We have a spam box where our users forward their spam. We have been using this data to check keyword filters and to generally see where how well we are taking care of spam issues. Recently I developed a way to compare message subject lines to the exchange message tracking logs to determine the origin IP.

To make a long story sort, I have a list of 6800 IPs that we have received spam from. I've done the best that I can to clear out any legitimate IP addresses, including doing an nslookup to see the domain if available. Does anyone have any sugestions on how I might submit this data?

I'm currently trying to get our own rbldnsd running, however the exchange server so far hasn't liked using this sever...

Many thanks,
~Seth

Tracking URL: http://www.spamcop.net/sc?id=z3470856709zd...f0403e8c38a149z

Spamcop will not report to the only email address in the whois listing. Abuse.net has a couple other email addresses, one of which SpamCop *will* report to... abuse[at]telecom.kz I would recommend that SpamCop hard-code that email address or do a lookup against the abuse.net whois database.

Many orange-wanadoo customers complain that they're blocked by Spamcop.
When examining the headers, I can't find any server IP.
mwinf2201.orange.fr has no reverse DNS...

What can we do about it ?

Here's an example :
Return-Path: <>
Received: from mwinf2201.orange.fr (mwinf2201.orange.fr)
by mwinb7404 (SMTP Server) with LMTP; Mon, 02 Nov 2009 14:10:17 +0100
X-Sieve: Server Sieve 2.2
X-Bcc: "loc: requested length %ld"
Received: from me-wanadoo.net (localhost [127.0.0.1])
by mwinf2201.orange.fr (SMTP Server) with ESMTP id B121C1C00096
for <o22000000000000000115105016[at]back74-mail02-02.me-wanadoo.net>; Mon, 2 Nov 2009 14:10:17 +0100 (CET)
Received: by mwinf2201.orange.fr (SMTP Server)
id 9DFC01C0009E; Mon, 2 Nov 2009 14:10:17 +0100 (CET)
Date: Mon, 2 Nov 2009 14:10:17 +0100 (CET)
X-ME-UUID: 20091102131017381.5D0751C00096[at]mwinf2201.orange.fr
From: MAILER-DAEMON[at]orange.fr (Mail Delivery System)
Subject: Undelivered Mail Returned to Sender
To: (masked)
Auto-Submitted: auto-replied
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="7DED71C00096.1257167417/orange.fr"
Message-Id: <20091102131017.9DFC01C0009E[at]mwinf2201.orange.fr>
X-me-spamlevel: not-spam
X-me-spamrating: 38.400002
X-me-spamcause: OK, (- 40)(0000)gggruggvucftvghtrhhoucdtuddrvdekiedrudeiucetggdotefuucfrrhhofhhilhgvmec
uoffgnecuuegrihhlohhuthemuceftddtnecutehtthgrtghhuchhvggruggvrhculddqhedtmdenufh
prghmjfgvrgguvghrhfhivghlugcujfgvrgguvghrucfutghorhhinhhgucdluddtmd


This is the mail system at host mwinf2201.orange.fr.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

The mail system

<masked>: host smtp.calixo.net[masked] said: 553 sorry, your
mailserver is rejected by see http://spamcop.net (in reply to MAIL FROM
command)

Over the last weeks, I have noticed something strangish. A very large proportion (90 % or more) of the (fake) e-mail addresses behind messages that end up in my Held Mail start with the letter "q". My filters work well, I get very few false negatives and false positives.

Is it just me?

We're experiencing a strange situation with our client's e-mail accounts, in that they are being intermittently blocked by spamcop because the addresses 'do not exist'. A popular ISP in the area is using the reputable spamcop software, and I was wondering how spamcop determines that addresses might not exist (when they clearly do).

Here is the failure response message that the ISP's outbound server generates:

The following message to <webtech[at]emmatt.com> was undeliverable.
The reason for the problem:
5.1.0 - Unknown address error 550-'found in bl.spamcop.net'
Reporting-MTA: dns; fipsb03.cogeco.net

Final-Recipient: rfc822;webtech[at]emmatt.com
Action: failed
Status: 5.0.0 (permanent failure)
Remote-MTA: dns; [67.222.96.155]
Diagnostic-Code: smtp; 5.1.0 - Unknown address error 550-'found in bl.spamcop.net' (delivery attempts: 0)


Our mail servers are primarily at mail.emmatt.com, on a shared server. The address listed is my own, and definitely exists... however, this happens on numerous accounts under the same hosting server, with different domains. Everyone who uses this popular ISP reports this intermittent issue when trying to contact us or our clients.

Could someone shed some light on this? Thanks in advance.