URLs not reported, SC finds, but does not offer to LART! Options

[Jeff G.]

I'm hoping the alert to watch more closely either confirms or denies (by lack of duplication) the stories thus far told.

When I have time to do full/slow reporting, I take my own advice. If a few refreshes don't fix a failure to see a URL, deobfuscate a URL, resolve a URL, or find a reportee for a URL, I'll parse that URL alone on one line in a separate tab or window, then come back and likely find the failure resolved within a few more refreshes. The quantity "few" depends on how much attention I'm paying to that browser window vs. whatever else I'm doing. Of course, if the separate parse of the URL still can't resolve the URL's hostname, I'll check that another way (via dig, ping, nslookup, Sam Spade, DNS Report, and/or DNS Stuff, whatever's easily available). My main Windows computer has a command-line dig utility that can trace from the root servers, which really helps with troubleshooting.

[StevenUnderwood]

My main Windows computer has a command-line dig utility that can trace from the root servers, which really helps with troubleshooting.

Where did you get that... I would be interested.

[Jeff G.]

My main Windows computer has a command-line dig utility that can trace from the root servers, which really helps with troubleshooting.

Where did you get that... I would be interested.

I'll get back to you on that. It may have come with cygwin, or I may have had to install it separately (I don't remember, I'm not there right now).

[Wazoo]

OK, agree with "the second time this has come up" ... query sent upstream, asking about a possible coding error, browser/display issue .. but also suggesting that there may still be something going on with the "stories" offered.

Copied off the spam, submitted it, got the same 'found the link but did nothing with it' parse result.  Cancelled the report.  Checked the Tracking URL for that report, no sign of an attempt to report the spamvertised site.

So question now would be how to duplicate the twice told story of not seeing the report selection boxes for reporting of the spamvertised site, but having those reports get generated and sent out anyway.

As suggested, it appears that duplicating the results complained about is going to be a problem, especially with the "reports gone out" showing in the data seen 'after the fact' ...

I don't know what to tell you -- the parse looks fine now. The system sees
the url and parses it and finds and IP and reporting addresses. And it looks
to me like it sent reports previously also:

Reports regarding this spam have already been sent:
Re: 61.105.25.118 (Administrator of network where email originates)
Reportid: 1496187296 To: postmaster#thrunet.com[at]devnull.spamcop.net
Reportid: 1496187298 To: abuse[at]thrunet.com
Re: http://grudgingly.net/rm.php?sash99 (Administrator of network hosting
website referenced in spam)
Reportid: 1496187309 To: abuse#gddc.com.cn[at]devnull.spamcop.net
Reportid: 1496187310 To: ct-abuse[at]abuse.sprint.net
Reportid: 1496187311 To: anti-spam#ns.chinanet.cn.net[at]devnull.spamcop.net
Re: Forwarded Spam (User defined recipient)
Reportid: 1496187307 To: spamrecycle[at]chooseyourmail.com
Reportid: 1496187308 To: spam[at]uce.gov
Re: 61.105.25.118 (Third party interested in email source)
Reportid: 1496187300 To: spamcop[at]imaphost.com
Re: http://grudgingly.net/rm.php?sash99 (Third party interested in
spamvertized web site)
Reportid: 1496187313 To: abuse[at]gzidc.com

I don't know of any situation where the system would be sending reports
without the usual checkboxes or notifies during the parse. I see that your
tracking url now parses correctly and I don't know what happened previously.
We have been unable to reproduce this problem altho we have looked at the
code to see if we can figure out what is happening and have been
unsuccessful in seeing anything that would cause what you indicate is
happening.


Ellen
SpamCop

Please include all previous correspondence with replies

----- Original Message -----
From: "Wazoo"
To: <deputies>
Sent: Friday, August 26, 2005 1:56 PM
Subject: Coding/Display bug??

> This is the second time this week that this scenario has come up.
> Not sure if the users are leaving out part of the story of if there
> may be something going on in the background.
>
> http://www.spamcop.net/sc?id=z800050261z9e...471dce20cd4346z
> User posted in the Forum with the now-standard complaint
> about the parser "seeing" the included URL in the spam, but
> not doing anything with it.  However, looking at the above
> Tracking URL, reports did in fact go out on the spamvertised
> site.  Again, this is the second time this week that this has
> been seen/discussed.
>
> Are there reports going out that the user does not get/see the
> selection boxes on?
>
> Did this user submit the same spam twice, one submittal doing
> the 'full' parse, but somehow offering up the wrong Tracking URL
> to complain about?
>
> Some kind of a strange browser issue, somehow not displaying
> the full parse results, but the Send button still on-screen?
>
> For giggles, I copied off the spam submittal, ran it through my
> account, and also see the link found,
> Finding links in message body
> Recurse multipart:
>    Parsing text part
>
> Resolving link obfuscation
> http://grudgingly.net/rm.php?sash99
> http://grudgingly.net/cs/?sash99
>
> but, as complained about .... nothing done with that data.
> Cancelled that report, but that Tracking URL also does not
> include a reference to reporting the site.
> http://www.spamcop.net/sc?id=z800089192zd3...4fe7fdbcefd757z

[StevenUnderwood]

As suggested, it appears that duplicating the results complained about is going to be a problem, especially with the "reports gone out" showing in the data seen 'after the fact' ...

