From donkey at fred.pp.fi Sun Feb 7 11:49:11 2010 From: donkey at fred.pp.fi (Donkey Hottie) Date: Sun Feb 7 11:55:08 2010 Subject: [Schelp] Rejected reports Message-ID: <7h7347-hu2.ln1@wellington.fredriksson.dy.fi> I do report spam via SpamCop. Sometimes I get a reply from the receiving abuse, claiming that they are not responsible of the incident. Is there some SpamCop address that I could forward the reply? If the claim is good, then SpamCop has maybe wrong data in their database, and they might be glad to fix it. -- Tell the truth or trump--but get the trick. -- Mark Twain, "Pudd'nhead Wilson's Calendar" From nobody at spamcop.net Sun Feb 7 14:12:11 2010 From: nobody at spamcop.net (bar0) Date: Sun Feb 7 14:15:08 2010 Subject: [Schelp] Re: Rejected reports References: <7h7347-hu2.ln1@wellington.fredriksson.dy.fi> Message-ID: "Donkey Hottie" wrote in message news:7h7347-hu2.ln1@wellington.fredriksson.dy.fi... > > I do report spam via SpamCop. > > Sometimes I get a reply from the receiving abuse, claiming that they are > not responsible of the incident. > > Is there some SpamCop address that I could forward the reply? If the > claim is good, then SpamCop has maybe wrong data in their database, and > they might be glad to fix it. Nowadays most bad reports are because the tracker was able to parse its way into bogus recieved lines which are found on almost all spam with more than 1 received line from prior to hitting your mailserver nowadays. A favorite end luser address is any IP in Nigeria, while the spam often actually originates in Germany or Netherlands. Non Mailhosted reporters are far more likely to run into this because the parsing engine is more "forgiving". From clewis at nortel.com Wed Feb 10 10:12:27 2010 From: clewis at nortel.com (Chris Lewis) Date: Wed Feb 10 10:15:08 2010 Subject: [Schelp] Re: Rejected reports References: <7h7347-hu2.ln1@wellington.fredriksson.dy.fi> Message-ID: According to bar0 : > > "Donkey Hottie" wrote in message > news:7h7347-hu2.ln1@wellington.fredriksson.dy.fi... > > > > I do report spam via SpamCop. > > > > Sometimes I get a reply from the receiving abuse, claiming that they are > > not responsible of the incident. > > > > Is there some SpamCop address that I could forward the reply? If the > > claim is good, then SpamCop has maybe wrong data in their database, and > > they might be glad to fix it. > > > Nowadays most bad reports are because the tracker was able to parse its way > into bogus recieved lines which are found on almost all spam with more than > 1 received line from prior to hitting your mailserver nowadays. > > A favorite end luser address is any IP in Nigeria, while the spam often > actually originates in Germany or Netherlands. Non Mailhosted reporters are > far more likely to run into this because the parsing engine is more > "forgiving". I dont't think Nigerians use BOTs much. This is mostly a couple of BOTs that forge received headers with random IP addresses. Some of these bots frequently generate illegal IPs (like 546.0.3.146). But the main thing is pure randomness. We have a /8, so we get a lot of bogus complaints about IPs in our address space. Relatively little of our /8 is routed, let alone allocated, so virtually all of these reports are trivially disproved as being totally impossible. Out of the few hundred Spamcop reports we've received over the past several years, perhaps just one of them was valid, the rest were forged IPs. I always followup explaining the IPs are forged. The SC deputies are well familiar with this issue (and my responses ;-) [Yes, we're aware of route hijacking, but insofar as we've checked, it' never been that.] As I'm not a SpamCop user per-se, I don't know the details, but there is a way to ensure that your spamcop reports only report the IP