From abuse at whathostingshould.be Wed May 3 09:28:27 2006 From: abuse at whathostingshould.be (Galen) Date: Wed May 3 08:30:10 2006 Subject: [SC-Help] I'm not sure if this is the right place - SPLOG. Message-ID: They call it SPLOG, SPAM + Blog = SPLOG it seems. It is pretty ruthless and does come with some information such as IP address and the likes. I thought about posting this in the social but, well, that didn't seem right. It's more a question about the future then it is about help. Is there any plans in the works to make SPLOG reporting an option that anyone is aware of? I do know that there are countless scripts/programs for blogging and I'm aware that there's no standard at this point that I'm able to find but, well, this seems to be the most logical place to ask. Thoughts? Anything in the works or even thought about? I realize that this is email and (finally - thanks guys) usenet SPAM reporting but, again, this seemed like something to ask in here - mostly because there's nothing that I'm able to find online where anyone's doing anything effective about it. Galen From 3okwuc5t001 at loncps.demon.co.uk Thu May 4 20:11:08 2006 From: 3okwuc5t001 at loncps.demon.co.uk (Chris Salter) Date: Thu May 4 14:15:02 2006 Subject: [SC-Help] Registering mail hosts Message-ID: <7LtmxMK8OkWEFAsc@loncps.demon.co.uk> Although I first started reporting spam to Spamcop at least as far back as early 2002 I stopped reporting several years ago; precisely why I cannot recall. Having decided to give it a go again I am having a slight difficulty deciding how to respond to the mail hosts configuration set of pages. I understand the general principal of configuring the final receiving host first BUT this appears to not quite dovetail with my particular set-up. I will try and explain. The final receiving 'mail host', which I will call 'domain Z extension', is a pop3 server running on my PC, i.e. I have configured it to use domain Z in the receiving header it generates. It collects mail from all my other hosts. Domain Z is also my legacy domain and Broadband provider BUT I do not collect legacy email directly from its servers. Instead, I have domain A hosted at a different service provider which automatically collects mail from domain Z and drops it in a domain A pop3 mailbox. The same provider also hosts half a dozen or so further domains that I manage, e.g. domains B,C,D,E etc and the final destination of all mail for those domains and of course Domain A is my local pop3 server, domain Z extension. My registered Spamcop address is in Domain A, not Domain Z. Domain Z mail is only collected at hourly intervals and is also filtered through Brightmail at Domain Z. Domain A mail is also filtered through SpamAssassin but I have total control over that so I prefer my Spamcop reporting address to be under that domain. The problem is that the first hosting domain configuration page (which has to be for the last receiving host) appears to be tied into the spamcop reporting address which is NOT the last receiving host in the chain. Advice anyone? Thanks, Chris -- Chris Salter From MikeE at ster.invalid Thu May 4 15:22:03 2006 From: MikeE at ster.invalid (Mike Easter) Date: Thu May 4 17:25:04 2006 Subject: [SC-Help] Re: Registering mail hosts References: <7LtmxMK8OkWEFAsc@loncps.demon.co.uk> Message-ID: Chris Salter wrote: > The final receiving 'mail host', which I will call 'domain Z > extension', is a pop3 server running on my PC, i.e. I have configured > it to use domain Z in the receiving header it generates. I wouldn't call that Z your 'final receiving mailhost' according to the par below. > I have domain A hosted at a different service > provider which automatically collects mail from domain Z and drops it > in a domain A pop3 mailbox. I would call /that/ A your final receiving mailhost. There just above you are saying that all of the mail from all of the different places that you receive at Z is 'collected' - which I presume to mean forwarded - from Z to A - at A mailbox. There above it sez that A is last, right after Z. > the > final destination of all mail for those domains and of course Domain > A is my local pop3 server, domain Z extension. I thought you just said that Z mail was forwarded to A -- you said A collects mail from Z. Now you are saying that Z is last. That is discordant. > My registered Spamcop address is in Domain A, not Domain Z. I don't think the registered spamcop address is important here except that it identifies the account. > The problem is that the first hosting domain configuration page (which > has to be for the last receiving host) appears to be tied into the > spamcop reporting address which is NOT the last receiving host in the > chain. > > Advice anyone? Think of your registered address as your 'account number' rather than a username+domainname. But I'm confused about the discrepancy mentioned above about which is the last host in the chain between A vs Z. -- Mike Easter kibitzer, not SC admin From HerbEppel at gmail.com Sun May 7 17:34:26 2006 From: HerbEppel at gmail.com (Herbert Eppel) Date: Sun May 7 11:35:02 2006 Subject: [SC-Help] Re: Loads of spam showing "Delviery Status Notification", "Failure Notice" etc. In-Reply-To: References: <1145201196.288571.50190@u72g2000cwu.googlegroups.com> Message-ID: On 28.04.2006 15:06 UK Time, Mike Easter wrote: > Herbert Eppel wrote: > >> I have the same problem as the one reported by Rowan on 16 April, and >> I would like to get to the bottom of it, but I'm not quite sure how to >> create a tracker. > > Okay. > >> Mike said "You get it by submitting one of those spams you are trying >> to describe to the webparser", but I'm not sure where I can find this >> webparser and how exactly I can submit messages. >> >> Can you help? > > Sure. > > First you have to become a [theoretical or real] free or paid SpamCop > reporter by registering. > > http://www.spamcop.net/anonsignup.shtml Getting Started > > Be sure you read all of the rules about the responsibilities of being a > reporter; and the faq about how to obtain complete headers of spam with > your mailuser agent. Naturally the responsibilities apply to those SC > reports which are going to be actually sent, not just parsed and copy a > tracker and then cancelled if that is what is your interest and purpose. > > You will be emailed an authorization letter which contains the username > which is the email address you provided, a password which is 8 > alphanumerics case sensitive, and a link to a couple of different ways > to log in, with or without cookies. > > When you are properly logged in, this page will display a webparser > http://www.spamcop.net/ Welcome, xxxx > > You paste your spam into that parser which spam with complete headers > was obtained by the guidelines here > http://www.spamcop.net/fom-serve/cache/19.html How do I get my email > program to reveal the full, unmodified email? > > If your mailuser agent is Tbird, you use this link > http://www.spamcop.net/fom-serve/cache/21.html Netscape, Mozilla and > Thunderbird > > Then you paste the spam into the webparser which will provide a tracking > UJRL at the top of the page which is in this environment > > Here is your TRACKING URL - it may be saved for future reference: > http://www.spamcop.net/sc?id=z921452706z5f80c3536f02ccd15f431f0fc87fc372z > > You copy that tracker so that you can paste it into a news message here > and then you cancel the report, unless you have chosen to send it > according to the responsibilities described in the rules. > >> Thank you. > > YW. Hi Mike, thanks again for the detailed instructions, and sorry about the delay in following it up. Here is a tracking URL for one of the messages I received recently: http://www.spamcop.net/sc?id=z937307358ze15961079deba7261d7636c948c79feez In order to avoid potential confusion, perhaps I should say that I am not particularly concerned about those message delivery notifications themselves - what I am worried about is that my domain name appears to be used by something/someone to sending out spam (and virus?) messages. Do you have any advise on how I should proceed in order to 'clear my name'? Thank you. Herbert Eppel -- www.HETranslation.co.uk From MikeE at ster.invalid Sun May 7 11:43:29 2006 From: MikeE at ster.invalid (Mike Easter) Date: Sun May 7 13:45:03 2006 Subject: [SC-Help] Re: Loads of spam showing "Delviery Status Notification", "Failure Notice" etc. References: <1145201196.288571.50190@u72g2000cwu.googlegroups.com> Message-ID: Herbert Eppel wrote: > Here is a tracking URL for one of the messages I received recently: www.spamcop.net/sc?id=z937307358ze15961079deba7261d7636c948c79feez I see a stock spam in the form of a b64/d .gif whose To & From are munged, sourced from a dynamic and spamsource listed 84.163.142.229 rDNS p54A38EE5.dip0.t-ipconnect.de and carrying a Received bogus line. That stockspam was received by the server at 200.49.96.73 rDNS antispam7.netizen.com.ar which server emailed it as an attachment to cyberstrider.net/gmx.net presumably as a belated DSN-failed which was abusively new emailed to the bogus From or Return-Path. That abusive .ar server IP is spews listed -- the basis of which I can't tell just now because spews isn't currently accessible. Spews resolves, but the webserver must be down, I can't see a port 80 at its 216.168.31.31 > In order to avoid potential confusion, perhaps I should say that I am > not particularly concerned about those message delivery notifications > themselves - what I am worried about is that my domain name appears to > be used by something/someone to sending out spam (and virus?) > messages. This is not a virus, this is a b64 gif spam. If and presumably you received this because your addy was forged as a bogus From, you can't do anything about that other than spamcop report the abusive server which isn't currently SC blocklisted. You don't have a mechanism to make the spammer stop spamming or stop forging your addy as a From. Altho' it is annoying, it is not meaningful in terms of your 'good name'. The normal situation is that almost all spam has forged Froms, it is to be expected, and those forged Froms are most often derived from the same lists as the lists of those which are spammed. No one creates any blocklists on the basis of forged From, with the exception of some end user ninnies who use 'block sender' as a response to spams received. You can't do anything about ninnies doing that either. > Do you have any advise on how I should proceed in order to 'clear my > name'? No name clearing is possible or necessary. It is not necessary because nothing in that spam process 'besmirches' your name or addy except possibly in your own mind. So clear that besmirched idea out of your head. -- Mike Easter kibitzer, not SC admin From nobody at spamcop.net Sun May 7 17:22:54 2006 From: nobody at spamcop.net (SJones) Date: Sun May 7 16:25:03 2006 Subject: [SC-Help] Re: Loads of spam showing "Delviery Status Notification", "Failure Notice" etc. In-Reply-To: References: <1145201196.288571.50190@u72g2000cwu.googlegroups.com> Message-ID: On or about 5/7/2006 11:34 AM, Herbert Eppel penned the following: > On 28.04.2006 15:06 UK Time, Mike Easter wrote: >> Herbert Eppel wrote: >> >>> I have the same problem as the one reported by Rowan on 16 April, and >>> I would like to get to the bottom of it, but I'm not quite sure how to >>> create a tracker. >> >> Okay. >> >>> Mike said "You get it by submitting one of those spams you are trying >>> to describe to the webparser", but I'm not sure where I can find this >>> webparser and how exactly I can submit messages. >>> >>> Can you help? >> >> Sure. >> >> First you have to become a [theoretical or real] free or paid SpamCop >> reporter by registering. >> >> http://www.spamcop.net/anonsignup.shtml Getting Started >> >> Be sure you read all of the rules about the responsibilities of being a >> reporter; and the faq about how to obtain complete headers of spam with >> your mailuser agent. Naturally the responsibilities apply to those SC >> reports which are going to be actually sent, not just parsed and copy a >> tracker and then cancelled if that is what is your interest and purpose. >> >> You will be emailed an authorization letter which contains the username >> which is the email address you provided, a password which is 8 >> alphanumerics case sensitive, and a link to a couple of different ways >> to log in, with or without cookies. >> >> When you are properly logged in, this page will display a webparser >> http://www.spamcop.net/ Welcome, xxxx >> >> You paste your spam into that parser which spam with complete headers >> was obtained by the guidelines here >> http://www.spamcop.net/fom-serve/cache/19.html How do I get my email >> program to reveal the full, unmodified email? >> >> If your mailuser agent is Tbird, you use this link >> http://www.spamcop.net/fom-serve/cache/21.html Netscape, Mozilla and >> Thunderbird >> >> Then you paste the spam into the webparser which will provide a tracking >> UJRL at the top of the page which is in this environment >> >> Here is your TRACKING URL - it may be saved for future reference: >> http://www.spamcop.net/sc?id=z921452706z5f80c3536f02ccd15f431f0fc87fc372z >> >> You copy that tracker so that you can paste it into a news message here >> and then you cancel the report, unless you have chosen to send it >> according to the responsibilities described in the rules. >> >>> Thank you. >> >> YW. > > Hi Mike, > > thanks again for the detailed instructions, and sorry about the delay in > following it up. > > Here is a tracking URL for one of the messages I received recently: > http://www.spamcop.net/sc?id=z937307358ze15961079deba7261d7636c948c79feez > > In order to avoid potential confusion, perhaps I should say that I am > not particularly concerned about those message delivery notifications > themselves - what I am worried about is that my domain name appears to > be used by something/someone to sending out spam (and virus?) messages. > > Do you have any advise on how I should proceed in order to 'clear my name'? > > Thank you. > > Herbert Eppel I normally parse the e-mail through spamcop and then copy it into an e-mail to the originating (as determined by spamcop) ISP with one of the two preambles: The following e-mail which was returned to me as a non-delivery was *NOT* originated by me. A parsing of the headers by spamcop shows that it was originated within your network. Please investigate this case of identity theft and let me know the results. I may wish to press charges against the perpetrator. Thank you. OR Regarding the e-mail below. A parsing of the header by spamcop shows the originating ISP to be . One of your users is using my identity. This message was NOT originated by me. This is a case of identity theft and is being reported to proper authorities. I request you take action. (fill in the x's with info from spamcop's parsing) and then either continue with spamcop reporting or cancel the report and send the e-mail directly to the originating ISP. -- SJones From r.antiochdunkthis at dunkthisntlworld.com Tue May 9 15:46:11 2006 From: r.antiochdunkthis at dunkthisntlworld.com (antioch) Date: Tue May 9 09:50:03 2006 Subject: [SC-Help] Re: ikarma stock spam References: Message-ID: Hello Leslie SG Looks familiar - sounds familiar - come back and talk Antioch 'You cant educate pork' "Leslie S. Gottlieb" wrote in message news:e2qjhd$p7c$1@news.spamcop.net... > What is werid about this is that I had just e-mailed and browsed the site > that my mail is forged from (www.wpi.edu). Do I have a virus? Is anyone > stopping this ikarma stock spammer at all? > > Return-Path: > Received: from mx26.nyc.untd.com (mx26.nyc.untd.com [10.140.24.86]) > by maildeliver25.lax.untd.com with SMTP id AABCFBVGWA544DLA > for (sender ); > Thu, 27 Apr 2006 06:53:25 -0700 (PDT) > Received: from mail1.wpi.edu (MAIL1.WPI.EDU [130.215.36.91]) > by mx26.nyc.untd.com with SMTP id AABCFBVGWANGD5N2 > for (sender ); > Thu, 27 Apr 2006 06:53:24 -0700 (PDT) > Received: from alum.WPI.EDU (ALUM.WPI.EDU [130.215.36.126]) > by mail1.wpi.edu (8.13.6/8.13.6) with ESMTP id k3RDrOwv021245 > for ; Thu, 27 Apr 2006 09:53:24 -0400 > Received: from mail1.wpi.edu (MAIL1.WPI.EDU [130.215.36.91]) > by alum.WPI.EDU (8.13.6/8.13.6) with ESMTP id k3RDrOCT068933 > for ; Thu, 27 Apr 2006 09:53:24 -0400 (EDT) > Received: from mcafee.wpi.edu (MCAFEE.WPI.EDU [130.215.36.86]) > by mail1.wpi.edu (8.13.6/8.13.6) with SMTP id k3RDrOtQ021238 > for ; Thu, 27 Apr 2006 09:53:24 -0400 > Received: from (130.215.36.186) by mcafee.wpi.edu via smtp > id 558d_76ba9722_d5f4_11da_8821_00304811e63a; > Thu, 27 Apr 2006 09:48:09 -0400 > Received: from utility5.wpi.edu (UTILITY5.WPI.EDU [130.215.36.226]) > by SMTP.WPI.EDU (8.13.6/8.13.6) with ESMTP id k3RDrMv1014928 > for ; Thu, 27 Apr 2006 09:53:23 -0400 > Received: from CPE-144-136-143-225.qld.bigpond.net.au > (CPE-144-136-143-225.qld.bigpond.net.au [144.136.143.225]) > by utility5.wpi.edu (8.13.6/8.13.6) with SMTP id k3RDqthl032551 > for ; Thu, 27 Apr 2006 09:53:18 -0400 > Received: from kceb.dyq ([144.136.112.153]) > by CPE-144-136-143-225.qld.bigpond.net.au (8.13.2/8.13.2) with SMTP id > k3RDvcFN035065; > Thu, 27 Apr 2006 23:57:38 +1000 > Message-ID: <000d01c66a01$e06366ea$99708890@kceb.dyq> > From: "Maude Gomez" > To: > Subject: levity hoot > Date: Thu, 27 Apr 2006 23:44:29 +1000 > MIME-Version: 1.0 > Content-Type: multipart/related; > type="multipart/alternative"; > boundary="----=_NextPart_000_0009_01C66A55.B20F7662" > X-Priority: 3 > X-MSMail-Priority: Normal > X-Mailer: Microsoft Outlook Express 6.00.2800.1158 > X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1158 > X-Perlmx-Spam: Gauge=XXXXXXXXII, Probability=82%, > Report='KNOWN_FINANCIAL_CAMPAIGN 8, HTML_90_100 0.1, __CT 0, > __CTYPE_HAS_BOUNDARY 0, __CTYPE_MULTIPART 0, __CTYPE_MULTIPART_ALT 0, > __EMBEDDED_IMG 0, __EXTRA_MPART_TYPE_1 0, __EXTRA_MPART_TYPE_N1 0, > __HAS_MSGID 0, __HAS_MSMAIL_PRI 0, __HAS_X_MAILER 0, __HAS_X_PRIORITY 0, > __MIME_HTML 0, __MIME_VERSION 0, __RUS_MIME_NO_TEXT 0, __SANE_MSGID 0, > __TAG_EXISTS_HTML 0' > X-ContentStamp: 0:0:2865347872 > X-UNTD-Peer-Info: > 130.215.36.91|MAIL1.WPI.EDU|mail1.wpi.edu|ndq@garysalter.com > X-UNTD-UBE:-1 > > This is a multi-part message in MIME format. > > > > > > > > -- > Leslie Gottlieb > From r.antiochdunkthis at dunkthisntlworld.com Tue May 9 16:09:33 2006 From: r.antiochdunkthis at dunkthisntlworld.com (antioch) Date: Tue May 9 10:10:02 2006 Subject: [SC-Help] Understanding SC's Reports Message-ID: Hello to this group I have recently joined spamcop in hope that I might add my help to fight spam. I spent all day yesterday(well just over 10 hours) going round and round their site, trying to figure out what it was all about. Cant say I did very well, but at my age it takes a hell of a time to let info sink in. I managed to sort out the reporting side - chose email method - seemed the easiest way - sent off 8 spams. Reports started to fly back as fast as I could send. I also had a try at searching those IP numbers. Having got these reports, I then spent some hours trying to find a way to see how to read/understand/interpret them. Despite trying various words in the search facility I gave up. It's probably there somewhere. If anybody knows then a prod in the right direction would be appreciated. Rgds Antioch P.S. I tried the forum for an answer - I think I will give that a miss. I have spent most of today have to read so much .... before making that first post. I prefer newsgroups. From MikeE at ster.invalid Tue May 9 08:26:32 2006 From: MikeE at ster.invalid (Mike Easter) Date: Tue May 9 10:30:04 2006 Subject: [SC-Help] Re: Understanding SC's Reports References: Message-ID: antioch wrote: > Hello to this group > I have recently joined spamcop in hope that I might add my help to > fight spam. Okey dokey. > I spent all day yesterday(well just over 10 hours) going round and > round their site, trying to figure out what it was all about. That is a very useful activity. > Cant say I did very well, but at my age it takes a hell of a time to > let info sink in. > I managed to sort out the reporting side - chose email method - > seemed the easiest way - sent off 8 spams. I also 'recommend' using the webparser first for most people. To me it is simpler and cleaner to 'troubleshoot'. The person needs to know how to access the raw spam with complete headers with their mailuser agent, and then they paste it into the webparser, and then they immediately see the result of the parse. Whereas emailing is a 'blackbox' concept, and if there is trouble, I think there can be confusion about where things weren't right. > Reports started to fly back as fast as I could send. > I also had a try at searching those IP numbers. I'm losing you. I don't know what you mean. > Having got these reports, I then spent some hours trying to find a > way to see how to read/understand/interpret them. Despite trying > various words in the search facility I gave up. Let's do something different. Let's talk about a spam by your posting its tracking URL. That is, you submit a spam to the parser; I recommend the webparser, but you can also use email if it is working for you. The tracker and its environment looks like: Here is your TRACKING URL - it may be saved for future reference: http://www.spamcop.net/sc?id=z939018156zce3ff9ab3b5765265194cea1472a5ccez at the top of the webparse before reporting or cancelling, which you would copy for pasting here, or in the email that SC sends you in this environment: May be saved for future reference: http://www.spamcop.net/sc?id=z939018156zce3ff9ab3b5765265194cea1472a5ccez > It's probably there somewhere. If anybody knows then a prod in the > right direction would be appreciated. I'm not sure what you are trying to find out. When you submit a spam to the webparser, it can give you its verbose output if you configure for that in the preferences. That verbose output tells you a lot about what is the parser's logic in its processes. If you think the faq was difficult to understand and navigate, you'll find the parser verbose particularly confusing. But it too is worth getting oriented with. > I prefer newsgroups. Me too. -- Mike Easter kibitzer, not SC admin From r.antiochdunkthis at dunkthisntlworld.com Tue May 9 22:03:15 2006 From: r.antiochdunkthis at dunkthisntlworld.com (antioch) Date: Tue May 9 16:05:02 2006 Subject: [SC-Help] Re: Understanding SC's Reports References: Message-ID: Hello Mike And thank you for the response - you not understanding my explanations will happen, until the 'geek/lingo' speak is more familiar. The spam I am getting is, I am told, in .gif format and so message rules do not apply, although there is a very long workaround I believe. When I have received the email reply to a spam report, what am I looking for, where do I find it, what do I do with the info contained within this report, what actions do I do or SC do for me. Of the first 8 sent, some have extra bits added to it, like Quoting: Reports re this spam have already been sent to.... If reported today, would be sent to.... Abuse@....... Re144 ... ... ... spamcop@imaphost Sorry this email is too old etc etc but goes on and gives more info plus 'If reported....then at bottom Re 144 ... ... 3rd party interest in email report. Another, towards the bottom asks if this email IS Spam with a name and email address. Then I have three choices Send Spam - Report Now - Preview Report and Cancel Underneath is a warning box - avoid checking any boxes left empty...false reports etc Quotes End I have interspliced/clipped my responses and yours just to pick out the salient points. Hope it works ;-) Hope you don't mind - and as a result, I have top-posted. :-( "Mike Easter" wrote in message news:e3q8q5$d81$1@news.spamcop.net... > That is a very useful activity. Not according to 'Her indoors' > I also 'recommend' using the webparser first for most people. To me it is > simpler and cleaner to 'troubleshoot'. The person needs to know how to > access the raw spam with complete headers with their mailuser agent, and > then they paste it into the webparser, and then they immediately see the > result of the parse. I will do as you suggest with the next 8 to 10 waiting in my 'Kill Folder'. I will need to read-up on that. >> Reports started to fly back as fast as I could send. >> I also had a try at searching those IP numbers. > I'm losing you. I don't know what you mean. As I was doing attachments to each email to send to SC, I started to get the email replies with the links like you put below as an example. And I was also doing searches re the IP numbers - I do these from time to time on other search engines, as it is a neat practice to have. > Let's do something different. > Let's talk about a spam by your posting its tracking URL. That is, you > submit a spam to the parser; I recommend the webparser, but you can also > use email if it is working for you. The tracker and its environment looks > like: > > Here is your TRACKING URL - it may be saved for future reference: > http://www.spamcop.net/sc?id=z939018156zce3ff9ab3b5765265194cea1472a5ccez > at the top of the webparse before reporting or cancelling, which you would > copy for pasting here, or in the email that SC sends you in this > environment: > May be saved for future reference: > http://www.spamcop.net/sc?id=z939018156zce3ff9ab3b5765265194cea1472a5ccez Both the above are the same? - its the info contained in them I don't understand. That is what I was asking >> It's probably there somewhere. If anybody knows then a prod in the right >> direction would be appreciated. > I'm not sure what you are trying to find out. > When you submit a spam to the webparser, it can give you its verbose > output if you configure for that in the preferences. That verbose output > tells you a lot about what is the parser's logic in its processes. If you > think the faq was difficult to understand and navigate, you'll find the > parser verbose particularl confusing. But it too is worth getting oriented with. Configure - I don't remember reading about that - I cant believe I missed something!!!! So you can get a condensed reply of info if you want?? > -- > Mike Easter > kibitzer, not SC admin Thank you again for the help. I will leave it there for the moment. Better to take things in stages. I will have a go at the web parse. Rgds Antioch 'You cant educate pork' - The bagpipes seem a better alternative. From MikeE at ster.invalid Tue May 9 15:02:18 2006 From: MikeE at ster.invalid (Mike Easter) Date: Tue May 9 17:05:04 2006 Subject: [SC-Help] Re: Understanding SC's Reports References: Message-ID: antioch wrote: > The spam I am getting is, I am told, in .gif format and so message > rules do not apply, although there is a very long workaround I > believe. One example of spams which are in a .gif are stock spams. Typically the only thing which will come out of the spamcop parse will be spamcop identifying the IP of the source and offering to report that spamsource IP to the spamsource provider. The method by which SC spamcop determines a notify is based on a lookup in the regional registrar for the IP block. All of the IPs of the world which are routing can be found in the whois lookup of one of the RIR regional internet registrars, arin, ripe, lacnic, apnic, afrinic. There is a lot of 'organization' about ICANN and its ASO and NRO and those registrars. SC uses those databases db/s to determine the contact information for the IP's block, and also uses the abuse.net registered contact or its default suggestions for a domainname derived from the RIR contact, and also uses its own experience with addresses which bounce, and also uses its own database of human adjustments referred to as 'routing' information. SC also uses any information which a provider or other admin has provided about whether it wants to be notified or not, or alternate addresses for notifying,. In addition, sometimes there are third parties which may be notified about an IP or about all IPs. > When I have received the email reply to a spam report, what am I > looking for, where do I find it, what do I do with the info contained > within this report, what actions do I do or SC do for me. > Of the first 8 sent, some have extra bits added to it, like > > Quoting: Reports re this spam have already been sent to.... > If reported today, would be sent to.... > Abuse@....... > Re144 ... ... ... > spamcop@imaphost > > Sorry this email is too old etc etc but goes on and gives more info > plus 'If reported....then at bottom Re 144 ... ... 