Well, since this second report, I have been double checking every report and while I find about 10-20% of the reports failing to do anything with the found links, none of those reports have immediately shown sent messages nor do the Tracking URLs show reports sent. I am not organized enough to check back more than the current days reports.

[gwelsh]

The reason the tracking URL I provided might have indicated that reports were sent is that, like someone else who posted here, I keep reloading the page (or going back to the "Unreported Spam Saved: Report Now" link) until SpamCop decides to stop ignoring the URLs.

Yeah, I hate spammers that much.

But it's frustrating to me and, almost certainly more important, generating a lot of useless load on SpamCop if multiple people have to re-analyze their spam 10, 20, or 30 times before SpamCop works properly.

[gwelsh]

OK, here's a URL that won't be recognized no matter how many times I reload... and, since I can't get at the rest of my queued spam until I give up on this one.

http://www.spamcop.net/sc?id=z801601960zb5...67868c2715a2d9z

Finding links in message body
Parsing text part
Resolving link obfuscation
http://uneaten.net/cs/?ronn
http://uneaten.net/rm.php?ronn

Please make sure this email IS spam:

... etc. BUT... parse http://uneaten.net/cs/?ronn on its own and I get:

Parsing input: http://uneaten.net/cs/?ronn
[report history]
Routing details for 221.11.133.82
Report routing for 221.11.133.82: abuse[at]cnc-noc.net
Statistics:
221.11.133.82 not listed in bl.spamcop.net
More Information..
221.11.133.82 not listed in dnsbl.njabl.org
221.11.133.82 not listed in dnsbl.njabl.org
221.11.133.82 not listed in cbl.abuseat.org
221.11.133.82 listed in dnsbl.sorbs.net ( 127.0.0.6 )
221.11.133.82 not listed in relays.ordb.org.

Reporting addresses:
abuse[at]cnc-noc.net

... no problem. But I can reload the original spam and it still does nothing with the URL.

Maybe there's a reason why SpamCop is declining to report, but it would be nice to know what that reason is.

[StevenUnderwood]

The reason the tracking URL I provided might have indicated that reports were sent is that, like someone else who posted here, I keep reloading the page (or going back to the "Unreported Spam Saved: Report Now" link) until SpamCop decides to stop ignoring the URLs.

Thank you for that update. Now we can stop chasing that question.

But it's frustrating to me and, almost certainly more important, generating a lot of useless load on SpamCop if multiple people have to re-analyze their spam 10, 20, or 30 times before SpamCop works properly.

I don't think most people do reload endlessly until it reports. Most people accept what spamcop hands them and go on with their lives. Also, many people use quick reporting either directly or via webmail and do not report web sites at all. As mentioned elsewhere in this long thread, it is on the todo list but most people believe keeping up with the spammers latest tricks to keep the email out of the inboxes in the first place is more important than the reporting of web sites that has been mistaken by ISP's (more than once) as an actual spam report against the site owner. The ones we hear about are usually 3rd parties with nothing to do with the spam.

[Wazoo]

... etc. BUT... parse http://uneaten.net/cs/?ronn on its own and I get:

Maybe there's a reason why SpamCop is declining to report, but it would be nice to know what that reason is.

http://www.dnsreport.com/tools/dnsreport.c...ain=uneaten.net
A timeout occurred getting the NS records from your nameservers! None of your nameservers responded fast enough. They are probably down or unreachable. I can't continue since your nameservers aren't responding.

Your NS records at the parent servers are:
ns1.iratest.com. [221.11.133.81] [TTL=172800] [CN]
ns2.iratest.com. [221.11.133.82] [TTL=172800] [CN]
[These were obtained from m.gtld-servers.net]

You'll note that DNS is 'provided' by the same IP address used to 'serve' the spamvertised web-page.

[gwelsh]

A timeout occurred getting the NS records from your nameservers!

But, when I copy the URL and paste it into the SpamCop reporting window, SpamCop resolves it fine. OK, so the DNS servers were slow but now SpamCop knows the answer... so I go back to the spam in the reporting queue, it still doesn't report them.

Also, whenever SpamCop is inable to resolve a URL, it reports that fact. It does not do so in these cases.

I therefore believe that the problem is not that SpamCop cannot resolve the URL.

