So I'm not getting much more than "we'll look into it" from e-mail so I'm posting this here. We signed up for all of our active allocations. And faithfully, I get an e-mail every few hours with "IPs reported in the last hour"

So we've had about two dozen IPs show up there, but I've gotten about 4 reports in the last month we've been signed up. Impossible to investigate without having the reports, this hourly thing is starting to just get ignored by the abuse staff.

Someone clue me in on how to actually see all of these reports?

Reports about what?

It sounds as though you might have done what you were supposed to in order to get spamcop reports sent to your abuse address instead of your provider or somewhere upstream. But then later you say that 'email' just says 'we'll look into it' which sounds as if you are dependent on someone else's server to send email.

However, you will have to give more details.

I don't think that spamcop sends reports every hour so you may not be posting to whatever service you signed up for.

Are any of the IP addresses you are talking about listed in the spamcop blocklist? If you can't find out how to determine this, post the IP addresses and someone will tell you.

You might try reading the FAQ to see if you are in right place.

As soon as a moderator comes along, this post will be moved, I am sure, since it doesn't have anything to do with Geek/Tech things. There is a forum for the SpamCop Blocklist, but since you are so vague about what the problem is, the moderator might decide to move it to the Lounge. It really isn't at all clear that you are talking about SpamCop at all. Maybe that's why you posted in this forum?

Miss Betsy

...From what I understand, the SpamCop staff are very busy due to some unusual activity this week. I'm sure they do intend to get back to you but it may be a bit longer....You are referring to reports to your SpamCop ISP account, correct?...Hopefully, the following SpamCop FAQ article and other user's threads will help answer your questions:

• How do I register an abuse@ email address?
• ISP account - how to get details of reports?

If anything here still leaves you with a question in your mind, please pop back in here to ask them as follow-ups. Thanks!
...Since I am not certain that this thread does not belong here, I am not moving it. If another Moderator or our Admin thinks it should be moved, they may do so.

Have you logged into your ISP account? Have you entered the IP address of your mail servers into the search form and select Find Reports? Have you clicked the "reporting details" link? Have you clicked the link in the report ID which brings you to the "Abuse report response center"?

You then have these options:
Please select one..
This spam outbreak has been stopped.
This message did not originate from the above address.
This issue is under investigation.
I am not the right person to contact about this.
This message is not spam.
Add a note to this issue.

(and yes, I actually sent a report on my own server to walk through this issue.)

Miss Betsy, I am glad you are trying to help but PLEASE stop assuming that we're some little shop at the end of the line blah blah blah. We _ARE_ the provider, we are the top of the heap, not the bottom. I meant exactly what I said, really.

Every few hours we get

From: summaries[at]admin.spamcop.net
Subject: Alert
Date: December 15, 2005 4:37:06 PM PST
To: abuse[at]svcolo.com

IPs reported in past hour:
205.217.153.43
64.13.132.143
209.157.144.2
205.217.153.222

Very nice, IF we were also getting the spam reports associated with those entries!

[quote=turetzsr,Dec 15 2005, 05:47 PM]
...From what I understand, the SpamCop staff are very busy due to some unusual activity this week.
I'm sure they do intend to get back to you but it may be a bit longer....[/quote]

I've been waiting several months for this to get fixed. Not weeks.

[quote=turetzsr,Dec 15 2005, 05:47 PM]
You are referring to reports to your SpamCop ISP account, correct?[/quote]

...Hopefully, the following SpamCop FAQ article and other user's threads will help answer your questions:

• How do I register an abuse@ email address?
• ISP account - how to get details of reports?

If anything here still leaves you with a question in your mind, please pop back in here to ask them as follow-ups. Thanks!
[/quote]

I have already read this. I registered the networks several months ago. I clarified that they were registered correctly. I have sent several queries about this, and keep being told that the networks are set up correctly and that I should be receiving these reports. But I'm not. Spamcop staff have investigated and confirmed that they haven't been sent (not a reception problem on my side) but somehow, this is not getting fixed.

