btech Posted May 26, 2006 Share Posted May 26, 2006 On the past 2 reports I've sent, the parser shows that reporting address of the ISP for the source IP, but the actual report only sends to the 3rd party. http://www.spamcop.net/sc?id=z954839818z87...e9ca43104796d6z Any ideas? Link to comment Share on other sites More sharing options...
manchot Posted May 26, 2006 Share Posted May 26, 2006 Same here. 2 spams, no message to ISP, no mention of the clearly present spamvertised URLs. Sumpin's gotta be broke! - Manchot Link to comment Share on other sites More sharing options...
btech Posted May 26, 2006 Author Share Posted May 26, 2006 I just noticed that too.. the URLs didn't parse either. Link to comment Share on other sites More sharing options...
Wazoo Posted May 26, 2006 Share Posted May 26, 2006 I just noticed that too.. the URLs didn't parse either. ???? There is no URL to parse ... payload is in a graphic .... As far as the reports .. agreed .. e-mail sent From: "WazoO" To: "SpamCop, Argyle" Cc: "SpamCop, Deputies" Subject: SpamCop v 1.573 is broken Date: Fri, 26 May 2006 13:40:33 -0500 The parse results it for spam source are not listed as choices for sending reports. Strangely, only Cyveillence as a Third-Party shows up. Forum posting: http://forum.spamcop.net/forums/index.php?showtopic=6436 MailHosted Tracking URL: http://www.spamcop.net/sc?id=z954839818z87...e9ca43104796d6z Non-MailHosted Account Tracking URL: http://www.spamcop.net/sc?id=z954862692z95...da09e992a9b316z SpamCop v 1.573 Copyright © 1998-2005 No date offered, but in my documentation; 24 May 2006 - SpamCop v 1.564.2.1 Copyright © 1998-2005 Link to comment Share on other sites More sharing options...
mrbungle Posted May 26, 2006 Share Posted May 26, 2006 I have just tried to report 3 UCE in a row and the system came back with 'nothing to do' every time. Is there maintenance going on? Link to comment Share on other sites More sharing options...
bobbear Posted May 26, 2006 Share Posted May 26, 2006 I have just tried to report 3 UCE in a row and the system came back with 'nothing to do' every time. Is there maintenance going on? Me too - there seem to be reportable addresses parsed but no reports generated except for user defined/third party addresses. (Sorry - no tracking URL available). Link to comment Share on other sites More sharing options...
mrbungle Posted May 26, 2006 Share Posted May 26, 2006 I have one http://www.spamcop.net/sc?id=z954875957z0e...9104588ea7f234z Link to comment Share on other sites More sharing options...
StevenUnderwood Posted May 26, 2006 Share Posted May 26, 2006 Always on the long weekends....argh They must be telling me to take the weekend off from reporting Just to add more info, submissions at 6:30 AM EST went through. Those at 10:45, did not. Submitted: Friday, May 26, 2006 10:45:06 AM -0400: Re: Account # 03664457U No reports filed -------------------------------------------------------------------------------- Submitted: Friday, May 26, 2006 6:30:31 AM -0400: loongger -Carolina 1765699253 ( 58.81.74.131 ) To: postmaster[at]usen.ad.jp 1765699232 ( 58.81.74.131 ) To: abuse[at]usen.ad.jp P.S. Ther is another thread with the same complaint. These should be merged. P.S.S. And it was, while I was editing this message :lol Link to comment Share on other sites More sharing options...
btech Posted May 26, 2006 Author Share Posted May 26, 2006 Looks like the issue is resolved: http://www.spamcop.net/sc?id=z954841646z30...e3af522e4f7972z Link to comment Share on other sites More sharing options...
Wazoo Posted May 26, 2006 Share Posted May 26, 2006 Looks like the issue is resolved: Heh! As I was typing up the Announcement ... it looks like the code got rolled back .. as your last successful parse not shows; SpamCop v 1.564.2.1 Copyright © 1998-2005 again .... Link to comment Share on other sites More sharing options...
SpamCopAdmin Posted May 26, 2006 Share Posted May 26, 2006 Something in the new code was broken and caused the parse to not send reports to abuse addresses. The problem has been fixed and everything seems to be back to normal now. Sorry for the freakout! - Don D'Minion - SpamCop Admin - Link to comment Share on other sites More sharing options...