3rd party interest > in email report. > Another, towards the bottom asks if this email IS Spam with a name > and email address. > Then I have three choices Send Spam - Report Now - Preview Report and > Cancel Underneath is a warning box - avoid checking any boxes left > empty...false reports etc > Quotes End All of that is about the reporter fulfilling hir responsibilities about reporting spam. > I have interspliced/clipped my responses and yours just to pick out > the salient points. Hope it works ;-) > Hope you don't mind - and as a result, I have top-posted. :-( > > "Mike Easter" wrote in message > news:e3q8q5$d81$1@news.spamcop.net... > >> That is a very useful activity. > > Not according to 'Her indoors' I don't understand 'her indoors' >> I also 'recommend' using the webparser first for most people. To me >> it is simpler and cleaner to 'troubleshoot'. The person needs to >> know how to access the raw spam with complete headers with their >> mailuser agent, and then they paste it into the webparser, and then >> they immediately see the result of the parse. > > I will do as you suggest with the next 8 to 10 waiting in my 'Kill > Folder'. I will need to read-up on that. You can also do it with an old one; all you have to do is parse something you have already reported, and then copy the tracking url, and then cancel the report. > As I was doing attachments to each email to send to SC, I started to > get the email replies with the links like you put below as an > example. And I was also doing searches re the IP numbers - I do these > from time to time on other search engines, as it is a neat practice > to have. I completely agree. When I first started to use spamcop, I did not use it to report. I manually parsed all of my own spam headers and 'manually' by doing my own lookups determined all of my own notifies. After I was completely thru' deriving my own notifies, then I submitted the spam to spamcop to see how spamcop would notify, and I compared SC's results with my own, and cancelled the spamcop report. When they differed, I sought to understand why my notify would be different from SC's. When I was a neophyte, it was often that SC was not only much faster at notifying than I, but also 'better'. As time went on and I became more skilled at both parsing and also deriving notify addresses, then I became better at notifying by my criteria than spamcop's notifies. >> May be saved for future reference: >> http://www.spamcop.net/sc?id=z939018156zce3ff9ab3b5765265194cea1472a5ccez > > Both the above are the same? - its the info contained in them I don't > understand. That is what I was asking We can talk about that. I have a way I like to use to abbreviate the Received headerlines. I'll use one of mine from above as an example In the above example there's only one line: Abbreviated Received traceline *comment from my.flirt.com.ua ([58.51.7.200]) by mx-roseate.atl.sa.earthlink.net *sourceline SC determines that source IP and determines the notifies for it, and also determines a spamvertised link and determines the notifies for it. In addition, SC offers to report to the 3rd party at imaphost.com -- which is another story and which I routinely uncheck. >> When you submit a spam to the webparser, it can give you its verbose >> output if you configure for that in the preferences. On the page with the webparser which I'm encouraging you to use and experience, there is a 'preferences' link which gives you access to 4 different kinds of preferences, one of which is report handling. In the report handling preferences, there are a number of choices, the 4th one of which is "Show Technical Details during reporting" I like those technical details. > That verbose >> output tells you a lot about what is the parser's logic in its >> processes. If you think the faq was difficult to understand and >> navigate, you'll find the parser verbose particularl confusing. > But it too is worth getting oriented with. > > Configure - I don't remember reading about that - I cant believe I > missed something!!!! So you can get a condensed reply of info if you > want?? The preference for show techical details is /more/ verbose or wordy, not less. > Better to take things in stages. I will have a go at the web parse. Good idea. -- Mike Easter kibitzer, not SC admin From r.antiochdunkthis at dunkthisntlworld.com Wed May 10 01:24:00 2006 From: r.antiochdunkthis at dunkthisntlworld.com (antioch) Date: Tue May 9 19:25:04 2006 Subject: [SC-Help] Re: Understanding SC's Reports References: Message-ID: "Mike Easter" wrote in message news:e3r007$1ju$1@news.spamcop.net... > One example of spams which are in a .gif are stock spams. Typically the > only thing which will come out of the spamcop parse will be spamcop > identifying the IP of the source and offering to report that spamsource IP > to the spamsource provider. Stock reports - yes they are the ones I am getting > The method by which SC spamcop determines a notify is based on a lookup in > the regional registrar for the IP block. > All of the IPs of the world which are routing can be found in the whois > lookup of one of the RIR regional internet registrars, arin, ripe, lacnic, > apnic, afrinic. There is a lot of 'organization' about ICANN and its ASO > and NRO and those registrars. They are some I have used in the past. > SC uses those databases db/s to determine the contact information for the > IP's block, and also uses the abuse.net registered contact or its default > suggestions for a domainname derived from the RIR contact, and also uses > its own experience with addresses which bounce, and also uses its own > database of human adjustments referred to as 'routing' information. SC > also uses any information which a provider or other admin has provided > about whether it wants to be notified or not, or alternate addresses for > notifying,. In addition, sometimes there are third parties which may be > notified about an IP or about all IPs. Interesting info. CLIPPED >> spamcop@imaphost >> Sorry this email is too old etc etc but goes on and gives more info >> plus 'If reported....then at bottom Re 144 ... ... 3rd party interest >> in email rep > > All of that is about the reporter fulfilling hir responsibilities about > reporting spam. So I have done another 10 or more and got all the reports back and saved. I did it as you said and by God it was fast. They must have one hell of a computer/programme. This is what I mean - unless I know what I am reading in these reports, then I have no idea what I am supposed to do next. In partic on the ones that ask if this is a spam. >> Not according to 'Her indoors' > > I don't understand 'her indoors' Are you from the other side of the pond? Her indoors OR she who must be obeyed - its the wife :-) :-) >>> I also 'recommend' using the webparser first for most people. T Done that way. > You can also do it with an old one; all you have to do is parse > something you have already reported, and then copy the tracking url, and > then cancel the report. That is handy. >>> May be saved for future reference: > http://www.spamcop.net/sc?id=z939018156zce3ff9ab3b5765265194cea1472a5ccez its the info contained in them I don't understand. That is what I was asking > We can talk about that. I have a way I like to use to abbreviate the > Received headerlines. I'll use one of mine from above as an example. > In the above example there's only one line: > Abbreviated Received traceline *comment > from my.flirt.com.ua ([58.51.7.200]) by > mx-roseate.atl.sa.earthlink.net *sourceline Sorry - you have lost me already. > SC determines that source IP and determines the notifies for it, and also > determines a spamvertised link and determines the notifies for it. In > addition, SC offers to report to the 3rd party at imaphost.com -- which > is another story and which I routinely uncheck. > >>> When you submit a spam to the webparser, it can give you its verbose >>> output if you configure for that in the preferences. CLIPPED there are a number of choices, the 4th one > of which is "Show Technical Details during reporting" I like those > technical details. Thanks for that - yes I did spot it >> That verbose >>> output tells you a lot about what is the parser's logic in its >>> processes. If you think the faq was difficult to understand and >>> navigate, you'll find the parser verbose particularl confusing. >> But it too is worth getting oriented with. This is what I want to be able to do, otherwise the whole point of coming here is rather pointless. > The preference for show techical details is /more/ verbose or wordy, not > less. As I found out when making the choices. Additional Info As I went in and did the first parse/report as you suggested, I got a report for an email that I have never received. It certainly was not the one I had copied and pasted. Panic set in - what the hell had I done - red card coming I thought. So I found a contact, pasted it in there and explained what had happened. Then I cancelled it as a choice, there and then. Forgot to save a copy though. I am waiting for their reply. I did the parse again and got a proper report the second time. Many thanks again for your patience and help. I see that in spam group there are a couple of threads re the stock spam. Better go - her etc etc is wondering when/if I am going to bed. Rgds Antioch 'The name of the slough was Spamcop' - apologies to Bunyan From not at home.today Wed May 10 01:49:52 2006 From: not at home.today (Ant) Date: Tue May 9 19:50:04 2006 Subject: [SC-Help] Re: Understanding SC's Reports References: Message-ID: The holy hand-grenade of "antioch" wrote: > "Mike Easter" wrote: >> I don't understand 'her indoors' > > Are you from the other side of the pond? Mike is from Leftpondia, whereas U and I are Rightpondians. > Her indoors OR she who must be obeyed - its the wife :-) :-) A popular UK colloquialism from the TV series Minder. "I could be so good for you". http://www.oed.com/bbcwordhunt/her-indoors.html From r.antiochdunkthis at dunkthisntlworld.com Wed May 10 01:56:21 2006 From: r.antiochdunkthis at dunkthisntlworld.com (antioch) Date: Tue May 9 20:00:02 2006 Subject: [SC-Help] Re: Understanding SC's Reports References: Message-ID: And old Rumpy-Bumpy of the Old Bailey. "Ant" wrote in message news:e3r9r0$6un$1@news.spamcop.net... > The holy hand-grenade of "antioch" wrote: > >> "Mike Easter" wrote: >>> I don't understand 'her indoors' >> >> Are you from the other side of the pond? > > Mike is from Leftpondia, whereas U and I are Rightpondians. > >> Her indoors OR she who must be obeyed - its the wife :-) :-) > > A popular UK colloquialism from the TV series Minder. > "I could be so good for you". > > http://www.oed.com/bbcwordhunt/her-indoors.html > > From MikeE at ster.invalid Tue May 9 19:15:04 2006 From: MikeE at ster.invalid (Mike Easter) Date: Tue May 9 21:15:02 2006 Subject: [SC-Help] Re: Understanding SC's Reports References: Message-ID: Ant wrote: > The holy hand-grenade of "antioch" wrote: > >> "Mike Easter" wrote: >>> I don't understand 'her indoors' >> >> Are you from the other side of the pond? > > Mike is from Leftpondia, whereas U and I are Rightpondians. You guys need to get straightened out on your ponds. There are two. The big pond and the little pond. I am on the right shore of the big pond. You guys over there on the right shores of the little pond seem to imagine that there is only one pond, and that the only people on the other side of the little pond you know about are the ones on the left shore of the little pond. That is a little bit like imagining that the earth is flat or something. We call it the Pacific Rim. OTOH -- I have no defense for the inane methods of sizing paper in the US. Why they don't adopt the logical standards of ISO 216 I have no idea. Just for the record, I believe we should use ISO 8601 for time standards and ISO 216 for paper standards. Some of you Rightpondians are a little confused about some of those issues as well. There are a few lurking non-participants in these 'topic drifts' who think the subject should be changed. Bah humbug. We don't need no steenkin' subject badges. -- Mike Easter kibitzer, not SC admin From r.antiochdunkthis at dunkthisntlworld.com Wed May 10 11:31:02 2006 From: r.antiochdunkthis at dunkthisntlworld.com (antioch) Date: Wed May 10 05:35:10 2006 Subject: [SC-Help] Re: Understanding SC's Reports References: Message-ID: "Mike Easter" wrote in message news:e3req4$9nq$1@news.spamcop.net... > Ant wrote: >> The holy hand-grenade of "antioch" wrote: >> >>> "Mike Easter" wrote: >>>> I don't understand 'her indoors' >>> >>> Are you from the other side of the pond? >> >> Mike is from Leftpondia, whereas U and I are Rightpondians. > > You guys need to get straightened out on your ponds. We know where we are - WE only have one pond. We also have a 'gutter' which keeps us away(but not enough these days) from another land-mass. > There are two. The big pond and the little pond. Gosh - you are a lucky bloke - you have two ponds ;-) ;-) > I am on the right shore of the big pond. Is that the sunny side, then? > You guys over there on the right shores of the little pond seem to > imagine that there is only one pond, and that the only people on the > other side of the little pond you know about are the ones on the left > shore of the little pond. > > That is a little bit like imagining that the earth is flat or something. > We call it the Pacific Rim. > > > OTOH -- I have no defense for the inane methods of sizing paper in the US. > Why they don't adopt the logical standards of ISO 216 I have no idea. > Just for the record, I believe we should use ISO 8601 for time standards > and ISO 216 for paper standards. > Some of you Rightpondians are a little confused about some of those issues > as well. > There are a few lurking non-participants in these 'topic drifts' who > think the subject should be changed. > Bah humbug. We don't need no steenkin' subject badges. > -- > Mike Easter > kibitzer, not SC admin > P.S. BS came back to me - they have no idea how I got another user's report. It was also pointed out that I had not activated any of my reports. So I will be spending most of the day trying to find out how to do that. Rgds Antioch From chris.a.wright at gmail.com Wed May 10 15:18:58 2006 From: chris.a.wright at gmail.com (Chris Wright) Date: Wed May 10 09:20:03 2006 Subject: [SC-Help] Re: Understanding SC's Reports In-Reply-To: References: Message-ID: LMAO Mike Easter wrote: > Ant wrote: >> The holy hand-grenade of "antioch" wrote: >> >>> "Mike Easter" wrote: >>>> I don't understand 'her indoors' >>> Are you from the other side of the pond? >> Mike is from Leftpondia, whereas U and I are Rightpondians. > > You guys need to get straightened out on your ponds. > > There are two. The big pond and the little pond. > > I am on the right shore of the big pond. > > You guys over there on the right shores of the little pond seem to > imagine that there is only one pond, and that the only people on the > other side of the little pond you know about are the ones on the left > shore of the little pond. > > That is a little bit like imagining that the earth is flat or something. > We call it the Pacific Rim. > > > OTOH -- I have no defense for the inane methods of sizing paper in the > US. Why they don't adopt the logical standards of ISO 216 I have no > idea. Just for the record, I believe we should use ISO 8601 for time > standards and ISO 216 for paper standards. > > Some of you Rightpondians are a little confused about some of those > issues as well. > > > There are a few lurking non-participants in these 'topic drifts' who > think the subject should be changed. > > Bah humbug. We don't need no steenkin' subject badges. > > From rpetey at gmail.com Wed May 10 12:37:39 2006 From: rpetey at gmail.com (rpetey@gmail.com) Date: Wed May 10 14:40:03 2006 Subject: [SC-Help] Detailed Reports Message-ID: <1147286259.724783.307470@q12g2000cwa.googlegroups.com> I have been tried to get a detailed report from spam cop and have been unable to do so. I get the summary report but that really does not have the details I need. How do I get a copy of the actual email? From rpetey at gmail.com Wed May 10 12:39:02 2006 From: rpetey at gmail.com (rpetey@gmail.com) Date: Wed May 10 14:40:05 2006 Subject: [SC-Help] Detailed Reports Message-ID: <1147286342.776639.241650@u72g2000cwu.googlegroups.com> I have been trying to get detailed reports that included the offending emails. I am an ESP and need to see what clients are offenders. I get the summary report but I need something more. How do I do it? From do-not-use at example.com Wed May 10 15:56:30 2006 From: do-not-use at example.com (Ron) Date: Wed May 10 14:55:02 2006 Subject: [SC-Help] Trouble Renewing Spamcop/Webmail Message-ID: My Spamcop/Webmail account is expiring in a few days. On May 1, I mailed a check to the new address of Corporate Email Services, as indicated on the renewal page (http://mail.spamcop.net/account_renew3.php). My account expiration date, as indicated on http://webmail.spamcop.net/horde/imp/spamcop/preferences.php, has not been updated. I've tried several times to send a message of inquiry to support at cesmail.net and spamcop.net, but I have not received any response. Is there any way to get someone to reply with the status of my account? I don't know how often they do the updates, whether they've received my check, etc. Thanks. Ron From Kilgallen at SpamCop.net Wed May 10 17:08:43 2006 From: Kilgallen at SpamCop.net (Larry Kilgallen) Date: Wed May 10 17:10:06 2006 Subject: [SC-Help] Re: Detailed Reports References: <1147286342.776639.241650@u72g2000cwu.googlegroups.com> Message-ID: In article <1147286342.776639.241650@u72g2000cwu.googlegroups.com>, rpetey@gmail.com writes: > I have been trying to get detailed reports that included the offending > emails. I am an ESP and need to see what clients are offenders. I get > the summary report but I need something more. How do I do it? For a rational discussion of SpamCop interactions you should specify what the reports are about. I have a suspicion you are not the postmaster for gmail.com. If the report you are talking about is regarding an IP address you control (or fail to control), you should post that IP address. The report that is mailed to the abuse address for that IP address should give a good bit of individual human-reported spam. If, on the other hand, your machine is sending to SpamCop spamtraps, the text is not divulged, lest someone attempt listwashing. From not at home.today Wed May 10 23:36:16 2006 From: not at home.today (Ant) Date: Wed May 10 17:40:03 2006 Subject: [SC-Help] Re: Understanding SC's Reports References: Message-ID: "Mike Easter" wrote: > You guys need to get straightened out on your ponds. > > There are two. The big pond and the little pond. > > I am on the right shore of the big pond. > > You guys over there on the right shores of the little pond seem to > imagine that there is only one pond, and that the only people on the > other side of the little pond you know about are the ones on the left > shore of the little pond. I include right big-pondians in my little-pondian perspective. If you were talking with the Aussies or Chinese rather than Europeans, your pondian-ness would be big! > That is a little bit like imagining that the earth is flat or something. > We call it the Pacific Rim. It's probably more to do with the convention in (flat) world maps of depicting the americas on the left, and the rest on the right. > OTOH -- I have no defense for the inane methods of sizing paper in the > US. Why they don't adopt the logical standards of ISO 216 I have no > idea. Just for the record, I believe we should use ISO 8601 for time > standards and ISO 216 for paper standards. > > Some of you Rightpondians are a little confused about some of those > issues as well. Are we? Well, if you mean we are supposed to have 'gone metric' and yet our road signs are still in miles and our beer is served in pints then perhaps we are. Personally, I prefer feet and inches to metres and centimetres -- they are a more natural measure. I worked for 13 years in the UK arm of a US-based company, and got used to US paper sizes as being normal. I found it strange going back to UK A4 size when I left. > There are a few lurking non-participants in these 'topic drifts' who > think the subject should be changed. > > Bah humbug. We don't need no steenkin' subject badges. Let 'em flame! From vxpy7do02 at sneakemail.com Wed May 10 16:38:57 2006 From: vxpy7do02 at sneakemail.com (anon) Date: Wed May 10 18:40:02 2006 Subject: [SC-Help] Re: Understanding SC's Reports References: Message-ID: "Mike Easter" wrote in message news:e3req4$9nq$1@news.spamcop.net... > Ant wrote: >> The holy hand-grenade of "antioch" wrote: >> >>> "Mike Easter" wrote: >>>> I don't understand 'her indoors' >>> >>> Are you from the other side of the pond? >> >> Mike is from Leftpondia, whereas U and I are Rightpondians. > > You guys need to get straightened out on your ponds. > > There are two. The big pond and the little pond. > > I am on the right shore of the big pond. > > You guys over there on the right shores of the little pond seem to > imagine that there is only one pond, and that the only people on the > other side of the little pond you know about are the ones on the left > shore of the little pond. > > That is a little bit like imagining that the earth is flat or something. > We call it the Pacific Rim. > > > OTOH -- I have no defense for the inane methods of sizing paper in the > US. Why they don't adopt the logical standards of ISO 216 I have no > idea. Just for the record, I believe we should use ISO 8601 for time > standards and ISO 216 for paper standards. > The US paper sizes are about as sensible as the world wide (non) standard railroad gauge - changing trains at national borders does not make sense. Someone, way back then, must have had a huge piece of paper and proceeded to cut it in half, then that in half - etc. until we got the 8-1/2x11 inches letter size and 8-1/2 x 14 inches legal size. You guys just started with a different 'huge' size to get your 8.3x11.7 inch A4 and 7.2x10.5 executive sizes. There is really no logic to ANY paper size. At least one of the RR gauges started with the wagon wheel/chariot wheel gauges - but who can say how logical THOSE were. -- A SpamCop user and forum reader, Not Admin > Some of you Rightpondians are a little confused about some of those > issues as well. > > > There are a few lurking non-participants in these 'topic drifts' who > think the subject should be changed. > > Bah humbug. We don't need no steenkin' subject badges. > > > -- > Mike Easter > kibitzer, not SC admin > From r.antiochdunkthis at dunkthisntlworld.com Thu May 11 16:06:01 2006 From: r.antiochdunkthis at dunkthisntlworld.com (antioch) Date: Thu May 11 10:10:02 2006 Subject: [SC-Help] The next step?? Message-ID: Hello All As I have just started with SpamCop and having tried to get to grips with reading and understanding their web site, I have decided to hold for a moment at the first stage. I have at last managed to submit spam for parse :-) :-) :-) I started with O.E. email, then tried copy/paste into the parse box, but HQ pointed out(very nicely) that I was doing all these with double headers. What damage this might have caused I do not fully comprehend - yet :-) I have, I think, cant see how to check, signed in as a mole :-) Am I being of any use or service to SpamCop if I only send the suspect spam emails. I have read about 'reporting', which I understand is when you send your suspect spam to someone else(whom to send it to I have yet to establish), but I have been put off by the scare of getting retribution. So that it why I have stopped where I have. I still do not know how or what I am reading when I get the info from doing a parse. I really would appreciate any feedback as to the point I have reached. I will read more and then come back to the group for help should I feel confident enough to proceed to the next phase. Apologies for the length. Rgds to all Antioch 'You cant educate pork' - but this one would like to learn. From MikeE at ster.invalid Thu May 11 08:31:55 2006 From: MikeE at ster.invalid (Mike Easter) Date: Thu May 11 10:35:03 2006 Subject: [SC-Help] Re: The next step?? References: Message-ID: antioch wrote: > I have at last managed to submit spam for parse :-) :-) :-) > I started with O.E. email, then tried copy/paste into the parse box, > but HQ pointed out(very nicely) that I was doing all these with > double headers. I don't understand how you would get whatever is 'double headers' by accessing the mail's properties as described in the faq for OE to paste into the parser. OE/ File/ Properties/ Details tab/ Message source button. - select copy paste into the webparser. > I have, I think, cant see how to check, signed in as a mole :-) If you are registered as a mole, then you won't see any 'real' address to report to in the phase of the operation in which you are to report vs cancel, you will only see a devnull address, ie mole devnull.spamcop.net Mole reports don't do much of anything, most importantly they don't contribute to the SCbl blocklist. > Am I being of any use or service to SpamCop if I only send the > suspect spam emails. What is a 'suspect' spam email in this context? Presumably a reporter would only be reporting what they believe to be spam. > I have read about 'reporting', which I understand is when you send > your suspect spam to someone else(whom to send it to I have yet to > establish), but I have been put off by the scare of getting > retribution. In the case of regular spamcop reporting, the reporter who is not a mole submits the spam to the parsing reporting algorithm. The parser determines the reporting addresses as best it can for the providers for the spamsource and spamvertiser, and configurably and by default munges the To address and any obvious occurrences of that address presumably obfuscating the address of the reporter. The parser reporting tool offers to make the report to various entities on that basis, any and all of which can be unchecked. If a regular reporter allows a report to be made to a spamsource provider address, then the spamsource IP counts toward the SC blocklist. > I still do not know how or what I am reading when I get the info from > doing a parse. The verbose version of the parse is trying to tell you how it determined the source IP from the header and who it recommends to notify about that. It also tells the IP of any found spamvertiser link. The reporter is supposed to have sufficient knowledge of header analysis that they won't report their own provider and is supposed to recognize any found innocent bystanders in the body of the spam so that they can be unchecked as spamvertisers. -- Mike Easter kibitzer, not SC admin From r.antiochdunkthis at dunkthisntlworld.com Thu May 11 22:52:37 2006 From: r.antiochdunkthis at dunkthisntlworld.com (antioch) Date: Thu May 11 16:55:03 2006 Subject: [SC-Help] Re: The next step?? References: Message-ID: Hello Mike Have you found that missing post yet, in the General???? My replies are spliced between mine and yours. Thanks again for your help Rgds Antioch "Mike Easter" wrote in message news:e3vhsr$ia8$1@news.spamcop.net... > antioch wrote: > >> I have at last managed to submit spam for parse :-) :-) :-) >> I started with O.E. email, then tried copy/paste into the parse box, >> but HQ pointed out(very nicely) that I was doing all these with >> double headers. > > I don't understand how you would get whatever is 'double headers' by > accessing the mail's properties as described in the faq for OE to paste > into the parser. OE/ File/ Properties/ Details tab/ Message source > button. - select copy paste into the webparser. Not difficult - here is the info sent - >From HQ. "There is something wrong with your submission because when I look at the spam you have submitted the headers appear twice. This is resulting in an error, "Header data found in body, aborting link detection"." I now use the Crt/F3/ a & c method - don't know why I didn't before! 