address that connected to your inbound mail server. Which, in virtually 100% of cases, the right IP to complain about. Even if the email is relayed, the relayer is the one responsible for stopping it. -- Chris Lewis, Age and Treachery will Triumph over Youth and Skill It's not just anyone who gets a Starship Cruiser class named after them. From donkey at fred.pp.fi Fri Feb 12 03:03:34 2010 From: donkey at fred.pp.fi (Donkey Hottie) Date: Fri Feb 12 03:05:07 2010 Subject: [Schelp] Re: Rejected reports In-Reply-To: References: <7h7347-hu2.ln1@wellington.fredriksson.dy.fi> Message-ID: On 10.2.2010 17:12, Chris Lewis wrote: > As I'm not a SpamCop user per-se, I don't know the details, but there is > a way to ensure that your spamcop reports only report the IP address > that connected to your inbound mail server. Which, in virtually 100% > of cases, the right IP to complain about. Even if the email is relayed, > the relayer is the one responsible for stopping it. That is how SpamCop is supposed to work. The configuration has all our mail servers and routes, and it tries to filter out forged sources. -- For years a secret shame destroyed my peace-- I'd not read Eliot, Auden or MacNiece. But now I think a thought that brings me hope: Neither had Chaucer, Shakespeare, Milton, Pope. -- Justin Richardson. From borgholio at storymind.com Sun Feb 14 00:36:15 2010 From: borgholio at storymind.com (Borgholio) Date: Sun Feb 14 00:40:08 2010 Subject: [Schelp] Spamcop not POPing any mail Message-ID: Last day or so I've noticed my email load has gone way down. I check my POP servers and every single one of my external servers has errors (Unknown error 8). Help? From joegill at removethis Sun Feb 14 13:50:28 2010 From: joegill at removethis (Joe Gill) Date: Sun Feb 14 13:55:09 2010 Subject: [Schelp] Re: Spamcop not POPing any mail In-Reply-To: References: Message-ID: "Borgholio" wrote in message news:hl824d$rbc$1@news.spamcop.net... > Last day or so I've noticed my email load has gone way down. I check my > POP servers and every single one of my external servers has errors > (Unknown error 8). Help? Does this happen to be YAHOO? (or Yahoo run?).. If so, I was having problems this past week.... If was soooo frustrating I sent a note to SERVICE. Basically, if a server says 'later' or 'not available', Spamcop elongates the time until it pops again... YAHOO has been a ROYAL P.I.A in the last few weeks! From borgholio at storymind.com Sun Feb 14 22:45:34 2010 From: borgholio at storymind.com (Borgholio) Date: Sun Feb 14 22:50:08 2010 Subject: [Schelp] Re: Spamcop not POPing any mail In-Reply-To: References: Message-ID: Joe Gill wrote: > > "Borgholio" wrote in message > news:hl824d$rbc$1@news.spamcop.net... >> Last day or so I've noticed my email load has gone way down. I check >> my POP servers and every single one of my external servers has errors >> (Unknown error 8). Help? > > Does this happen to be YAHOO? (or Yahoo run?).. > If so, I was having problems this past week.... > If was soooo frustrating I sent a note to SERVICE. > > Basically, if a server says 'later' or 'not available', Spamcop > elongates the time until it pops again... > > YAHOO has been a ROYAL P.I.A in the last few weeks! Happens to all my external accounts including Yahoo. From joegill at removethis Wed Feb 17 14:24:07 2010 From: joegill at removethis (Joe Gill) Date: Wed Feb 17 14:25:08 2010 Subject: [Schelp] Re: Spamcop not POPing any mail In-Reply-To: References: Message-ID: "Borgholio" wrote in message news:hlag0q$nkq$1@news.spamcop.net... > Joe Gill wrote: >> >> "Borgholio" wrote in message >> news:hl824d$rbc$1@news.spamcop.net... >>> Last day or so I've noticed my email load has gone way down. I check my >>> POP servers and every single one of my external servers has errors >>> (Unknown