Wazoo Posted May 26, 2006 Share Posted May 26, 2006 P.S. Ther is another thread with the same complaint. These should be merged. P.S.S. And it was, while I was editing this message :lol Wish I could do the same thing in the newsgroups .. what a mess .. flashbacks to the "techy stuff to be handled over there discussions" ... geeze .... Dang! Another problem ran into ... I was going to pull a listing of the crazy posting going on over there (in multiple newsgroups) but .... newsgroup archives are off-line .... am I the only one that cares about those things? wierd ... Edit much later: bit toggled on my main machine, firewall "interactive mode" got turned off somehow, turns out that there was a bunch of sites that were "off-line" for a while <g> Anyway, my reply "over there" that's sure to tick some folks off (copy from the spamcop.mail group as that covers the most ground) .... Path: news.spamcop.net!not-for-mail From: "WazoO" Newsgroups: spamcop.mail Subject: Re: Reporting system not reporting to source ISPs Date: Fri, 26 May 2006 15:14:01 -0500 Message-ID: <e57ni9$2uh$1[at]news.spamcop.net> References: <op.s96avxsxyax69d[at]qi> "Mr. King of-my-forest Pin" wrote in message news:op.s96avxsxyax69d[at]qi... > Has anyone else noticed a problem with SC version 1.573? It appears > that it was implemented late this morning, and now the only party I can > report my spam to is the "Cyveillance spam collection." Even the > responsible party for the source IP of the spam isn't listed at all. The issue is that this wasn't a SpamCop E-Mail Account issue, so traffic on this was seen in the spamcop newsgroup and the Forum. As I posted into the spamcop newsgroup; From: "WazoO" Newsgroups: spamcop Subject: Re: spamcop not reporting to abuse address? Date: Fri, 26 May 2006 15:07:14 -0500 Message-ID: <e57n5i$2m2$1[at]news.spamcop.net> References: <e57k7u$uar$1[at]news.spamcop.net> "cwg" wrote in message news:e57k7u$uar$1[at]news.spamcop.net... > > What? Not going to report the spam to the listed abuse address? Forum Topic/Discussion, same subject: Not sending reports to ISP!? Nothing to do Staff Notifications sent http://forum.spamcop.net/forums/index.php?showtopic=6436 Announcement posted New Parsing code broken - maybe fixed now? http://forum.spamcop.net/forums/index.php?showtopic=6438 As seen, instead of making multiple posts, starting multiple threads, a bit of analysis was applied, e-mail sent to the necessary people ... code was rolled back before I got a reply, but .. that's what one would like to have happen ... issue seems to be resolved at the moment .... Link to comment Share on other sites More sharing options...
StevenUnderwood Posted May 26, 2006 Share Posted May 26, 2006 As noted, we are back to the old code with it's problems (finding, but not reporting links). http://www.spamcop.net/sc?id=z954938972ze7...3c43afcc9ebdc4z I much prefer the current way Link to comment Share on other sites More sharing options...
Wazoo Posted May 26, 2006 Share Posted May 26, 2006 As noted, we are back to the old code with it's problems (finding, but not reporting links). Not sure what I'm missing .. I scrolled up/fown through that < span > crap .. but didn't notice another link in there (admitting that my eyesite and this monitor are not getting along) Resolving link obfuscation http://geocities.com/josetalhoganobles/ Host geocities.com (checking ip) = 66.218.77.68 host 66.218.77.68 = intl1.geo.vip.scd.yahoo.com (cached) Cached whois for 66.218.77.68 : network-abuse[at]cc.yahoo-inc.com Reports regarding this spam have already been sent: Re: http://geocities.com/josetalhoganobles/ (Administrator of network hosting website referenced in spam) Reportid: 1766277065 To: network-abuse[at]cc.yahoo-inc.com If reported today, reports would be sent to: Re: http://geocities.com/josetalhoganobles/ (Administrator of network hosting website referenced in spam) network-abuse[at]cc.yahoo-inc.com maybe a bad example? Link to comment Share on other sites More sharing options...
StevenUnderwood Posted May 27, 2006 Share Posted May 27, 2006 I could have sworn it did not originally report the geocities link, but it has been a very long week here, so I will not swear to anything. Link to comment Share on other sites More sharing options...
btech Posted May 31, 2006 Author Share Posted May 31, 2006 I found a new HTML trick that the spammers are using to fool the parser: http://www.spamcop.net/sc?id=z959721178zc8...65262a28b6528dz The parser misses the link in this code: </title><DIV class=RTE><FONT face=Verdana size=2><A href="http://www.timetohatekill.com">http://www.timetohatekill.com</A></FONT></DIV> But not this code: </title><DIV class=RTE><FONT face=Verdana size=2><A href="http://www.timetohatekill.com">http://www.timetohatekill.com </A></FONT></DIV> The space between the closing href code is not allowing the link to be parsed... though it IS detected. Link to comment Share on other sites More sharing options...
Wazoo Posted May 31, 2006 Share Posted May 31, 2006 I found a new HTML trick that the spammers are using to fool the parser: Are you suggesting that you have an e-mail client that rendered this e-mail in HTML? There are no "Content-Type:" lines in the header, so technically this should be handled as plain text .... From: "WazoO" To: <deputies[at]admin.spamcop.net> Subject: HTML URL not 'seen' by the parser Date: Wed, 31 May 2006 18:21:05 -0500 Tracking URL http://www.spamcop.net/sc?id=z959721178zc8...65262a28b6528dz Brought up in a Forum discussion at http://forum.spamcop.net/forums/index.php?showtopic=6436 (not sure why the user added to this Topic, but for now ...) Issue is: e-mail seems to be missing any Content-Type lines HTML parse code not invoked as there is no HTML defined in header Text part of parse sees the IB of Vonage sites, but not the payload URL User states that adding a space before the HTML </a> closing tag then results in the parser picking up the payload URL ... So the "Text parse" code seems to be impacted by the HTML wrapping of the payload URL ...???? Link to comment Share on other sites More sharing options...
btech Posted May 31, 2006 Author Share Posted May 31, 2006 Possibly... this was received in my Hotmail, but I manually copy and paste the message content, if that matters. I don't believe I've come across this issue in my SCMail, but I can't see how the text of a href link would prevent the actual coded link from being picked up. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.