16 of the emails submitted to SC are now marked as 'too old to file spam report.' I may as well delete all of them as they are of no use. Will have to find that out. I have 5 others not showing this - yet. I did not realise that there was a time period. Can I take it the time(2 days) starts from the time I get the spam. Then I have 48hrs to decide if I report or not?? As I have said before, how, where and to whom, I have yet to find out. >> I have, I think, cant see how to check, signed in as a mole :-) > If you are registered as a mole, then you won't see any 'real' address to > report to in the phase of the operation in which you are to report vs > cancel, you will only see a devnull address, ie mole > devnull.spamcop.net Cant see any as you say with devnull etc address. So I can't be a mole then. > Mole reports don't do much of anything, most importantly they don't > contribute to the SCbl blocklist. >> Am I being of any use or service to SpamCop if I only send the >> suspect spam emails. > What is a 'suspect' spam email in this context? Presumably a reporter > would only be reporting what they believe to be spam. OK - forget the word suspect. >> I have read about 'reporting', which I understand is when you send your >> suspect spam to someone else(whom to send it to I have yet to establish), >> but I have been put off by the scare of getting >> retribution. > > In the case of regular spamcop reporting, the reporter who is not a mole > submits the spam to the parsing reporting algorithm. The parser > determines the reporting addresses as best it can for the providers for > the spamsource and spamvertiser, and configurably and by default munges > the To address and any obvious occurrences of that address presumably > obfuscating the address of the reporter. The parser reporting tool offers > to make the report to various entities on that basis, any and all of which > can be unchecked. > If a regular reporter allows a report to be made to a spamsource > provider address, then the spamsource IP counts toward the SC blocklist. >> I still do not know how or what I am reading when I get the info from >> doing a parse. With the most recent parsed spam I have the following 'headers' I believe; Parsing header Tracking message Finding links in message body Please make sure email is spam Report spam to xxxxxxxxx Re xxxxxxxx(silent report about source mail) Then the click button choices Send spam report NOW:Preview Reports:Cancel (Do I use this cancel to get rid of all the out of time ones???) Then there is the Attention box warning etc etc > > The verbose version of the parse is trying to tell you how it determined > the source IP from the header and who it recommends to notify about that. > It also tells the IP of any found spamvertiser link. The reporter is > supposed to have sufficient knowledge of header analysis that they won't > report their own provider and is supposed to recognize any found innocent > bystanders in the body of the spam so that they can be unchecked as > spamvertisers. > Right, so where do I get this 'sufficient knowledge'. Is it reasonable to expect me to do this reporting, without this knowledge? I think that I have gone far enough for the moment. > -- > Mike Easter > kibitzer, not SC admin > From MikeE at ster.invalid Thu May 11 15:12:14 2006 From: MikeE at ster.invalid (Mike Easter) Date: Thu May 11 17:15:03 2006 Subject: [SC-Help] Re: The next step?? References: Message-ID: antioch wrote: > Have you found that missing post yet, in the General???? missing? general? > "Mike Easter" >> antioch wrote: >>> double headers. >> >> I don't understand how you would get whatever is 'double headers' > From HQ. Who is HQ? Someone at SC? > "There is something wrong with your submission because when I look at > the spam you have submitted the headers appear twice. This is > resulting in an error, "Header data found in body, aborting link > detection"." > I now use the Crt/F3/ a & c method - don't know why I didn't before! I have some negative comments about ctrl-F3, but it works OK if the spam is either open or being previewed, but I don't recommend either one of those conditions for secure spam handling. > 16 of the emails submitted to SC are now marked as 'too old to file > spam report.' I may as well delete all of them as they are of no use. They are no good for reporting, but they would still be good for educational or demonstration purposes and they can still provide a tracker for discussing if you wanted to. The condition of a spam too old or being a mole reporter isn't really much different, as neither one contribute to the SCbl. > I have 5 others not showing this - yet. I did not realise that there > was a time period. Can I take it the time(2 days) starts from the > time I get the spam. Then I have 48hrs to decide if I report or not?? SC has two different ways of determining the age of a spam, one designed for mailhosted accounts and one for non-mailhosted. The 'simplest' and cleanest is for non-mailhosted where SC uses the timestamp of the first good Received traceline. As a general rule a nonmailhosted account's spamclock starts when the item arrives in your mailbox. > Cant see any as you say with devnull etc address. So I can't be a > mole then. Okay. > With the most recent parsed spam I have the following 'headers' > I believe; > Parsing header > Tracking message > Finding links in message body > Please make sure email is spam > Report spam to xxxxxxxxx > Re xxxxxxxx(silent report about source mail) Silent sounds like a mole to me. > Then the click button choices > Send spam report NOW:Preview Reports:Cancel > (Do I use this cancel to get rid of all the out of time ones???) Generally if a spam is too old, you don't have a chance to cancel or report, it is just too old. >> The reporter is supposed to have sufficient knowledge of >> header analysis that they won't report their own provider and is >> supposed to recognize any found innocent bystanders in the body of >> the spam so that they can be unchecked as spamvertisers. >> > Right, so where do I get this 'sufficient knowledge'. Heh. Yeah. I think you should know some things about the 'elements' of the Received tracelines vis the name or IP of your own provider. Recall that when this conversation started I was encouraging you to provide a tracker for one of your spam parses, and also gave you an example of one of my own tracking URLs. You still have not posted your own tracker yet. You are spending a lot of words trying to describe something which I could see in much more 'vivid' and real detail if you would post a tracker. Remember what a tracker is? > Is it > reasonable to expect me to do this reporting, without this knowledge? I am sympathetic to your fears of being a 'bad' or mistaken reporter. For a long time as a spamcop neophyte, I only used the parser to parse spams which reports I cancelled while reporting them manually. > I think that I have gone far enough for the moment. -- Mike Easter kibitzer, not SC admin From r.antiochdunkthis at dunkthisntlworld.com Fri May 12 02:53:01 2006 From: r.antiochdunkthis at dunkthisntlworld.com (antioch) Date: Thu May 11 20:55:03 2006 Subject: [SC-Help] Re: The next step?? References: Message-ID: Hello again I have again spliced and clipped below "Mike Easter" wrote in message news:e409bc$2k2$1@news.spamcop.net... > antioch wrote: > >> Have you found that missing post yet, in the General???? > > missing? general? Sorry - confused you with another. >> "Mike Easter" >>> antioch wrote: > >>>> double headers. >>> >>> I don't understand how you would get whatever is 'double headers' > >> From HQ. > > Who is HQ? Someone at SC? Headquarters of SC >> "There is something wrong with your submission because when I look at >> the spam you have submitted the headers appear twice. This is >> resulting in an error, "Header data found in body, aborting link >> detection"." > >> I now use the Crt/F3/ a & c method - don't know why I didn't before! > > I have some negative comments about ctrl-F3, but it works OK if the spam > is either open or being previewed, but I don't recommend either one of > those conditions for secure spam handling. Yes, but for the moment I am doing it this way - my mind is on other matters. > >> 16 of the emails submitted to SC are now marked as 'too old to file spam >> report.' I may as well delete all of them as they are of no use. > > They are no good for reporting, but they would still be good for > educational or demonstration purposes and they can still provide a > tracker for discussing if you wanted to. The condition of a spam too old > or being a mole reporter isn't really much different, as neither one > contribute to the SCbl. > >> I have 5 others not showing this - yet. I did not realise that there >> was a time period. Can I take it the time(2 days) starts from the >> time I get the spam. Then I have 48hrs to decide if I report or not?? > > SC has two different ways of determining the age of a spam, one designed > for mailhosted accounts and one for non-mailhosted. The 'simplest' and > cleanest is for non-mailhosted where SC uses the timestamp of the first > good Received traceline. As a general rule a nonmailhosted account's > spamclock starts when the item arrives in your mailbox. Thanks for the clarification. > >> Cant see any as you say with devnull etc address. So I can't be a >> mole then. > > Okay. > >> With the most recent parsed spam I have the following 'headers' >> I believe; >> Parsing header >> Tracking message >> Finding links in message body >> Please make sure email is spam >> Report spam to xxxxxxxxx >> Re xxxxxxxx(silent report about source mail) > > Silent sounds like a mole to me. So I will have to change that and come out into the light to be able to report. >> Then the click button choices >> Send spam report NOW:Preview Reports:Cancel >> (Do I use this cancel to get rid of all the out of time ones???) > > Generally if a spam is too old, you don't have a chance to cancel or > report, it is just too old. OK, so they just stay there in my record of what I have parsed. > >>> The reporter is supposed to have sufficient knowledge of >>> header analysis that they won't report their own provider and is >>> supposed to recognize any found innocent bystanders in the body of the >>> spam so that they can be unchecked as spamvertisers. >>> Right, so where do I get this 'sufficient knowledge'. > > Heh. Yeah. I think you should know some things about the 'elements' of > the Received tracelines vis the name or IP of your own provider That bit I do recognise - my IP - at the top of the parse result, sorry received tracelines. > > Recall that when this conversation started I was encouraging you to > provide a tracker for one of your spam parses, and also gave you an > example of one of my own tracking URLs. You still have not posted your > own tracker yet. You are spending a lot of words trying to describe > something which I could see in much more 'vivid' and real detail if you > would post a tracker. Remember what a tracker is? I had no idea that was what you were talking about. How is this - my latest offering - is this what you were expecting. http://www.spamcop.net/sc?id=z940869391z3c9254dd5fe391887143f61e62e65880z > > Is it reasonable to expect me to do this reporting, without this > > knowledge? > I am sympathetic to your fears of being a 'bad' or mistaken reporter. For > a long time as a spamcop neophyte, I only used the parser to parse spams > which reports I cancelled while reporting them manually. Plus the thought of being made a target by one of these spammers does not encourage reporting just yet. I think that I have gone far enough for the moment. Many thanks again - sorry for the misid. Its bedtime here. The hum of my comp annoys 'her indoors' Rgds Antioch From MikeE at ster.invalid Thu May 11 19:59:37 2006 From: MikeE at ster.invalid (Mike Easter) Date: Thu May 11 22:00:03 2006 Subject: [SC-Help] Re: The next step?? References: Message-ID: antioch wrote: > Its bedtime here. It appears that you are UTC +0100. I am UTC -0700. You are already in the 'wee' hours of Friday now, and at this moment I'm typing it isn't dark on Thursday here yet. Sundown is still almost an hour away for me > The hum of my comp annoys 'her indoors' If your computer is humming loud enough to be annoying anyone, it is making too much noise. Probably a case or cpu fan doing something wrong -- some kind of vibration or something. It should be nearly silent. Thanks for the tracker. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Thu May 11 20:12:30 2006 From: MikeE at ster.invalid (Mike Easter) Date: Thu May 11 22:15:03 2006 Subject: [SC-Help] Re: The next step?? References: Message-ID: antioch wrote: > How is this - my latest offering - is this what you were expecting. Yes, but... www.spamcop.net/sc?id=z940869391z3c9254dd5fe391887143f61e62e65880z That was a 'live' tracker. I've cancelled it. Whenever you are going to show us a tracker here, you should cancel it so that someone else can't do some mischief with it which would be accorded to you, since it was submitted under your authorization code. -- Mike Easter kibitzer, not SC admin From r.antiochdunkthis at dunkthisntlworld.com Fri May 12 13:25:53 2006 From: r.antiochdunkthis at dunkthisntlworld.com (antioch) Date: Fri May 12 07:30:10 2006 Subject: [SC-Help] Re: The next step?? References: Message-ID: Oh! - SH ONE T - is it no good to you now? A little knowledge IS dangerous. Rgds Antioch "Mike Easter" wrote in message news:e40qud$cdn$1@news.spamcop.net... > antioch wrote: > >> How is this - my latest offering - is this what you were expecting. > > Yes, but... > > www.spamcop.net/sc?id=z940869391z3c9254dd5fe391887143f61e62e65880z > > That was a 'live' tracker. I've cancelled it. Whenever you are going > to show us a tracker here, you should cancel it so that someone else > can't do some mischief with it which would be accorded to you, since it > was submitted under your authorization code. > > > -- > Mike Easter > kibitzer, not SC admin > From r.antiochdunkthis at dunkthisntlworld.com Fri May 12 13:59:12 2006 From: r.antiochdunkthis at dunkthisntlworld.com (antioch) Date: Fri May 12 08:00:03 2006 Subject: [SC-Help] Re: The next step?? References: Message-ID: Hello Mike Yes, I thought there were a few hours between us. Re the humming - well she calls it humming - its a gentle sound of a fan turning at very high speed. Its no more than a small hand-held type of battery driven fan. Though she has to agree that it is quieter than comp I put together a year ago - P4 3.0Gh Prescott 478pin - now they ran hot - plus 400w power - had five fans running to keep the temp down to 55-60 when running flight sims at full belt. Current system has a bit more under the bonnet - P4 3.4Gh LGA775 (again a hot runner)plus gforce 7800, 600w power with a 120mm supercool/quiet fan over the CPU. That keeps the temp down to 40-45 all on its own. Even with a bit of clocking. Also I can assure you that everything in the box is as tight as a drum. The box is also sitting on a sound absorbent material. Anyhow, with a headset on I hear no outside noises -- not even 'her'. Take care Rgds Antioch "Mike Easter" wrote in message news:e40q68$bq4$1@news.spamcop.net... > antioch wrote: > >> Its bedtime here. > > It appears that you are UTC +0100. I am UTC -0700. You are already in > the 'wee' hours of Friday now, and at this moment I'm typing it isn't > dark on Thursday here yet. Sundown is still almost an hour away for me > >> The hum of my comp annoys 'her indoors' > > If your computer is humming loud enough to be annoying anyone, it is > making too much noise. Probably a case or cpu fan doing something > wrong -- some kind of vibration or something. It should be nearly > silent. > > Thanks for the tracker. > > -- > Mike Easter > kibitzer, not SC admin > From MikeE at ster.invalid Fri May 12 06:35:29 2006 From: MikeE at ster.invalid (Mike Easter) Date: Fri May 12 08:40:02 2006 Subject: [SC-Help] Re: The next step?? References: Message-ID: antioch wrote: > supercool/quiet fan over the CPU. I once had a cpu fan that was too noisy, but when I put a variable speed control on it I could adjust it manually [as it wasn't an automatically adjusting one] and I found that the cpu was just as cool at a lower speed as at a higher speed. If I were a gamer, I might have used an automatically adjusting one. I like cpu coolers that have a lot of 'muscle' in the cooler's construction, convection and radiation copper and aluminum beef and good contact medium, so that the fan doesn't have to spin fast or noisily. > That keeps the temp down to 40-45 all on its own. Even with a bit of > clocking. Maybe your fan could go a teensy slower. The manual variable speed control devices are very very cheap and easily installed. > Anyhow, with a headset on I hear no outside noises -- not even 'her'. Ha! -- Mike Easter kibitzer, not SC admin From r.antiochdunkthis at dunkthisntlworld.com Fri May 12 23:09:52 2006 From: r.antiochdunkthis at dunkthisntlworld.com (antioch) Date: Fri May 12 17:10:03 2006 Subject: [SC-Help] Re: The next step?? References: Message-ID: Gamers fitting fans on their rigs - never - everything is now water cooled. They tend to go for the most hideous of boxes that for some reason seem to be planned without a thought of cooling. But then these days. Yes, I am thinking of adding it to my birthday wish list in a couple of months, although there is some degree of auto control at the moment, it is more to when I apply heavy usage. With a control I can turn it down for when I'm doing me clerical stuff. Got to go. Uncle Billy wants me to download Antispy - I wonder if the old XXX is still trying to get me to take that 'sh one t' Defender. Catch you later. Got to disconnect everything. Rgds Antioch "Mike Easter" wrote in message news:e41vef$ve$1@news.spamcop.net... > antioch wrote: > >> supercool/quiet fan over the CPU. > > I once had a cpu fan that was too noisy, but when I put a variable speed > control on it I could adjust it manually [as it wasn't an automatically > adjusting one] and I found that the cpu was just as cool at a lower > speed as at a higher speed. > > If I were a gamer, I might have used an automatically adjusting one. > > I like cpu coolers that have a lot of 'muscle' in the cooler's > construction, convection and radiation copper and aluminum beef and good > contact medium, so that the fan doesn't have to spin fast or noisily. > >> That keeps the temp down to 40-45 all on its own. Even with a bit of >> clocking. > > Maybe your fan could go a teensy slower. The manual variable speed > control devices are very very cheap and easily installed. > >> Anyhow, with a headset on I hear no outside noises -- not even 'her'. > > Ha! > > > -- > Mike Easter > kibitzer, not SC admin > From ddotrdotnewman at qub.ac.uk Mon May 15 17:48:45 2006 From: ddotrdotnewman at qub.ac.uk (David R. Newman) Date: Mon May 15 11:50:03 2006 Subject: [SC-Help] Is spamcop down? Message-ID: I'm getting, even for http://www.spamcop.net/, error messages like the following: An error occurred while processing your request. Reference #97.1d863554.1147707953.e51993 (at 16:47 British Summer Time). From bar_n0ne at hotmail.com Mon May 15 12:53:04 2006 From: bar_n0ne at hotmail.com (Berny) Date: Mon May 15 12:55:02 2006 Subject: [SC-Help] Re: Is spamcop down? References: Message-ID: "David R. Newman" wrote in message news:e4a7st$qtg$1@news.spamcop.net... > I'm getting, even for http://www.spamcop.net/, error messages like the > following: > > An error occurred while processing your request. > > Reference #97.1d863554.1147707953.e51993 > > (at 16:47 British Summer Time). No, try again From devnull at nospam.sjl.dk Mon May 15 20:31:09 2006 From: devnull at nospam.sjl.dk (=?ISO-8859-1?Q?S=F8ren_Jacob_Lauritsen?=) Date: Mon May 15 13:30:02 2006 Subject: [SC-Help] Unstoppable picture spam. Message-ID: Hello there! Four times a day since the end of April, I have been blessed with e-mails containing text as pictures. I'm pretty sure they're from the same source. They all share the same "look": Text on a colored background (light red or light green). The contents of the text differs from time to time. Have anybody received these e-mails? The spammer seems to be unstoppable. So any suggestions would be nice. It's the first time, I haven't been able to stop them within a few days. Best regards, S?ren -- Remove nospam to write me! :-) From ddotrdotnewman at qub.ac.uk Mon May 15 19:35:21 2006 From: ddotrdotnewman at qub.ac.uk (David R. Newman) Date: Mon May 15 13:40:02 2006 Subject: [SC-Help] Re: Is spamcop down? In-Reply-To: References: Message-ID: Berny wrote: > "David R. Newman" wrote in message > news:e4a7st$qtg$1@news.spamcop.net... >> I'm getting, even for http://www.spamcop.net/, error messages like the >> following: >> >> An error occurred while processing your request. >> >> Reference #97.1d863554.1147707953.e51993 >> >> (at 16:47 British Summer Time). > > No, try again An hour later it started working here. It may be an effect of the proxy servers on the way. From post.please.this.email.is.not.valid at example.com Mon May 15 13:52:41 2006 From: post.please.this.email.is.not.valid at example.com (DougW) Date: Mon May 15 13:55:03 2006 Subject: [SC-Help] Re: Unstoppable picture spam. References: Message-ID: Søren Jacob Lauritsen did pass the time by typing: > Hello there! > > Four times a day since the end of April, I have been blessed with > e-mails containing text as pictures. I'm pretty sure they're from the > same source. They all share the same "look": Text on a colored > background (light red or light green). The contents of the text differs > from time to time. > > Have anybody received these e-mails? The spammer seems to be > unstoppable. So any suggestions would be nice. It's the first time, I > haven't been able to stop them within a few days. Most of mine is for pump&dump (stock scam) but there are several gangs out there that put the links in picutures to avoid filtering. Recent ones were caught by the Spamhaus SBL/XBL or Spamcop. (I use SpamPal locally) -- DougW From bar_n0ne at hotmail.com Mon May 15 14:10:20 2006 From: bar_n0ne at hotmail.com (Berny) Date: Mon May 15 14:15:03 2006 Subject: [SC-Help] Re: Unstoppable picture spam. References: Message-ID: "Søren Jacob Lauritsen" wrote in message news:e4adq6$vdn$1@news.spamcop.net... > Hello there! > > Four times a day since the end of April, I have been blessed with > e-mails containing text as pictures. I'm pretty sure they're from the > same source. They all share the same "look": Text on a colored > background (light red or light green). The contents of the text differs > from time to time. > > Have anybody received these e-mails? The spammer seems to be > unstoppable. So any suggestions would be nice. It's the first time, I > haven't been able to stop them within a few days. > > Best regards, > Søren > > -- > Remove nospam to write me! :-) Light artillery would be sufficient From vxpy7do02 at sneakemail.com Mon May 15 13:00:27 2006 From: vxpy7do02 at sneakemail.com (anon) Date: Mon May 15 15:05:03 2006 Subject: [SC-Help] Re: Unstoppable picture spam. References: Message-ID: "S?ren Jacob Lauritsen" wrote in message news:e4adq6$vdn$1@news.spamcop.net... > Hello there! > > Four times a day since the end of April, I have been blessed with e-mails > containing text as pictures. I'm pretty sure they're from the same source. > They all share the same "look": Text on a colored background (light red or > light green). The contents of the text differs from time to time. > I think that the first thing you should do (not do) is about READING spams. NEVER, NEVER, EVER *open* a spam - many spams 'phone home' to tell the spammer that he has a 'live one' and the address is a salable commodity and worth money to other spammers. Also, never 'unsubscribe' to something you never subscribed to (same reason as above.) If you MUST read the spam - either disconnect from the web before opening it to prevent communication. BUT realize that some spam may contain malicious code that nesses up your hard drive. Alternate method of looking at spam - in outlook express right click on spam listed in mailbox, click on properties -> click on details tab -> click on message source button. This will give you all the information about the spam (but does not decode base64 which looks like gibberish) - you can then see the complete headers and the (possible) html coding. -- A SpamCop user and forum reader, Not Admin > Have anybody received these e-mails? The spammer seems to be unstoppable. > So any suggestions would be nice. It's the first time, I haven't been able > to stop them within a few days. > > Best regards, > S?ren > > -- > Remove nospam to write me! :-) From spamcop.forum at hisnameistimmy.com Mon May 15 14:12:21 2006 From: spamcop.forum at hisnameistimmy.com (Tim Wayne) Date: Mon May 15 16:15:27 2006 Subject: [SC-Help] Question on mail forwarding , 1 of 2 Message-ID: <924B71CB-5537-4180-BFE9-D461CE983051@hisnameistimmy.com> When I give out an email address, I always give out an alias that is unique and has only one purpose. For example, when I registered with the NY Times, I used nytimes@hisnameistimmy.com and never used the alias nytimes again for anything else. When I registered my copy of Warcraft III, I used warcraft_registration@hisnameistimmy.com and (again) never used that alias again for anything else. When I signed up for this forum, I used spamcop.forum@hisnameistimmy.com. Using this method, when a spam comes to me, I always know by what route it arrived. And if the particular email address gets "out there" somehow and that alias starts getting a lot of spam, I go onto my server and tell the server to forward all email to that alias into the server's bit bucket and I never see any email via that alias again. That alias is thereafter effectively "killed." In the seven years I've had my server online, I have killed 13 email addresses because of spam. It's a system which works very well for me. I recently got a paid spamcop account, and since I've been actively reporting spam, I got curious about how much spam my server is sending to the bit bucket. So to find out, I temporarily disabled all of the forwards. All of a sudden, *quite* a bit of spam started arriving in my inbox via these formerly "killed" aliases. On one particular address it looks like I was getting in excess of ten a day. Bastards! To take advantage of my new spamcop account, I thought it would be interesting to set up the forwarding on my server to re-route emails sent to these dead aliases to my spamcop email address instead of into the server's bit bucket. So, I told the server to forward said email to submit.nj1jTDtvl4UXoCDG@spam.spamcop.net, my spamcop reporting address. But instead of the reports getting taken by spamcop, I keep getting failure notices, like in the example in part two of this message. Question: what am I doing wrong? Or, is my assumption that Spamcop can accept forwards wrong? Or should my server be set to configure forwards in a particular way so that they are spamcop friendly? I am confused. Please help. :-| Thanks, Tim Wayne San Francisco From spamcop.forum at hisnameistimmy.com Mon May 15 14:13:52 2006 From: spamcop.forum at hisnameistimmy.com (Tim Wayne) Date: Mon May 15 16:16:57 2006 Subject: [SC-Help] Question on mail forwarding , 2 of 2 Message-ID: <219E8CA3-15DF-4386-86C0-AD810544A06A@hisnameistimmy.com> NOTE: PLEASE READ PART ONE OF THIS MESSAGE FIRST. Begin forwarded message: From: SpamCop AutoResponder Date: May 15, 2006 4:38:45 PM PDT To: spamcop.net@hisnameistimmy.com Subject: [SpamCop] Errors encountered SpamCop encountered errors while saving spam for processing: SpamCop could not find your spam message in this email: Return-Path: Received: from sc-smtp2-bulkmx.soma.ironport.com (sc-smtp2- bulkmx.soma.ironport.com [204.15.82.125]) by sc-app1.soma.ironport.com (Postfix) with ESMTP id DD52A1A707 for ; Mon, 15 May 2006 09:37:41 -0700 (PDT) Received: from studio321.studio32.com ([128.121.51.87]) by sc-smtp2-bulkmx.soma.ironport.com with ESMTP; 15 May 2006 09:37:41 -0700 Received: from yahoo.no ([219.155.31.145]) by studio321.studio32.com (8.13.6/8.12.6) with ESMTP id k4FGbbNu098558 for ; Mon, 15 May 2006 09:37:39 -0700 (PDT) (envelope-from rgb8osnfu@yahoo.no) Received: from unknown (HELO nntp.pinxodet.net) (Tue, 16 May 2006 04:26:33 +1100) by smtp-server1.cfdenselr.com with ASMTP; Tue, 16 May 2006 04:26:33 +1100 Received: from unknown (HELO mail.gimmicc.net) (Tue, 16 May 2006 04:07:44 +1100) by mx.reskind.net with LOCAL; Tue, 16 May 2006 04:07:44 +1100 Message-ID: <6CCA1932.626E9FF@yahoo.no> Date: Tue, 16 May 2006 03:45:45 +1100 From: "Ms" MIME-Version: 1.0 To: "Postmaster" Subject: Message for Tammy Lord 5.25% Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 8bit Hi, Our Office has recei ved your filled app. http://geocities.com/InaThayer7914 Please check the site above, Our office shall then re-confirm your info. With Ref to: Tammy Lord and your past track reco rd is not a factor. All reefin ance types have been Ap pro ve d for you Tammy Lord say never: http://geocities.com/RondaPelletier2462/a.htm Best Regards, Ms The email which triggered this auto-response had the following headers: Return-Path: Received: from sc-smtp2-bulkmx.soma.ironport.com (sc-smtp2- bulkmx.soma.ironport.com [204.15.82.125]) by sc-app1.soma.ironport.com (Postfix) with ESMTP id DD52A1A707 for ; Mon, 15 May 2006 09:37:41 -0700 (PDT) Received: from studio321.studio32.com ([128.121.51.87]) by sc-smtp2-bulkmx.soma.ironport.com with ESMTP; 15 May 2006 09:37:41 -0700 Received: from yahoo.no ([219.155.31.145]) by studio321.studio32.com (8.13.6/8.12.6) with ESMTP id k4FGbbNu098558 for ; Mon, 15 May 2006 09:37:39 -0700 (PDT) (envelope-from rgb8osnfu@yahoo.no) Received: from unknown (HELO nntp.pinxodet.net) (Tue, 16 May 2006 04:26:33 +1100) by smtp-server1.cfdenselr.com with ASMTP; Tue, 16 May 2006 04:26:33 +1100 Received: from unknown (HELO mail.gimmicc.net) (Tue, 16 May 2006 04:07:44 +1100) by mx.reskind.net with LOCAL; Tue, 16 May 2006 04:07:44 +1100 Message-ID: <6CCA1932.626E9FF@yahoo.no> Date: Tue, 16 May 2006 03:45:45 +1100 From: "Ms" MIME-Version: 1.0 To: "Postmaster" Subject: Message for Tammy Lord 5.25% Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 8bit From devnull at nospam.sjl.dk Mon May 15 23:21:00 2006 From: devnull at nospam.sjl.dk (=?windows-1252?Q?S=F8ren_Jacob_Lauritsen?