SPAMCOP HOME · SPAMCOP FAQ · NEWSGROUPS · FORUM FAQ · WEBMAIL · SSL WEBMAIL · SPAMCOPWIKI


 Other words, data, places -->  SpamCop Pages V  FAQs & Words V  Newsgroups V  WebMail V  News-Recent Stuff V   Poll on menu

------>------> Latest and Current Announcements <------<------

Welcome Guest ( Log In | Register )

> This is a User to User Support Forum

The primary mode of support here is peer-to-peer, meaning users helping other users. (please remember this at all times!)
Another try:
This forum is composed of people who have used spamcop and those who are learning about anti-spam efforts.

 
 Reply to this topicStart new topic
> Not sending reports to ISP!? Nothing to do, Staff Notifications sent
btech
post May 26 2006, 01:01 PM
Post #1


Advanced Member
Group Icon

Group: Memberp
Posts: 447
Joined: 17-June 04
From: Texas
Member No.: 1895
On the past 2 reports I've sent, the parser shows that reporting address of the ISP for the source IP, but the actual report only sends to the 3rd party.

http://www.spamcop.net/sc?id=z954839818z87...e9ca43104796d6z

Any ideas?
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
manchot
post May 26 2006, 01:05 PM
Post #2


Newbie
*

Group: Members
Posts: 3
Joined: 27-April 04
Member No.: 1306
Same here. 2 spams, no message to ISP, no mention of the clearly present spamvertised URLs.
Sumpin's gotta be broke!

- Manchot
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
btech
post May 26 2006, 01:28 PM
Post #3


Advanced Member
Group Icon

Group: Memberp
Posts: 447
Joined: 17-June 04
From: Texas
Member No.: 1895
I just noticed that too.. the URLs didn't parse either.
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Wazoo
post May 26 2006, 01:46 PM
Post #4


What Life?
Group Icon

Group: Forum Admin
Posts: 12892
Joined: 22-January 04
From: Iowa
Member No.: 18
QUOTE(btech @ May 26 2006, 01:28 PM) *
I just noticed that too.. the URLs didn't parse either.

???? There is no URL to parse ... payload is in a graphic ....

As far as the reports .. agreed .. e-mail sent
QUOTE
From: "WazoO"
To: "SpamCop, Argyle"
Cc: "SpamCop, Deputies"
Subject: SpamCop v 1.573 is broken
Date: Fri, 26 May 2006 13:40:33 -0500

The parse results it for spam source are not listed as choices
for sending reports. Strangely, only Cyveillence as a Third-Party
shows up.

Forum posting:
http://forum.spamcop.net/forums/index.php?showtopic=6436
MailHosted Tracking URL:
http://www.spamcop.net/sc?id=z954839818z87...e9ca43104796d6z
Non-MailHosted Account Tracking URL:
http://www.spamcop.net/sc?id=z954862692z95...da09e992a9b316z

SpamCop v 1.573 Copyright © 1998-2005
No date offered, but in my documentation;
24 May 2006 - SpamCop v 1.564.2.1 Copyright © 1998-2005
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
mrbungle
post May 26 2006, 01:48 PM
Post #5


Member
**

Group: Members
Posts: 24
Joined: 3-March 04
Member No.: 578
I have just tried to report 3 UCE in a row and the system came back with 'nothing to do' every time. Is there maintenance going on?
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
bobbear
post May 26 2006, 01:55 PM
Post #6


Advanced Member
***

Group: Membera
Posts: 193
Joined: 23-January 04
Member No.: 36
QUOTE(mrbungle @ May 26 2006, 07:48 PM) *

I have just tried to report 3 UCE in a row and the system came back with 'nothing to do' every time. Is there maintenance going on?

Me too - there seem to be reportable addresses parsed but no reports generated except for user defined/third party addresses. (Sorry - no tracking URL available).


--------------------
Fraudsters Log.. http://www.bobbear.net/
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
mrbungle
post May 26 2006, 01:56 PM
Post #7


Member
**

Group: Members
Posts: 24
Joined: 3-March 04
Member No.: 578
I have one

http://www.spamcop.net/sc?id=z954875957z0e...9104588ea7f234z
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
StevenUnderwood
post May 26 2006, 02:27 PM
Post #8


What Life?
Group Icon

Group: Membersph
Posts: 5172
Joined: 20-January 04
From: Whitinsville, MA USA
Member No.: 12
Always on the long weekends....argh
They must be telling me to take the weekend off from reporting (IMG:style_emoticons/default/smile.gif)

Just to add more info, submissions at 6:30 AM EST went through. Those at 10:45, did not.