error 8). Help? >> >> Does this happen to be YAHOO? (or Yahoo run?).. >> If so, I was having problems this past week.... >> If was soooo frustrating I sent a note to SERVICE. >> >> Basically, if a server says 'later' or 'not available', Spamcop elongates >> the time until it pops again... >> >> YAHOO has been a ROYAL P.I.A in the last few weeks! > > Happens to all my external accounts including Yahoo. Problem is back for me with Yahoo... Problem never has existed for me with GMAIL... FWIW From cpollock at embarqmail.com Sat Feb 20 17:05:15 2010 From: cpollock at embarqmail.com (Chris) Date: Sat Feb 20 17:10:09 2010 Subject: [Schelp] C/R to SpamCop report Message-ID: One of my spamcop reports bounced back with the below. Anything that can be done about this? Any other information I can pass along? The email address gfrerer@logmedia.at is protected by Antispamservice spamCleaner. If you dont't send us a spam please follow the instructions. You must authentificate your email address once to complete the mail delivery. Please click on the following link: http://spamcleaner.antispamservice.at/ba0058912d9e4317a988d552954f7c13.htm Chris From Still-Just-A-Rat-In-A-Cage at crazyhat.net Sun Feb 21 01:36:54 2010 From: Still-Just-A-Rat-In-A-Cage at crazyhat.net (DevilsPGD) Date: Sun Feb 21 01:40:08 2010 Subject: [Schelp] Re: C/R to SpamCop report References: Message-ID: <3tj1o5hli5i0101snv6vglre60pg1rhjd5@4ax.com> In message Chris was claimed to have wrote: >One of my spamcop reports bounced back with the below. Anything that can >be done about this? Any other information I can pass along? Personally, I'd complain to their upstream (if applicable) about the original spam. From nobody at spamcop.net Sun Feb 21 09:57:52 2010 From: nobody at spamcop.net (bar0) Date: Sun Feb 21 10:00:08 2010 Subject: [Schelp] Re: C/R to SpamCop report References: Message-ID: "Chris" wrote in message news:hlpmar$ct7$1@news.spamcop.net... > One of my spamcop reports bounced back with the below. Anything that can > be done about this? Any other information I can pass along? > > The email address gfrerer@logmedia.at is protected by Antispamservice > spamCleaner. If you dont't send us a spam please follow the instructions. > You must authentificate your email address once to complete the mail > delivery. > Please click on the following link: > http://spamcleaner.antispamservice.at/ba0058912d9e4317a988d552954f7c13.htm > > Chris Hmmm,, blahblah.at. Without investigation, I'd be happy if reports didn't go to any .at addresses. Far too many Russian SEO services, which also supply lots of C&C , mail, and other spammer services are in .at (Austria) space. Think back a few years when SpamHaus pulled a nasty on .at, the same gangsters still seem to be there now. From avoozl at spamcop.net Fri Feb 26 00:26:41 2010 From: avoozl at spamcop.net (Chris Willoughby) Date: Fri Feb 26 00:30:08 2010 Subject: [Schelp] Unreportable spam Message-ID: Any idea how I can make this legitmately reportable? http://www.spamcop.net/sc?id=z3769769472z473d4a0121bef636ab4c1ef3e6a096c4z I get 100s of these a day.. 404k each, everything about the message is exactly the same except for the date which varies between December 18th and December 24th. I'd love to get this guy/computer/idiot out of my daily inbox without just covering up the problem. From bert at iphouse.com Fri Feb 26 09:31:50 2010 From: bert at iphouse.com (Bert Hyman) Date: Fri Feb 26 09:35:09 2010 Subject: [Schelp] Re: Unreportable spam References: Message-ID: In news:hm7m2s$pp9$1@news.spamcop.net "Chris Willoughby" wrote: > Any idea how I can make this legitmately reportable? > > http://www.spamcop.net/sc?id=z3769769472z473d4a0121bef636ab4c1ef3e6a096c4z > > I get 100s of these a day.. 404k each, everything about the message is > exactly