=) Date: Mon May 15 16:20:03 2006 Subject: [SC-Help] Re: Unstoppable picture spam. In-Reply-To: References: Message-ID: anon wrote: > I think that the first thing you should do (not do) is about READING spams. > > NEVER, NEVER, EVER *open* a spam - many spams 'phone home' to tell the > spammer that he has a 'live one' and the address is a salable commodity > and worth money to other spammers. I use gmail. It will never open any pictures. Besides that, I've checked the e-mail file. The picture is an attachment. It's not an HTML e-mail. Regards Soeren -- Remove nospam to write me! :-) From MikeE at ster.invalid Mon May 15 14:30:37 2006 From: MikeE at ster.invalid (Mike Easter) Date: Mon May 15 16:35:03 2006 Subject: [SC-Help] Re: Question on mail forwarding , 1 of 2 References: Message-ID: Tim Wayne wrote: > Question: what am I doing wrong? That method doesn't work. > Or, is my assumption that Spamcop > can accept forwards wrong? Your assumption that the headers which the parser uses will work satisfactorily with 'internal' forwarding rather than forwarding as attachment is not correct. > Or should my server be set to configure > forwards in a particular way so that they are spamcop friendly? I don't know. That is, I don't know how you might be able to configure your server. -- Mike Easter kibitzer, not SC admin From vxpy7do02 at sneakemail.com Mon May 15 14:37:42 2006 From: vxpy7do02 at sneakemail.com (anon) Date: Mon May 15 16:40:03 2006 Subject: [SC-Help] Re: Unstoppable picture spam. References: Message-ID: "S?ren Jacob Lauritsen" wrote in message news:e4anol$6s2$1@news.spamcop.net... > anon wrote: >> I think that the first thing you should do (not do) is about READING >> spams. >> >> NEVER, NEVER, EVER *open* a spam - many spams 'phone home' to tell the >> spammer that he has a 'live one' and the address is a salable commodity >> and worth money to other spammers. > > I use gmail. It will never open any pictures. Besides that, I've checked > the e-mail file. The picture is an attachment. It's not an HTML e-mail. > No, I mean do not open the spam at all (not talking about pictures or anything else) - just do not open it at all. Many times the mail does not 'look' like html, but if there is any formatting - then it is html. If it is html then it is very easy for the spammer to imbed a one pixel bit into the spam e-mail that DOES 'mail home' when you open it - you can't see the one pixel bit on the screen but it is there anyway. Many people (unknowingly) send ordinary e-mails to their friends as html mail because that is the default method when the mail programs are installed on the computers. -- A SpamCop user and forum reader, Not Admin > Regards > Soeren > > -- > Remove nospam to write me! :-) From MikeE at ster.invalid Mon May 15 14:43:37 2006 From: MikeE at ster.invalid (Mike Easter) Date: Mon May 15 16:45:03 2006 Subject: [SC-Help] Re: Question on mail forwarding , 2 of 2 References: Message-ID: Tim Wayne wrote: > NOTE: PLEASE READ PART ONE OF THIS MESSAGE FIRST. There are several problems with trying to communicate your forwarding problem by this method. - posting a news message with your newsreader causes the header lines to become 'mangled' compared to their original condition. - you are exposing your submit address to the public. That unique code for you needs to be kept a secret Headerlines must be 'perfectly' configured, in which the fieldname colon space fieldvalue starts every line, except for those lines which are properly configured with leading whitespaces according to the rules of wrapping fieldvalues with leading whitespace. When you paste headers into the newsmessage, that formatting is manged. The body is also mangled by adding linewraps which weren't previously there, but that is less consequential. After you get this problem worked out, it would be advisable to get a new authorization code, because it is /possible/ - but unlikely - that someone might choose to nefariously create bogus reports to cause trouble by using your submit address code. That being said, I'll suggest that you 'imagine' how the SC parser works on a spam which you have forwarded to the parser by forwarding as an attachment to a 'normal' mail addressed to the submit. The normal submit consists of your headers to submit, followed by some empty line representing the first part of the body, and typically followed by some attachment MIME structure. The parser 'automatically' removes the headers from you to the submit and also automatically removes the MIME attachment structure so that it can 'find' the beginning of the spam headers. Then, the parser parses the headers 'line by line' until it gets to the end of the spam's headers and finds the empty line representing the body, and then it begins to parse the body. If you forward a spam, the first thing that hits the parser is the headers of the spam with your own forwarding lines appended to the top. If SC 'subtracts' the headers from you to the submit, there are no headers left. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Mon May 15 14:48:05 2006 From: MikeE at ster.invalid (Mike Easter) Date: Mon May 15 16:50:03 2006 Subject: [SC-Help] Re: Question on mail forwarding , 2 of 2 References: Message-ID: Mike Easter wrote: > - posting a news message with your newsreader causes the header lines > to become 'mangled' compared to their original condition. I see that you posted a news message to an nntp newsgroup by using a mailuser agent through the mailing list and Mailman instead of a news agent, but the problems of the mail agent mangling the example of the mail's headers by introducing spurious wraps is exactly the same problem as if it had been done by an nntp news agent. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Mon May 15 15:10:53 2006 From: MikeE at ster.invalid (Mike Easter) Date: Mon May 15 17:15:04 2006 Subject: [SC-Help] Re: Question on mail forwarding , 1 of 2 References: Message-ID: Tim Wayne wrote: > Question: what am I doing wrong? Here's another way of saying what's wrong, using my Abbreviated Received tracelines display style: Abbreviated Received tracelines *comment from (sc-smtp2-bulkmx.soma.ironport.com [204.15.82.125]) by sc-app1.soma.ironport.com *spamcop from studio321.studio32.com ([128.121.51.87]) by sc-smtp2-bulkmx.soma.ironport.com *you to SC from yahoo.no ([219.155.31.145]) by studio321.studio32.com *sourceline from unknown (HELO nntp.pinxodet.net) by smtp-server1.cfdenselr.com *bogusline from unknown (HELO mail.gimmicc.net) by mx.reskind.net *bogusline If you like, imagine that the headerlines are numbered 1-5 from top to bottom. The spammer created the 2 boguslines 4 & 5 and then injected the item at the abused proxy 219.155.31.145 calling itself yahoo.no and aimed it at a hisnameistimmy addy, which MX is 128.121.51.87 rDNS studio321.studio32.com. That MX received the item in line 3 and forwarded it to the ironport server using your submit address which received it in line 2. The result of that mailhandling is that there is a single set of headers from the spamsource to the ironport server. That is not the normal condition of spam which is sent to a submit address. The normal condition is that the submit for a single spam consists of several parts. - the headers from your mailuser agent to the ironport server - a non-existent body consisting of an empty line - a MIME attachment structure delimitor - the headers from the spamsource to your mailbox - the body of the spam, which might have additional MIME structure If someone submits multiple spams to the submit, the structure is more complicated, with 1 iteration of the top 2 items and mulitple iterations of the last 3 items in the above - marked bullets. In any case, the first thing the parser does is subtract the top 3 bullet items aboive before it begins the parse on the spam headers. > Or, is my assumption that Spamcop > can accept forwards wrong? Yes. > Or should my server be set to configure > forwards in a particular way so that they are spamcop friendly? I would guess that it would not be possible to configure your forwards to match the parser's behavior. If you had a spamcop address to receive forwards, that address could be used to handle spam. You could also simply forward the junk mail by forwarding as attachment, like everyone else. -- Mike Easter kibitzer, not SC admin From asterix at no_where.net Tue May 16 00:30:16 2006 From: asterix at no_where.net (Asterix) Date: Mon May 15 17:35:03 2006 Subject: [SC-Help] Re: Unstoppable picture spam. References: Message-ID: <1hfejuv.oz4vf2asdtchN%asterix@no_where.net> anon wrote: > "S?ren Jacob Lauritsen" wrote in message > news:e4anol$6s2$1@news.spamcop.net... > > anon wrote: > >> I think that the first thing you should do (not do) is about READING > >> spams. > >> > >> NEVER, NEVER, EVER *open* a spam - many spams 'phone home' to tell the > >> spammer that he has a 'live one' and the address is a salable commodity > >> and worth money to other spammers. > > > > I use gmail. It will never open any pictures. Besides that, I've checked > > the e-mail file. The picture is an attachment. It's not an HTML e-mail. > > > > No, I mean do not open the spam at all (not talking about pictures or > anything else) - just do not open it at all. Please tell me how to report spam without opening it (and make sure it's spam. By the way, it's years since I saw a web bug (fone home thingy). -- I recommend Macs to my friends, and Windows machines to those whom I don't mind billing by the hour From MikeE at ster.invalid Mon May 15 15:45:51 2006 From: MikeE at ster.invalid (Mike Easter) Date: Mon May 15 17:50:03 2006 Subject: [SC-Help] Re: Unstoppable picture spam. References: <1hfejuv.oz4vf2asdtchN%asterix@no_where.net> Message-ID: Asterix wrote: > Please tell me how to report spam without opening it (and make sure > it's spam. By the way, it's years since I saw a web bug (fone home > thingy). My spam is 'combed' by SpamPal so that it is tagged with a spam label in its subject and given header Xlines defining how the spam was so categorized before it arrives at my mua OE. OE puts the spamtagged items into the Junk folder. If I want to see why an item was tagged, I can examine its header Xlines by looking at its message properties without opening it. If I should really want to know more about what it inside, I can examine the rest of its message properties including the unrendered body 'with my own eyes'. That process is of course slower and less sophisticated than how SpamPal has already more thoroughly examined it while accessing spam database DNSBL lookups as well as churning through the body using regular expression conditions far too complex to be performed by a mere human brain. Opening a spam to find out what is inside is a practice I discourage except in some kind of 'advanced' spamfighting and then only for some very good reason, perhaps 'teaching' spam forensics or something. It is far too often performed by those who are simply curious spamhandlers. The concept of opening a spam to find out if it is spam is totally foreign to me. -- Mike Easter kibitzer, not SC admin From nobody at devnull.spamcop.net Mon May 15 17:54:17 2006 From: nobody at devnull.spamcop.net (WazoO) Date: Mon May 15 17:55:02 2006 Subject: [SC-Help] Re: Question on mail forwarding , 1 of 2 References: Message-ID: "Tim Wayne" wrote in message news:mailman.7.1147724128.3606.spamcop-help@news.spamcop.net... > > To take advantage of my new spamcop account, I thought it would be > interesting to set up the forwarding on my server to re-route emails > sent to these dead aliases to my spamcop email address instead of > into the server's bit bucket. So, I told the server to forward said > email to submit.nj1jTDtvl4UXoCDG@spam.spamcop.net, my spamcop > reporting address. But instead of the reports getting taken by > spamcop, I keep getting failure notices, like in the example in part > two of this message. You have confused your "SpamCop.net e-mail address" and your SpamCop.net Reporting address .... You really need to contact Don/Deputies to get a new Reporting account .. this one is now burned, open to abuse, etc. .... As far as "forwarding" foes, that's a whole special case .. but I see that Mike Easter is already involved with that issue. From spamcop.forum at hisnameistimmy.com Mon May 15 16:00:48 2006 From: spamcop.forum at hisnameistimmy.com (Tim Wayne) Date: Mon May 15 18:03:04 2006 Subject: [SC-Help] Re: Question on mail forwarding , 1 of 2 In-Reply-To: References: Message-ID: <81D80A83-C07C-4C7E-A99E-565F0D339E5A@hisnameistimmy.com> On May 15, 2006, at 2:54 PM, WazoO wrote: >> To take advantage of my new spamcop account, I thought it would be >> interesting to set up the forwarding on my server to re-route emails >> sent to these dead aliases to my spamcop email address instead of >> into the server's bit bucket. So, I told the server to forward said >> email to submit.nj1jTDtvl4UXoCDG@spam.spamcop.net, my spamcop >> reporting address. But instead of the reports getting taken by >> spamcop, I keep getting failure notices, like in the example in part >> two of this message. > > You have confused your "SpamCop.net e-mail address" and your > SpamCop.net Reporting address .... It says on http://www.spamcop.net/ on the Report Spam page: Forward your spam to: submit.nj1jTDtvl4UXoCDG@spam.spamcop.net or: Paste entire spam (headers, blank line, body) - or - single address (one line only): [ Form Field ] What have I confused? > You really need to contact > Don/Deputies to get a new Reporting account .. this one is now > burned, open to abuse, etc. .... Why do you think this? Thanks for your help, Tim Wayne San Francisco From r.antiochdunkthis at dunkthisntlworld.com Tue May 16 00:04:35 2006 From: r.antiochdunkthis at dunkthisntlworld.com (antioch) Date: Mon May 15 18:05:03 2006 Subject: [SC-Help] Re: Unstoppable picture spam. References: Message-ID: Yes - they are in .gif format and cannot be stopped with message rules unless you add a rule to stop any mail that does not contain each letter of the alphabet - long winded I know - I was getting 6 a day - had none for two days - perhaps they don't work at the weekends. Others have reported same in the past in spamcop groups. Rgds Antioch PS To Mike Easter - think I got the hang of the reporting - well not been black-balled yet!!!! "Søren Jacob Lauritsen" wrote in message news:e4adq6$vdn$1@news.spamcop.net... > Hello there! > > Four times a day since the end of April, I have been blessed with e-mails > containing text as pictures. I'm pretty sure they're from the same source. > They all share the same "look": Text on a colored background (light red or > light green). The contents of the text differs from time to time. > > Have anybody received these e-mails? The spammer seems to be unstoppable. > So any suggestions would be nice. It's the first time, I haven't been able > to stop them within a few days. > > Best regards, > Søren > > -- > Remove nospam to write me! :-) From scamper at trisk.com Mon May 15 17:21:31 2006 From: scamper at trisk.com (Garen Erdoisa) Date: Mon May 15 18:20:04 2006 Subject: [SC-Help] Re: Question on mail forwarding , 1 of 2 In-Reply-To: References: Message-ID: Tim Wayne wrote: > > On May 15, 2006, at 2:54 PM, WazoO wrote: > >>> To take advantage of my new spamcop account, I thought it would be >>> interesting to set up the forwarding on my server to re-route emails >>> sent to these dead aliases to my spamcop email address instead of >>> into the server's bit bucket. So, I told the server to forward said >>> email to submit.nj1jTDtvl4UXoCDG@spam.spamcop.net, my spamcop >>> reporting address. But instead of the reports getting taken by >>> spamcop, I keep getting failure notices, like in the example in part >>> two of this message. >> >> You have confused your "SpamCop.net e-mail address" and your >> SpamCop.net Reporting address .... > > It says on http://www.spamcop.net/ on the Report Spam page: > > Forward your spam to: submit.nj1jTDtvl4UXoCDG@spam.spamcop.net or: This reporting address should be kept between you and SpamCop. Revealing it on an forum that is open to the public is asking for it to be abused. I suggest that you contact deputies spamcop net to get a new reporting address. > Paste entire spam (headers, blank line, body) - or - single address > (one line only): > [ Form Field ] > > What have I confused? You need to forward the spam as an RFC822 attachment. If you Google for "automatic spamcop reporting" it returns a few thousand hits. There are a lot of options out there. There are plug ins that can enable various spam filters to do this if they don't have it built in. Some spam filters have this functionality built in. I'm rather partial to SpamBouncer but would not recommend it for novices because it requires some programing skill, some knowledge of how procmail works and it needs to be managed a bit more than some of the other filters out there. > > > >> You really need to contact >> Don/Deputies to get a new Reporting account .. this one is now >> burned, open to abuse, etc. .... > > Why do you think this? See above. Your reporting address is unique to you. If you give it out, then anyone can potentially use it to report spam in your name. > > > Thanks for your help, > > Tim Wayne > San Francisco > -- Garen From spamcop.forum at hisnameistimmy.com Mon May 15 16:30:32 2006 From: spamcop.forum at hisnameistimmy.com (Tim Wayne) Date: Mon May 15 18:32:46 2006 Subject: [SC-Help] Re: Question on mail forwarding , 1 of 2 In-Reply-To: References: Message-ID: <836FDA8F-AD90-4E62-BF2C-DB08B8438F9D@hisnameistimmy.com> On May 15, 2006, at 3:21 PM, Garen Erdoisa wrote: >> It says on http://www.spamcop.net/ on the Report Spam page: >> Forward your spam to: submit.nj1jTDtvl4UXoCDG@spam.spamcop.net >> or: > > This reporting address should be kept between you and SpamCop. > Revealing it on an forum that is open to the public is asking for > it to be abused. > I suggest that you contact deputies spamcop net to get a > new reporting address. Oh. Well, actually, I thought there *might* be something private or unique (to my account) to that email. When I wrote the post I changed two letters in the email address. The one above is representational only. It's similar but not exactly the one I got from Spamcop. ;-) > >> Paste entire spam (headers, blank line, body) - or - single >> address (one line only): >> [ Form Field ] >> What have I confused? > > You need to forward the spam as an RFC822 attachment. > > If you Google for "automatic spamcop reporting" it returns a few > thousand hits. There are a lot of options out there. > > There are plug ins that can enable various spam filters to do this > if they don't have it built in. Some spam filters have this > functionality built in. > > I'm rather partial to SpamBouncer but would not recommend it for > novices because it requires some programing skill, some knowledge > of how procmail works and it needs to be managed a bit more than > some of the other filters out there. Thanks! I am going to have my server expert help me out with this part, and with what I got from Mike Easter earlier. Thank you! Cheers, Tim Wayne From MikeE at ster.invalid Mon May 15 16:36:32 2006 From: MikeE at ster.invalid (Mike Easter) Date: Mon May 15 18:40:03 2006 Subject: [SC-Help] Re: Question on mail forwarding , 1 of 2 References: Message-ID: Tim Wayne wrote: > It says on http://www.spamcop.net/ on the Report Spam page: > > Forward your spam to: submit.nj1jTDtvl4UXoCDG@spam.spamcop.net or: > Paste entire spam (headers, blank line, body) - or - single address > (one line only): > [ Form Field ] > > What have I confused? You have confused configuring a server to forward with the very different process of using a mailuser agent to receive spam mail and then to forward that/those spam *AS AN ATTACHMENT* [to a mail sent from a mailuser agent] to the submit address. That 'Forward your spam' and secret submit address you pasted above is only seen by someone who has logged in and is authorized to submit spam to the webparser or to the submit address. That authorized 'person' is assumed to be a person using a mailuser agent and following the guidelines provided for that. Not a person configuring a server wrongly. That authorized someone is required to have read the rules and guidelines prior to signing up, which are found on this page http://www.spamcop.net/anonsignup.shtml Reporting Spam -- Getting Started -- What do I need to know to start reporting spam? -- How do I get my email program to reveal the full headers? -- How should I select the recipients for my spam report? -- Learn more about how SpamCop reporting service works Thus, I would assume that the authorized and logged in person is intending to submit a spam which spam has been accessed for submitting to the webparser or to the submit address with a browser into the webparser or with a mailuser agent to the submit address. The various mailuser agents methods of submitting by email are described in detail in the section http://www.spamcop.net/fom-serve/cache/19.html How do I get my email program to reveal the full, unmodified email? Those instructions are principally structured around submitting spam to the webparser -- which at this stage of your confusion I would highly recommend that you perform so that you will have the experience of having successfully submitted a spam and seeing the result of a successful parse, or else your confusion is liable to become more muddled before it becomes clearer. There are no instructions in the faq for using a server to forward its received spam to the submit address -- that isn't done. The word Forward in the context you read it there means "Use your mailuser agent in the manner described for the appropriate mailuser agent to Forward as Attachment, not Forward, to the submit address." The word Forward there does *not* mean, "Use your server's forward function to forward its received spam to the submit address." Some mailuser agents can forward as attachment to the submit address and some cannot. I see no instructions for AppleMail, so I don't know one way or the other about it. >> You really need to contact >> Don/Deputies to get a new Reporting account .. this one is now >> burned, open to abuse, etc. .... > > Why do you think this? Anyone who wants can use your submit address to submit fraudulent forged spams to cause someone some trouble. The blame for all the trouble that it causes and the banishment of the spamforging reporter would be on you because it is your personal submit address attached to your identity, not that of the forger. