E-Mail spam submittals blocked by your ISP Options

[JSK333]

Add nuvox.net to the list.

This started happening recently. However, they alert you with an error message when trying to send them:

Transaction failed
Server replied: 554 5.7.1 Access denied. Possible UBE/UCE detected. Contact postmaster[at]nuvox.net

This happens with both webmail and SMTP.

I've noticed, with webmail at least, that it seems to accept single reports with 3 or fewer spams attached.

It had been happening seemingly randomly, but now it appears to be all the time, so that I can't send my 15-20 spams per report email any longer. Very annoying.

I've written their postmaster but have yet to receive a reply as of 2-3 days.

[Element Dave]

RCN also appears to be silently discarding outgoing SPAM submissions to spamcop.* None of my submissions to spamcop sent through RCN's SMTP server have gone through. And yes, I have tried adding myself to the CC field of submissions, among other tests to rule out alternative possibilities.

If I'm able to get any notable information from them concerning the issue, I will report back.

* I don't expect that there will be any confusion, but to make clear, the filtering is based on e-mail content, not the recipient -- in this case spamcop.

[Farelf]

nuvox.net added to the list per JSK333's post and no subsequent response reported or refutation offered.

[Wazoo]

adelphia.net added to the list, based on dialog at http://forum.spamcop.net/forums/index.php?showtopic=7348

[elvey]

Those ISPs (or techs in the mix) have stated that this is for the purposes of stopping spam from their system. Overlooked is that these days, the compromised machines are using their own SMTP engines, therefor not going through the ISP's provided e-mail servers with all this filtering applied. And again, even this data is provided by the few that either know or are allowed to talk about it ... as it turns out, most users don't know that this is going on at all.

You say hat color, but you also have to include some cluelessness.

The idea of running outgoing spam through a spam detector isn't a bad one; it just needs to be implemented cluefully. E.g. Email to abuse@*, postmaster@* or *@*spamcop.net should be ignored, and the action should not be a silent drop. The main system I use sends an error to the MUA during the SMTP transaction, e.g. if it detects a syntax error in a destination email address; works very well.

Keep in mind, many spammers like to use an ISP's mail gateways; these detectors are essential to dealing with that desire.

[Toffa]

Having had a series of arguments with them (and them denying everything) BigPond here in Oz should be added as they now even admit to the hidden filtering practice on their Web Site. They're blocking "identifiable" incoming Spam so I can't report it. How we're supposed to get the Spammers off the air when the mails are blocked is beyond me. The filters work on outgoing mail too, so if the Spam came to my Email client via a non BigPond Mail Server, the attachment I send to you is sometimes identified on it's way out and the whole Mail Message is just trashed without even a non-delivery notification. Nice....... NOT (IMG:style_emoticons/default/excl.gif)

This quote from the BigPond Web Site on this page - Email Services - Telstra BigPond:

SNIP.....
Your mailbox is automatically covered by our network Spam and Email Virus Filters. That'll cut out a lot of annoying junk mail
SNIP.....

And the reason I was raging at them? This crap filter is so Draconian that it is also restricting genuine email that I want to receive (IMG:style_emoticons/default/mad.gif)

[Miss Betsy]

<snip>
And the reason I was raging at them? This crap filter is so Draconian that it is also restricting genuine email that I want to receive (IMG:style_emoticons/default/mad.gif)

My complaint exactly! I am in favor of blocklists where there is a message returned to the source because that way legitimate senders who get blocked can actually *do* something about the spam whether it is complain to their provider or change providers.

Miss Betsy

[turetzsr]

<snip>
And the reason I was raging at them? This crap filter is so Draconian that it is also restricting genuine email that I want to receive

My complaint exactly!

...Not if I understand correctly (see below)!

I am in favor of blocklists where there is a message returned to the source because that way legitimate senders who get blocked can actually *do* something about the spam whether it is complain to their provider or change providers.

Miss Betsy

...IIUC, Toffa is complaining that BigPond is blocking suspected spam rather than tagging or sorting it and giving him access to it, whereas you are complaining about not sending a rejection (5xx) message to the source. BigPond may be doing the 5xx reject (can not tell from the information Toffa provided, which is okay because it's not germane to his complaint). (IMG:style_emoticons/default/smile.gif) <g>

[Farelf]

Having had a series of arguments with them (and them denying everything) BigPond here in Oz should be added as they now even admit to the hidden filtering practice on their Web Site. ... The filters work on outgoing mail too, so if the Spam came to my Email client via a non BigPond Mail Server, the attachment I send to you is sometimes identified on it's way out and the whole Mail Message is just trashed without even a non-delivery notification. Nice....... NOT (IMG:style_emoticons/default/excl.gif) ...

Hi Toffa - possibly not quite enough to add them to the list - my emphasis - ("... the attachment I send to you is sometimes identified on it's way out ... "). FWIW iinet.net.au which I use seems to do the same - but they also seem to leave alone anything (in attachments) that has been tagged by NAS (Norton), no doubt others too. But if I have a single untagged spam in my submission batch, the whole submission "evaporates". And they won't admit it (no doubt on the justification that spammers might benefit somehow).

