how to report this kind of spam? SC sends abuse to yahoo, but it's misleading.

p.s. i couldn't use quote or code tag for mail source code (( are they working?


Delivered-To: *****
Received: by 10.100.201.17 with SMTP id y17cs68468anf;
Thu, 30 Oct 2008 01:44:40 -0700 (PDT)
Received: by 10.150.121.3 with SMTP id t3mr8917708ybc.131.1225356280593;
Thu, 30 Oct 2008 01:44:40 -0700 (PDT)
Return-Path: <corneliusspurrial2554441[at]yahoo.com>
Received: from n8.bullet.re3.yahoo.com (n8.bullet.re3.yahoo.com [68.142.237.93])
by mx.google.com with SMTP id 6si1915233gxk.63.2008.10.30.01.44.39;
Thu, 30 Oct 2008 01:44:39 -0700 (PDT)
Received-SPF: pass (google.com: domain of corneliusspurrial2554441[at]yahoo.com designates 68.142.237.93 as permitted sender) client-ip=68.142.237.93;
DomainKey-Status: good (test mode)
Authentication-Results: mx.google.com; spf=pass (google.com: domain of corneliusspurrial2554441[at]yahoo.com designates 68.142.237.93 as permitted sender) smtp.mail=corneliusspurrial2554441[at]yahoo.com; domainkeys=pass (test mode) header.From=corneliusspurrial2554441[at]yahoo.com
Received: from [68.142.237.87] by n8.bullet.re3.yahoo.com with NNFMP; 30 Oct 2008 08:44:39 -0000
Received: from [216.252.111.168] by t3.bullet.re3.yahoo.com with NNFMP; 30 Oct 2008 08:44:39 -0000
Received: from [127.0.0.1] by omp103.mail.re3.yahoo.com with NNFMP; 30 Oct 2008 08:44:39 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 339748.58950.bm[at]omp103.mail.re3.yahoo.com
Received: (qmail 15577 invoked by uid 60001); 30 Oct 2008 08:44:39 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=Received:Date:From:Subject:To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID;
b=bXgHje4EBUoFzNNABBEB0E/EXc0sC4pBWE4sEdMLqzy8P0/ 2HC+QJ+mnFiGGKPSMeVe0vruKIRMqC003N31eJ+iXQZtoERMMzhkPHaibu9Lkm8HPpvfnBOH2CPiFc7R
WYzdQ4BwLCPS3bqnLWknuhhxXVqimhS9NUmvB+IFQD/o=;
Received: from [85.87.241.196] by web57410.mail.re1.yahoo.com via HTTP; Thu, 30 Oct 2008 01:44:39 PDT
Date: Thu, 30 Oct 2008 01:44:39 -0700 (PDT)
From: Cornelius Spurrial <corneliusspurrial2554441[at]yahoo.com>
Subject: seeix up your life her
To: daddieskitten1966[at]sbcglobal.ne
Cc: pcurrynew[at]aol.com, shineon[at]blueyonder.co.uk,
sjdhkj[at]gfhklj.com, acerroo[at]sbcglobal.net, ckroll[at]tmail.com,
bryanindelmar[at]yahoo.com, seancnd[at]hotmail.com, electroshy26[at]yahoo.com,
memo85_85[at]hotmail.com, tmthyis07[at]yahoo.com, martinezjr.alexander[at]gmail.com,
aaghtsbbddf[at]hotmail.com, aschwemmer[at]vjf.inserm.fr, airichiro[at]aol.com,
chstrfox[at]yahoo.com, kid-vargas[at]hotmail.com, naughty_alyssa21[at]hotmail.com
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Message-ID: <138732.14265.qm[at]web57410.mail.re1.yahoo.com>

mary cake round low rings ma hues mist.
google.com/notebook/public/05377497236356013399/BDQqXSgoQrbKf0dIj/?harkwerzrspillpewtyr2elbow

First of all, you are giving a sexually harassing spammer free publicity with the URL below. I hope a moderator will be along very soon to remove it! When posting an example it is always best to provide a tracking url than to paste even the spam header. Certainly the body of a spam should never be pasted. See here for instructions on how to obtain a tracking url.

To me as a technically non-fluent SpamCop user it is not clear what your problem is with reporting. I think you will need to explain it more clearly. Then technically fluent people will be along to help you with your problem, probably as dawn breaks on the shores of America (although certain Western Australian specialists may also find the time in their afternoon schedule...)

thx
fixed url
i don't know how to explain more clearly. SC recognizes only 1 source of spam - yahoo. but it's misleading recognition.