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Mon May 15 16:38:58 2006 From: MikeE at ster.invalid (Mike Easter) Date: Mon May 15 18:40:05 2006 Subject: [SC-Help] Re: Unstoppable picture spam. References: Message-ID: antioch wrote: > To Mike Easter - think I got the hang of the reporting - well not been > black-balled yet!!!! Good. Now we are going to have to train you to post by trimming and contextualizing your news messages for much greater clarity. Here's an example of a guide http://members.fortunecity.com/nnqweb/nquote.html news.newusers.questions - Quoting Style in Newsgroup Postings -- Mike Easter kibitzer, not SC admin From dfmanno at mail.com Mon May 15 19:39:37 2006 From: dfmanno at mail.com (D.F. Manno) Date: Mon May 15 18:40:08 2006 Subject: [SC-Help] Re: Unstoppable picture spam. References: Message-ID: In article , "anon" wrote: > No, I mean do not open the spam at all (not talking about pictures or > anything else) - just do not open it at all. That advice is useless if you want to report to Spamcop and you have a email client that breaks the headers when you forward the spam. -- D.F. Manno | dfmanno@mail.com Had enough? Vote Democratic! From r.antiochdunkthis at dunkthisntlworld.com Tue May 16 01:14:18 2006 From: r.antiochdunkthis at dunkthisntlworld.com (antioch) Date: Mon May 15 19:15:05 2006 Subject: [SC-Help] Re: Unstoppable picture spam. References: Message-ID: "Mike Easter" wrote in message news:e4avtu$cqa$1@news.spamcop.net... > antioch wrote: > >> To Mike Easter - think I got the hang of the reporting - well not been >> black-balled yet!!!! > > Good. > > Now we are going to have to train you to post by trimming and > contextualizing your news messages for much greater clarity. I already do - we call it 'clipping' - some dont like it in msnewsgroups. I do it all the time - its a personal issue anyhow - like top or bottom posting. I guess you do it slightly different here from what I have just read. When things get long and complicated and you dont bottom post, you get a smack - certainly if you dont clip/trim parts of the post. Take care - if others are getting these stock spams, I might get less - no perhaps not ;-) ;-) Rgds Antioch > Here's an example of a guide > http://members.fortunecity.com/nnqweb/nquote.html > news.newusers.questions - Quoting Style in Newsgroup Postings > > > > -- > Mike Easter > kibitzer, not SC admin > From MikeE at ster.invalid Mon May 15 18:04:50 2006 From: MikeE at ster.invalid (Mike Easter) Date: Mon May 15 20:05:03 2006 Subject: [SC-Help] Re: Unstoppable picture spam. References: Message-ID: antioch wrote: > "Mike Easter" >> trimming and >> contextualizing > I already do - we call it 'clipping' - some dont like it in > msnewsgroups. I leave the MS MVPs alone about their shabby posting style when I'm participating in MS public ng/s, but if MVP gurus top post when they are 'outside' in the normal usenet I beat them up about it. Not only do I beat them up about top posting outside of MS ng/s, but I also beat them up for 'causing' the MS ng/s to be in such a condition, and for badly 'training' by example or guiding all of the newbies who start usenet participation in the MS ng/s. The rest of usenet and ng/s are *not* like the MS groups. Very very few ng/s are like that. > I do it all the time - I noticed that earlier sometimes you /were/ contextualizing. > its a personal issue anyhow - > like top or bottom posting. It is a lot more than a 'personal' issue -- there is no such thing being discussed as 'bottom' posting. Top posting is untrimmed noncontextualized posting up above everything else with an additional failure to 'organize' the cite attributions because there is no meaningful citing and attributing because there is no trimming or contextualizing. The opposite of top posting is trimmed and contextualized -- not untrimmed noncontextualized posting down underneath everything else on the 'bottom'. An untrimmed and thus non-contextualized bottom post is its own problem, which problem is often bandied about by top posters who think it is a top vs bottom issue, like left handed and right handed. That means that the topposter makes a complete mess of a thread because of the disruption of the order of the conversation -- and no one else can fix it without completely disassembling and reconstructing the top poster's remark; or alternatively aggressively chopping off everything which had ever preceded the top poster's remark which pushed all that preceding down below. > I guess you do it slightly different here from what I have just read. > When things get long and complicated and you dont bottom post, you > get a smack - certainly if you dont clip/trim parts of the post. Trimming is at the top of the list. If the replier starts by trimming, everything else about the contextualization comes naturally. -- Mike Easter kibitzer, not SC admin From spamtrap at dixie-soft.com Mon May 15 22:20:34 2006 From: spamtrap at dixie-soft.com (Alan Brown) Date: Mon May 15 21:25:03 2006 Subject: [SC-Help] Re: Quick reporting data Reports In-Reply-To: References: Message-ID: SpamCop Admin wrote: > The ability to disable SpamCop's automatic response to "Quick" spam > submissions is now available as a user option. > > - Don D'Minion - SpamCop Admin - I just looked and did not see this feature. Which options panel is this found on? - Alan From VROYLUAKAPCX at spammotel.com Mon May 15 23:44:07 2006 From: VROYLUAKAPCX at spammotel.com (Johnnie) Date: Mon May 15 22:45:02 2006 Subject: [SC-Help] Re: Unstoppable picture spam. In-Reply-To: References: Message-ID: S?ren Jacob Lauritsen wrote: > Hello there! > > Four times a day since the end of April, I have been blessed with > e-mails containing text as pictures. I'm pretty sure they're from the > same source. They all share the same "look": Text on a colored > background (light red or light green). The contents of the text differs > from time to time. > > Have anybody received these e-mails? The spammer seems to be > unstoppable. So any suggestions would be nice. It's the first time, I > haven't been able to stop them within a few days. Not only have I received them, the people who send them have used two of my domains as return addresses so I get dozens of bounces a day. The spammer is unstoppable and untraceable as he/she uses zombies to do the mailing. I just wish he/she would move on to someone elses' domain!! It is filterable as both Yahoo and Broghtmail put the emails in the spam folder and about 60% of the bounces too. Filtering them is easy as you can just filter out anything that is all or almost all picture and is not from anyone in your address book. From scamper at trisk.com Tue May 16 04:23:03 2006 From: scamper at trisk.com (Garen Erdoisa) Date: Tue May 16 05:25:08 2006 Subject: [SC-Help] Re: Quick reporting data Reports In-Reply-To: References: Message-ID: SpamCop Admin wrote: > Alan Brown wrote: >> -I just looked and did not see this feature. Which options panel is this >> -found on? > > It's in the "Report Handling Options" section under the "Preferences" > tab on the reporting server. > > Log in at: > > http://www.spamcop.net > http://members.spamcop.net > http://mailsc.spamcop.net > > > - Don - I see nothing for quick report options at http://members.spamcop.net/ After browsing to preferences and report handling options. Even after a refresh. I chose to not use this method years ago, so never bothered to have it enabled on my account. Perhaps it only shows up on that web page for people who already had the feature enabled? -- Garen From not at here.invalid Tue May 16 08:52:13 2006 From: not at here.invalid (Ellen) Date: Tue May 16 08:00:11 2006 Subject: [SC-Help] Re: Quick reporting data Reports References: Message-ID: "SpamCop Admin" wrote in message news:qgsi625os1he8l7u738rukjhv7u4atutpt@4ax.com... > Alan Brown wrote: >>-I just looked and did not see this feature. Which options panel is this >>-found on? > > It's in the "Report Handling Options" section under the "Preferences" > tab on the reporting server. > > Log in at: > > http://www.spamcop.net > http://members.spamcop.net > http://mailsc.spamcop.net > > Only appears if the quick flag has been set on the user account. Ellen SpamCop From spamers.sollen.sterben at cablenet.de Tue May 16 16:36:30 2006 From: spamers.sollen.sterben at cablenet.de (Ivan Kossey) Date: Tue May 16 09:40:02 2006 Subject: [SC-Help] Spam report via E-mail Message-ID: Hi All, Is it possible? What is the E-mail Address to report? How must be composed the E-mail? I'm registered, thus have an E-mail address with password Thanks Ivan Kossey From MikeE at ster.invalid Tue May 16 07:55:26 2006 From: MikeE at ster.invalid (Mike Easter) Date: Tue May 16 10:00:02 2006 Subject: [SC-Help] Re: Spam report via E-mail References: Message-ID: Ivan Kossey wrote: Subject: Spam report via E-mail Put your fully framed question into the body of a news message not part in the subject and part in the body -- so that a replier doesn't have to paste part of the subject into the body of his reply in order to properly contextualize the response. > Is it possible? Did you read the faq which was required when you registered for your authorization? You should not be submitting any spam until you have read the faq. Yes it may be possible to submit spam to the parser for the parsing reporting function which is the same as the parsing reporting function of the webparser with the correct mailuser agent, but it is better to use the webparser first to gain experience with seeing various pages of the spamcop interface and because it is easier to troubleshoot any problems when the webparser is being used. In order to use the webparser for experience you should go to this page http://www.spamcop.net/ and login with your address and password > What is the E-mail Address to report? If you go to the above page logged in, the submit address is seen in this format: Forward your spam to: submit16charANcodeNMBR@spam.spamcop.net or: Paste entire spam (headers, blank line, body) - or - single address (one line only): where the 'term' 16charANcodeNMBR is your personal code for submitting which should be kept secret. > How must be composed the E-mail? First use the webparser according to the instructions you saw when you registered and got your authorization. By using the webparser, you will be able to tell if you have learned how to get the spam with complete headers as described in the faq http://www.spamcop.net/fom-serve/cache/19.html How do I get my email program to reveal the full, unmodified email? Then, after you know how to use the webparser, see if the faq link above tells you how to use your mailuser agent to email submit. > I'm registered, thus have an E-mail address with password Did you read the faq? -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Tue May 16 10:19:27 2006 From: MikeE at ster.invalid (Mike Easter) Date: Tue May 16 12:20:03 2006 Subject: [SC-Help] Re: SC says email address and URL no good References: Message-ID: posted to spamcop.spam and spamcop.help. Followups to .help Nigel Featherston wrote: > "Nigel Featherston" >> What could this be? >> >> Looks to be a Monster.com spoof, but for what purpose. >> >> SC # 1752758072 >> >> (Is the SC # sufficient for others to see this?) No. Only you can access the item by reportid. > Here's the URL for the email in question: > http://www.spamcop.net/mcgi?action=gettrack&reportid=1752758072 That is not a tracking url. That is a link /you/ and only you can use to access the tracking url. Use that link, click the highlighted reportid and it will take you to the parse which has the tracking url which looks like Here is your TRACKING URL - it may be saved for future reference: http://www.spamcop.net/sc?id=z944733845z4d43361577725dbaa547057341267ebdz Spamcop.spam is not a discussion group. .spam is a place to post raw spam. posting raw spam is not a good method to show a spam. A tracking url is a good method to show a spam. A tracking url should be posted into a discussion group like spamcop.help or spamcop to discuss. A raw spam should never be posted into a discussion group. -- Mike Easter kibitzer, not SC admin From spamtrap-02 at ec-magic.com Tue May 16 10:33:33 2006 From: spamtrap-02 at ec-magic.com (Nigel Featherston) Date: Tue May 16 12:35:03 2006 Subject: [SC-Help] Re: SC says email address and URL no good References: Message-ID: Thanks Mike, Nigel "Mike Easter" wrote in message news:e4cu2c$ivn$1@news.spamcop.net... > posted to spamcop.spam and spamcop.help. Followups to .help > > Nigel Featherston wrote: >> "Nigel Featherston" > >>> What could this be? >>> >>> Looks to be a Monster.com spoof, but for what purpose. >>> >>> SC # 1752758072 >>> >>> (Is the SC # sufficient for others to see this?) > > No. Only you can access the item by reportid. > >> Here's the URL for the email in question: >> http://www.spamcop.net/mcgi?action=gettrack&reportid=1752758072 > > That is not a tracking url. That is a link /you/ and only you can use > to access the tracking url. Use that link, click the highlighted > reportid and it will take you to the parse which has the tracking url > which looks like > > Here is your TRACKING URL - it may be saved for future reference: > http://www.spamcop.net/sc?id=z944733845z4d43361577725dbaa547057341267ebdz > > Spamcop.spam is not a discussion group. .spam is a place to post raw > spam. posting raw spam is not a good method to show a spam. A tracking > url is a good method to show a spam. A tracking url should be posted > into a discussion group like spamcop.help or spamcop to discuss. A raw > spam should never be posted into a discussion group. > > > -- > Mike Easter > kibitzer, not SC admin > From spamtrap-02 at ec-magic.com Tue May 16 10:42:27 2006 From: spamtrap-02 at ec-magic.com (Nigel Featherston) Date: Tue May 16 12:45:02 2006 Subject: [SC-Help] Here is the Tracking URL References: Message-ID: Thanks Mike, Here is the Tracking URL for this mysterious spam email. http://www.spamcop.net/sc?id=z945557411z13c22d3cfce8e5f033884bc08c04bb9az SC says the email addresses 'jobs@thestocktongroup.com' 'adriaan.p@thestocktongroup.com' and the web URL: http://www.thestocktongroup.com/ are no good. If so, what possible purpose does this email serve? Nigel ------------------------------ "Mike Easter" wrote in message news:e4cu2c$ivn$1@news.spamcop.net... > posted to spamcop.spam and spamcop.help. Followups to .help > > Nigel Featherston wrote: >> "Nigel Featherston" > >>> What could this be? >>> >>> Looks to be a Monster.com spoof, but for what purpose. >>> >>> SC # 1752758072 >>> >>> (Is the SC # sufficient for others to see this?) > > No. Only you can access the item by reportid. > >> Here's the URL for the email in question: >> http://www.spamcop.net/mcgi?action=gettrack&reportid=1752758072 > > That is not a tracking url. That is a link /you/ and only you can use > to access the tracking url. Use that link, click the highlighted > reportid and it will take you to the parse which has the tracking url > which looks like > > Here is your TRACKING URL - it may be saved for future reference: > http://www.spamcop.net/sc?id=z944733845z4d43361577725dbaa547057341267ebdz > > Spamcop.spam is not a discussion group. .spam is a place to post raw > spam. posting raw spam is not a good method to show a spam. A tracking > url is a good method to show a spam. A tracking url should be posted > into a discussion group like spamcop.help or spamcop to discuss. A raw > spam should never be posted into a discussion group. > > > -- > Mike Easter > kibitzer, not SC admin > From asterix at no_where.net Tue May 16 22:05:09 2006 From: asterix at no_where.net (Asterix) Date: Tue May 16 15:10:03 2006 Subject: [SC-Help] Re: Unstoppable picture spam. References: <1hfejuv.oz4vf2asdtchN%asterix@no_where.net> Message-ID: <1hfg7em.1jym52vdlp9waN%asterix@no_where.net> Mike Easter wrote: > Asterix wrote: > > > Please tell me how to report spam without opening it (and make sure > > it's spam. By the way, it's years since I saw a web bug (fone home > > thingy). > > My spam is 'combed' by SpamPal so that it is tagged with a spam label in > its subject and given header Xlines defining how the spam was so > categorized before it arrives at my mua OE. OE puts the spamtagged > items into the Junk folder. If I want to see why an item was tagged, I > can examine its header Xlines by looking at its message properties > without opening it. Sorry, I was actually mocking "anon" - most of my spam is also marked, either by SpamAssasin or PerlMx-Spam depending on the mail server. As I a) want full control of what I report and b) always report through the web site, there is no way I can avoid opening the spam. Besides, your reply says abolutely nothing about how to *report* spam, which what I asked. And you don't say *why* you discourage opening spam, though I think I have an idea. However, in my world adware, spyware, trojans, worms and viruses are a non-issue so I have no problem opening and reporting every spam. For that matter, OE is a non-issue in my world, too :-) -- I recommend Macs to my friends, and Windows machines to those whom I don't mind billing by the hour From MikeE at ster.invalid Tue May 16 14:16:21 2006 From: MikeE at ster.invalid (Mike Easter) Date: Tue May 16 16:20:03 2006 Subject: [SC-Help] Re: Here is the Tracking URL References: Message-ID: Nigel Featherston wrote: www.spamcop.net/sc?id=z945557411z13c22d3cfce8e5f033884bc08c04bb9az Preface: I don't recommend reading spam subjects receptively, I don't recommend opening spam to find out what is inside, I don't recommend reading spambodies for 'content', and I don't recommend trying to read the mind of the spammer who created the Subject or why /that/ subject, or the From and why /that/ From, or the body words and why /those/ words, or the bogus lines and why /those/ bogus lines. Chapter 1: Before I 'dissect' any spambody, I dissect its headers. There's something funny about those headers Abbreviated Received tracelines *comment from (smtp101.biz.mail.re2.yahoo.com [68.142.229.215]) by mx9.pacifier.net from unknown (HELO da168@ebankerscorus.com) (da168@ebankerscorus.com@65.113.104.154 with login) by smtp101.biz.mail.re2.yahoo.com I believe that the item was relayed by a yahoo server to pacifier, but that the yahoo server's headers are noncompliant, so I'm having to guess at the IP source for the yahoo server, ie is it 65.113.104.154 no rDNS? whois -h whois.arin.net 65.113.104.154 ... Qwest Comm 65.112.0.0 - 65.127.255.255 VIPOWERNET 65.113.104.0 - 65.113.111.255 In addition, the item carries a pacifier.net mid Message-Id: <2006_________________4265@mx9.pacifier.net> suggesting that either the item got all the way thru' the yahoo mailserver without an mid which was ultimately provided by pacifier, or else the source fabricated a pacifier mid before mailing/injection. So, that makes 2 strange situations in the headers already. In that case, I'll look at the From, which I normally do not, which sez monster.com So far I conclude, "Funky headers. Unanswered questions." Chapter 2: Look at the body. There's a problem with the body. It has been mangled thrice, once by OL when it was being stored by the MAPI client OL which mapi-izes the html, then again a second time by OL when it was removed from storage and de-mapi-ized to try to turn it back into an approximation of the original html version, and then the 3rd time by SC which is configured to do a hack on an html spam when it is submitted by an OL or Eurdora client. That is too much mangling by all of those parties to rely on the correct structure anymore. The original spam has been lost. This is a spam 'forged' or manufactured or synthesized to try to look like the original might be guessed to have looked. I can find a mailto for thestocktongroup.com and I can find a link for http://www.thestocktongroup.com/jobs.html which doesn't resolve, neither, due to nameserver failure Searching for www.thestocktongroup.com A record at ns1.allhostingsolutions.com. [63.239.178.210]: Server failure! [took 214 ms]. so the email addies aren't going to go anywhere either. Chapter 3: Back to Nigel's original question. > SC says the email addresses > 'jobs@thestocktongroup.com' > 'adriaan.p@thestocktongroup.com' > > and the web URL: http://www.thestocktongroup.com/ are no good. That is correct. They do not resolve. The domain registrationa at wildwestdomains.com for thestocktongroup.com just shows a domains by proxy registration and gives the nameservers which aren't working. > If so, what possible purpose does this email serve? None. It is b0rken. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Tue May 16 14:20:07 2006 From: MikeE at ster.invalid (Mike Easter) Date: Tue May 16 16:25:02 2006 Subject: [SC-Help] Re: Unstoppable picture spam. References: <1hfejuv.oz4vf2asdtchN%asterix@no_where.net> <1hfg7em.1jym52vdlp9waN%asterix@no_where.net> Message-ID: Asterix wrote: > Mike Easter >> Asterix wrote: >> >>> Please tell me how to report spam without opening it (and make sure >>> it's spam. >> If I want to see why an item >> was tagged, I can examine its header Xlines by looking at its >> message properties without opening it. > As I a) want full control of what I report and b) always report > through the web site, there is no way I can avoid opening the spam. If you are saying that your software prohibits you from reporting spam without opening it, I can't very well tell you how to report spam without opening it. > Besides, your reply says abolutely nothing about how to *report* spam, > which what I asked. No, you asked "and make sure it's spam" in addition to not saying what method you were using to report. > And you don't say *why* you discourage opening > spam, though I think I have an idea. I think I'll go into that on Nigel's post instead of here. -- Mike Easter kibitzer, not SC admin From r.antiochdunkthis at dunkthisntlworld.com Wed May 17 02:21:47 2006 From: r.antiochdunkthis at dunkthisntlworld.com (antioch) Date: Tue May 16 20:25:03 2006 Subject: [SC-Help] Ping Mike Easter Message-ID: Hello Mike Great news - my ISP is at last filtering out those .gif spam emails. I got an email today from them - I had complained to them for their inaction - there were 25 sitting there ready for deletion - six were the medical type - quite a few for 5 days. I will keep going to spamcop and read the faqs at my leisure though. I recon that in about three months I might be able to read through some of the posts and actually understand what the hell you are all talking about. I was wondering if it would be any help to the 'cause' if I went through the parsing of these - that is if I can do it from the ISP web site. I do not wish to allow them to come onto my computer. The ISP did not say if they were taking their own action to report - I doubt it. Thanks for all your help - and good luck to all who have recently encountered these 'barstewards' sending this spam. Antioch P.S. For the record - I do not agree with your comments on msnewsreader groups ;-) ;-) From scamper at trisk.com Tue May 16 19:51:10 2006 From: scamper at trisk.com (Garen Erdoisa) Date: Tue May 16 20:55:03 2006 Subject: [SC-Help] Re: Ping Mike Easter In-Reply-To: References: Message-ID: antioch wrote: > Hello Mike > Great news - my ISP is at last filtering out those .gif spam emails. > [snip] > P.S. > For the record - I do not agree with your comments on msnewsreader groups Just a comment: There are very good reasons for using the recommended newsgroup quoting style. It has to do with making it easy for others to understand what you are talking about when you post a reply to anything by placing your comments into context. 1) If you do not quote at all in a reply you leave the reader guessing at what you are replying to. 2) If you quote the entire message but then post your reply above or below the the message you are responding to, and the message happens to be very long and cover a lot of topics of discussion, again you leave the reader guessing as to what part of the message your reply was for. This is why you should put your replies into context. 4) Newsgroup quoting styles have been in use now for well over 20 years, they are very well understood and accepted quoting practices among those who participate in newsgroup threaded discussions. Because of that, if you choose for whatever reason to not follow these accepted practices, then you invite criticism. Quite often people who fail to follow accepted practices in threaded discussions and choose to ignore request to start doing so, will eventually be ignored completely and/or not taken seriously. 5) It's bad form to quote the entire message of an OP (Original Poster) especially so if that message is more than just a few lines in length, unless you are doing a point by point response to the message and properly contextualizing your responses as you go. You should [snip] any comments you are not responding to. A lot of these styles are just adapted for computer use from accepted academic and/or journalistic quoting and referencing styles that predate computers by centuries. I'm making these comments partly to let you know that Mike Easter is correct and is far from being alone in his thinking on these issues. Mike Easter is just more vocal than most about pointing out bad posting styles. Most people who don't like such bad form would just put your posts into a kill file and be done with it, or be annoyed at it but say nothing. That is usually what I do. -- Garen From r.antiochdunkthis at dunkthisntlworld.com Wed May 17 03:04:01 2006 From: r.antiochdunkthis at dunkthisntlworld.com (antioch) Date: Tue May 16 21:05:03 2006 Subject: [SC-Help] Re: Ping Mike Easter References: Message-ID: Hello Garen Yes I have seen and read the context of your reply already. I have never had any problem reading posts in msn or other groups - except those that write without common grammar and syntax rules. And those that use capitals for all their posts. Even where some posts develop into two, three or four different threads, I find the majority easy to follow. It is the lazy, and ignorant, who cant type basic english - that really pizzes me off. Although those with a lesser grasp of english do get treated very well and with understanding, in my opinion. But I agree, there should be basic ways that posts are written. But I cant say if any particular set of groups follow these ways or not. I doubt it. Nice to have contact with you Rgds Antioch "Garen Erdoisa" wrote in message news:e4ds21$6j2$1@news.spamcop.net... > antioch wrote: >> Hello Mike >> Great news - my ISP is at last filtering out those .gif spam emails. >> [snip] >> P.S. >> For the record - I do not agree with your comments on msnewsreader groups > > Just a comment: There are very good reasons for using the recommended > newsgroup quoting style. It has to do with making it easy for others to > understand what you are talking about when you post a reply to anything by > placing your comments into context. > > 1) If you do not quote at all in a reply you leave the reader guessing at > what you are replying to. > > 2) If you quote the entire message but then post your reply above or below > the the message you are responding to, and the message happens to be very > long and cover a lot of topics of discussion, again you leave the reader > guessing as to what part of the message your reply was for. This is why > you should put your replies into context. > > 4) Newsgroup quoting styles have been in use now for well over 20 years, > they are very well understood and accepted quoting practices among those > who participate in newsgroup threaded discussions. Because of that, if you > choose for whatever reason to not follow these accepted practices, then > you invite criticism. Quite often people who fail to follow accepted > practices in threaded discussions and choose to ignore request to start > doing so, will eventually be ignored completely and/or not taken > seriously. > > 5) It's bad form to quote the entire message of an OP (Original Poster) > especially so if that message is more than just a few lines in length, > unless you are doing a point by point response to the message and properly > contextualizing your responses as you go. You should [snip] any comments > you are not responding to. > > A lot of these styles are just adapted for computer use from accepted > academic and/or journalistic quoting and referencing styles that predate > computers by centuries. > > I'm making these comments partly to let you know that Mike Easter is > correct and is far from being alone in his thinking on these issues. > > Mike Easter is just more vocal than most about pointing out bad posting > styles. Most people who don't like such bad form would just put your posts > into a kill file and be done with it, or be annoyed at it but say nothing. > That is usually what I do. > > -- > Garen From spamtrap-02 at ec-magic.com Tue May 16 19:36:08 2006 From: spamtrap-02 at ec-magic.com (Nigel Featherston) Date: Tue May 16 21:40:03 2006 Subject: [SC-Help] Re: Here is the Tracking URL References: Message-ID: Thanks Mike, I sure appreciate you looing it over like that. I suspected it might be an old spam with no longer valid links, perhaps sent to probe a new email address. I say ths because to the best of my knowledge the address to which it was sent has never before been spammed. The recipient email address also contained both the words "spam" and "abuse". The copies of my manual lart were sent to the addresses in the spam email as well as those found in WHOIS for the domain thestocktongroup.com (as I have always done). Since my bottom line is having a clean inbox, listwashing is encouraged here. Chances are they now know it is a reporting address. So far no bounces have been received as yet.. Fortunately, if this is an indication this particular email address has gotten "out", it will only take a couple of hours work to replace it with a new address. This address is used for very few specific things. One of my concerns was whether anything in this email looked (to anyone else) like a virus/malware attempt. Regards, Nigel "Mike Easter" wrote in message news:e4dbuh$rud$1@news.spamcop.net... > Nigel Featherston wrote: > > www.spamcop.net/sc?id=z945557411z13c22d3cfce8e5f033884bc08c04bb9az > > Preface: I don't recommend reading spam subjects receptively, I don't > recommend opening spam to find out what is inside, I don't recommend > reading spambodies for 'content', and I don't recommend trying to read > the mind of the spammer who created the Subject or why /that/ subject, > or the From and why /that/ From, or the body words and why /those/ > words, or the bogus lines and why /those/ bogus lines. > > Chapter 1: Before I 'dissect' any spambody, I dissect its headers. > There's something funny about those headers > > Abbreviated Received tracelines *comment > from (smtp101.biz.mail.re2.yahoo.com [68.142.229.215]) by > mx9.pacifier.net > from unknown (HELO da168@ebankerscorus.com) > (da168@ebankerscorus.com@65.113.104.154 with login) by > smtp101.biz.mail.re2.yahoo.com > > I believe that the item was relayed by a yahoo server to pacifier, but > that the yahoo server's headers are noncompliant, so I'm having to guess > at the IP source for the yahoo server, ie is it 65.113.104.154 no rDNS? > > whois -h whois.arin.net 65.113.104.154 ... > Qwest Comm 65.112.0.0 - 65.127.255.255 > VIPOWERNET 65.113.104.0 - 65.113.111.255 > > In addition, the item carries a pacifier.net mid > > Message-Id: <2006_________________4265@mx9.pacifier.net> > > suggesting that either the item got all the way thru' the yahoo > mailserver without an mid which was ultimately provided by