC admin From billrubin at prodigy.net Tue Mar 28 22:40:45 2006 From: billrubin at prodigy.net (Bill) Date: Tue Mar 28 22:40:02 2006 Subject: [SC-Help] Using Google redirect to hide the real link, Spamcop doesn't de-obfuscate Message-ID: <442A01BD.6B3077D9@prodigy.net> I've noticed that spammers are using site redirects to hide the real URL that they are going to. Here is an example from a recent Chase phish mail I received: Resolving link obfuscation http://www.google.com/url?sa=u&start=4&q=http://220.181.9.242/.chaseonlinesm.chase.com/ Host www.google.com (checking ip) = 64.233.179.104 host 64.233.179.104 (getting name) no name Tracking link: http://www.google.com/url?sa=u&start=4&q=http://220.181.9.242/.chaseonlinesm.chase.com/ No recent reports, no history available ISP does not wish to receive report regarding google.com You will notice that Spamcop did not try to report the 220.181.9.242 address, it never got past Google. I think there is a similar issue with something like rd.yahoo.com. Does Spamcop need to be made smarter so it can report the real site that these lowlifes are using? From fullerm at spam.killer.remove.cyber-matrix.com Wed Mar 29 20:06:22 2006 From: fullerm at spam.killer.remove.cyber-matrix.com (Michael Fullerton) Date: Wed Mar 29 22:10:03 2006 Subject: [SC-Help] Re: No longer getting back spam reporting link emails References: Message-ID: "Mike Easter" wrote: >Michael Fullerton wrote: >> Michael Fullerton >>> "Mike Easter" >>>> Michael Fullerton wrote: > >>>>> I am no longer getting back spam reporting link emails. I recently >>>>> did some changes to my email accounts and there might have been a >>>>> few bounces but I can login to SC and there are no alerts. My ISPs >>>>> do not block any email. >>>> >>>> Try putting your own address or alternate address of yours as an >>>> additional To or CC to the submit and see if you get that. >>> >>> I just tried it and I got the CC email. The link also came back so I >>> guess complaining here works. (: >> >> There is still a problem. I sent in two reports early this morning and >> nothing has arrived yet. I have had this problem sporadically for the >> last month or so. It has gotten really bad this last several days. > >You may have more than one pattern of trouble. Troubleshooting >inconsistent problems requires that the entire troubleshooting operation >be performed each time, or during a problem and also not a problem. I switched to a different SMTP server instead of Shaw and all reports are now coming back. Does that mean SC is blocking Shaw? BTW regarding the backwards smiley, I just do that to be different and to annoy those that cannot stand those who are. ___ VirusCop - Free Windows virus reporting utility http://www.viruscop.org/ From MikeE at ster.invalid Wed Mar 29 20:17:59 2006 From: MikeE at ster.invalid (Mike Easter) Date: Wed Mar 29 23:20:02 2006 Subject: [SC-Help] Re: No longer getting back spam reporting link emails References: Message-ID: Michael Fullerton wrote: >>>>> Michael Fullerton wrote: >> >>>>>> I am no longer getting back spam reporting link emails. > I switched to a different SMTP server instead of Shaw and all reports > are now coming back. Does that mean SC is blocking Shaw? No. More likely that shaw was involved in interfering with the circle -- where the circle is that you email a bunch of spam attachments via your shaw provider's server and then SC mails you back the links via your shaw provider. The circle passes thru' shaw twice. If there wasn't a bounce caused SC suspension of the reporting account, the most likely problem is related to provider interference with one of the two way traffics. > BTW regarding the backwards smiley, I just do that to be different and > to annoy those that cannot stand those who are. You get to do whatever you want to do -- I was just telling you about the traditional models in case you weren't aware. -- Mike Easter kibitzer, not SC admin From diespammer at spamthis.net Thu Mar 30 00:56:57 2006 From: diespammer at spamthis.net (die spammer) Date: Thu Mar 30 04:00:16 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? In-Reply-To: References: Message-ID: > Mike isn't experiencing the problem. Benny isn't experiencing the > problem. Tom has a problem receiving his returns, but his email > submissions are reaching spamcop's parsing system. You haven't done > your troubleshooting homework yet. > > There are tons of spamcop users reading and posting to the forum and the > newsgroups and there isn't a widespread clamor about a problem, which > suggests that whatever this problem is, isn't widespread at all. this is just one more problem that adds to the mile long list of stuff we have to do. what else would we be doing? doing someting like getting some R&R after a long day at work ? LOL ya right... From diespammer at spamthis.net Thu Mar 30 01:04:27 2006 From: diespammer at spamthis.net (die spammer) Date: Thu Mar 30 04:10:02 2006 Subject: [SC-Help] Re: What's wrong now, Spamcop? In-Reply-To: <877r12l4j16mg4ab807eo3h134jlaanjb9@4ax.com> References: <5vkm1297v6ts2q7sucuu66ktdsl98jvspn@4ax.com> <877r12l4j16mg4ab807eo3h134jlaanjb9@4ax.com> Message-ID: > HotMail has suddenly taken to bouncing a lot of our mail with a > "timeout" error. I