I think your problem is that you are not forwarding as attachment. I haven't read much of this topic, but StevenUnderwood says:


I also think that if you are not using Yahoo!Mail Classic, you don't have that option, but I am not sure on that point.

Miss Betsy

sorry, didn't get it completely )

let me explain in other words. spaamers are using techniques which SC can't process correctly. and i don't think it's possible to do automatically. i just need some recommendations hot to do it manually.

Usually people who are having trouble submitting spam are not 'forwarding as attachment' However, I see now why you were confused.

I think, for better advice, that you should post a Tracking URL (a definition can be found Here in the spamcop glossary)

I am not an expert at reading headers, but it looks to me as though the spam did come from yahoo. The parser may not have been able to pick up the IP address that posted to yahoo ( which I think is there).

However, if you get the Tracking URL, that would help people decide why the parser stopped when it did.

Miss Betsy

PS you can cancel the report if you have to submit it again to get a Tracking URL.

I'd be interested to learn how to forward as attachment using yahoo too!

So you know, they removed the pull down menu they USED to have. IT's gone.
And... using a mac, there is NO WAY to get any option to forward as attachment.
NO holding down command, (same as control on pc.) It doesn't work.

I've been through this with yahoo's live help. They confirmed that it does not work and "are working on it."

If there is any way to manually forward spam to spamcop again, I would love to know. It's been growing since yahoo "improved" their system.

Hi daizzy,

You are correct that the parser does identify a Yahoo! server as the source but it also appears that Yahoo! is the first mail server in the headers...

However, there does appear to be an IP for the originating PC at 85.87.241.196 which the parser didn't identify. There are better informed users than me around so perhaps someone can say why 85.87.241.196 isn't picked up. Interestingly the SenderBase score for this IP is poor (626%) and it is listed in dnsbl.sorbs.net, cbl.abuseat.org and pbl.spamhaus.org - but not the scbl.

For artmaker, there are other threads which I think have been posted previously for you which address the Yahoo! mail issue. It seems the new Yahoo! interface has dropped the inline-attachment option. You would need to switch back to the classic interface if you have that ability to gain the attachment option.

Andrew

Here is a parse of that data:
http://www.spamcop.net/sc?id=z2376517940ze...009998950373fcz
It seems to pick up host 85.87.241.196 = 196.85-87-241.dynamic.clientes.euskaltel.es which Andrew mentions.

We would need to see the O/Ps tracking URL to see why that didn't go the same way.

[On edit] Ah, I see, variable results! View the parse one time it says

QUOTE

If reported today, reports would be sent to:

Re: 85.87.241.196 (Administrator of network where email originates)

postmaster[at]euskaltel.es
abuse[at]t-ipnet.de
abuse[at]euskaltel.com

Processed by <!-- 05look $Revision: #1 $ produced by sc-app12 -->
View it another time, it says "No master" (Ah, how many times have I heard that? But I digress)

QUOTE

If reported today, reports would be sent to:

Re: 85.87.241.196 (Administrator of network where email originates)

nomaster[at]devnull.spamcop.net

<!-- 05look $Revision: #1 $ produced by sc-app10 -->

http://www.spamcop.net/mcgi?action=gettrac...rtid=3629351960

is it this one?

Ah no, you need to go one step further to get the tracking URL from the report ID (because only you and the paid SC staff can see the detail from the report ID) - see http://forum.spamcop.net/forums/index.php?showtopic=4498 for how to do it.

sorry

got it
http://www.spamcop.net/sc?id=z2375972949z6...f43617afbcda98z

Thanks!

What I'm going to guess at ..... Yahoo has added more e-mail servers to their server farm that have not been identified in the 'shared' MailHost Configuration database.

Possible actions: try to add this new data yourself by 'adjusting' your MailHost Configuration of your Reporting Account .... or contact Don/Deputies to get them to do a bit of manual updating to the same database.

Why I come to this probable conclusion: your Tracking URL lines;

1: Received: from [85.87.241.196] by web57410.mail.re1.yahoo.com via HTTP; Thu, 30 Oct 2008 01:44:39 PDT
Hostname verified: 196.85-87-241.dynamic.clientes.euskaltel.es
Possible forgery. Supposed receiving system not associated with any of your mailhosts
Will not trust anything beyond this header

The "receiving" system is in fact a Yahoo asset, but not found within the MailHost Configuration database.