pacifier, or > else the source fabricated a pacifier mid before mailing/injection. So, > that makes 2 strange situations in the headers already. > > In that case, I'll look at the From, which I normally do not, which sez > monster.com > > So far I conclude, "Funky headers. Unanswered questions." > > Chapter 2: Look at the body. > > There's a problem with the body. It has been mangled thrice, once by OL > when it was being stored by the MAPI client OL which mapi-izes the html, > then again a second time by OL when it was removed from storage and > de-mapi-ized to try to turn it back into an approximation of the > original html version, and then the 3rd time by SC which is configured > to do a hack on an html spam when it is submitted by an OL or Eurdora > client. > > That is too much mangling by all of those parties to rely on the correct > structure anymore. The original spam has been lost. This is a spam > 'forged' or manufactured or synthesized to try to look like the original > might be guessed to have looked. > > I can find a mailto for thestocktongroup.com and I can find a link for > http://www.thestocktongroup.com/jobs.html > > which doesn't resolve, neither, due to nameserver failure > > Searching for www.thestocktongroup.com A record at > ns1.allhostingsolutions.com. [63.239.178.210]: Server failure! [took 214 > ms]. > > so the email addies aren't going to go anywhere either. > > Chapter 3: Back to Nigel's original question. > >> SC says the email addresses >> 'jobs@thestocktongroup.com' >> 'adriaan.p@thestocktongroup.com' >> >> and the web URL: http://www.thestocktongroup.com/ are no good. > > That is correct. They do not resolve. The domain registrationa at > wildwestdomains.com for thestocktongroup.com just shows a domains by > proxy registration and gives the nameservers which aren't working. > >> If so, what possible purpose does this email serve? > > None. It is b0rken. > > > > -- > Mike Easter > kibitzer, not SC admin > From scamper at trisk.com Tue May 16 21:06:36 2006 From: scamper at trisk.com (Garen Erdoisa) Date: Tue May 16 22:10:03 2006 Subject: [SC-Help] Re: Ping Mike Easter In-Reply-To: References: Message-ID: antioch wrote: > Hello Garen > Yes I have seen and read the context of your reply already. > [snip] > But I agree, there should be basic ways that posts are written. > But I cant say if any particular set of groups follow these ways or not. I > doubt it. >[snip] In my experience, having been on the Internet now since 1984 in one form or other and having participated in threaded newsgroup discussions in many forums off and on over the years, the one common thread I see among all the acceptable newsgroup posting styles is that you quote, then snip what you are not responding to, then respond to what is left over right underneath the quoted text. Like it or not, this is the only newsgroup posting style that I've seen over the years that does not generate criticism. -- Regards Garen From MikeE at ster.invalid Tue May 16 22:07:57 2006 From: MikeE at ster.invalid (Mike Easter) Date: Wed May 17 00:10:03 2006 Subject: [SC-Help] Re: Here is the Tracking URL References: Message-ID: Nigel Featherston wrote: > One of my concerns was whether anything in this email looked (to > anyone else) like a virus/malware attempt. Not to me. -- Mike Easter kibitzer, not SC admin From gago at spamcop.net Wed May 17 10:17:16 2006 From: gago at spamcop.net (Gaston Goossens) Date: Wed May 17 03:20:04 2006 Subject: [SC-Help] "no reports files" Message-ID: since Tuesday none of my reports get "filed" (small extract below) Submitted: dinsdag 16 mei 2006 7:59:28 +0200: Re: your VtAGRaA No reports filed Submitted: dinsdag 16 mei 2006 7:59:27 +0200: re: hi No reports filed Submitted: dinsdag 16 mei 2006 7:59:27 +0200: High Quality Replica No reports filed Submitted: dinsdag 16 mei 2006 7:59:26 +0200: propose cherry accumulation!!! No reports filed I now have like 40-50 reports like that, is it something I have to change in my settings? From gago at spamcop.net Wed May 17 10:38:22 2006 From: gago at spamcop.net (Gaston Goossens) Date: Wed May 17 03:40:05 2006 Subject: [SC-Help] Re: "no reports files" In-Reply-To: References: Message-ID: Gaston Goossens schreef: > since Tuesday none of my reports get "filed" (small extract below) > > Submitted: dinsdag 16 mei 2006 7:59:28 +0200: > Re: your VtAGRaA > No reports filed > Submitted: dinsdag 16 mei 2006 7:59:27 +0200: > re: hi > No reports filed > Submitted: dinsdag 16 mei 2006 7:59:27 +0200: > High Quality Replica > No reports filed > Submitted: dinsdag 16 mei 2006 7:59:26 +0200: > propose cherry accumulation!!! > No reports filed > > I now have like 40-50 reports like that, is it something I have to > change in my settings? btw: "Setting your Preferences to "Enable quick data reports" will return things to normal." that option is not in my "report-handling options" - "reporting preferences" list. From spamers.sollen.sterben at cablenet.de Wed May 17 11:15:38 2006 From: spamers.sollen.sterben at cablenet.de (Ivan Kossey) Date: Wed May 17 04:20:03 2006 Subject: [SC-Help] Re: Spam report via E-mail References: Message-ID: Thank You, Mike. I have sent a couple of reports from web page Spamcop. It works. I'm writing my own E-mail client and want to send reports automatically (of course with user authorisation). I understand now that it is not possible simply send an E-mail. Interaction with Spamcop page must be programmed. best regards Ivan Kossey "Mike Easter" schrieb im Newsbeitrag news:e4clkb$dqg$1@news.spamcop.net... > Ivan Kossey wrote: > Subject: Spam report via E-mail > > Put your fully framed question into the body of a news message not part > in the subject and part in the body -- so that a replier doesn't have to > paste part of the subject into the body of his reply in order to > properly contextualize the response. > >> Is it possible? > > Did you read the faq which was required when you registered for your > authorization? You should not be submitting any spam until you have > read the faq. > > Yes it may be possible to submit spam to the parser for the parsing > reporting function which is the same as the parsing reporting function > of the webparser with the correct mailuser agent, but it is better to > use the webparser first to gain experience with seeing various pages of > the spamcop interface and because it is easier to troubleshoot any > problems when the webparser is being used. > > In order to use the webparser for experience you should go to this page > http://www.spamcop.net/ and login with your address and password > >> What is the E-mail Address to report? > > If you go to the above page logged in, the submit address is seen in > this format: > > Forward your spam to: submit16charANcodeNMBR@spam.spamcop.net or: > Paste entire spam (headers, blank line, body) - or - single address (one > line only): > > where the 'term' 16charANcodeNMBR is your personal code for submitting > which should be kept secret. > >> How must be composed the E-mail? > > First use the webparser according to the instructions you saw when you > registered and got your authorization. By using the webparser, you will > be able to tell if you have learned how to get the spam with complete > headers as described in the faq > http://www.spamcop.net/fom-serve/cache/19.html How do I get my email > program to reveal the full, unmodified email? > > Then, after you know how to use the webparser, see if the faq link above > tells you how to use your mailuser agent to email submit. > >> I'm registered, thus have an E-mail address with password > > Did you read the faq? > > > -- > Mike Easter > kibitzer, not SC admin > From mikeyhsd at sport.rr.com Wed May 17 09:05:32 2006 From: mikeyhsd at sport.rr.com (mikeyhsd) Date: Wed May 17 09:05:09 2006 Subject: [SC-Help] blocked once again Message-ID: seems some spammer has found a novel way to protect themselves. by filing complaints to ISP and getting spamcop black listed. once again am not receiving spamcop mail. this would be the only thing I can think of to cause this AGAIN. here is my reporting address. submit.9eSeDVO4LvmhSvK2@spam.spamcop.net if that helps track it down. have checked with ISP and am not on reject list. have verified that spamcop is not being blocked by email programs. mikeyhsd@sport.rr.com From chris.a.wright at gmail.com Wed May 17 15:44:46 2006 From: chris.a.wright at gmail.com (Chris Wright) Date: Wed May 17 09:45:02 2006 Subject: [SC-Help] Re: blocked once again In-Reply-To: References: Message-ID: mikeyhsd wrote: > seems some spammer has found a novel way to protect themselves. > by filing complaints to ISP and getting spamcop black listed. > > once again am not receiving spamcop mail. > this would be the only thing I can think of to cause this AGAIN. > > here is my reporting address. > submit.9eSeDVO4LvmhSvK2@spam.spamcop.net > if that helps track it down. > > have checked with ISP and am not on reject list. > have verified that spamcop is not being blocked by email programs. > > > mikeyhsd@sport.rr.com > > Well now that you have posted your submit address, its time for you to get a new one anyway. And if you searched for spamcop on the blacklists, you won't find it. More likely that some mail to you from spamcop has bounced for whatever reason and your account has been flagged for some reason. (In other words, SPAMCOP are just not sending it to you anymore). From MikeE at ster.invalid Wed May 17 07:48:40 2006 From: MikeE at ster.invalid (Mike Easter) Date: Wed May 17 09:50:03 2006 Subject: [SC-Help] Re: blocked once again References: Message-ID: mikeyhsd wrote: > seems some spammer has found a novel way to protect themselves. > by filing complaints to ISP and getting spamcop black listed. It seems that you have drawn a ridiculous conclusion. Besides reading what follows, be sure to get to the bottom line here which says: If you are a quick reporter, go to Preferences and uncheck don't send replies. > once again am not receiving spamcop mail. If you don't get spamcop mail, you conclude that mail sourced from spamcop intended for you has been silently deleted? What a strange conclusion. > this would be the only thing I can think of to cause this AGAIN. Surely you can think of something else. > here is my reporting address. > submit.9eSeDVO4LvmhSvK2@spam.spamcop.net > if that helps track it down. What on earth do you think exposing your personal and private [=secret] submit address here is going to accomplish? > have checked with ISP and am not on reject list. What does that sentence mean? That your mailbox isn't full? > have verified that spamcop is not being blocked by email programs. Yeah, that seems like something you could do. If you were a quick reporter, the system changed some unknown number, perhaps all, of the quick reporters to getting no reports. It is also possible that those so changed are also not having their reports processed. If you are a quick reporter, go to Preferences and uncheck don't send replies. -- Mike Easter kibitzer, not SC admin From not at here.invalid Wed May 17 11:49:53 2006 From: not at here.invalid (Ellen) Date: Wed May 17 11:45:02 2006 Subject: [SC-Help] Re: blocked once again References: Message-ID: "mikeyhsd" wrote in message news:e4f712$bf$1@news.spamcop.net... > seems some spammer has found a novel way to protect themselves. > by filing complaints to ISP and getting spamcop black listed. > > once again am not receiving spamcop mail. > this would be the only thing I can think of to cause this AGAIN. > Mail to your registered SC email address is bouncing; slightly munged : The original message was received at Tue, 16 May 2006 17:08:11 -0500 from ms-mta-04-eri0.texas.rr.com [10.93.46.18] ----- The following addresses had permanent fatal errors ----- (expanded from: ) ----- Transcript of session follows ----- mail.local: unknown name: mikeyhsd 550 ... User unknown the x == the local part in the email address you used to post to this newsgroup. Ellen SpamCop From vxpy7do02 at sneakemail.com Wed May 17 11:03:53 2006 From: vxpy7do02 at sneakemail.com (anon) Date: Wed May 17 13:05:03 2006 Subject: [SC-Help] Re: blocked once again References: Message-ID: "Mike Easter" wrote in message news:e4f9jk$2ft$1@news.spamcop.net... > mikeyhsd wrote: >> seems some spammer has found a novel way to protect themselves. >> by filing complaints to ISP and getting spamcop black listed. > > > If you are a quick reporter, go to Preferences and uncheck don't send > replies. > Mike - where in preferences is the box labeled 'don't send replies' (I am a free member)? Which paragraph is it in? -- A SpamCop user and forum reader, Not Admin > -- > Mike Easter > kibitzer, not SC admin > From MikeE at ster.invalid Wed May 17 11:08:49 2006 From: MikeE at ster.invalid (Mike Easter) Date: Wed May 17 13:10:03 2006 Subject: [SC-Help] Re: blocked once again References: Message-ID: anon wrote: > "Mike Easter" >> If you are a quick reporter, go to Preferences and uncheck don't send >> replies. >> > > Mike - where in preferences is the box labeled 'don't send replies' > (I am a free member)? > > Which paragraph is it in? If, and only if, you are a quick reporter, then it is present in the preferences, fairly far down. I can't access the account which I have configured for quick reporting just now, so I can't see the par number. I'm currently logged in as a non-quick reporter, which non-quick does not have such a preferences option. Earlier today when I was changing my login account I had a lot of trouble logging in as alternative accounts, and I had to 'monkey with' the logging in process a lot -- deleting cookies, clearing cache, over and over and over and over again -- so I don't feel like doing that right now. If you aren't a quick reporter, you won't find it in preferences. If you /are/ quick, you should be able to find it without knowing the par number. -- Mike Easter kibitzer, not SC admin From geary at fnord.io.com Wed May 17 18:12:18 2006 From: geary at fnord.io.com (Mark Geary) Date: Wed May 17 13:15:02 2006 Subject: [SC-Help] Re: Ping Mike Easter References: Message-ID: In article , antioch wrote: < It is the lazy, and ignorant, who cant type basic english - that really < pizzes me off. Using irony to make your point, eh? Mark Geary -- "It's going to be a tough one Sam...Ziggy hasn't got a clue and the guy in the waiting room keeps asking me if I want a jelly baby." From vxpy7do02 at sneakemail.com Wed May 17 11:14:53 2006 From: vxpy7do02 at sneakemail.com (anon) Date: Wed May 17 13:15:06 2006 Subject: [SC-Help] Re: blocked once again References: Message-ID: "Mike Easter" wrote in message news:e4flas$a1g$1@news.spamcop.net... > anon wrote: >> "Mike Easter" > >>> If you are a quick reporter, go to Preferences and uncheck don't send >>> replies. >>> >> >> Mike - where in preferences is the box labeled 'don't send replies' >> (I am a free member)? >> >> Which paragraph is it in? > > If, and only if, you are a quick reporter, then it is present in the > preferences, fairly far down. I can't access the account which I have > configured for quick reporting just now, so I can't see the par number. > I'm currently logged in as a non-quick reporter, which non-quick does > not have such a preferences option. > > Earlier today when I was changing my login account I had a lot of > trouble logging in as alternative accounts, and I had to 'monkey with' > the logging in process a lot -- deleting cookies, clearing cache, over > and over and over and over again -- so I don't feel like doing that > right now. > > If you aren't a quick reporter, you won't find it in preferences. If > you /are/ quick, you should be able to find it without knowing the par > number. > > I DID find the checkbox that said 'enable quick data reports' but am unable to find the 'don't send replies'. When you can, please post the answer. Thanks. -- A SpamCop user and forum reader, Not Admin > -- > Mike Easter > kibitzer, not SC admin > From mikeyhsd at sport.rr.com Wed May 17 13:26:09 2006 From: mikeyhsd at sport.rr.com (mikeyhsd) Date: Wed May 17 13:30:02 2006 Subject: [SC-Help] Re: blocked once again References: Message-ID: thank you for that, have forwarded your comment to roadrunner. they had previousely responded that spamcop was recently RE-whitelisted. mikeyhsd@sport.rr.com "Ellen" wrote in message news:e4fg9v$6r9$1@news.spamcop.net... > > "mikeyhsd" wrote in message > news:e4f712$bf$1@news.spamcop.net... >> seems some spammer has found a novel way to protect themselves. >> by filing complaints to ISP and getting spamcop black listed. >> >> once again am not receiving spamcop mail. >> this would be the only thing I can think of to cause this AGAIN. >> > > Mail to your registered SC email address is bouncing; slightly munged : > > The original message was received at Tue, 16 May 2006 17:08:11 -0500 > from ms-mta-04-eri0.texas.rr.com [10.93.46.18] > > ----- The following addresses had permanent fatal errors ----- > > (expanded from: ) > > ----- Transcript of session follows ----- > mail.local: unknown name: mikeyhsd > 550 ... User unknown > > the x == the local part in the email address you used to post to this > newsgroup. > > > Ellen > SpamCop > > From MikeE at ster.invalid Wed May 17 11:36:07 2006 From: MikeE at ster.invalid (Mike Easter) Date: Wed May 17 13:40:03 2006 Subject: [SC-Help] Re: blocked once again References: Message-ID: anon wrote: > "Mike Easter" >>>> If you are a quick reporter, go to Preferences and uncheck don't >>>> send replies. >>> Mike - where in preferences is the box labeled 'don't send replies' > I DID find the checkbox that said 'enable quick data reports' but am > unable to find the 'don't send replies'. I don't remember the exact language/words. If you have access to it, then post the section here in its entirety and we can talk about it if you want. -- Mike Easter kibitzer, not SC admin From post.please.this.email.is.not.valid at example.com Wed May 17 14:49:37 2006 From: post.please.this.email.is.not.valid at example.com (DougW) Date: Wed May 17 14:50:06 2006 Subject: [SC-Help] sc borking on some new spammer munge Message-ID: Examples http://www.spamcop.net/sc?id=z946695895z2c705b2b53ad7160b549ff55ab034269z http://www.spamcop.net/sc?id=z946695899z28bf754d21ff34f61ec0cbbd437ec48cz basically <%rand_chars>.spamsite -- DougW From post.please.this.email.is.not.valid at example.com Wed May 17 14:50:40 2006 From: post.please.this.email.is.not.valid at example.com (DougW) Date: Wed May 17 14:55:02 2006 Subject: [SC-Help] Re: sc borking on some new spammer munge References: Message-ID: DougW did pass the time by typing: > Examples > > http://www.spamcop.net/sc?id=z946695895z2c705b2b53ad7160b549ff55ab034269z > http://www.spamcop.net/sc?id=z946695899z28bf754d21ff34f61ec0cbbd437ec48cz > > basically <%rand_chars>.spamsite actually, the second one processes properly, the first used <+>.site From post.please.this.email.is.not.valid at example.com Wed May 17 15:09:24 2006 From: post.please.this.email.is.not.valid at example.com (DougW) Date: Wed May 17 15:10:04 2006 Subject: [SC-Help] Re: sc borking on some new spammer munge References: Message-ID: DougW did pass the time by typing: > DougW did pass the time by typing: >> Examples >> >> http://www.spamcop.net/sc?id=z946695895z2c705b2b53ad7160b549ff55ab034269z >> http://www.spamcop.net/sc?id=z946695899z28bf754d21ff34f61ec0cbbd437ec48cz >> >> basically <%rand_chars>.spamsite > > actually, the second one processes properly, the first used <+>.site another variant that didn't process. http://www.spamcop.net/sc?id=z946708820z458b932a3952559229375a6eb9b5083dz -- DougW From chris.a.wright at gmail.com Wed May 17 21:55:16 2006 From: chris.a.wright at gmail.com (Chris Wright) Date: Wed May 17 16:00:03 2006 Subject: [SC-Help] Re: blocked once again In-Reply-To: References: Message-ID: I've had trouble with RR before. A few months back they had a massive amount of SPAM sourced from their IP space. I think they got confused and blocked the wrong people. There abuse department is slightly lacking in the common sense area IMHO. mikeyhsd wrote: > thank you for that, have forwarded your comment to roadrunner. > they had previousely responded that spamcop was recently RE-whitelisted. > > mikeyhsd@sport.rr.com > "Ellen" wrote in message > news:e4fg9v$6r9$1@news.spamcop.net... >> "mikeyhsd" wrote in message >> news:e4f712$bf$1@news.spamcop.net... >>> seems some spammer has found a novel way to protect themselves. >>> by filing complaints to ISP and getting spamcop black listed. >>> >>> once again am not receiving spamcop mail. >>> this would be the only thing I can think of to cause this AGAIN. >>> >> Mail to your registered SC email address is bouncing; slightly munged : >> >> The original message was received at Tue, 16 May 2006 17:08:11 -0500 >> from ms-mta-04-eri0.texas.rr.com [10.93.46.18] >> >> ----- The following addresses had permanent fatal errors ----- >> >> (expanded from: ) >> >> ----- Transcript of session follows ----- >> mail.local: unknown name: mikeyhsd >> 550 ... User unknown >> >> the x == the local part in the email address you used to post to this >> newsgroup. >> >> >> Ellen >> SpamCop >> >> > > From asterix at no_where.net Thu May 18 01:40:04 2006 From: asterix at no_where.net (Asterix) Date: Wed May 17 18:45:03 2006 Subject: [SC-Help] Re: Unstoppable picture spam. References: <1hfejuv.oz4vf2asdtchN%asterix@no_where.net> <1hfg7em.1jym52vdlp9waN%asterix@no_where.net> Message-ID: <1hfiaky.nauxirx59bvpN%asterix@no_where.net> Mike Easter wrote: > Asterix wrote: > > Mike Easter > >> Asterix wrote: > >> > >>> Please tell me how to report spam without opening it (and make sure > >>> it's spam. > > >> If I want to see why an item > >> was tagged, I can examine its header Xlines by looking at its > >> message properties without opening it. > > > As I a) want full control of what I report and b) always report > > through the web site, there is no way I can avoid opening the spam. > > If you are saying that your software prohibits you from reporting spam > without opening it, I can't very well tell you how to report spam > without opening it. I didn't say my software prohibits me - it's rather Spamcop's web form. Eudora lets me forward the spam to a sumbission address without inspection, but then I completely lose control of where the reports go. Examining the X-lines is of limited or no interest for that purpose. I'm more concerned about not reporting "innocent bystander' - and/or joe-job - web links in the body. And making sure that real spamvertized links get parsed. How can I do *that* without opening and reading the spam? Or just use the web form at all without opening the spam? > > Besides, your reply says abolutely nothing about how to *report* spam, > > which what I asked. > > No, you asked "and make sure it's spam" in addition to not saying what > method you were using to report. The last part was my mistake - I use the web form exclusively. However, I feel you *should* have seen what I meant - i'll try to rephrase it: "How do I report spam without opening it - being sure it is really spam I'm reporting?" > > And you don't say *why* you discourage opening > > spam, though I think I have an idea. > > I think I'll go into that on Nigel's post instead of here. As far as I can tell you didn't. You just repeat *what* you don't recommend - not *why*. As if spam inspection was some kind of black magic that only you can master. And you didn't tell Nigel that the site http://www.thestocktongroup.com/ is alive and kicking (maybe it wasn't yesterday) whether Spamcop resolves the link or not. Actually it does today - to my surprise. I thought it might be on a "bulletproof" domain that block DNS queries from SC. Sometimes I get the feeling that some spamvertized sites are not online - or even in DNS - until a day or two *after* the spam is sent. Quite an elabotate scheme to dodge reports. -- I recommend Macs to my friends, and Windows machines to those whom I don't mind billing by the hour From vxpy7do02 at sneakemail.com Wed May 17 16:53:22 2006 From: vxpy7do02 at sneakemail.com (anon) Date: Wed May 17 18:55:03 2006 Subject: [SC-Help] Re: blocked once again References: Message-ID: "Mike Easter" wrote in message news:e4fmu3$b2f$1@news.spamcop.net... > anon wrote: >> "Mike Easter" > >>>>> If you are a quick reporter, go to Preferences and uncheck don't >>>>> send replies. > >>>> Mike - where in preferences is the box labeled 'don't send replies' > >> I DID find the checkbox that said 'enable quick data reports' but am >> unable to find the 'don't send replies'. > > I don't remember the exact language/words. If you have access to it, > then post the section here in its entirety and we can talk about it if > you want. > > > > -- > Mike Easter > kibitzer, not SC admin > Per instructions - here follows the complete 'preferences' page. Reporting preferences Display Name (box with my display name in it here) Normally, SpamCop sends reports identified by a simple number. Here, you can personalize your reports with your own name. In either case, SpamCop will conceal your real email address and forward any replies to the numerical address to you. Your Display Name should be a handle or your real name, not an email address. Personal copies of outgoing reports (box for e-mail address here) If you wish to receive a copy of every outgoing report, enter your email address here. This is a "Bcc" so nobody else will be able to see this address. Note that this will create a separate copy for each report even if there are multiple reports per spam. Public standard report recipients (box for e-mail address here) If you wish others to receive a copy of every spam you submit, enter the email address here. Please do not send to any address which is not receptive to receiving untargetted spam reports. Note this will create only one copy for each spam, even if there are multiple reports per spam. Show Technical Details during reporting x Simple output O Show technical data SpamCop can reveal the logic it uses as it finds the right reporting parties for your spam. This can be helpful for advanced users who want to double-check SpamCop's logic, or for new users who want to learn from SpamCop's example. "Are you sure?" Prompts x Prompt me - Ask if you are sure when deleting O No Prompts - I always know what I am doing. SpamCop uses javascript confirmation boxes to ask if you are sure whenever you perform actions which could be destructive. By choosing "no prompts," you can override this often-annoying feature. Report reply handling x Forward only replies from sentient people O Forward replies from people and robots SpamCop challenges "administrators" by making them respond to an email to determine if they are people or robots. Only human replies which require action from you are forwarded to your attention by default. You may override this behavior if you would rather receive every reply, robotic or otherwise. Quick Data Reports O Disable quick data reports x Enable quick data reports When you use "quick" spam submission SpamCop sents automatic "[SpamCop] Quick reporting data" response. By choosing "Disable quick data reports", you can override this behavior. Spam Munging x Obscure identifying information O Leave spam copies intact O Become a "mole" - Don't even send reports (mostly pointless) SpamCop usually tries to obscure (munge) your email address and other identifying information from spam reports before they are sent. However, some ISPs will not accept this type of report. If you select munging, SpamCop will not send to ISPs which refuse munged reports by default (you will be given a default-off option when using the web-interface). If you select intact spam copies, SpamCop will send all reports unmodified. It has become painfully obvious that spammers are able to identify your email address by using tracking codes - even after SpamCop's attempts to munge them. It has also become plain that even the largest and most well-respected ISPs forward complaints intact to the accused. In response, we now offer the ability to send reports silently. These reports are not emailed and are not available to anyone but SpamCop administrators and will not be shared (except as aggregate counts). 