[Wazoo]

But, when I copy the URL and paste it into the SpamCop reporting window, SpamCop resolves it fine.  OK, so the DNS servers were slow but now SpamCop knows the answer... so I go back to the spam in the reporting queue, it still doesn't report them.

The single-line look-up tool and the spam parsing tool are two separate codebase items. The only thing in common is they both use the same entry window. If there is no new-line character at the end of the first line of text pasted in, the single-item lookip code is followed. If there is a new-line character involved, the spam parser is invoked.

Also, whenever SpamCop is inable to resolve a URL, it reports that fact.  It does not do so in these cases.

Not really, as explained above. The single-line entry lookup simply looks for a reporting address for the one item queried and thows that data up on screen. The spam parsing engine invokes many, many things on the search / process of diagnosing the spam and all its contents.

I therefore believe that the problem is not that SpamCop cannot resolve the URL.

Have you actually read this whole Topic/Discussion? Have you read the associated entries in the SpamCop FAQ here? Have you looked at other Topics/Discussion on the same type of problem/complaint? Do you actually see anyone arguing with you? Have you looked at http://www.spamcop.net/spamgraph.shtml?spamstats ? (hmm, no complaints about the outage .interesting)

[lcusdtech]

I don't think most people do reload endlessly until it reports.  Most people accept what spamcop hands them and go on with their lives.  Also, many people use quick reporting either directly or via webmail and do not report web sites at all.  As mentioned elsewhere in this long thread, it is on the todo list but most people believe keeping up with the spammers latest tricks to keep the email out of the inboxes in the first place is more important than the reporting of web sites that has been mistaken by ISP's (more than once) as an actual spam report against the site owner.  The ones we hear about are usually 3rd parties with nothing to do with the spam.

You could be right, you could be wrong about what most people do. I for one am very interested in getting the websites reported, and will refresh until it does work. The spamers can't make any money if their web sites have been taken down, and will not be able to keep spamming. Also I do SURBL checks on incoming mail. I need those websites listed so the SURBL check will tag the e-mails as spam. Whether or not getting them listed is dependant on the parser or not I don't know, but I'm sure Wazoo can tell us. (I know... there's already a thread on it, go do my own research... right?) (IMG:style_emoticons/default/biggrin.gif)

[Wazoo]

Whether or not getting them listed is dependant on the parser or not I don't know, but I'm sure Wazoo can tell us.  (I know... there's already a thread on it, go do my own research... right?)   (IMG:style_emoticons/default/biggrin.gif)

Well, as a matter of fact, Jeff G. did write up a FAQ entry, it has been added to the Forum version of the SpamCop FAQ and has also been included into the KnowledgeNase view of the FAQ I'm trying to populate ... So you don't even have to search for the "Thread" , Topic, or Discussion .. it's is in two versions of the FAQ at present ....
New! How does SpamCop interface with SURBL?
How does SpamCop interface with SURBL?

It is a challenge to see how much of this stuff we can hide, just so no one can find it, causing the question to have to be asked agian and again ... just so "we" can bitch about the fact that it does actually already exist somewhere ....

[lcusdtech]

Well, as a matter of fact, Jeff G. did write up a FAQ entry, it has been added to the Forum version of the SpamCop FAQ and has also been included into the KnowledgeNase view of the FAQ I'm trying to populate ... So you don't even have to search for the "Thread" , Topic, or Discussion .. it's is in two versions of the FAQ at present ....
New! How does SpamCop interface with SURBL?
How does SpamCop interface with SURBL?

It is a challenge to see how much of this stuff we can hide, just so no one can find it, causing the question to have to be asked agian and again ... just so "we" can bitch about the fact that it does actually already exist somewhere ....

I've read enough posts to know that you do a good job of documenting what is going on. I was just poking fun at myself there, because I knew I was being too lazy to go find it, and new you would point that out. (IMG:style_emoticons/default/smile.gif) I'm really having a good laugh right now.

So if I'm reading that SURBL FAQ correctly, if the parser does not parse the URL, then the ULR will not make it on to the SURBL list. Is that correct? Or am I just totally lost?

This post has been edited by lcusdtech: Oct 27 2005, 07:05 PM

[StevenUnderwood]

So if I'm reading that SURBL FAQ correctly, if the parser does not parse the URL, then the ULR will not make it on to the SURBL list.  Is that correct?  Or am I just totally lost?

Correct

[lcusdtech]

Correct

Good, then add that as one more reason I want the URL's parsed, and will refresh until they do. (IMG:style_emoticons/default/smile.gif)

[qjvgpuryy]

It is a challenge to see how much of this stuff we can hide, just so no one can find it, causing the question to have to be asked agian and again ... just so "we" can bitch about the fact that it does actually already exist somewhere ....