Dig web57410.mail.re1.yahoo.com[at]208.67.220.220 ...
Non-authoritative answer
Recursive queries supported by this server
Query for web57410.mail.re1.yahoo.com type=255 class=1
web57410.mail.re1.yahoo.com MX (Mail Exchanger) Priority: 0 Malformed name

BTW: Quote is seen working at the top of this post.

no problem seen with the 'code' tags either. How are you trying to use them?

The difference between the parses (the genuine one above and my re-creation in linear post 9 further above) apparently comes about because of mailhosting, my test (and subsequent re-test) being with a non-mailhosted account. In this instance, I would prefer the non-mailhosted rendition (mine) which seems to indicate an entirely probable source (as Andrew points out) a but, alas, nothing can be done about that (other than manual reporting). The purpose of the mailhosting is to make it harder for cunning header forgeries to slip through the reporting and we can only bring it to the attention of the SC staff if we think it might have goofed in some specific instance in case there is some systemic problem with the parser logic/process. I am not really confident that it has goofed in this case but it does look so to me.

[on edit - ah, Wazoo suggests another possibility and some things the O/P can try]

Are you using Yahoo! Mail Classic (does it say that just above the 4 tabs)? I most certainly have the option as I used copy/paste to make my post earlier. I do use the free option... things may be different if you are using one of the paid versions either directly through Yahoo or from one of the other providers using Yahoo.

guys, i'm using only gmail, i don't know why u all are talking about yahoo ))

Relax daizzzy - we've diverged into two conversations (because Yahoo was in the headers) but thanks for confirming you're only involved in the original topic. Have you looked at Wazoo's response (further above) on the matter of mailhosting? Seems like it's time for you to contact Don - service[at]admin.spamcop.net - to see if there's something with the mailhosts setup that needs fixing. The rest of 'us' can't really see any other reason for your parse not drilling down to what we think is the actual spam injection. But Don knows all that stuff inside out.

Thx Farelf )

Daizzzy isn't a Yahoo user, so the Yahoo Mailhost isn't part of the problem.

The problem is that the Yahoo servers in his spam aren't included in our "Trusted Relays" database.

I added them to the list, and the parse is working correctly now.

- Don D'Minion - SpamCop Admin -
.

The issue is that there is another Forum user that hasn't quite got things sorted out on how to use this thing. So she unfortunately keeps jumping into other people's Topics/Discussion to toss in her issues with her use of Yahoo on a Mac. Then she seems not to ever follow-up, the appearance is that she can't find or simply doesn't look for her previous posts ... there are loads of questions that she's never gotten around to answering.

Yet another PM sent to her about her actions.

Thanks Don! daizzzy, if you pull up your (old) parse you will see that it automagically goes right down to the actual spammer now. Too late for that particular instance but any future handing by those Yahoo relays will be properly tracked through. Properly handled for everyone - including for those users who didn't even realise there was anything wrong. So your query has helped lots of people. Including the beleaguered network-abuse[at]cc.yahoo-inc.com. They ought to give you a medal!

Ah, synergy!

thx guys

SC works really great!

u know, at the beginning i started to use SC i thought that i'll need to redeem balance each 2-3 months. but now it seems like there still will be some money after a year ))

It is interesting that the topic starter of this topic titled: how to fight this kind of spam , insists on generating their own spam using the forum signature as the medium. The signature has been removed twice so far. We realize that there are not clear cut rules on what can be included in a signature, but there are limits and they will be inforced.

ok, no more signatures

but your policy is really strange for me.

my sig had nothing about spam, it was what was actual for me. i think it's about paranoia.

Inappropriate content is the issue involved.

It is your defination of spam that is strange. You signature was basicly a personal ad. It was requesting people to contact you. This is fine for personal forums. SpamCop is not a personal forum or blog. Starting a signature Looking for a partner from surfers community (prOn) for innovative great project (see profile). is spam as defined by this forum. You are sending an invitation to everyone who see you post. It is no different that had you sent it via email to everyone who uses the SpamCop forum. If you want to fight spam, you had better get a better understanding of what spam is. see the Wiki entry: spam

I am removing the signature I created for you which was: "Signature was deleted by a moderator as being unacceptable for this forum"

hey, i was and i am looking for THE ONLY ONE person i would like to call a partner. i launch really innovative 100% white and legal sites based on perfect idea and perfectly realized (what is completely unusual for the industry i work). my team spent over 8 months. the only trouble i expect is language problem. for that i need a buddy who would help me literally everywhere. on my board and here on SC too.
sorry for such long description about my needs, but the message i tried to represent was really personal for me.