3rd party report default O Send by default x Do not send by default Sometimes, people other than the ISP as identified by SpamCop have an interest in seeing copies of SpamCop reports (for example, small downstream providers, or users running services on a DSL or cable-modem). SpamCop will offer you a checkbox on the web-reporting form when this occurs. Normally, this checkbox is default ON, but by changing this option, you can alter the behavior of SpamCop so that the default is OFF. (button says Save Preferences) ---end of copy--- From vxpy7do02 at sneakemail.com Wed May 17 17:03:52 2006 From: vxpy7do02 at sneakemail.com (anon) Date: Wed May 17 19:05:02 2006 Subject: [SC-Help] Re: Unstoppable picture spam. References: <1hfejuv.oz4vf2asdtchN%asterix@no_where.net> <1hfg7em.1jym52vdlp9waN%asterix@no_where.net> <1hfiaky.nauxirx59bvpN%asterix@no_where.net> Message-ID: "Asterix" wrote in message news:1hfiaky.nauxirx59bvpN%asterix@no_where.net... > Mike Easter wrote: > >> Asterix wrote: >> > Mike Easter >> >> Asterix wrote: >> >> >> >>> Please tell me how to report spam without opening it (and make sure >> >>> it's spam. >> >> >> No, you asked "and make sure it's spam" in addition to not saying what >> method you were using to report. > > The last part was my mistake - I use the web form exclusively. > However, I feel you *should* have seen what I meant - i'll try to > rephrase it: > "How do I report spam without opening it - being sure it is really spam > I'm reporting?" > I think there is semantics problem here. "Be sure it is spam" - by definition spam is unsolicited mail (mail you did not request) - the definition does not say anything about content (therefore you do not have to read the spam to see what it says.) Either you requested the mail or you did not request the mail - unrequested = unsolicited = spam. Mail from your friends is always "requested" mail. -- A SpamCop user and forum reader, Not Admin >> > And you don't say *why* you discourage opening >> > spam, though I think I have an idea. >> >> I think I'll go into that on Nigel's post instead of here. > > As far as I can tell you didn't. You just repeat *what* you don't > recommend - not *why*. As if spam inspection was some kind of black > magic that only you can master. > And you didn't tell Nigel that the site http://www.thestocktongroup.com/ > is alive and kicking (maybe it wasn't yesterday) whether Spamcop > resolves the link or not. Actually it does today - to my surprise. > > I thought it might be on a "bulletproof" domain that block DNS queries > from SC. Sometimes I get the feeling that some spamvertized sites are > not online - or even in DNS - until a day or two *after* the spam is > sent. Quite an elabotate scheme to dodge reports. > > -- > I recommend Macs to my friends, and Windows machines > to those whom I don't mind billing by the hour From MikeE at ster.invalid Wed May 17 17:24:26 2006 From: MikeE at ster.invalid (Mike Easter) Date: Wed May 17 19:25:02 2006 Subject: [SC-Help] Re: Unstoppable picture spam. References: <1hfejuv.oz4vf2asdtchN%asterix@no_where.net> <1hfg7em.1jym52vdlp9waN%asterix@no_where.net> <1hfiaky.nauxirx59bvpN%asterix@no_where.net> Message-ID: Asterix wrote: > I didn't say my software prohibits me - it's rather Spamcop's web > form. Eudora lets me forward the spam to a sumbission address without > inspection, but then I completely lose control of where the reports > go. Examining the X-lines is of limited or no interest for that > purpose. I could use Eudora with SpamPal. SpamPal would identify and tag 'all' of my spam and tag none of my goodmail. I could use Eudora to the submit and submit all of my spams at one time I presume. The parser reporter would provide me with links for each and every spam and then I could go to the tracker link to oversee and report the spam which I haven't opened yet. Then, the parser reporter would show me the headers of the submitted spam which headers contain my SpamPal's Xlines so that I can see why each item was spam. Next, SC is going to tell me how it wants to report. My experience has been that I can recognize an IB in the deobfuscated links. If I am confused, I can look at the raw spambody available at the parser. I could do that, but I don't do it that way for various reasons. > I'm more concerned about not reporting "innocent bystander' > - and/or joe-job - web links in the body. If I were 'inspecting' a spam in the parser view entire spam and I were confused about IB or j-j and couldn't handle the problem by looking at the raw body, then I guess I could go to my mailuser agent and render it, but I would rather not do that. I don't like for the spamitem to get ahead on my 'scoresheet' -- which scores me higher if I never open an item I think is a mail which is really a spam, or if I don't have to open an item to determine it is a spam, or if I don't have to open an item to report it properly. For me personally, it is a scorecard. For the various kinds of masses it is advice to not be opening their spam 'foolishly' or insecurely -- where insecurely means insecure in operating system, mailuser agent, or browser rendering engine configuration and insecurely also means insecure in mental condition or pledge commitment. Masses include unwitting newbies as well as spamcop reporters, see below. > And making sure that real spamvertized links get parsed. > How can I do *that* without opening and reading the spam? I know that when I used to do it, I could do it. Currently I am not reporting spamvertised links to providers. My 'personal' spam only contains blackhat/unresponsive spamvertiser providers. > Or just use the web form at all without opening the spam? The webform at the tracker URL gives you total access to the complete spam. If you can submit it to the submit address without opening it, you can see the entire raw spam at the tracker. > "How do I report spam without opening it - being sure it is really > spam I'm reporting?" As above. > As far as I can tell you didn't. You just repeat *what* you don't > recommend - not *why*. As if spam inspection was some kind of black > magic that only you can master. Most of what I try to 'advise' or teach about mail/spam handling is what I recommend to the 'masses' which includes the majority of spamcop reporters. Some advanced spamfighters do all kinds of things I don't recommend to the mass of SC reporters, including going to the website and exploring it. > And you didn't tell Nigel that the site > http://www.thestocktongroup.com/ is alive and kicking (maybe it > wasn't yesterday) Yesterday it didn't resolve, today it is 66.226.64.30 rDNS pro29.abac.com Abacus America NetRange: 66.226.64.0 - 66.226.95.255 OrgAbuseEmail: abuse@aplus.net not currently blocklisted anywhere, including spews or spamhaus, so the present IP doesn't have a history of unresponsiveness. Currently SC resolves it quickly. > I thought it might be on a "bulletproof" domain that block DNS queries > from SC. Sometimes I get the feeling that some spamvertized sites are > not online - or even in DNS - until a day or two *after* the spam is > sent. Quite an elabotate scheme to dodge reports. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Wed May 17 17:27:28 2006 From: MikeE at ster.invalid (Mike Easter) Date: Wed May 17 19:30:03 2006 Subject: [SC-Help] Re: blocked once again References: Message-ID: anon wrote: > "Mike Easter" >> I don't remember the exact language/words. If you have access to it, >> then post the section here in its entirety and we can talk about it >> if you want. 'section' there meant the one section in preferences. > Quick Data Reports > > O Disable quick data reports > x Enable quick data reports > > When you use "quick" spam submission SpamCop sents automatic > "[SpamCop] Quick reporting data" response. By choosing "Disable quick > data reports", you can override this behavior. That one. I said don't check don't send replies. I should have said don't check disable quick data reports. -- Mike Easter kibitzer, not SC admin From vxpy7do02 at sneakemail.com Wed May 17 17:32:51 2006 From: vxpy7do02 at sneakemail.com (anon) Date: Wed May 17 19:35:03 2006 Subject: [SC-Help] Re: blocked once again References: Message-ID: "Mike Easter" wrote in message news:e4gbgq$pel$1@news.spamcop.net... > anon wrote: >> "Mike Easter" > >>> I don't remember the exact language/words. If you have access to it, >>> then post the section here in its entirety and we can talk about it >>> if you want. > > 'section' there meant the one section in preferences. > >> Quick Data Reports >> >> O Disable quick data reports >> x Enable quick data reports >> >> When you use "quick" spam submission SpamCop sents automatic >> "[SpamCop] Quick reporting data" response. By choosing "Disable quick >> data reports", you can override this behavior. > > That one. I said don't check don't send replies. I should have said > don't check disable quick data reports. > > Thanks - now we are on the same page. -- A SpamCop user and forum reader, Not Admin > -- > Mike Easter > kibitzer, not SC admin > From asterix at no_where.net Fri May 19 01:23:49 2006 From: asterix at no_where.net (Asterix) Date: Thu May 18 18:25:02 2006 Subject: [SC-Help] Re: Unstoppable picture spam. References: <1hfejuv.oz4vf2asdtchN%asterix@no_where.net> <1hfg7em.1jym52vdlp9waN%asterix@no_where.net> <1hfiaky.nauxirx59bvpN%asterix@no_where.net> Message-ID: <1hfk5b6.15s71xf14jl63bN%asterix@no_where.net> Mike Easter wrote: > Asterix wrote: > > > I didn't say my software prohibits me - it's rather Spamcop's web > > form. Eudora lets me forward the spam to a sumbission address without > > inspection, but then I completely lose control of where the reports > > go. Examining the X-lines is of limited or no interest for that > > purpose. > > I could use Eudora with SpamPal. SpamPal would identify and tag 'all' > of my spam and tag none of my goodmail. I could use Eudora to the > submit and submit all of my spams at one time I presume. The parser > reporter would provide me with links for each and every spam and then I > could go to the tracker link to oversee and report the spam which I > haven't opened yet. [and so on] The procedure you describe just sounds way too tedious, and my guess is that's why you don't do it yourself any more ... Copy-n-paste - or even better, drag-n-drop - into the web form is as efficient as this game ever gets. More work is not worth the effort - to me. > Most of what I try to 'advise' or teach about mail/spam handling is what > I recommend to the 'masses' which includes the majority of spamcop > reporters. Some advanced spamfighters do all kinds of things I don't > recommend to the mass of SC reporters, including going to the website > and exploring it. Aah - the "uneducated masses". Heard that one before. The masses are smarter than you think. But of course there are some morons, too. Anyway parts of your advice are blunt and miss the target. - what do you mean by reading spam subjects receptively ? (English is *not* my mother language) - I don't read spam bodies for content, but for links and for appearances of my address in the body. OK - that is contents ? :-) - Who would get the idea of reading Spammy's mind ? Unlike them I don't use Windows, so I can open next to anything with next to zero risk. > > And you didn't tell Nigel that the site > > http://www.thestocktongroup.com/ is alive and kicking (maybe it > > wasn't yesterday) > > Yesterday it didn't resolve, today it is 66.226.64.30 rDNS > pro29.abac.com > Abacus America > NetRange: 66.226.64.0 - 66.226.95.255 > OrgAbuseEmail: abuse@aplus.net > > not currently blocklisted anywhere, including spews or spamhaus, so the > present IP doesn't have a history of unresponsiveness. So they got a new IP ? - didn't think of that. -- I recommend Macs to my friends, and Windows machines to those whom I don't mind billing by the hour From MikeE at ster.invalid Thu May 18 17:25:36 2006 From: MikeE at ster.invalid (Mike Easter) Date: Thu May 18 19:30:03 2006 Subject: [SC-Help] Re: Unstoppable picture spam. References: <1hfejuv.oz4vf2asdtchN%asterix@no_where.net> <1hfg7em.1jym52vdlp9waN%asterix@no_where.net> <1hfiaky.nauxirx59bvpN%asterix@no_where.net> <1hfk5b6.15s71xf14jl63bN%asterix@no_where.net> Message-ID: Asterix wrote: > Mike Easter >> Asterix wrote: >> >>> I didn't say my software prohibits me - it's rather Spamcop's web >>> form. Eudora lets me forward the spam to a sumbission address >>> without inspection, but then I completely lose control of where the >>> reports go. Examining the X-lines is of limited or no interest for >>> that purpose. >> >> I could use Eudora with SpamPal. > The procedure you describe just sounds way too tedious, No, we have different 'default' modes. My default mode is to not open my spam unless I have to. Your default mode is to open your spam, I think.. My default mode isn't tedious at all, it is quick. I go to my Junk folder, 'globally view' [overview their subject/froms in a glance seeing there isn't anything from some forgotten friend in there] on the spamgroup, gather them en masse and quick report them with a series of keystrokes which take about 2 seconds and also mark the spams as 'read'. I quick report because I'm not notifying spamvertiser providers for the reasons I explained. If I should need to check the interior of a spam, I am not in default mode, and the first thing I look at is the headers - first what SpamPal's Xlines say, and then if I need any additional information I use my own techniques. > More work is not worth the effort - to me. It isn't more work for me. > >> Most of what I try to 'advise' or teach about mail/spam handling is >> what I recommend to the 'masses' which includes the majority of >> spamcop reporters. Some advanced spamfighters do all kinds of >> things I don't recommend to the mass of SC reporters, including >> going to the website and exploring it. > > Aah - the "uneducated masses". My term did *not* say uneducated. The masses are a lot of different things, some are pledged to never aid a spammer, some are not. Some are insecurely configured, some are not. Some just need some advice about how to handle their mail, not be a reporter. > Heard that one before. The masses > are smarter than you think. But of course there are some morons, too. Of course. Don't ascribe words to me that I didn't say and more importantly didn't mean. > Anyway parts of your advice are blunt and miss the target. > - what do you mean by reading spam subjects receptively ? The recipient is reading the subject to see if she is interested in reading the spam for content. > (English is *not* my mother language) OK. It is practically the only one I have even though I've spent some years in both Spanish and German language classes and lots of time in Mexico and Southern California locales in which the first language is Spanish not English. > - I don't read spam bodies for content, but for links and for > appearances of my address in the body. OK - that is contents ? :-) That is 'inspection'. You can inspect the interior of a spam without even reading it. You can even use a tool to search it for the occurrence of your username or a derivation thereof. > - Who would get the idea of reading Spammy's mind ? Lotsa people make themselves crazy trying to figure out why a spammer did something. > Unlike them I don't use Windows, so I can open next to anything with > next to zero risk. Yes. Not using Win and OE and IE's rendering engine is one element of security -- or rather one element of not being insecure in that particular way. >> not currently blocklisted anywhere, including spews or spamhaus, so >> the present IP doesn't have a history of unresponsiveness. > > So they got a new IP ? - didn't think of that. I don't know. It is hard to figure out what an old IP used to be unless it is somewhere in sightings and resolved differently. -- Mike Easter kibitzer, not SC admin From piraino at spamcop.net Thu May 18 20:29:55 2006 From: piraino at spamcop.net (John Piraino) Date: Thu May 18 20:35:02 2006 Subject: [SC-Help] WTF? NO REPORT SENT Message-ID: Ok, so I've been a subscriber for 4 years now. All of a sudden, I get NO REPORT SENT. I see the message that states "Setting your Preferences to "Enable quick data reports" will return things to normal." Where might this option be? I've spent the last hour looking under every friggin configuration that I have and can not see this option? Why did some genius decide to break something that WASN'T BROKEN? If some "network-god" all knowing adminsitrator is going to change a configuration, SEND A GLOBAL EMAL TO EVERYONE SO WE KNOW WHAT THE F*CK IS GOING ON! Sheez, we're paying for a service and for three friggin days, NO REPORT HAS BEEN SENT. I should get credit for those three days wasted and a blessed hour of my time trying to find an OPTION that IS NOT THERE! Give me a break Spamcop! From piraino at spamcop.net Thu May 18 20:40:39 2006 From: piraino at spamcop.net (John Piraino) Date: Thu May 18 20:45:03 2006 Subject: [SC-Help] Re: WTF? NO REPORT SENT References: Message-ID: BTW: Your search - Enable quick data reports - did not match any documents. Next rocket scientist..... "John Piraino" wrote in message news:e4j3r1$gve$1@news.spamcop.net... > Ok, so I've been a subscriber for 4 years now. All of a sudden, I get NO > REPORT SENT. > > I see the message that states "Setting your Preferences to "Enable quick > data reports" will > return things to normal." > > Where might this option be? I've spent the last hour looking under every > friggin configuration that I have and can not see this option? > > Why did some genius decide to break something that WASN'T BROKEN? If > some "network-god" all knowing adminsitrator is going to change a > configuration, SEND A GLOBAL EMAL TO EVERYONE SO WE KNOW WHAT THE F*CK IS > GOING ON! > > Sheez, we're paying for a service and for three friggin days, NO REPORT > HAS BEEN SENT. I should get credit for those three days wasted and a > blessed hour of my time trying to find an OPTION that IS NOT THERE! > > Give me a break Spamcop! > > From nobody at devnull.spamcop.net Thu May 18 22:54:09 2006 From: nobody at devnull.spamcop.net (WazoO) Date: Thu May 18 22:55:04 2006 Subject: [SC-Help] Re: WTF? NO REPORT SENT References: Message-ID: "John Piraino" wrote in message news:e4j3r1$gve$1@news.spamcop.net... > Ok, so I've been a subscriber for 4 years now. All of a sudden, I get NO > REPORT SENT. > > I see the message that states "Setting your Preferences to "Enable quick > data reports" will > return things to normal." > > Where might this option be? I've spent the last hour looking under every > friggin configuration that I have and can not see this option? If following the newsgroup traffic hasn't helped (and I will note that not all traffic has been in "one" newsgroup ... perhaps try another view in the sequence, scenario, issue, and status ... http://forum.spamcop.net/forums/index.php?showtopic=6366 You don't actually mention how you're submitting, but the "discussion" 'over there' has tried to cover all bases ... From vxpy7do02 at sneakemail.com Thu May 18 21:58:32 2006 From: vxpy7do02 at sneakemail.com (anon) Date: Fri May 19 00:00:03 2006 Subject: [SC-Help] Re: WTF? NO REPORT SENT References: Message-ID: "WazoO" wrote in message news:e4jc13$m1i$1@news.spamcop.net... > "John Piraino" wrote in message > news:e4j3r1$gve$1@news.spamcop.net... >> Ok, so I've been a subscriber for 4 years now. All of a sudden, I get NO >> REPORT SENT. >> >> I see the message that states "Setting your Preferences to "Enable quick >> data reports" will >> return things to normal." >> >> Where might this option be? I've spent the last hour looking under every >> friggin configuration that I have and can not see this option? > > If following the newsgroup traffic hasn't helped (and I will note > that not all traffic has been in "one" newsgroup ... perhaps try > another view in the sequence, scenario, issue, and status ... > > http://forum.spamcop.net/forums/index.php?showtopic=6366 > > You don't actually mention how you're submitting, but the > "discussion" 'over there' has tried to cover all bases ... > > I posted this in another ng but here is the preferences page when you go to your account -- way down near the bottom is the checkbox you are looking for under 'quick data reports'. --copy of preferences page--- Reporting preferences Display Name (box with my display name in it here) Normally, SpamCop sends reports identified by a simple number. Here, you can personalize your reports with your own name. In either case, SpamCop will conceal your real email address and forward any replies to the numerical address to you. Your Display Name should be a handle or your real name, not an email address. Personal copies of outgoing reports (box for e-mail address here) If you wish to receive a copy of every outgoing report, enter your email address here. This is a "Bcc" so nobody else will be able to see this address. Note that this will create a separate copy for each report even if there are multiple reports per spam. Public standard report recipients (box for e-mail address here) If you wish others to receive a copy of every spam you submit, enter the email address here. Please do not send to any address which is not receptive to receiving untargetted spam reports. Note this will create only one copy for each spam, even if there are multiple reports per spam. Show Technical Details during reporting x Simple output O Show technical data SpamCop can reveal the logic it uses as it finds the right reporting parties for your spam. This can be helpful for advanced users who want to double-check SpamCop's logic, or for new users who want to learn from SpamCop's example. "Are you sure?" Prompts x Prompt me - Ask if you are sure when deleting O No Prompts - I always know what I am doing. SpamCop uses javascript confirmation boxes to ask if you are sure whenever you perform actions which could be destructive. By choosing "no prompts," you can override this often-annoying feature. Report reply handling x Forward only replies from sentient people O Forward replies from people and robots SpamCop challenges "administrators" by making them respond to an email to determine if they are people or robots. Only human replies which require action from you are forwarded to your attention by default. You may override this behavior if you would rather receive every reply, robotic or otherwise. Quick Data Reports O Disable quick data reports x Enable quick data reports When you use "quick" spam submission SpamCop sents automatic "[SpamCop] Quick reporting data" response. By choosing "Disable quick data reports", you can override this behavior. Spam Munging x Obscure identifying information O Leave spam copies intact O Become a "mole" - Don't even send reports (mostly pointless) SpamCop usually tries to obscure (munge) your email address and other identifying information from spam reports before they are sent. However, some ISPs will not accept this type of report. If you select munging, SpamCop will not send to ISPs which refuse munged reports by default (you will be given a default-off option when using the web-interface). If you select intact spam copies, SpamCop will send all reports unmodified. It has become painfully obvious that spammers are able to identify your email address by using tracking codes - even after SpamCop's attempts to munge them. It has also become plain that even the largest and most well-respected ISPs forward complaints intact to the accused. In response, we now offer the ability to send reports silently. These reports are not emailed and are not available to anyone but SpamCop administrators and will not be shared (except as aggregate counts). 3rd party report default O Send by default x Do not send by default Sometimes, people other than the ISP as identified by SpamCop have an interest in seeing copies of SpamCop reports (for example, small downstream providers, or users running services on a DSL or cable-modem). SpamCop will offer you a checkbox on the web-reporting form when this occurs. Normally, this checkbox is default ON, but by changing this option, you can alter the behavior of SpamCop so that the default is OFF. (button says Save Preferences) ---end of copy--- From nobody at devnull.spamcop.net Fri May 19 04:43:30 2006 From: nobody at devnull.spamcop.net (WazoO) Date: Fri May 19 04:45:20 2006 Subject: [SC-Help] Re: WTF? NO REPORT SENT References: Message-ID: "anon" wrote in message news:e4jfpd$oeq$1@news.spamcop.net... > > I posted this in another ng but here is the preferences page when you go to > your account -- way down near the bottom is the checkbox you are looking for > under 'quick data reports'. > > --copy of preferences page--- > Reporting preferences A lot of words used to describe a condition that .... if present, has already been addressed several times if not present, doesn't help at all and the ones doing the complaining at present are those that do not have the text present, but were impacted by the code change .... From BNRAGMAOKKXT at spammotel.com Fri May 19 11:28:20 2006 From: BNRAGMAOKKXT at spammotel.com (Canopus) Date: Fri May 19 06:30:09 2006 Subject: [SC-Help] Sector 5 Policy - Googlemail Message-ID: I've searched Googlemail and the web, but, can't find an answer to this. Some spam submitted to SpamCop via my Googlemail account generates a mail delivery Failure Notification stating the reason as "PERM_FAILURE: Message rejected for Sector 5 policy reasons." As I couldn't find any info anywhere what this means I mailed Google, but, it doesn't look as if I'll get a reply. Anyone have any idea what is generating this bounce, what a Sector 5 Policy is? It only happens once or twice a week so it's not too big an issue, but, if I can prevent it all the better. -- Rob http://www.flickr.com/photos/canopus_archives/ From MikeE at ster.invalid Fri May 19 07:28:53 2006 From: MikeE at ster.invalid (Mike Easter) Date: Fri May 19 09:30:04 2006 Subject: [SC-Help] Re: Sector 5 Policy - Googlemail References: Message-ID: Canopus wrote: > I've searched Googlemail and the web, but, can't find an answer to > this. > > Some spam submitted to SpamCop via my Googlemail account generates a > mail delivery Failure Notification stating the reason as > "PERM_FAILURE: Message rejected for Sector 5 policy reasons." As I > couldn't find any info anywhere what this means I mailed Google, but, > it doesn't look as if I'll get a reply. Anyone have any idea what is > generating this bounce, what a Sector 5 Policy is? It only happens > once or twice a week so it's not too big an issue, but, if I can > prevent it all the better. Without doing any searching, or 'thinking' for that matter, my first shoot-from-the-hip guess is that it simply refers to the non-specific 5xx permanent failure [as opposed to the temporary 4xx] family of failure messages. -- Mike Easter kibitzer, not SC admin From piraino at spamcop.net Fri May 19 10:47:32 2006 From: piraino at spamcop.net (John Piraino) Date: Fri May 19 10:50:03 2006 Subject: [SC-Help] Guess again References: Message-ID: The newsgroup link you sent states: I have the following text between Report reply handling and Spam Munging and it seems the default is set to disabled. Quick Data Reports Disable quick data reports Enable quick data reports When you use "quick" spam submission SpamCop sents automatic "[SpamCop] Quick reporting data" response. By choosing "Disable quick data reports", you can override this behavior. Further: Unfortunately, it turns out that the option is NOT available to Email Filtering Service users who are reporting spam from their Held Mail folder. It only applies to reporting accounts that have been granted "quick" access for email spam submissions. Please accept my apologies for getting your hopes up prematurely. The omission is my fault because I didn't realize that including Email Filtering Service users would require specific code to tie the option to their reporting accounts. I just now submitted a request to have my error fixed. While we're waiting for that to happen, I would be happy to enable email "quick" reporting for users who are reporting spam from their Held Mail folder so they can take advantage of the option. WHAT THE F*CK ARE WE PAYING FOR IF WE SPEND THE DAMN TIME TO SEND THE MAIL IN FOR REPORTING, WHAT MAKES THEM THINK THAT WE DON'T WANT IT TO BE REPORTED? WHAT KIND OF SCAM IS THIS? I DON'T THINK I'LL RENEW WHEN MY SUBSCRIPTION COMES UP AGAIN IN DECEMBER. I'M SORRY I DON'T HAVE TIME TO SIT AND READ NEWSGROUPS, FORUMS ETC. I PAY FOR A SERVICE, I EXPECT TO GET WHAT I PAY FOR WITHOUT HAVING TO SPEND HOURS OF MY TIME READING NEWS, NEWSGROUPS ETC. IF THE SERVICE MAKES CHANGES, I WOULD EXPECT TO BE NOTIFIED OF CHANGES NOT SPEND RELENTLESS HOURS TRING TO FIGURE OUT WHY SOMEONE BROKE SOMETHING. Reporting preferences Display Name Normally, SpamCop sends reports identified by a simple number. Here, you can personalize your reports with your own name. In either case, SpamCop will conceal your real email address and forward any replies to the numerical address to you. Your Display Name should be a handle or your real name, not an email address. Personal copies of outgoing reports If you wish to receive a copy of every outgoing report, enter your email address here. This is a "Bcc" so nobody else will be able to see this address. Note that this will create a separate copy for each report even if there are multiple reports per spam. Public standard report recipients If you wish others to receive a copy of every spam you submit, enter the email address here. Please do not send to any address which is not receptive to receiving untargetted spam reports. Note this will create only one copy for each spam, even if there are multiple reports per spam. Show Technical Details during reporting SpamCop can reveal the logic it uses as it finds the right reporting parties for your spam. This can be helpful for advanced users who want to double-check SpamCop's logic, or for new users who want to learn from SpamCop's example. "Are you sure?" Prompts SpamCop uses javascript confirmation boxes to ask if you are sure whenever you perform actions which could be destructive. By choosing "no prompts," you can override this often-annoying feature. Report reply handling SpamCop challenges "administrators" by making them respond to an email to determine if they are people or robots. Only human replies which require action from you are forwarded to your attention by default. You may override this behavior if you would rather receive every reply, robotic or otherwise. Spam Munging SpamCop usually tries to obscure (munge) your email address and other identifying information from spam reports before they are sent. However, some ISPs will not accept this type of report. If you select munging, SpamCop will not send to ISPs which refuse munged reports by default (you will be given a default-off option when using the web-interface). If you select intact spam copies, SpamCop will send all reports unmodified. It has become painfully obvious that spammers are able to identify your email address by using tracking codes - even after SpamCop's attempts to munge them. It has also become plain that even the largest and most well-respected ISPs forward complaints intact to the accused. In response, we now offer the ability to send reports silently. These reports are not emailed and are not available to anyone but SpamCop administrators and will not be shared (except as aggregate counts). 