SpamCop Discussion > msg from spamcop appears to be spam?

Full Version: msg from spamcop appears to be spam?

SpamCop Discussion > Discussions & Observations > Mailhost Configuration of your Reporting Account

alexz@abv.bg

Dec 2 2006, 08:26 AM

QUOTE

ht tp://www.spamcop.net/mcgi - Sorry, all tests failed.

We cannot deliver mail to the address you provided: alexz[at]blhr.org. Double check the address provided or try again later. Your mailhost appears to be offline.

Detailed errors:

Connecting to mail.step-in.biz.:
smtpSend:smtpEnd: message transmission failed: 552 Sorry, this message appears to be spam (#5.6.0)

Sometimes, mailservers are temporarilly unavailable. If you believe you have entered your email address and other details correctly, you might just wait a few minutes (or 24 hours) and try again.

I sent a ticket to that host, from what I have found, their level of spam assasin is very low - 4, that is why, my wild guess is, it is rejecting mail from over here... what else I can do?!?

Wazoo

Dec 2 2006, 09:08 AM

As the link provided didn't actually go anywhere (due to only being a partial URL) I edited the starting post.
To my mind, this does not seem to be a Parsing/Reporting issue, guessing that it is in fact related to th MailHost Confoguration of a Reporting Account, so will be moving this Topic with this post.

There is no one 'here' that would have any idea/contol over your ISP's filter settings, and even the 'score of 4' can be generated many different ways. What is more likely is that a word filter is in use and it's triggering on seeing the word 'spam' ...???? Of course, based on so much spammer abuse of these 'new' Domain names, it's not that hard to conceive that step-in.biz may in fact have SpamCop.net specifically blocked ... no accusations, just years of previous experience showing here .....

Not said is whether you can whitelist any addresses. This and several other "lost, missing, bounced e-mail problems" are addressed in several FAQ entries found here.

alexz@abv.bg

Dec 3 2006, 04:03 AM

what is MORE strange to me - it worked for another mail at the same host! Mailhost name: blhr.org
Email address: hrlawye{_at }blhr.org
Hosts/Domains:
Relaying IPs: - I am not shure - should I paste the URL where I get that?!? http://www.spamcop.net/mcgi?action=mhedit;...hBtGlKbQd9jgZ4H - a little ammended - here it is...

10x!
Mailhosts - it is from my session - I will find and post the header of the message which passed thru the test!

Here it is!

QUOTE

Return-Path: <service
Delivered-To: hrlawyer
Received: (qmail 28279 invoked by uid 399); 29 Nov 2006 12:38:17 -0000
Received: from localhost by pns.step-in.biz
with SpamAssassin (version 3.1.7);
Wed, 29 Nov 2006 14:38:18 +0200
From: SpamCop robot <mhconf.x[at]cmds.spamcop.net>
To: hrlawyer[at]blhr.org
Subject: *****SPAM***** [SpamCop] account configuration email
Date: Wed, 29 Nov 2006 12:38:15 GMT
Message-Id: <wh456d7f37g104ba[at]msgid.spamcop.net>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on pns.step-in.biz
X-Spam-Level: ****
X-Spam-Status: Yes, score=4.0 required=4.0 tests=FORGED MUA MOZILLA,
FROM LOCAL NOVOWEL autolearn=disabled version=3.1.7
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------= 456D7F3A.D76C60F8"

------------= 456D7F3A.D76C60F8
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: 8bit

Spam detection software, running on the system "pns.step-in.biz", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.

Content preview: Hello SpamCop user, This email contains special codes
and tracking information to help SpamCop figure out your specific email
configuration. Do not post this email in public. It contains
confidential information related to the security of your SpamCop
account. [...]

Content analysis details: (4.0 points, 4.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
2.5 FROM LOCAL NOVOWEL From: localpart has series of non-vowel letters
1.5 FORGED MUA MOZILLA Forged mail pretending to be from Mozilla

NOD32 1888 (20061128) Information

This message was checked by NOD32 antivirus system.
http://www.eset.com

Moderator EDIT: Removed secret code

StevenUnderwood

Dec 3 2006, 03:24 PM

QUOTE

abv.bg' post='51665' date='Dec 3 2006, 04:03 AM']
a little ammended - here it is...

10x!

Not amended quite enough. I found 2 copied of your secret code in that message and replaced them with x, but you should probably request a new code from deputies[at]spamcop.net just to be safe.

alexz@abv.bg

Dec 11 2006, 01:55 PM

ok, will try it now

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.