i hate spam, i never spammed and will never spam. there're even threads on my surfers and webmasters boards about fighting spam using SC. should i ban myself on my forums for advertising SC?

i understand that SC board has its own rules and NOW i understand HOW SPECIFIC they are, not like most boards have. but don't make such humiliating comments (it concerns both of u). i simplified my sig after the first notification, the secound one in pm would be completely enough to understand that i can't have sig i like here.

there's no need in public drama for things that could be resolved in 1 or 2 PMs

i think the issue is resolved. u may delete all my and your posts regarding it.

I think the issue is that the signature is not related to spam and is 'advertising'.

spam, in my definition, is unsolicited and unwanted. This is a forum about spam and we try to keep everything on topic. We do have a lounge area where anything can be discussed. However, since we are 'educational', we do not want to have anything that a child could not view or that some parents would not want a child to see. Besides the topic of your signature, we don't allow crude language. We would not allow racist comments either. SpamCop Admin, the only paid employee of spamcop to post here, is also very much against any post being 'rude.' His definition of rude is even more strict than most of the posters.

The internet is a place of etiquette. Some forums may encourage their participants to contact each other and that's ok. However, our business here is to answer questions in a way that everyone can see the answers in case they have the same problem and we do not encourage posters to contact one another. And we definitely do not encourage 'advertising' - even personal ads.

Miss Betsy

btw, that's the last thing i want to tell
http://groups.google.com/group/Google_Webm...cf55a50b40cae77

that's my post on official google webmaster groups where i leaved a link to my site and just warned that adult content is there. and u know, nobody didn't guess to point me on a spam LOL

or u think that i spam google webmasters groups here? LOL

i don't want to joke on u, but i'll be really happy once u change your point of view on some things. some ppl are more expressive and some are less. and i think that's the reason in our issue.

C'mon John, let's have some honesty - you come here for help, you get it (and benefit a heap of other people too), that's great. That's what this site is all about. "We" are not about SEO points. If you didn't know that SC profiles aren't search engine indexed you would be perfectly happy just to have your website in your profile here too, wouldn't you? I don't think it is likely "we" are about to change our POV to suit you, (there are some resource/bandwidth issues in all of that too) but thanks for the invitation.

glad u like it

btw. that's my industry's leading board http://www.gofu**yourself.com/
i bet it'd be a hell for u )) just look at sigs there

and your attitude to me is the way u'd like to see me here. now i hear it like: work only, no fu**ing joy )
that's np. work is work.

updated
holly sh**
u even censure here

it sucks that i can't write * * * *

hey, guys, u definitely need some fun here. wanna some grass this evening? LOL

Moderator edit: Removed another word inappropriate for mixed company and younger audience which we get here from time to time. IMHO, you are asking to be banned here if you do not cut it out.

We are not out to censor the internet but THIS board is not an appropriate venue for your language.

Familiar with it already thanks. Topic there referenced by showthread.php?t=176038 is one of my alltime faves.

Incidentally I think the 'shocked matron/mom' masthead for those boards says more about your industry than you could ever explain. But maybe that's just me. And this is getting well O/T. We're not an 'adult site'. Deal with it.

would u read it more closely u'd notice that TS was banned there. dont bring messages out of context. mainstream industry doesn't tolerate spam of any kind, and thx to guys like me most of adult involved webmasters like SpamCop.

btw, have u seen the date over there? it's 2003 baby, it's 2003.

I know - that's why it's one of my favoritesI know - that's why/how come it's one of my all time favorites.

Seems you are quick to judge in accordance with your preconceptions buddy.

http://www.spamcop.net/sc?id=z2387672703z1...f196e93b262bdfz
Tracking message source: 76.13.13.80:
Routing details for 76.13.13.80
[refresh/show] Cached whois for 76.13.13.80 : network-abuse[at]cc.yahoo-inc.com
Using best contacts spamcop[at]mailservices.yahoo.com

Reports regarding this spam have already been sent:
Re: 76.13.13.80 (Administrator of network where email originates)
Reportid: 3643480133 To: spamcop[at]mailservices.yahoo.com

Moderator Note: This post and my reply have been merged from a new topic on the same (related) issue. Email sent to Don to notify of another instance.

