From usenet-imp at exp09.spam.woody.ch Wed Aug 5 02:54:57 2009 From: usenet-imp at exp09.spam.woody.ch (Benoit Panizzon) Date: Wed Aug 5 02:55:04 2009 Subject: [Schelp] Why are Yahoo Groups not reported to Yahoo anymore? Message-ID: Hi Spamcopers I operate Spamtraps. Since months they get flooded by spam advertizing yahoo groups or yahoo blog sites. So I manually reported a few of them to yahoo and observed, that the spamvertized groups and blogs never get deleted. To make things easier I wanted to report them using spamcop. I found out that spamcop successfully finds the yahoo URI in the mails, but never sends any spam compaint to yahoo. Why that? -Benoit- From usenet-imp at exp09.spam.woody.ch Wed Aug 5 04:35:48 2009 From: usenet-imp at exp09.spam.woody.ch (Benoit Panizzon) Date: Wed Aug 5 04:40:03 2009 Subject: [Schelp] Re: Why are Yahoo Groups not reported to Yahoo anymore? References: Message-ID: Yahoo Spamtrap Hits in the last Hour... mysql> select * from entry where host = "yahoo.com.uri"; +---------+---------------+---------------------+ | id | host | expire | +---------+---------------+---------------------+ | 4811096 | yahoo.com.uri | 2009-08-06 10:16:11 | | 4811094 | yahoo.com.uri | 2009-08-06 10:15:40 | | 4811114 | yahoo.com.uri | 2009-08-06 10:21:19 | | 4811153 | yahoo.com.uri | 2009-08-06 10:29:49 | | 4811144 | yahoo.com.uri | 2009-08-06 10:27:35 | | 4810833 | yahoo.com.uri | 2009-08-06 09:20:25 | | 4811090 | yahoo.com.uri | 2009-08-06 10:14:38 | | 4811098 | yahoo.com.uri | 2009-08-06 10:17:16 | | 4810798 | yahoo.com.uri | 2009-08-06 09:16:05 | | 4810806 | yahoo.com.uri | 2009-08-06 09:17:31 | | 4810826 | yahoo.com.uri | 2009-08-06 09:19:56 | | 4810822 | yahoo.com.uri | 2009-08-06 09:19:24 | | 4810839 | yahoo.com.uri | 2009-08-06 09:21:39 | | 4810837 | yahoo.com.uri | 2009-08-06 09:21:25 | | 4810863 | yahoo.com.uri | 2009-08-06 09:24:29 | | 4810855 | yahoo.com.uri | 2009-08-06 09:23:19 | | 4810867 | yahoo.com.uri | 2009-08-06 09:24:50 | | 4811106 | yahoo.com.uri | 2009-08-06 10:19:13 | | 4811102 | yahoo.com.uri | 2009-08-06 10:18:32 | | 4811085 | yahoo.com.uri | 2009-08-06 10:12:31 | | 4811042 | yahoo.com.uri | 2009-08-06 10:00:58 | | 4810956 | yahoo.com.uri | 2009-08-06 09:42:38 | | 4810952 | yahoo.com.uri | 2009-08-06 09:42:07 | | 4810904 | yahoo.com.uri | 2009-08-06 09:31:57 | | 4810908 | yahoo.com.uri | 2009-08-06 09:31:59 | | 4810920 | yahoo.com.uri | 2009-08-06 09:34:28 | | 4811189 | yahoo.com.uri | 2009-08-06 10:34:56 | | 4811159 | yahoo.com.uri | 2009-08-06 10:30:44 | | 4811162 | yahoo.com.uri | 2009-08-06 10:30:57 | | 4811168 | yahoo.com.uri | 2009-08-06 10:32:05 | | 4811175 | yahoo.com.uri | 2009-08-06 10:33:16 | | 4811011 | yahoo.com.uri | 2009-08-06 09:54:22 | | 4811047 | yahoo.com.uri | 2009-08-06 10:02:43 | | 4811052 | yahoo.com.uri | 2009-08-06 10:04:15 | | 4811055 | yahoo.com.uri | 2009-08-06 10:04:21 | | 4810804 | yahoo.com.uri | 2009-08-06 09:16:58 | | 4810812 | yahoo.com.uri | 2009-08-06 09:18:09 | | 4810816 | yahoo.com.uri | 2009-08-06 09:18:40 | | 4810820 | yahoo.com.uri | 2009-08-06 09:19:02 | | 4810843 | yahoo.com.uri | 2009-08-06 09:21:55 | | 4811036 | yahoo.com.uri | 2009-08-06 10:00:13 | | 4811170 | yahoo.com.uri | 2009-08-06 10:32:08 | | 4810987 | yahoo.com.uri | 2009-08-06 09:47:56 | | 4810989 | yahoo.com.uri | 2009-08-06 09:48:10 | | 4810984 | yahoo.com.uri | 2009-08-06 09:47:19 | | 4811001 | yahoo.com.uri | 2009-08-06 09:51:40 | | 4811004 | yahoo.com.uri | 2009-08-06 09:52:19 | | 4811027 | yahoo.com.uri | 2009-08-06 09:57:13 | | 4811033 | yahoo.com.uri | 2009-08-06 09:59:08 | | 4810859 | yahoo.com.uri | 2009-08-06 09:24:10 | | 4810902 | yahoo.com.uri | 2009-08-06 09:31:33 | | 4810934 | yahoo.com.uri | 2009-08-06 09:37:32 | | 4810861 | yahoo.com.uri | 2009-08-06 09:24:25 | | 4810946 | yahoo.com.uri | 2009-08-06 09:40:45 | | 4810948 | yahoo.com.uri | 2009-08-06 09:40:54 | | 4810973 | yahoo.com.uri | 2009-08-06 09:44:58 | | 4810975 | yahoo.com.uri | 2009-08-06 09:45:19 | | 4810978 | yahoo.com.uri | 2009-08-06 09:45:57 | | 4811083 | yahoo.com.uri | 2009-08-06 10:12:23 | | 4811151 | yahoo.com.uri | 2009-08-06 10:29:49 | | 4811081 | yahoo.com.uri | 2009-08-06 10:12:01 | | 4811013 | yahoo.com.uri | 2009-08-06 09:54:26 | | 4810906 | yahoo.com.uri | 2009-08-06 09:31:59 | | 4810892 | yahoo.com.uri | 2009-08-06 09:29:22 | | 4811139 | yahoo.com.uri | 2009-08-06 10:26:50 | | 4811180 | yahoo.com.uri | 2009-08-06 10:33:48 | | 4811185 | yahoo.com.uri | 2009-08-06 10:34:12 | | 4810850 | yahoo.com.uri | 2009-08-06 09:22:59 | | 4810848 | yahoo.com.uri | 2009-08-06 09:22:45 | | 4810871 | yahoo.com.uri | 2009-08-06 09:26:32 | | 4810873 | yahoo.com.uri | 2009-08-06 09:26:33 | | 4810875 | yahoo.com.uri | 2009-08-06 09:27:07 | | 4811007 | yahoo.com.uri | 2009-08-06 09:53:44 | | 4811063 | yahoo.com.uri | 2009-08-06 10:06:49 | | 4811066 | yahoo.com.uri | 2009-08-06 10:07:28 | +---------+---------------+---------------------+ 75 rows in set (0.00 sec) From MikeE at ster.invalid Wed Aug 5 11:31:21 2009 From: MikeE at ster.invalid (Mike Easter) Date: Wed Aug 5 11:35:03 2009 Subject: [Schelp] Re: Why are Yahoo Groups not reported to Yahoo anymore? References: Message-ID: Benoit Panizzon wrote: > I found out that spamcop successfully finds the yahoo URI in the mails, > but never sends any spam compaint to yahoo. To discuss any specific SC report process including the spamvertiser link, paste the tracking URL into a discussion group such as this one, or even better a group which has more traffic such as spamcop. Here's my boilerplate suggestion for getting a tracker: How to make a tracker: 1 select and obtain the complete spam 2 privatize the header&body content 3 webparse it & copy the tracking URL 4 cancel the report & paste the tracker in here 1 ... in the manner described by the SC faq http://www.spamcop.net/fom-serve/cache/19.html How do I get my email program to reveal the full, unmodified email? 2 ... by modestly and unambiguously mungeing any private information you don't want to expose, such as your name or email address which might appear anywhere in the header or body. Avoid excessive or confusing mungeing. 3 login to the SC webparser, paste in the spam, and click Process Spam button; then copy the tracking URL from the top 'Here is your TRACKING URL' of the appearance http://www.spamcop.net/sc?id=z1505491930z5db2559eebcde98291b8e783c95d61c ez 4 ... after parsing, the report is 'live' until the cancel button is used. After cancelling the tracker disappears; the munged spam report should be cancelled because it has been materially changed and because you don't want to leave a tracker live. -- Mike Easter kibitzer, not SC admin From graham at gmurray.org.uk Sat Aug 8 04:05:20 2009 From: graham at gmurray.org.uk (Graham Murray) Date: Sat Aug 8 04:10:03 2009 Subject: [Schelp] No Source IP Address found Message-ID: Tracking URL: http://www.spamcop.net/sc?id=z3198208328zddf1a41776fc9d5353ca413ff3b912d7z The Received: headers look perfectly good to me, with IP addresses in them. From user at domain.invalid Sat Aug 8 11:05:56 2009 From: user at domain.invalid (Farelf) Date: Sat Aug 8 11:10:03 2009 Subject: [Schelp] Re: No Source IP Address found In-Reply-To: References: Message-ID: Graham Murray wrote: > Tracking URL: > http://www.spamcop.net/sc?id=z3198208328zddf1a41776fc9d5353ca413ff3b912d7z > > The Received: headers look perfectly good to me, with IP addresses in them. Yes, here is the same parsed *without* mailhosts being set up: http://www.spamcop.net/sc?id=z3199394795z973ab561ea3ca3dcc165793b46fcce7ez which looks good to me (ignores the ipv6 addresses which seems okay in the context of that spam). Maybe we have a problem with ipv6 in mailhosted analysis (I'm afraid I'm not 'technical' enough to guess). This is an interesting one, I think. From spamcop at prodigy.net Mon Aug 10 02:59:05 2009 From: spamcop at prodigy.net (Bill) Date: Mon Aug 10 03:00:03 2009 Subject: [Schelp] Mail source only being reported to devnull@devnull.spamcop.net Message-ID: <4A7FC539.9090205@prodigy.net> I am getting a bunch of spam (related to extended warranties, Dish network, etc) from a particular location, and the email source is always getting reported back to devnull@devnull.spamcop.net. > Tracking message source: 128.168.195.34: > Routing details for 128.168.195.34 > > Report routing for 128.168.195.34: devnull@devnull.spamcop.net > Message is 9 hours old > 128.168.195.34 not listed in dnsbl.njabl.org ( 127.0.0.8 ) > 128.168.195.34 not listed in dnsbl.njabl.org ( 127.0.0.9 ) > 128.168.195.34 not listed in cbl.abuseat.org > 128.168.195.34 listed in dnsbl.sorbs.net ( 127.0.0.9 ) > 128.168.195.34 not listed in accredit.habeas.com > 128.168.195.34 not listed in plus.bondedsender.org > 128.168.195.34 not listed in iadb.isipp.com This seemed odd to me so I clicked on the "routing details" and it has the following: > Reports routes for 128.168.195.34: > routeid:46812976 128.168.0.0 - 128.168.255.255 > to:devnull@devnull.spamcop.net > Administrator interested in all reports > > * Tuesday, January 06, 2009 12:44:44 PM -0500* > [Note added by 75.74.158.144 (c-75-74-158-144.hsd1.fl.comcast.net)] > Route added without comment > Does that mean that someone changed the routing reporting for that network in Spamcop on 1/6/09 so it never sends reports? If not, why isn't Spamcop able to find someone to report the email source to? Bill From nobody at spamcop.net Mon Aug 10 10:30:47 2009 From: nobody at spamcop.net (Ellen) Date: Mon Aug 10 10:55:04 2009 Subject: [Schelp] Re: No Source IP Address found In-Reply-To: References: Message-ID: Graham Murray wrote: > Tracking URL: > http://www.spamcop.net/sc?id=z3198208328zddf1a41776fc9d5353ca413ff3b912d7z > > The Received: headers look perfectly good to me, with IP addresses in them. Replied via email Ellen SpamCop From nobody at spamcop.net Mon Aug 10 10:49:42 2009 From: nobody at spamcop.net (Ellen) Date: Mon Aug 10 10:55:04 2009 Subject: [Schelp] Re: Mail source only being reported to devnull@devnull.spamcop.net In-Reply-To: <4A7FC539.9090205@prodigy.net> References: <4A7FC539.9090205@prodigy.net> Message-ID: Bill wrote: > >> Reports routes for 128.168.195.34: >> routeid:46812976 128.168.0.0 - 128.168.255.255 >> to:devnull@devnull.spamcop.net >> Administrator interested in all reports >> >> * Tuesday, January 06, 2009 