No specific data provided from the beginning ... why get so excited about someone trying to fill in the blanks with just as generic responses?

Parsing input: 205.217.153.43
host 205.217.153.43 (getting name) = h43-rt.sv.meer.net.
Routing details for 205.217.153.43
[refresh/show] Cached whois for 205.217.153.43 : ipadmin[at]meer.net
Using abuse net on ipadmin[at]meer.net
No abuse net record for meer.net
Using default postmaster contacts postmaster[at]meer.net
Reporting addresses:
postmaster[at]meer.net

Third parties interested in reports:
abuse[at]svcolo.com

Reports routes for 205.217.153.43:
routeid:16609441 205.217.152.0 - 205.217.159.255 to:abuse[at]svcolo.com
Third party interested in all reports

Wednesday, November 16, 2005 11:20:26 PM -0600
[Note added by 70.64.153.98, 24.66.94.141 (S0106001195758c79.ss.shawcable.net)]
Route added without comment

http://www.senderbase.org/search?searchString=svcolo.com
Date of first message seen from this domain 2005-11-14
-=-=-=-=-=-
Parsing input: 64.13.132.143
host 64.13.132.143 (getting name) no name
Routing details for 64.13.132.143
[refresh/show] Cached whois for 64.13.132.143 : abuse[at]meer.net
Using abuse net on abuse[at]meer.net
No abuse net record for meer.net
Using best contacts abuse[at]meer.net
Reporting addresses:
abuse[at]meer.net

Third parties interested in reports:
abuse[at]svcolo.com

Reports routes for 64.13.132.143:
routeid:16609440 64.13.128.0 - 64.13.191.255 to:abuse[at]svcolo.com
Third party interested in all reports

Wednesday, November 16, 2005 11:20:26 PM -0600
[Note added by 70.64.153.98, 24.66.94.141 (S0106001195758c79.ss.shawcable.net)]
Route added without comment
-=-=-=-=-
http://www.senderbase.org/?searchBy=ipaddr...g=64.13.132.143 - listed on other BLs

12/15/05 21:42:34 whois svcolo.com
whois -h whois.opensrs.net svcolo.com ...
Registrant:
meer.net LLC
P.O. Box 390804
Mountain View, CA 94039
US

Domain name: SVCOLO.COM

Administrative Contact:
Giannandrea, John hostmaster[at]svcolo.com
P.O. Box 390804
Mountain View, CA 94039
US
+1.888.844.6337
Technical Contact:
hostmaster, meer.net hostmaster[at]meer.net
P.O. Box 390804
Mountain View, CA 94039
US
+1.8888446337 Fax: +1.6506181482

Registration Service Provider:
Meer.net LLC, support[at]meer.net
888-844-6337
650-618-1482 (fax)
http://www.meer.net/
P.O. Box 390804
Mountain View, CA 94039
USA

Registrar of Record: TUCOWS, INC.
Record last updated on 11-Aug-2005.
Record expires on 08-Nov-2006.
Record created on 08-Nov-2004.

Domain servers in listed order:
NS.MEER.NET 140.174.164.2
NS2.MEER.NET 216.206.136.2

no abuse.net listing, reports going to registered Domain contacts, ???? your working relationship with them is ????

Two Topics stared within this Geeky Stuff Forum by the same user, but the other Topic includes comments from the Topic starter in "this" Topic that seems not to lnow what was said in both Topics .. confusing from this side of the screen ... if you actually have multiple people posting under the same (single) account, please stop this now.

Noting that you've responded to several posts, but seemed to have ignored the critical one from StevenUnderwood .. have you actually logged into the actual ISP Control Center? Are you able to accsss the data that should be present there?

They didn't try to fill in the blanks. They instead rewrote the question into a completely different question. And then used that standpoint to talk down to me. Rude, and not-useful.


I am the abuse contact there. As you would know if you looked at the mail archive and my repeated queries about this.


No, I asked three distinct questions, two of which have been closed without an answer. Apparently resolving problems with spam isn't in the interests of SpamCop.