Submitted: Friday, May 26, 2006 10:45:06 AM -0400:
Re: Account # 03664457U
No reports filed
--------------------------------------------------------------------------------

Submitted: Friday, May 26, 2006 6:30:31 AM -0400:
loongger -Carolina
1765699253 ( 58.81.74.131 ) To: postmaster[at]usen.ad.jp
1765699232 ( 58.81.74.131 ) To: abuse[at]usen.ad.jp

P.S. Ther is another thread with the same complaint. These should be merged.
P.S.S. And it was, while I was editing this message :lol


--------------------
Steven P. Underwood, DNRC
Whitinsville, MA
underwood+forum[at]spamcop.net

-No trees were killed in the sending of this message. However, a large number of electrons were terribly inconvenienced.-
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
btech
post May 26 2006, 02:36 PM
Post #9


Advanced Member
Group Icon

Group: Memberp
Posts: 447
Joined: 17-June 04
From: Texas
Member No.: 1895
Looks like the issue is resolved:
http://www.spamcop.net/sc?id=z954841646z30...e3af522e4f7972z
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Wazoo
post May 26 2006, 02:42 PM
Post #10


What Life?
Group Icon

Group: Forum Admin
Posts: 12892
Joined: 22-January 04
From: Iowa
Member No.: 18
QUOTE(btech @ May 26 2006, 02:36 PM) *
Looks like the issue is resolved:

Heh! As I was typing up the Announcement ... it looks like the code got rolled back .. as your last successful parse not shows;
SpamCop v 1.564.2.1 Copyright © 1998-2005 again ....
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
SpamCopAdmin
post May 26 2006, 03:25 PM
Post #11


Advanced Member
Group Icon

Group: SpamCop Staff
Posts: 792
Joined: 30-January 04
Member No.: 138
Something in the new code was broken and caused the parse to not send reports to abuse addresses.

The problem has been fixed and everything seems to be back to normal now.

Sorry for the freakout!

- Don D'Minion - SpamCop Admin -
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Wazoo
post May 26 2006, 03:25 PM
Post #12


What Life?
Group Icon

Group: Forum Admin
Posts: 12892
Joined: 22-January 04
From: Iowa
Member No.: 18
QUOTE(StevenUnderwood @ May 26 2006, 02:27 PM) *
P.S. Ther is another thread with the same complaint. These should be merged.
P.S.S. And it was, while I was editing this message :lol

Wish I could do the same thing in the newsgroups .. what a mess .. flashbacks to the "techy stuff to be handled over there discussions" ... geeze ....

Dang! Another problem ran into ... I was going to pull a listing of the crazy posting going on over there (in multiple newsgroups) but .... newsgroup archives are off-line .... am I the only one that cares about those things? wierd ...

Edit much later: bit toggled on my main machine, firewall "interactive mode" got turned off somehow, turns out that there was a bunch of sites that were "off-line" for a while <g>

Anyway, my reply "over there" that's sure to tick some folks off (copy from the spamcop.mail group as that covers the most ground) ....
QUOTE
Path: news.spamcop.net!not-for-mail
From: "WazoO"
Newsgroups: spamcop.mail
Subject: Re: Reporting system not reporting to source ISPs
Date: Fri, 26 May 2006 15:14:01 -0500
Message-ID: <e57ni9$2uh$1[at]news.spamcop.net>
References: <op.s96avxsxyax69d[at]qi>


"Mr. King of-my-forest Pin" wrote
in message news:op.s96avxsxyax69d[at]qi...
> Has anyone else noticed a problem with SC version 1.573? It appears
> that it was implemented late this morning, and now the only party I can
> report my spam to is the "Cyveillance spam collection." Even the
> responsible party for the source IP of the spam isn't listed at all.

The issue is that this wasn't a SpamCop E-Mail Account issue, so
traffic on this was seen in the spamcop newsgroup and the Forum.
As I posted into the spamcop newsgroup;

From: "WazoO"
Newsgroups: spamcop
Subject: Re: spamcop not reporting to abuse address?
Date: Fri, 26 May 2006 15:07:14 -0500
Message-ID: <e57n5i$2m2$1[at]news.spamcop.net>
References: <e57k7u$uar$1[at]news.spamcop.net>

"cwg" wrote in message
news:e57k7u$uar$1[at]news.spamcop.net...
>
> What? Not going to report the spam to the listed abuse address?

Forum Topic/Discussion, same subject:
Not sending reports to ISP!? Nothing to do
Staff Notifications sent
http://forum.spamcop.net/forums/index.php?showtopic=6436

Announcement posted
New Parsing code broken
- maybe fixed now?
http://forum.spamcop.net/forums/index.php?showtopic=6438

As seen, instead of making multiple posts, starting multiple
threads, a bit of analysis was applied, e-mail sent to the
necessary people ... code was rolled back before I got a
reply, but .. that's what one would like to have happen ...
issue seems to be resolved at the moment ....
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
StevenUnderwood
post May 26 2006, 03:49 PM
Post #13


What Life?
Group Icon

Group: Membersph
Posts: 5172
Joined: 20-January 04
From: Whitinsville, MA USA
Member No.: 12
As noted, we are back to the old code with it's problems (finding, but not reporting links).

http://www.spamcop.net/sc?id=z954938972ze7...3c43afcc9ebdc4z

I much prefer the current way (IMG:style_emoticons/default/ohmy.gif)


--------------------
Steven P. Underwood, DNRC
Whitinsville, MA
underwood+forum[at]spamcop.net

-No trees were killed in the sending of this message. However, a large number of electrons were terribly inconvenienced.-
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Wazoo
post May 26 2006, 04:10 PM
Post #14


What Life?
Group Icon

Group: Forum Admin
Posts: 12892
Joined: 22-January 04
From: Iowa
Member No.: 18
QUOTE(StevenUnderwood @ May 26 2006, 03:49 PM) *
As noted, we are back to the old code with it's problems (finding, but not reporting links).