12:44:44 PM -0500* >> [Note added by 75.74.158.144 (c-75-74-158-144.hsd1.fl.comcast.net)] >> Route added without comment >> > > Does that mean that someone changed the routing reporting for that > network in Spamcop on 1/6/09 so it never sends reports? yes that is what that means ... I removed the /16 from the reports database back in January. See I did a BGP lookup and found this: BGP routing table entry for 128.168.128.0/17, version 115027 Paths: (34 available, best #32, table Default-IP-Routing-Table) Not advertised to any peer 852 2828 14744 14744 14744 13686 20445 And looked up AS20445 which is apparently some entity called: DATA1 / Data 180, Inc. which doesn't seem to have a website. And I also did an ARIN lookup and found: OrgName: Gold Hill Computers OrgID: GHC-4 Address: 2175 Cloverdale Drive City: Colorado Springs StateProv: CO PostalCode: 80920 Country: US NetRange: 128.168.0.0 - 128.168.255.255 CIDR: 128.168.0.0/16 OrgAbuseHandle: DAT13-ARIN OrgAbuseName: Data102 Abuse Team OrgAbusePhone: +1-719-578-8842 OrgAbuseEmail: abuse@data102.com and it all made me very twitchy. See SpamHaus for SBL listings including ROKSO .... http://www.spamhaus.org/sbl/listings.lasso?isp=data102.com Ellen SpamCop From nobody at spamcop.net Tue Aug 18 00:16:21 2009 From: nobody at spamcop.net (Richard W) Date: Tue Aug 18 00:20:03 2009 Subject: [Schelp] Release of Spamcop Version 4.6.0-028 Message-ID: The long awaited new version of SpamCop (v4.6) will being going into production release Tuesday, August 18, 2009. This means the SpamCop reporting service and website will be offline and unavailable for approximately eight hours beginning at 9:00 a.m. PDT. Emailed spam submissions will be accepted but will be queued for later handling. When the reporting service is brought back up please expect several hours of delay as the backlog is processed. This outage does not affect the SpamCop/CESMail email service. SpamCop/Cisco-Ironport apologizes in advance for inconvenience to our users. We would also like to thank the several users who have participated in the beta testing for the last several weeks. Richard From nobody at spamcop.net Tue Aug 18 00:42:18 2009 From: nobody at spamcop.net (Richard W) Date: Tue Aug 18 00:45:04 2009 Subject: [Schelp] Re: Release of Spamcop Version 4.6.0-028 In-Reply-To: References: Message-ID: This deployment has now been moved to Wednesday, August 19, 2009. Same time, same duration, same effects. Richard Richard W wrote: > The long awaited new version of SpamCop (v4.6) will being going into > production release Tuesday, August 18, 2009. This means the SpamCop > reporting service and website will be offline and unavailable for > approximately eight hours beginning at 9:00 a.m. PDT. > > Emailed spam submissions will be accepted but will be queued for later > handling. When the reporting service is brought back up please expect > several hours of delay as the backlog is processed. > > This outage does not affect the SpamCop/CESMail email service. > > SpamCop/Cisco-Ironport apologizes in advance for inconvenience to our > users. We would also like to thank the several users who have > participated in the beta testing for the last several weeks. > > Richard From r.c.bates at btinternet.com Wed Aug 26 05:35:30 2009 From: r.c.bates at btinternet.com (Robert Bates) Date: Wed Aug 26 05:40:03 2009 Subject: [Schelp] The TruthNBP Unregistered. Message-ID: CHILD ABUSE OF A FOUR YEAR OLD To