You do realize that you have quoted above all of the information that proves that I logged into there. I (and many others) answer abuse[at]svcolo.com. Your quote above proves that we've registed this with you, and that our whois is maintained properly. And yet we aren't getting but 1 in 10, 20 ... I dunno how many reports we haven't gotten. Just these summaries of "in the last hour".

You know what, forget I asked. All my other queries were shut down (even though each was a valid question). People are continuing to ask "what is my IP?" and various other irrelevancies, when every post I've made has made it clear that we're the abuse contact helpdesk for many IPs. And Wazoo and others are just going through and closing off open topics ... for no reason clear to me.

Spam can be stopped by people working together to make it happen. It isn't going to be stopped by people playing power games, and having fun being rude to each other. I've de-listed all of our netblocks. This is a waste of time.

Please note that no one in the forum has any access to the "mail archives" Your communications with SpamCop staff via email is totally unrelated to the forum. SpamCop staff does on occasion pay a visit to the forums but not on a regular basis. The only information we have to work with is the information that you provide in your posts in the forum. Official support is provided via email only to SpamCop Staff.
Forum support is unofficial and provided solely by unpaid volunteers (including the Forum Admin). Please keep that in mind.
Being in the ISP business, I am sure you are familiar with the concept of problem escalation. You started with the escalated method (email to staff) which is fine especially in your situation. But you have now stepped backwards by posting in the forum (which is also fine). We will try to help, but the official help does not reside here.

One of your questions: "How to Get Detailed Reports for ISP Accounts"
Answer: contact SpamCop staff via email
Question: "How to let users know that it isn't spam?"
Answer: only one way, and that is to respond to the address provided in the reports. You say you are not getting the reports. The only way to fix that is to contact SpamCop staff via email.
Your are right, delisting is a waste of time unless the problem is solved first, and from what I understand, that is not the case.

I see that Don (one of the SpamCop Staff Members) is currently active in the forums tonight, maybe he will be able to provide the information that you need
Thank you for posting your problems, sorry we have been unable to help.

I believe you are simply making too many wrong assumptions. One more try, Section 8 - SpamCop's System & Active Staff

As in the above, I'm guessing that you seem to think that my (and other folks) volunteering time to try to help other folks out here includes access to other data handled elsewhere and under other people's control .... the only data available "here" about "your situation" is that which you provided "here" ...

Strange comment, but again, I'll assume that it's based on the misconception that I get a paycheck from SpamCop.net .... I know that the Topics I closed had comments that dealt with trying to get answers in this remaining "open" Topic.

Your WHOIS does not list you "correctly" as far as "you" recieving reports directly. This is why I posted that data, to show you that issue.

The third-party listing is yet another item poisoned by previouis spammer actions. A lot of folks won't check that third-party notification box as it has been used in the past by some spammers to track which spams made it through which ISP filters, identify spam reporters, etc.

Once upon a time, one could see all activity against a Domain or an IP address, but it was seen that spammers were using that same data to stay ahead of the SpamCopDNSBL listings, so that data was removed. The third-party reports used to be copies of the actual spam complaint, but once again, this data was being used to also 'game' the system, so the "Summary Reports" thing is now the method of tracking data.

The data behind all of that is only available directly to that small number of "staff" that you've been complaining about in your e-mail dialog .... but if you've got issues with folks here trying to help out, that may be your only option .. deal with those folks. Plain and simple.

Hmmm, exctly what do you find "unclear" in;
You will stop opening up miltiple Topics on the same subject area.
You will get back to answering questions asked of you, which would include some data that was not provided by your initial entry here.
You will note the user-to-user notices made at each Forum section entry page.
You will change some of the attitude displayed "here" .... or perhaps follow the suggested scenario of simply not "playing games" here and simply deal with the "paid" SpamCop.net staff via e-mail.

And as there is only the one Topic remaining open that actually has data provided to work with, this one will also be closed.