Has there been any discussion of these matters in the PigPong (sorry, "BigPond") forum at Whirlpool? Other users may have some tips about the ISP filtering (both inwards and outwards). With "normal" ISPs you can sometimes get some remediation happening through those forums but I wouldn't think the mighty Telstra would descend to walk amongst mere mortals (guess who missed out on the share offers?).

HTH

[Miss Betsy]

My complaint exactly!...Not if I understand correctly (see below)!...IIUC, Toffa is complaining that BigPond is blocking suspected spam rather than tagging or sorting it and giving him access to it, whereas you are complaining about not sending a rejection (5xx) message to the source. BigPond may be doing the 5xx reject (can not tell from the information Toffa provided, which is okay because it's not germane to his complaint). (IMG:style_emoticons/default/smile.gif) <g>

Well, that's part of my complaint - that whatever some ISPs do, they won't tell you /why/ or /what/ or let you set your own parameters except sometimes to whitelist. If the accepted norm was a 5xx message to spam, then the *senders* would be able to change things by insisting on reliable email and phantom senders would never get through.

How many Comcast customers would be appalled to know how much porn Comcast allows to be sent?

Miss Betsy

[Desertphile]

It looks like Hughes.net using cp.net as their mail processing service needs to be added to the clueless list. HughesNet is the new name for the DirecWay Satellite Internet service.

Connection log:

�[ Wrote ]
�[ Wrote ]
�[ Wrote ] .
�[ Read ] 554 Message refused
�[ Wrote ] RSET
�[ Read ] 250 RSET
�[ Wrote ] QUIT
�[ Read ] 221 n126.sc0.cp.net QUIT

What is going to be needed at some point is another way of quickly submitting spam reports, bypassing clueless ISP's mail servers.

BlueSecurity.com is working on a HTTP based spam submission method using plugins for your mail program. FireTrust.com uses a spam submission method that avoids SMTP for thier FirstAlert spam blocking service.

Indeed, I use hughes.net and it not only rejects reports being submitted to SpamCop, but also rejects complaints I try to send to various ISP's abuse email addresses. It even rejcts the following email I tried to send to a friend of mine:

> Hey
>
> So you know what the deal is with emails that end up in my junk folder with
> rather normal names but are filled with words that make no sense?? What are
> they, code for something? They don't advertise anything. I don't get it. I
> get lots of those. No attachments. There has to be some catch??? My junk
> folder catches them but they don't get screened out..

Hi. I cannot say what they are without seeing them, but I suspect they
have image URLs attached to them: commercial spam using pictures
instead of text. Damn bastards.

I do not see anything sinister in the above, but hughes.net's spam filter does.

[Farelf]

... I do not see anything sinister in the above, but hughes.net's spam filter does.

Unbelievable - maybe they are a bit sensitive on the parentage thing and with good reason I should think. Added to the list at the head of this topic. You will have seen the workarounds and suggestions which followed the Stan_qaz post you quoted (just to note for others passing by and who maybe haven't browsed the full topic that some of that content may be useful).

[Desertphile]

Unbelievable - maybe they are a bit sensitive on the parentage thing and with good reason I should think. Added to the list at the head of this topic. You will have seen the workarounds and suggestions which followed the Stan_qaz post you quoted (just to note for others passing by and who maybe haven't browsed the full topic that some of that content may be useful).

I just had yet another email rejected by hughes.net

Incredably, it was rejected because it had the Subject: line that read "To start a brawl" which, when I changed the Subject: line to "The Preserve," hughes.net's mailer accepted the email and sent it on its way. Frankly I cannot imagine what is offensive or spam-like in "To start a brawl."

I will look for the work-arounds you have mentioned.

This was suggested to me as a possibility, so far it is working.

http://www.softstack.com/freesmtp.html

I'll have to find something a bit more polished if I'm going to keep using it.

How confident are you that Free SMTP Server is not malicious? Could it be sending email, or other information, that you are not aware of?

[Wazoo]

As posted to the spamcop newsgroup;

From: SpamCop Admin <nobody[at]devnull.spamcop.net>
Newsgroups: spamcop
Subject: Re: cox now blocking reports to spamcop (labelling them as spam)
Date: Tue, 08 May 2007 04:42:11 -0600
Message-ID: <qqk043h5ff6996bjjn2i59tkjg51ljgch2[at]4ax.com>
References: <24057796.dZx3GzRDtk[at]rawgames.org>
NNTP-Posting-Host: 206.207.78.146
X-No-Archive: yes

Technomage Hawke wrote:
>-looks like someone in the anti-spam corps for cox.net is getting anal
>-retentive.

Forwarded without comment...

A Cox user told me this...

"forwarding to Spamcop for reporting is no longer allowed as of
05/03/07. Talking with a Cox representative, they feel this is simply
a duplication of their already superior services! I may report
suspected errors in their spam filtering to help enhance their system,
but from now on things will be done their way only."