begin with I am tired of holding this secret so those that are guilty will benefit from my silence. This is not an attempt at harrassment or slander of any person. The Australian police have already attempted to silence me, GO TO HELL !!! This is a factual account experienced by me of allegations made by my son James Bates against Mr Ronald Armstrong, father of Tanya Armstrong ( now Bates). Paul Armstrong, Simon Armstrong. He was to my knowledge married to Louise Armstrong. They were residents of the state of Victoria, Australia. More specifically the Mornington Penninsula, Rosebud. While a minor my son James Bates accused Ronald Armstrong of sexually assaulting him at the age of four. He was penetrated anally. As his legal guardian and the parent who had contact with the police to give consent for the investigation to go ahead, I have first hand knowledge of these allegations. James is now eighteen years old and can still remember what happened to him vividly. My ex wife Tanya Bates told me that she had been sexually abused by her father from the age of nine to nineteen. In full knowledge of what her father did to her she allowed my children James Bates, Samantha Bates, Nickolas Bates to spend time around this man. I have first hand knowledge of this as I am an eye witness to these events. As conveyed to me by the police child protection team in Lowestoft, after the investigation Mr Ronald Armstrong was sent to prison for the abuse of my ex wife but he denied the abuse of my son. I as the father of Samantha and Nickolas Bates have repeatedly been denied access to my children in Australia because my ex wife knows very well I will tell the children the truth. Late last year , 2009, I attempted to contact my children in Australia only to be told in the first phone call by my ex wife that my daughter Samantha had been abused by her ex partner Darren who was an alcoholic. I attempted to get the information out of my daughter via MSN messenger but she would not say as she had discussed things with her mother and for brodies sake, the son of the alcoholic, that they should keep things quiet. After finding this out I wrote some abusive emails to her and have been telling her friends about the abuse of my eldest son. Through interpol the Australian Police have attempted to have me charged with harrassment. I signed an unofficial warning in the Suffolk policemans notebook. The police in the UK know very well what is going on and I was treated very leniently. Hearing that your second eldest child has been abused as well would make any parent go insane. To be honest I hope that abuse victims throughout the world read this. Yes, my ex wife was abused by her father but it does not give her the moral right to abuse my children. Her father was abused as well and he is in prison. Why wasn't my ex wife charged with child neglect for knowingly allowing my children to be around a known peadophile ? -------------- next part -------------- An HTML attachment was scrubbed... URL: http://zeta.cesmail.net/pipermail/schelp/attachments/20090826/3e089319/attachment.htm From V at nguard.LH Wed Aug 26 19:20:40 2009 From: V at nguard.LH (VanguardLH) Date: Wed Aug 26 19:25:03 2009 Subject: [Schelp] Re: The TruthNBP Unregistered. References: Message-ID: Robert Bates wrote: > CHILD ABUSE OF A FOUR YEAR OLD >From a poster too much a wussy to do anything and be responsible for his actions. Use a shotgun, prepare for prison.