the same except for the date which varies between December > 18th and December 24th. I'd love to get this guy/computer/idiot out > of my daily inbox without just covering up the problem. You could drop a line to the admins at "surewest.net" and ask them why they're sending you mail that's over 2 months old. Or, you could just forward the mail to "abuse@surewest.net" yourself. -- Bert Hyman St. Paul, MN bert@iphouse.com From avoozl at spamcop.net Fri Feb 26 16:51:20 2010 From: avoozl at spamcop.net (Chris Willoughby) Date: Fri Feb 26 16:55:09 2010 Subject: [Schelp] Re: Unreportable spam References: Message-ID: "Bert Hyman" wrote in message news:Xns9D2B56C74A907VeebleFetzer@216.154.195.61... > You could drop a line to the admins at "surewest.net" and ask them why > they're sending you mail that's over 2 months old. > > Or, you could just forward the mail to "abuse@surewest.net" yourself. > > -- > Bert Hyman St. Paul, MN bert@iphouse.com I tried contacting them yesterday.. haven't heard back yet. :) Other than that.. since the mail doesn't actually originate from them I'm not sure what I can do. From nobody at spamcop.net Sat Feb 27 13:27:53 2010 From: nobody at spamcop.net (Twayne) Date: Sat Feb 27 13:30:08 2010 Subject: [Schelp] Re: Unreportable spam References: Message-ID: In news:hm9foq$eb8$1@news.spamcop.net, Chris Willoughby typed: > "Bert Hyman" wrote in message > news:Xns9D2B56C74A907VeebleFetzer@216.154.195.61... >> You could drop a line to the admins at "surewest.net" and ask them >> why they're sending you mail that's over 2 months old. >> >> Or, you could just forward the mail to "abuse@surewest.net" yourself. >> >> -- >> Bert Hyman St. Paul, MN bert@iphouse.com > > I tried contacting them yesterday.. haven't heard back yet. :) > > Other than that.. since the mail doesn't actually originate from them > I'm not sure what I can do. Repeating spams will usually have something you can key on to use even OE's rules to delete it or send it to a spam folder. If you've reported hundreds of them and nothing's happened yet nothing is likely to happen ever. Or, if you know how, pull out some prejudice and go manual and go after anyone you can find that has any control over th em or their upstreams. My 2? anyway. HTH, Twayne -- -- Life is the only real counselor; wisdom unfiltered through personal experience does not become a part of the moral tissue. From nobody at spamcop.net Sat Feb 27 13:31:36 2010 From: nobody at spamcop.net (Twayne) Date: Sat Feb 27 13:35:07 2010 Subject: [Schelp] Re: Spamcop not POPing any mail References: Message-ID: In news:hlag0q$nkq$1@news.spamcop.net, Borgholio typed: > Joe Gill wrote: >> >> "Borgholio" wrote in message >> news:hl824d$rbc$1@news.spamcop.net... >>> Last day or so I've noticed my email load has gone way down. I >>> check my POP servers and every single one of my external servers >>> has errors (Unknown error 8). Help? >> >> Does this happen to be YAHOO? (or Yahoo run?).. >> If so, I was having problems this past week.... >> If was soooo frustrating I sent a note to SERVICE. >> >> Basically, if a server says 'later' or 'not available', Spamcop >> elongates the time until it pops again... >> >> YAHOO has been a ROYAL P.I.A in the last few weeks! > > Happens to all my external accounts including Yahoo. I've had things like that going on periodically lately too. Don't know whether it's Verizon or Verizon-Yahoo, but all mails and all 'net connectivity just goes away for a few hours. Yesterday was the third occurrence of it here. No idea whether it has anything to do with you issues; just thought I'm mention it. Located far upstate New York State, right on Canadian border. -- -- Life is the only real counselor; wisdom unfiltered through personal experience does not become a part of the moral tissue.