- Don -

[Wazoo]

RoadRunner added based on commetary seen at http://forum.spamcop.net/forums/index.php?...ost&p=57801

[Farelf]

iinet.net.au (about to be) added to the list. Not a deliberate block but they apparently block outgoing using one or both of the same (IronPort & BrightMail) filters that are used by default for incoming mail.

Anything leaking through the filters should leak back out again when an attempt is made to report to SC but the filter rules are evidently updated frequently or incoming and outgoing are not necessarily synchronised but anyway the longer the interval between receipt and report the less likely it is for reporting to succeed and sometimes it just doesn't get through, no matter how short the gap. No NDNs are received, stuff just never arrives at SC or anywhere else.

I have seen it denied (by users) in Whirlpool that there are outgoing iinet filters per se but the proof of the pudding ... plus I have had it confirmed in email and 'phone discussions with iinet support staff at several levels.

Batching as opposed to single submissions makes no difference, copying in iinet staff addresses (suggested by support) doesn't work, even removing the headers (a test) doesn't work - though the IronPort filter would almost certainly include reputation scoring so presumably content filtering is part of the deal as well.

<vent>Australian providers are required to do certain things about spam:

... email service providers will address the sources of spam within their own networks, including actual spammers, misconfigured customer email servers and the virus-infected computers used to spread spam (known as ‘zombies’).

Pointing out to iinet that sweeping it under the carpet is possibly not meeting the spirit of the requirement (they should be enforcing their "CRA" - which is what they have instead of AUP/TOS) and even less so is interfering with those who are trying to do something a little more pro-active have thus far been countered with simulated incomprehension.

Indeed, why should they do otherwise? 99.9% of their customers are more than happy with the whole deal (including competitive pricing) and iinet's competitors are, assuredly, doing just the same (and the share/stock holders are, no doubt, delirious with joy). Needless to say my request to escalate the matter to the "product improvement" team have been met with blank silence.</vent>

[Wazoo]

Based on traffic seen at http://forum.spamcop.net/forums/index.php?showtopic=9900 ... Apple MobileMe was added to the starting post in the Topic.

[NoSheds]

I send mail via my ISP's smarthost which is NTLWorld.com. I was a customer of NTL in the UK and they have been merged into Virgin Media.

I was having problems with email submissions, so I sent a copy of a virus report to a hotmail address and it didn't get through. I changed my setup to send emails directly to spamcop (i.e. not via my ISP) and email notification works again. So it seems that NTL/Virgin Media should also be added to the list of people deleting "spams".

Regards
NoSheds

[Edit - added, thanks - IIUC silent dropping may be indicative of IronPort device deployment, if so 'ironic' indeed]

This post has been edited by Farelf: Jan 20 2009, 08:32 PM

[Wazoo]

Added Verizon to the list based n the research/results seen at http://forum.spamcop.net/forums/index.php?showtopic=10100

[Farelf]

Added WOW-WideOpenWest based on abrupt disappearance of batched submissions through that network (and restoration of the reporting path when re-routed through GMail) reported by user "Erik Ch. Ohrnberger" in News Groups:

Path: news.spamcop.net!not-for-mail
From: "Erik Ch. Ohrnberger" <x>
Newsgroups: spamcop.mail
Subject: Re: SpamCop reporting issues
Date: Tue, 24 Mar 2009 21:03:07 -0400
Organization: SpamCop
Message-ID: <gqbvsb$l0a$1[at]news.spamcop.net>
References: <gqau05$qmh$2[at]news.spamcop.net> <gqb4i7$k2k$1[at]news.spamcop.net>
Xref: news.spamcop.net spamcop.mail:22521

Farelf,
Thanks for your reply. Lots of good information in there.

I tried a test where I sent the spam reporting email with multiple
attachments through my GMail account, and this worked perfectly and cleanly.

I guess WOW has decided to spam check outbound email as well as inbound
email. Oh well. I don't think that I'll be able to convince them to
change their practices. I'm far from their ideal customer, as I have a
Linux mail server of my own dumping the outbound on their SMTP server to
deliver (Can't deliver it directly on my own, I keep triggering their zombie
spammer alert - but never mind that it's not one, their tools say it's one).
...

and

Path: news.spamcop.net!not-for-mail
From: "Erik Ch. Ohrnberger" <x>
Newsgroups: spamcop.mail
Subject: Re: SpamCop reporting issues
Date: Wed, 25 Mar 2009 11:01:28 -0400
Organization: SpamCop
Message-ID: <gqdjta$54e$1[at]news.spamcop.net>
References: <gqau05$qmh$2[at]news.spamcop.net> <gqb4i7$k2k$1[at]news.spamcop.net> <gqbvsb$l0a$1[at]news.spamcop.net>
Xref: news.spamcop.net spamcop.mail:22523

OK, job done.

I tweaked my macro so that it specifically uses my GMail account for sending
spam reports to spamcop, which doesn't block this type of spam reporting
email, so all is well and working again.

...

Thanks Erik (IMG:style_emoticons/default/smile.gif)