Simultaneously laughing out loud, crying, rolling eyes, and remarking HHOS! Keep up the good work (please!)!

[ankman]

You got spam from the exact same source (24.203.217.72) and the date it was sent (not when you received it) was after March 26, 2005 8:50:49 AM -0600? Please post the tracking URL only please.

From your original:

0: Received: from 24.203.217.72 (HELO modemcable072.217-203-24.mc.videotron.ca) (24.203.217.72) by mta305.mail.scd.yahoo.com with SMTP; Sat, 26 Mar 2005 05:05:11 -0800 (25-mar-2005:21:05:11)

ISP has indicated spam will cease; ISP resolved this issue sometime after Saturday, March 26, 2005 8:50:49 AM -0600 (26-mar-2005:02:50:49)

As Jeff stated, the spam was sent to you almost 6 hours before the ISP took action. That is actually pretty good response time from an ISP. If you are a paid account holder, you are allowed to appeal the ISP response if nobody has appealed the ISP response already. In that case a deputy will look over the evidence and start sending reports again, but the timing needs to be correct.

Little older article here. But there is this new Social Network spammer at FanBridge dot com. I get about 3 spams a day, trying to complain via Spamcop results in

==
Tracking message source: 74.86.91.162:
Routing details for 74.86.91.162
[refresh/show] Cached whois for 74.86.91.162 : abuse[at]softlayer.com
Using abuse net on abuse[at]softlayer.com
abuse net softlayer.com = postmaster[at]softlayer.com, abuse[at]softlayer.com
Using best contacts postmaster[at]softlayer.com abuse[at]softlayer.com
ISP has indicated spam will cease; ISP resolved this issue sometime after Sat 12 Jul 2008 02:09:40 PM EDT -0400
Message is 0 hours old
==

So the spam is from today (13th) and Softlayer is not larted because he "indicated" something.

And the previous days the same happened, decrease day by one for the Spamcop message "ISP has indicated spam will cease...". And I bet it will continue tomorrow and so on.

Since Fanbridge seems to be a fairly big spammer and need to spam, and Softlayer appears in reports often too, Softlayer is lying and Spamcop obeys. That sucks.

Spamcop should have a database, and if there come further complaints for an ISP which "indicated spam will cease" notes of this ISP should be ignored and complaints be filed to get them listed.

Or do I get something wrong?

[StevenUnderwood]

Spamcop should have a database, and if there come further complaints for an ISP which "indicated spam will cease" notes of this ISP should be ignored and complaints be filed to get them listed.

Or do I get something wrong?

You may have something wrong... even with the "ISP does not want reports" set, those reports still are used to list the IP address if the math works.

SpamCop can not make any ISP do anything, and if they have indicated one way or another that they do not want SpamCop to send them any more reports, it would be abuse to keep sending those reports.

[Wazoo]

Little older article here. But there is this new Social Network spammer at FanBridge dot com. I get about 3 spams a day, trying to complain via Spamcop results in

Note: Tracking URL not provided. Only a snippet of a parse result posted.

So the spam is from today (13th) and Softlayer is not larted because he "indicated" something.

Evidence presented would indicate that the ISP/Host made the selection that the issue had been handled, with the result that further reporting had been "turned off" for 24 hours.

And the previous days the same happened, decrease day by one for the Spamcop message "ISP has indicated spam will cease...". And I bet it will continue tomorrow and so on.

Hard to agree or disagree due to lack of evidence presented here. The available Reporting History seen for the IP Address of 74.86.91.162 doesn't actually match your attempted scenario, specifically the "3 spams a day" description (based on the spams reported) .. and before you try the "because they were not larted because ...." justification, I'll point out the breaks in the sequential dates, the differing Subject lines/differing spams, the different Reporter/Reporting modes involved .....

Since Fanbridge seems to be a fairly big spammer and need to spam, and Softlayer appears in reports often too, Softlayer is lying and Spamcop obeys. That sucks.

"Fanbridge" only seen specifically in two of the past Reports. Not enough evidence rovided in your single snippet to talk about a response from Softlayer.

Spamcop should have a database, and if there come further complaints for an ISP which "indicated spam will cease" notes of this ISP should be ignored and complaints be filed to get them listed.

Or do I get something wrong?

http://www.senderbase.org/senderbase_queri...ng=74.86.91.162
Volume Statistics for this IP
Magnitude Vol Change vs. Last Month
Last day ....... 3.2 .. -80%
Last month ... 3.9

It does seem to suggest that something has changed, although noting that it's a week-end involved here.

On the other hand, with only 10 reported spams over the last 90 days, but a magnitude showing of approximately 4,000 e-mails a day, it's hard to see where your excitement may be coming from. More than likely, you are not taking the IP Address targetting mode of the SpamCop Reporting System into account as far as your Reporting activity goes.