And in that same post in another of your Topics,
No specific data offered in any of your "Topic starting" posts .. just exactly why and how do you expect someone "here" to have any kind of a clue as to who "you" are or "the massive ISP that you are" might actually be identified as??

Technically, I've not a clue right now what "delisting all of your netblocks" actually signifies .. am guessing that you might mean removing of that "third-party interested" bit, but that doesn't do a thing as far as resolving your initial query of "how to get reports directly" .... that issue you've not appeared to have started to work as far as the 'fine details' go .... but again, guess that'll have to be between you and the "staff" that you've been complaining about ....

As Admin "here" the beating up of (volunteer) folks trying to help out will not continue. Not sure how to make that any "clearer" .....

Unfortunately, I was offline when this dialogue took place.

I appreciate other regular posters defending me, but it really is unnecessary. I am sorry that jrhett thought that my attempts to get him an answer were condescending. If I had been here, this would have been my reply.

"I am sorry if I was confused about the 'hourly' reports that you talked about. For some reason I thought only weekly summaries (from the mole reports) were sent. But then I was not sure that you were actually talking about spamcop services.

I should have explained that since I am technically non-fluent, my replies are not going to be specific but will simply point you in the correct direction. The 'techies' who can answer your questions always want lots of specific information before they will make a guess. The only thing I can do is point you to the FAQ. Since I wasn't sure what you were asking, I couldn't point you to a specific FAQ."

Although it sounds as though you won't be back to read this:

As far as I can tell from the rest of the topic, you are in charge of the abuse department of a 'large' internet service provider that oversees several netblocks. Neither you nor anyone in your department understand what spamcop does or how it works. You have gone to the spamcop web pages for ISPs and have signed up for third party reports which you don't understand. You have emailed someone in spamcop - probably the deputies and have not gotten an answer yet. The reports that you have seen you think are not spam, but you have not followed any of the avenues open to you to inform the reporter. But possibly they may really be spam because you have had to 'delist' your IP netblocks. Usually, you don't get listed on reports from one reporter. If there are more reporters, there may be a problem with list management. I won't suggest that you look at the How to Use Mailing Lists responsibly FAQ, because I am sure that you would consider it condescending (and since someone has already pointed you there, it either doesn't seem to be your problem or you are ignoring the advice.)

And now you are in the peer to peer Forum where users of spamcop help one another, and also people who have had encounters with spamcop because their email has been blocked. The peer to peer is somewhat misleading because some people who come here are simply end users and others are server admins or people with much experience with computers.

Usually those in charge of IP addresses know that in order to get information, they have to present certain basic facts about what they are doing. The ones who don't usually only have a web site on a large web host. I am sorry I was mistaken about your status.

I certainly hope that you get your 'email' soon. I don't think you will like those answers any better than mine.

Miss Betsy

Items in red and lettered highlighted by me.

a>Wazoo's quote of an email summary only shows you get the summaries. You may never have had to log into your ISP account to get those summaries started.

b>Are we only talking to YOU when we are answering jrhett or are multiple people using that personal login to the forums? That may be where some of the problems are coming from. Also be aware that having an account here in the forums is in no way associated with an account on the spamcop email system or the spamcop reporting system (including ISP accounts). The people you are conversing with here are simply other users of SpamCop.

c>Again, how could any quote by someone here "PROVE" you logged into a completely separate system?

d>If you had read the FAQ's, you would be aware that many people here are registered as moles to help protect their accounts from spammers. These mole reports ONLY contribute to the summary reports you get and the blacklist.

Now, if you will provide an IP for one of your servers, perhaps we can help you work through some of the problems.

OK, What is ONE of the IP's. Perhaps if we can work through actual facts for ONE account, we can show you where the problem is.
Because in the forums, you can ask more than one question in each thread. And all of your questions seem related, and NONE of them provide enough information for us to help you. I think all of these threads should be merged into one thread but they have each taken on a life of their own (which is what happens with multiple parallel threads and merging would make it all unreadable.Working together requires give and take. It requires you to answer the questions being asked of you.