Not sure what I'm missing .. I scrolled up/fown through that < span > crap .. but didn't notice another link in there (admitting that my eyesite and this monitor are not getting along)

Resolving link obfuscation
http://geocities.com/josetalhoganobles/
Host geocities.com (checking ip) = 66.218.77.68
host 66.218.77.68 = intl1.geo.vip.scd.yahoo.com (cached)
Cached whois for 66.218.77.68 : network-abuse[at]cc.yahoo-inc.com

Reports regarding this spam have already been sent:
Re: http://geocities.com/josetalhoganobles/ (Administrator of network hosting website referenced in spam)
Reportid: 1766277065 To: network-abuse[at]cc.yahoo-inc.com

If reported today, reports would be sent to:
Re: http://geocities.com/josetalhoganobles/ (Administrator of network hosting website referenced in spam)
network-abuse[at]cc.yahoo-inc.com

maybe a bad example?
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
StevenUnderwood
post May 26 2006, 07:37 PM
Post #15


What Life?
Group Icon

Group: Membersph
Posts: 5172
Joined: 20-January 04
From: Whitinsville, MA USA
Member No.: 12
I could have sworn it did not originally report the geocities link, but it has been a very long week here, so I will not swear to anything.


--------------------
Steven P. Underwood, DNRC
Whitinsville, MA
underwood+forum[at]spamcop.net

-No trees were killed in the sending of this message. However, a large number of electrons were terribly inconvenienced.-
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
btech
post May 31 2006, 12:52 PM
Post #16


Advanced Member
Group Icon

Group: Memberp
Posts: 447
Joined: 17-June 04
From: Texas
Member No.: 1895
I found a new HTML trick that the spammers are using to fool the parser:
http://www.spamcop.net/sc?id=z959721178zc8...65262a28b6528dz

The parser misses the link in this code:
CODE
</title><DIV class=RTE><FONT face=Verdana size=2><A href="http://www.timetohatekill.com">http://www.timetohatekill.com</A></FONT></DIV>


But not this code:
CODE
</title><DIV class=RTE><FONT face=Verdana size=2><A href="http://www.timetohatekill.com">http://www.timetohatekill.com </A></FONT></DIV>

The space between the closing href code is not allowing the link to be parsed... though it IS detected.

This post has been edited by btech: May 31 2006, 12:54 PM
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Wazoo
post May 31 2006, 06:09 PM
Post #17


What Life?
Group Icon

Group: Forum Admin
Posts: 12892
Joined: 22-January 04
From: Iowa
Member No.: 18
QUOTE(btech @ May 31 2006, 12:52 PM) *
I found a new HTML trick that the spammers are using to fool the parser:

Are you suggesting that you have an e-mail client that rendered this e-mail in HTML? There are no "Content-Type:" lines in the header, so technically this should be handled as plain text ....
QUOTE
From: "WazoO"
To: <deputies[at]admin.spamcop.net>
Subject: HTML URL not 'seen' by the parser
Date: Wed, 31 May 2006 18:21:05 -0500

Tracking URL
http://www.spamcop.net/sc?id=z959721178zc8...65262a28b6528dz

Brought up in a Forum discussion at
http://forum.spamcop.net/forums/index.php?showtopic=6436
(not sure why the user added to this Topic, but for now ...)

Issue is:
e-mail seems to be missing any Content-Type lines
HTML parse code not invoked as there is no HTML defined in header
Text part of parse sees the IB of Vonage sites, but not the payload URL
User states that adding a space before the HTML </a> closing tag
then results in the parser picking up the payload URL ...

So the "Text parse" code seems to be impacted by the HTML
wrapping of the payload URL ...????
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
btech
post May 31 2006, 06:48 PM
Post #18


Advanced Member
Group Icon

Group: Memberp
Posts: 447
Joined: 17-June 04
From: Texas
Member No.: 1895
Possibly... this was received in my Hotmail, but I manually copy and paste the message content, if that matters. I don't believe I've come across this issue in my SCMail, but I can't see how the text of a href link would prevent the actual coded link from being picked up.
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
« Next Oldest · SpamCop Reporting Help · Next Newest »
 

Reply to this topicStart new topic
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:

 

- Lo-Fi Version Time is now: 31st July 2010 - 09:01 AM
Invision Power Board - Apple IIGs Powered © 2010  IPS, Inc.