3rd party report default Sometimes, people other than the ISP as identified by SpamCop have an interest in seeing copies of SpamCop reports (for example, small downstream providers, or users running services on a DSL or cable-modem). SpamCop will offer you a checkbox on the web-reporting form when this occurs. Normally, this checkbox is default ON, but by changing this option, you can alter the behavior of SpamCop so that the default is OFF. "WazoO" wrote in message news:e4jc13$m1i$1@news.spamcop.net... > "John Piraino" wrote in message > news:e4j3r1$gve$1@news.spamcop.net... >> Ok, so I've been a subscriber for 4 years now. All of a sudden, I get NO >> REPORT SENT. >> >> I see the message that states "Setting your Preferences to "Enable quick >> data reports" will >> return things to normal." >> >> Where might this option be? I've spent the last hour looking under every >> friggin configuration that I have and can not see this option? > > If following the newsgroup traffic hasn't helped (and I will note > that not all traffic has been in "one" newsgroup ... perhaps try > another view in the sequence, scenario, issue, and status ... > > http://forum.spamcop.net/forums/index.php?showtopic=6366 > > You don't actually mention how you're submitting, but the > "discussion" 'over there' has tried to cover all bases ... > > From spam_hjp at yahoo.com Fri May 19 12:00:41 2006 From: spam_hjp at yahoo.com (Jim) Date: Fri May 19 11:05:03 2006 Subject: [SC-Help] "No reports file" Message-ID: > While we're waiting for that to happen, I would be happy to enable email > "quick" reporting for users who are reporting spam from their Held Mail > folder so they can take advantage of the option. > > > Can you turn it on for me. Without having this option "quick reporting" has been turn off for me and there is nothing I can do about it. Jim Pearson hjp@spamcop.net From chris.a.wright at gmail.com Fri May 19 17:04:26 2006 From: chris.a.wright at gmail.com (Chris Wright) Date: Fri May 19 11:05:06 2006 Subject: [SC-Help] Re: Guess again In-Reply-To: References: Message-ID: Tell you what, cancel your subscription, get a refund and take your money elsewhere. Main problem you will have is finding something as good as SPAMCOP. Next problem you have is keeping it quiet that you are a complete numpty and hoping that your new service doesn't have an anti-numpty filter. Getting so worked up over something so trivial is so anal. All the answers to your problem were available, you just didn't find them. It really grips my do' do's when people just hit the caps lock without having the common decency to ask a civil question in a civil tone of voice. Ask yourself why the problem occured in the first place instead of just hitting the panic button and throwing all your toys out of your pram. From chris.a.wright at gmail.com Fri May 19 19:17:22 2006 From: chris.a.wright at gmail.com (Chris Wright) Date: Fri May 19 13:20:03 2006 Subject: [SC-Help] Re: Guess again In-Reply-To: References: Message-ID: Top posted because the crap I sent isn't worth reading again... John.. Thanks for your reply to me direct. Apologies for my rather brash retort at your problem, but now you get my drift. Shouting and getting a toot on don't help no-one, (nor does posting a reply such as the one below). I'm just as bad for sticking my oar in when it don't really effect me. Just caught me at an inopportune moment. Another example of engage brain before post finger. I did follow your advice in your email and now I am googling for answers on 'how to get ones dick out of ones rear'. So once again, sorry to for the fact my reply sounded a bit offish. Just lose the caps lock in future, make a direct request for help and you might find instead of one asshole reply from said asshole, you might get multiple answers from people who can help. ;) Chris Wright wrote: > Tell you what, cancel your subscription, get a refund and take your > money elsewhere. > > Main problem you will have is finding something as good as SPAMCOP. > Next problem you have is keeping it quiet that you are a complete numpty > and hoping that your new service doesn't have an anti-numpty filter. > > Getting so worked up over something so trivial is so anal. > > All the answers to your problem were available, you just didn't find them. > > It really grips my do' do's when people just hit the caps lock without > having the common decency to ask a civil question in a civil tone of voice. > > Ask yourself why the problem occured in the first place instead of just > hitting the panic button and throwing all your toys out of your pram. > > From BNRAGMAOKKXT at spammotel.com Fri May 19 19:45:18 2006 From: BNRAGMAOKKXT at spammotel.com (Canopus) Date: Fri May 19 14:50:03 2006 Subject: [SC-Help] Re: Sector 5 Policy - Googlemail References: Message-ID: Mike Easter on 19/05/2006 wrote: >Without doing any searching, or 'thinking' for that matter, my first >shoot-from-the-hip guess is that it simply refers to the non-specific >5xx permanent failure [as opposed to the temporary 4xx] family of >failure messages. I'm still non the wiser . I sent three submissions of just now and one generated the Sector 5 policy reason. Could it have maybe a virus in it as Googlemail do stop anything they detect as virus laden? I read and submit everything via MailWasher so I see mail in plain text so would miss an exe attached. -- Rob http://www.flickr.com/photos/canopus_archives/ From BNRAGMAOKKXT at spammotel.com Fri May 19 19:48:49 2006 From: BNRAGMAOKKXT at spammotel.com (Canopus) Date: Fri May 19 14:50:08 2006 Subject: [SC-Help] Re: "No reports file" References: Message-ID: Jim on 19/05/2006 wrote: > >>While we're waiting for that to happen, I would be happy to enable email >>"quick" reporting for users who are reporting spam from their Held Mail >>folder so they can take advantage of the option. >> >> >> > >Can you turn it on for me. Without having this option "quick reporting" >has been turn off for me and there is nothing I can do about it. > >Jim Pearson >hjp@spamcop.net You normally have to mail SpamCop Admin for that rather than just ask in the newsgroup. You also have to set up your mail hosts if not done already. -- Rob http://www.flickr.com/photos/canopus_archives/ From BNRAGMAOKKXT at spammotel.com Fri May 19 20:06:56 2006 From: BNRAGMAOKKXT at spammotel.com (Canopus) Date: Fri May 19 15:10:03 2006 Subject: [SC-Help] Re: Guess again References: Message-ID: John Piraino on 19/05/2006 wrote: >WHAT THE F*CK ARE WE PAYING FOR IF... Do you really thing SC do things like this on purpose? As has been explained a bug crept in while trying to implement an improvement and is trying to be fixed. If you are looking for absolute perfection in something with no further possibilities of improvement and no fallibilities in conscious entities then it is time to transcend to another plane leaving cyber space and the world behind you. -- Rob http://www.flickr.com/photos/canopus_archives/ From piraino at spamcop.net Fri May 19 21:12:32 2006 From: piraino at spamcop.net (John Piraino) Date: Fri May 19 21:15:03 2006 Subject: [SC-Help] Re: Guess again References: Message-ID: Wonderful Rob, Why wasn't this posted on the login page with the rest of the system news? Then I wouldn't be complaining. If we were NOTIFIED about this, it wouldn't be a concern. But to create a bug and hide behind it like nothing happened is bullshit. If you don't like the politically incorrectness of my posts, you surely would HATE to have a few beers with me. I'm the first one to admit I'm an a$$hole and I'm f*ckin proud of it too. "Canopus" wrote in message news:e4l50g$qvo$1@news.spamcop.net... > John Piraino on 19/05/2006 wrote: > >>WHAT THE F*CK ARE WE PAYING FOR IF... > > Do you really thing SC do things like this on purpose? As has been > explained a bug crept in while trying to implement an improvement and is > trying to be fixed. If you are looking for absolute perfection in > something with no further possibilities of improvement and no > fallibilities in conscious entities then it is time to transcend to > another plane leaving cyber space and the world behind you. > > > > -- > Rob > > http://www.flickr.com/photos/canopus_archives/ From BNRAGMAOKKXT at spammotel.com Sat May 20 11:54:45 2006 From: BNRAGMAOKKXT at spammotel.com (Canopus) Date: Sat May 20 06:55:03 2006 Subject: [SC-Help] Re: Guess again References: Message-ID: John Piraino on 20/05/2006 wrote: >Wonderful Rob, > >Why wasn't this posted on the login page with the rest of the system news? >Then I wouldn't be complaining. > >If we were NOTIFIED about this, it wouldn't be a concern. But to create a >bug and hide behind it like nothing happened is bullshit. > >If you don't like the politically incorrectness of my posts, you surely >would HATE to have a few beers with me. I'm the first one to admit I'm an >a$$hole and I'm f*ckin proud of it too. When I first noticed that non of my quick reporting submissions were not generating returns I too went to the main report page and didn't see a notice that anything was wrong so thought it was to do with recent changes I had made in MailWasher. Those settings checked out so I went to Recent Reports and noticed the No Reports Filed note against the submissions. I then went to the spamcop newsgroup and looked for topics with No Reports Filed as subject line in recent days, couldn't find an answer so posted a simple enquiry. I then looked in spamcop.help and found the answer immediately (should have looked there first). Then following instructions I went to Preferences an activated Quick Report Data again and everything went back to normal. It must have taken all of ten minutes altogether. Sure, they could have put a notice up although their webmaster seemed to have gone on holidays just at the wrong time and maybe no one could do it that was left. However, I'm still surprised that people were still posting questions on the same thing just above an obvious answer to it. Still, I almost did it as well. Swearing and cursing and threatening to leave due to the first hiccup for ages in an otherwise smoothly running service doesn't really seem to be the best approach in these circumstances. -- Rob http://www.flickr.com/photos/canopus_archives/ From scamper at trisk.com Sat May 20 20:43:06 2006 From: scamper at trisk.com (Garen Erdoisa) Date: Sat May 20 21:45:09 2006 Subject: [SC-Help] Re: Quick reporting data Reports In-Reply-To: References: <0lkj62dvm1lvlrluvuu9cd3gr3p68ak6um@4ax.com> Message-ID: SpamCop Admin wrote: > Early Friday evening, we were able to remove the code that caused all > the trouble and revert everything to the way it was. Everybody should > be back to normal now. > > I'm really sorry about all the trouble. We haven't given up on the > user option, but it's just not ready for prime time yet. Hopefully, > it won't be too long before you can disable the "Quick data report" > responses from the system if you want. Don; This is not a problem from where I sit as it did not affect me in any way. I have been following the discussion in other threads about how it has affected others though. Reverts are always messy things. Might I suggest implementing some standard software quality controls? You should be able to avoid similar issues in the future if you do simple little things like code reviews of changes, then a period internal alpha testing followed by a period of public beta testing of your changes before going live with it for everyone. I'm sure there are plenty of people here who would be more than happy to beta test changes for you guys. The absolute last thing a business such as yours needs is bad publicity due to fubar and clusterfraq issues. (Hmm, I wonder if clusterfraq is a new word...I kinda like the sound of it!) As I see it spamcop.net has become a sort of defacto privately operated clearing house for email, and as a checkpoint for abuse reporting. Since you are handling mail for so many people, you might also want to look into getting an iso9001:2000 certification to proudly display on your website. I know from experience that just going through the application process for such a certification can uncover many internal issues that need fixing, and must be dealt with before they'll even talk to you about issuing such a certification. Also, getting such a certification may enable you to bring in major new business as new clients who won't generally even consider doing business with companies that are not iso certified. > > When it's ready, you'll see the option appear in the "Report Handling > Options" section of your Preferences when you log into your account at > http://www.spamcop.net/ > > - Don - -- Regards Garen From piraino at spamcop.net Sat May 20 22:32:29 2006 From: piraino at spamcop.net (John Piraino) Date: Sat May 20 22:35:03 2006 Subject: [SC-Help] Another rocket scientist References: Message-ID: Canopus babbled some useless garbage like: >I went to Preferences an activated Quick Report Data again and everything >went back to normal. It must have taken all of ten minutes altogether. I guess you don't like to read the full thread. You just like to read the rants. Please read the part where I stated that I do not have this option on my preferences page. Please read the full thread before you ASSume things. Below is the full text from my preferences page. Please in your infinite wisdom, show me where it says QUICK REPORT. ================================================================= Reporting preferences Display Name Normally, SpamCop sends reports identified by a simple number. Here, you can personalize your reports with your own name. In either case, SpamCop will conceal your real email address and forward any replies to the numerical address to you. Your Display Name should be a handle or your real name, not an email address. -------------------------------------------------------------------------------- Personal copies of outgoing reports If you wish to receive a copy of every outgoing report, enter your email address here. This is a "Bcc" so nobody else will be able to see this address. Note that this will create a separate copy for each report even if there are multiple reports per spam. -------------------------------------------------------------------------------- Public standard report recipients If you wish others to receive a copy of every spam you submit, enter the email address here. Please do not send to any address which is not receptive to receiving untargetted spam reports. Note this will create only one copy for each spam, even if there are multiple reports per spam. -------------------------------------------------------------------------------- Show Technical Details during reporting Simple output Show technical data SpamCop can reveal the logic it uses as it finds the right reporting parties for your spam. This can be helpful for advanced users who want to double-check SpamCop's logic, or for new users who want to learn from SpamCop's example. -------------------------------------------------------------------------------- "Are you sure?" Prompts Prompt me - Ask if you are sure when deleting No Prompts - I always know what I am doing. SpamCop uses javascript confirmation boxes to ask if you are sure whenever you perform actions which could be destructive. By choosing "no prompts," you can override this often-annoying feature. -------------------------------------------------------------------------------- Report reply handling Forward only replies from sentient people Forward replies from people and robots SpamCop challenges "administrators" by making them respond to an email to determine if they are people or robots. Only human replies which require action from you are forwarded to your attention by default. You may override this behavior if you would rather receive every reply, robotic or otherwise. -------------------------------------------------------------------------------- Spam Munging Obscure identifying information Leave spam copies intact Become a "mole" - Don't even send reports (mostly pointless) SpamCop usually tries to obscure (munge) your email address and other identifying information from spam reports before they are sent. However, some ISPs will not accept this type of report. If you select munging, SpamCop will not send to ISPs which refuse munged reports by default (you will be given a default-off option when using the web-interface). If you select intact spam copies, SpamCop will send all reports unmodified. It has become painfully obvious that spammers are able to identify your email address by using tracking codes - even after SpamCop's attempts to munge them. It has also become plain that even the largest and most well-respected ISPs forward complaints intact to the accused. In response, we now offer the ability to send reports silently. These reports are not emailed and are not available to anyone but SpamCop administrators and will not be shared (except as aggregate counts). -------------------------------------------------------------------------------- 3rd party report default Send by default Do not send by default Sometimes, people other than the ISP as identified by SpamCop have an interest in seeing copies of SpamCop reports (for example, small downstream providers, or users running services on a DSL or cable-modem). SpamCop will offer you a checkbox on the web-reporting form when this occurs. Normally, this checkbox is default ON, but by changing this option, you can alter the behavior of SpamCop so that the default is OFF. "Canopus" wrote in message news:e4mshl$5q5$1@news.spamcop.net... > John Piraino on 20/05/2006 wrote: > >>Wonderful Rob, >> >>Why wasn't this posted on the login page with the rest of the system news? >>Then I wouldn't be complaining. >> >>If we were NOTIFIED about this, it wouldn't be a concern. But to create a >>bug and hide behind it like nothing happened is bullshit. >> >>If you don't like the politically incorrectness of my posts, you surely >>would HATE to have a few beers with me. I'm the first one to admit I'm an >>a$$hole and I'm f*ckin proud of it too. > > When I first noticed that non of my quick reporting submissions were not > generating returns I too went to the main report page and didn't see a > notice that anything was wrong so thought it was to do with recent > changes I had made in MailWasher. Those settings checked out so I went to > Recent Reports and noticed the No Reports Filed note against the > submissions. I then went to the spamcop newsgroup and looked for topics > with No Reports Filed as subject line in recent days, couldn't find an > answer so posted a simple enquiry. I then looked in spamcop.help and > found the answer immediately (should have looked there first). Then > following instructions I went to Preferences an activated Quick Report > Data again and everything went back to normal. It must have taken all of > ten minutes altogether. > > Sure, they could have put a notice up although their webmaster seemed to > have gone on holidays just at the wrong time and maybe no one could do it > that was left. However, I'm still surprised that people were still > posting questions on the same thing just above an obvious answer to it. > Still, I almost did it as well. Swearing and cursing and threatening to > leave due to the first hiccup for ages in an otherwise smoothly running > service doesn't really seem to be the best approach in these > circumstances. > > -- > Rob > > http://www.flickr.com/photos/canopus_archives/ From vxpy7do02 at sneakemail.com Sat May 20 20:28:23 2006 From: vxpy7do02 at sneakemail.com (anon) Date: Sat May 20 22:40:03 2006 Subject: [SC-Help] Re: WTF? NO REPORT SENT References: Message-ID: "WazoO" wrote in message news:e4k0fi$3te$1@news.spamcop.net... > "anon" wrote in message > news:e4jfpd$oeq$1@news.spamcop.net... >> >> I posted this in another ng but here is the preferences page when you go > to >> your account -- way down near the bottom is the checkbox you are looking > for >> under 'quick data reports'. >> >> --copy of preferences page--- >> Reporting preferences > > A lot of words used to describe a condition that .... > > if present, has already been addressed several times > > if not present, doesn't help at all > > and the ones doing the complaining at present are those > that do not have the text present, but were impacted by > the code change .... > > That's why I stuck all that wordy text in there - in case someone couldn't 'find' the correct page to look on. -- A SpamCop user and forum reader, Not Admin From BNRAGMAOKKXT at spammotel.com Sun May 21 13:43:19 2006 From: BNRAGMAOKKXT at spammotel.com (Canopus) Date: Sun May 21 08:45:04 2006 Subject: [SC-Help] Re: Another rocket scientist References: Message-ID: John Piraino on 21/05/2006 wrote: >Canopus babbled some useless garbage like: >>I went to Preferences an activated Quick Report Data again and everything >>went back to normal. It must have taken all of ten minutes altogether. I tell you what, considering that you think I wrote useless garbage and sideways call me an ass why don't you just block me then you won't have to read my useless drivel any more. I've just done it to you as I don't want to read your abusive ignorant rantings any more and will no longer be interested in proffering any advise to you. -- Rob http://www.flickr.com/photos/canopus_archives/ From asterix at no_where.net Sun May 21 17:15:44 2006 From: asterix at no_where.net (Asterix) Date: Sun May 21 10:20:03 2006 Subject: [SC-Help] Re: Unstoppable picture spam. References: <1hfejuv.oz4vf2asdtchN%asterix@no_where.net> <1hfg7em.1jym52vdlp9waN%asterix@no_where.net> <1hfiaky.nauxirx59bvpN%asterix@no_where.net> <1hfk5b6.15s71xf14jl63bN%asterix@no_where.net> Message-ID: <1hfp38f.14ciymlmqq6ejN%asterix@no_where.net> Mike Easter wrote: > Asterix wrote: > > Mike Easter > >> Asterix wrote: > >> > >>> I didn't say my software prohibits me - it's rather Spamcop's web > >>> form. Eudora lets me forward the spam to a sumbission address > >>> without inspection, but then I completely lose control of where the > >>> reports go. Examining the X-lines is of limited or no interest for > >>> that purpose. > >> > >> I could use Eudora with SpamPal. > > > The procedure you describe just sounds way too tedious, > > No, we have different 'default' modes. My default mode is to not open > my spam unless I have to. Your default mode is to open your spam, I > think.. Correct. > I quick report because I'm not notifying spamvertiser providers for the > reasons I explained. Well, I do - which I think makes much of a difference in "quick". > > More work is not worth the effort - to me. > > It isn't more work for me. Since you don't notify site providers. Now that's clarified. ... > > - what do you mean by reading spam subjects receptively ? > > The recipient is reading the subject to see if she is interested in > reading the spam for content. Thanks for the explanation - well, I don't care about the subject. ... > > - I don't read spam bodies for content, but for links and for > > appearances of my address in the body. OK - that is contents ? :-) > > That is 'inspection'. About what I though. > You can inspect the interior of a spam without > even reading it. You can even use a tool to search it for the > occurrence of your username or a derivation thereof. Eudora's Find is good enough for me. And I like to be in control of what I'm doing. I would *never* trust an ever so good inspection tool completely. -- I recommend Macs to my friends, and Windows machines to those whom I don't mind billing by the hour From post.please.this.email.is.not.valid at example.com Tue May 23 12:48:20 2006 From: post.please.this.email.is.not.valid at example.com (DougW) Date: Tue May 23 12:50:02 2006 Subject: [SC-Help] Botnet domains Message-ID: Just a heads up.. spammy is back to using botnets for hosting webpages. The following are botnet hosted sites. (Polyakov spam gang) www.columbus-partners.net youruinyourshoes.com swiss-invest.cn teambestmortform.com mortformusarefi.com refisavemortusa.com mortformrefiwithusa.com Mostly SpamCop larts each known IP, but I'm not sure if this can cause other problems. Some of these sites can have literally dozens of IP addresses listed. -- DougW From bar_n0ne at hotmail.com Tue May 23 13:47:33 2006 From: bar_n0ne at hotmail.com (Berny) Date: Tue May 23 13:50:03 2006 Subject: [SC-Help] Re: Botnet domains References: Message-ID: "DougW" wrote in message news:e4vech$ji5$1@news.spamcop.net... > Just a heads up.. spammy is back to using botnets for hosting webpages. > The following are botnet hosted sites. (Polyakov spam gang) > > www.columbus-partners.net > youruinyourshoes.com > swiss-invest.cn > teambestmortform.com > mortformusarefi.com > refisavemortusa.com > mortformrefiwithusa.com > > Mostly SpamCop larts each known IP, but I'm not sure if this can cause other > problems. Some of these sites can have literally dozens of IP addresses listed. > I don't understand, in my experience SC larts the first IP delivered up, if it gets one in time, usually the DNS is pokey and sporadic with botnet hosting, and often the DNS services refer through a botnet.