Also, in one of your messages here you state we can look through the email archives. We have no email archives, this forum IS the archive. Any emails you have sent to spamcop are in spamcops archives. This is a user to user forum. We don't have all the information you seem to think we do. You really need to be in contact with the deputies[at]spamcop.net. They are overwhelmed by email at the moment so it will take some time.

Just to help you understand how the forum usually works (not that it is right) but it will help you get answers instead of going in circles.
Posters do NOT usually look a different threads by the same user and tie them together when making a reply, so information is one thread, which may be useful in answering a question in another thread is often missed. Information even found in the same thread, but posted much earlier in the thread may also be missed or not considered with replying. Yes it is a pain to keep repeating information and trying to do things the way we (tinw) do them here, but you will find that it yields much greater returns. I have copied information below that you previously had posted.Remember that summary reports are totally separate and independent from individual reports. You have apparently signed up for summary reports and are getting them. They will never included the additional information you are looking for. Full reports are sent to the "official" abuse addresses of the affected IP address as found in web based records. Reports can be sent to abuse addresses that are different that the "official" addresses as found by SpamCop, but they MUST be requested via email and the email must PROVE that the requester has a right to receive them. Just asking is not enough. Also reports sent are not in a one to one ratio to summary totals. Reports (detailed reports) are only sent on those messages that have been reported by users using full reporting or munged reporting. Mole reporting and spamtrap hits do not generate detailed reports but are reflected in the summary reports. Additionally, reports generated from munged reporting are NOT sent if the recipient has requested not to receive them. Each and every address or address block must be included in your request to receive reports. Since you have chosen not to reveal that information here, we can not provide any information as to where the reports are currently being sent. If you wish to provide that information we can at least tell you where they are going right now. But that is your choice. We (tinw) can not change where they go or add additional recipients to the list, only SpamCop staff can do that and it is only done via email. Staff is currently being buried with a 400% increase in email traffic. Also when responding to staff, do NOT assume that they have access to your previous emailed information. Make sure you include ALL the information again in any follow up messages (the easiest way is to be sure the previous messages are attached as a part of the reply) I hope that this helps a bit. If not, please feel free to ignore it. If you would like additional help from the forum users, please simply restate the question and include the related IP address information and we will try to respond with usable information. The SpamCop BL IS IP addressed based and without providing the addresses you need information on we will get nowhere. Please reread the post by Wazoo that has addressed some of the IP addresses listed above, if you have specific questions about his reply, please quote the confusing part and ask your question and we will try to explain. Click on the following small link to jump back to his reply

And to be specific about the IP's you did provide:

a>Parsing input: 205.217.153.43
Reporting addresses:postmaster[at]meer.net
Third parties interested in reports:abuse[at]svcolo.com

Report History:
--------------------------------------------------------------------------------
Submitted: Saturday, November 26, 2005 7:52:48 AM -0500:
RE: 0ffice XP - $79.95 REDEEM.msg.m1s_B
1566293809 ( 205.217.153.43 ) To: postmaster[at]meer.net
1566293806 ( 205.217.153.43 ) To: abuse[at]svcolo.com

b>Parsing input: 64.13.132.143
Reporting addresses:abuse[at]meer.net
Third parties interested in reports:abuse[at]svcolo.com

Report History:
NONE (meaning only spamtraps or moles have reported this IP)

c>Parsing input: 209.157.144.2
Reporting addresses:postmaster[at]meer.net
Third parties interested in reports:abuse[at]svcolo.com

Report History:
NONE (meaning only spamtraps or moles have reported this IP)

d>Parsing input: 205.217.153.222
Reporting addresses:postmaster[at]meer.net
Third parties interested in reports:abuse[at]svcolo.com

Report History:
--------------------------------------------------------------------------------
Submitted: Monday, December 12, 2005 7:35:54 AM -0500:
Returned mail: see transcript for details
1583605018 ( 205.217.153.222 ) To: postmaster[at]meer.net

Many people will NOT send to third parties as those reports have been known to go to spammers directly. You should be able to get this report by contacting postmaster[at]meer.net.