You should not be sending reports that you know to be incorrect. Please be sure to confirm your reports before hitting the Send Reports button (unless you are using quick reporting, in which case you should stop for a while to be sure all your reports are working properly.

As mentioned in the "favorite thread" pointed to earlier, that is how incorrect reporting happens, when the reporter is not paying attention to where their reports are going.

As for your problem with this parse, you probably should have emailed the same person who helped earlier (service[at]admin.spamcop.net) since nobody here other than him can adjust the trusted addresses.

Message from Don tells me this parse is not working correctly.

Looks like he may have fixed it - and the spamcop[at]mailservices.yahoo.com persists, but as an "interested intermediary" this time and that would apprear to be a new 'special' address (since the opening of this topic a few days ago) - maybe to help track down any more "new assets" that Yahoo might bring online and which might require flagging as trusted relays?

Anyway, thanks to Don once more and thanks for presumed proactive moves.

that's this spam again:
http://www.spamcop.net/sc?id=z2388360140z0...126176b85c4c68z

Report spam to:

Re: 202.43.219.18 (Administrator interested in intermediary handling of spam)
To: spamcop[at]mailservices.yahoo.com (Notes)

Re: 41.219.210.179 (Administrator of network where email originates)
To: abuse[at]starcomms.com (Notes)

so SC recognizes not only Y already. btw i deselect it this time.

Great news, it is working - but I don't think you have to deselect Yahoo if they are shown asI think that indicates they have asked for the reports and it also indicates they are not going to have spam scores against their server. Only the originator gets a black mark, not the relay.

thx Farelf

it seems like today is my day

http://www.spamcop.net/sc?id=z2388654949z4...2ce52ca0bf1921z

Resolving link obfuscation
spam link removed
Host mnybewpibetl.net (checking ip) IP not found ; mnybewpibetl.net discarded as fake.
Tracking link: spamlink removed
No recent reports, no history available
Cannot resolve spamlink removed

Please make sure this email IS spam:
From: "Dan Lynn" <hyfqu[at]brains.com.pk> (Does 8 incches Enough 4 U)
------------9D3ECFFFF842CF
Content-Type: text/plain; charset=us-ascii
View full message

Report spam to:

Re: 213.123.113.14 (Administrator of network where email originates)
To: Internal spamcop handling: (bt) (Notes)

That one looks good to go - report or cancel but don't leave it 'open'- unreported/uncancelled (anyone can hop in and make mischief with it once you post the tracker) - the spamvertized site doesn't resolve, the 'neither permitted nor denied by best guess record for domain' wording is normal with Gmail transit IIUC.

sorry, yesterday i got tougher braces and now i expect awful headache.

i didn't cleared spamlinks from my previous post and now edit option is unavailable ((

thx Farelf, i reported it.

Not sure what you mean. Not necessary to edit spam submissions, in fact you effectively agree not to do that (the (no) Material changes to spam rule). It is OK if SC doesn't resolve the spamlinks, that one didn't resolve anyway - checking with nslookup (Windows) or equivalent - whole new topic, covered elsewhere in many posts (you can search these pages).

But generally, you can reload any parse - if, for instance the 'trusted relays' have been updated since first submission and you haven't submitted reports yet - just pulling it up from the "Unreported spam saved, report now" (whatever) link reloads/reparses too. You can also resubmit data from a cancelled report if you still have it or you can copy and paste the data from the cancelled report. Simply a matter of becoming aware of the facilities, takes time.

Hey, Farelf, do u have annoying braces too?

i was about my post where i copied part of report and didn't cleared http:// in spam links )

anyway thx for informative reply

Orthodontists
Look in my mouth
And weep.Ah, I see, thanks for taking care of that then.You're welcome.

it seems like these guys have found something new how to game SC:
http://www.spamcop.net/mcgi?action=gettrac...rtid=3656038587

Once again... we need a tracking URL to see what you are talking about. The link you provided only works when logged into your account.

http://www.spamcop.net/sc?id=z2396903140z6...48c82d5167fd4cz

Not sure what you mean by "it seems like these guys have found something new how to game SC:"
It looks like just one more Yahoo address that had not yet been updated in the SpamCop tables. The current parse reads:
Looks like the table has been updated since you reported it.

The bigger question is why did you send the report in the first place, instead of cancelling the report. If you were using Quick reporting, then you have no way to cancel a report, but the question still remains, that you knew SpamCop was having problems handing Yahoo intermediate servers. Based on that knowledge you should NOT be using QuickReporting at all, until you know that the basic problem has been fixed.