don't know why. Maybe the HotMail servers are too > busy to answer right away, or maybe our servers are too quick to bail > out if they don't get an immediate response. I dont remember having sent any reports to hotmail out of all the years reporting spam. even recently , all spam seems to be 3rd world. so this recent "bounce" that I have experienced wouldn't have been from hotmail as far as I can tell. From fullerm at spam.killer.remove.cyber-matrix.com Thu Mar 30 05:55:34 2006 From: fullerm at spam.killer.remove.cyber-matrix.com (Michael Fullerton) Date: Thu Mar 30 08:00:03 2006 Subject: [SC-Help] Re: No longer getting back spam reporting link emails References: Message-ID: "Mike Easter" wrote: >Michael Fullerton wrote: > >>>>>> Michael Fullerton wrote: >>> >>>>>>> I am no longer getting back spam reporting link emails. > >> I switched to a different SMTP server instead of Shaw and all reports >> are now coming back. Does that mean SC is blocking Shaw? > >No. More likely that shaw was involved in interfering with the >circle -- where the circle is that you email a bunch of spam attachments >via your shaw provider's server and then SC mails you back the links via >your shaw provider. The circle passes thru' shaw twice. If there >wasn't a bounce caused SC suspension of the reporting account, the most >likely problem is related to provider interference with one of the two >way traffics. Shaw seems to be saying that SC is blocking because there are no errors on sending so that means the email was sent out. SC does not receive them. If SC did receive them there would be an indication that there are unreported links but there isn't. The Shaw tech I talked to said one of the Shaw servers is on SORBS but shawmail.cg.shawcable.net seems to be pretty clean. ___ VirusCop - Free Windows virus reporting utility http://www.viruscop.org/ From edb2000 at spamcop.net Thu Mar 30 06:10:23 2006 From: edb2000 at spamcop.net (Don Wannit) Date: Thu Mar 30 09:15:03 2006 Subject: [SC-Help] Re: No longer getting back spam reporting link emails In-Reply-To: References: Message-ID: Michael Fullerton wrote: > "Mike Easter" wrote: > > >>Michael Fullerton wrote: >> >> >>>>>>>Michael Fullerton wrote: >>>> >>>>>>>>I am no longer getting back spam reporting link emails. >> >>>I switched to a different SMTP server instead of Shaw and all reports >>>are now coming back. Does that mean SC is blocking Shaw? >> >>No. More likely that shaw was involved in interfering with the >>circle -- where the circle is that you email a bunch of spam attachments >>via your shaw provider's server and then SC mails you back the links via >>your shaw provider. The circle passes thru' shaw twice. If there >>wasn't a bounce caused SC suspension of the reporting account, the most >>likely problem is related to provider interference with one of the two >>way traffics. > > > Shaw seems to be saying that SC is blocking because there are no > errors on sending so that means the email was sent out. SC does not > receive them. If SC did receive them there would be an indication that > there are unreported links but there isn't. The Shaw tech I talked to > said one of the Shaw servers is on SORBS but shawmail.cg.shawcable.net > seems to be pretty clean. Almost certainly SpamCop does not block or refuse incoming spam report emails sent to a reporting address, even if the sending IP is listed on a blocklist. Almost certainly the problem here is that the outgoing email is silently dropped by Shaw, perhaps because it contains detectable spam. -- Don Wannit A paid SpamCop user since 1999 From johnl at in.newsgroup.only Thu Mar 30 14:43:42 2006 From: johnl at in.newsgroup.only (JohnL) Date: Thu Mar 30 09:45:02 2006 Subject: [SC-Help] Re: No longer getting back spam reporting link emails References: Message-ID: Michael Fullerton wrote in news:dokn22h5g9j1qp5rgl3427q5jtekgd2ggo@4ax.com: > The Shaw tech I talked to > said one of the Shaw servers is on SORBS but shawmail.cg.shawcable.net > seems to be pretty clean. Uh, you might want to check... http://spews.org/ask.cgi?x=24.71.223.43 Or directly... http://spews.org/html/S3163.html Shaw has just about all their I.P.'s listed. From MikeE at ster.invalid Fri Mar 31 04:19:18 2006 From: MikeE at ster.invalid (Mike Easter) Date: Fri Mar 31 07:20:02 2006 Subject: [SC-Help] Re: No longer getting back spam reporting link emails References: Message-ID: Michael Fullerton wrote: > "Mike Easter" >>>>>>>> I am no longer getting back spam reporting link emails. >> >>> I switched to a different SMTP server instead of Shaw and all >>> reports are now coming back. Does that mean SC is blocking Shaw? >> >> No. More likely that shaw was involved in interfering with the >> circle - > Shaw seems to be saying that SC is blocking because there are no > errors on sending so that means the email was sent out. I disagree with Shaw saying SC blocks them. Remember the troubleshooting you were supposed to do from the conversation earlier and that when you get differing results that you are supposed to perform the troubleshooting over again under the changed conditions. What happens when you copy the SC submits to yourself at an alternate address? Remember that step? -- Mike Easter kibitzer, not SC admin