You may be able to get more information from deputies[at]spamcop.net if you can show you are responsible for the servers at those IP addresses. I suggest you make your emails to them a bit clearer than you did here providing as much information as you can so multiple messages are not required to answer your questions.

The SpamCop Parsing and Reporting System relies on lookups of abuse.net registrations to direct SpamCop Reports to where the ISP wants them to go, rather than to the ARIN (or other RIR) contacts or those contacts' postmasters. You appear not to have registered meer.net and svcolo.com with abuse.net. I strongly suggest that you do register all of your domains with abuse.net via How do I submit contact information for a domain?. Also, it would be helpful to know what became of the SpamCop Reports you were sent, which bore Report IDs 1566293809, 1566293806, and 1583605018.

Jeff, I am thinking that we are dealing only with abuse[at]svcolo.com and that meer.net is their provider so I'm thinking they only received report 1566293806.

I am also thinking we won't be hearing back from him again, as it has been quiet recently, though I hope we do.

True as far as I can tell, but that was also one of my questions .. what was the working relationship between them ... never responded to ...

I think it's one organization "meer.net llc" doing business as "Silicon Valley Colocation" and "svcolo.com". http://www.svcolo.com/ is "© 1994-2005 meer.net llc." and is advertised on http://www.meer.net/.

Just so that I know next time, the summary reports that come from mole reporting are sent hourly and consist of IP addresses that were reported that hour?

Are those reports just from moles or are regular reports included in the statistics?

I looked at the Google information about meer.net. They have been around a long time. Are we sure that person really was from there? It doesn't seem hardly possible that the abuse desk of a long time ISP wouldn't know more about how spamcop works.

Miss Betsy

Yes, but only if the "Hourly" Radio Button is Pushed under "Periodic Summary Reports" and "Frequency:" on the Preferences Tab OR if the "Hourly" Radio Button on the "Request Reports" Tab is Pushed for "Aggregate reports will be sent only if there is spam:" when specifically requesting Reports. The other Radio Buttons in both cases are "Never" and "Daily". Both cases default to "Daily".There appear to be separate columns for Mole Reports vs. Regular Reports vs. Spamtrap Receipts.Yes, the Post that created this Topic came from an IP Address with RDNS in svcolo.com in meer.net's NetRange 205.217.152.0 - 205.217.159.255 (CIDR 205.217.152.0/21).

Thanks for the information on what kind of statistical reports an ISP can get. I never paid attention because I never thought there would be any questions about them.

If he was for real, I think I will give Don a heads up that I have irritated another one.

Miss Betsy

Here is the text of the Daily Summary Report I got after I reported myself for this exercise. Again, this can be addedd to a FAQ. Too busy now to work it up.

[ SpamCop V1.514 Summary Report ]
-- See footer for key to columns and notes about this report --

IP_Address Start/Length Trap User Mole Simp Comments
RDNS

199.79.137.66 Dec 16 01h/0 0 1 0 0 marked resolved
mail.kopin.com.


-- Key to Columns --
IP Address: The numeric address.
Start: The first date (within the past week) that spam was
reported to have originated from the IP address.
Length: The duration of the incident in # of days
Trap: Messages received at traps.
User: Messages reported by registered users.
Mole: Messages reported by registered users who prefer to remain
anonymous.
Simp: Simple reports - messages submitted by unregistered users.
Comments: Notes reflect blocking-list status and issue-resolved status.
RDNS: Reverse dns name of ip address (must pass forward and reverse)

-- Summary Report Notes --
o All times are GMT, exact time of incident withheld.
o Time of this report is: Fri Dec 16 20:15:20 2005
o To close an issue, or get more details, log into your account:
http://www.spamcop.net/
o Issues are sorted with the newest reports first. Resolving new
issues first heads off additional spam from in-progress sources.
o This email is intended to be viewed with a fixed-width font.
o This email was requested in your SpamCop preferences page - where
it may be disabled.
o This report is sent periodically, but only if there have been changes.