Jump to content

groupw@spamcop.net

Members
  • Content Count

    19
  • Joined

  • Last visited

Everything posted by groupw@spamcop.net

  1. groupw@spamcop.net

    Held email returns

    I've been using SpamCop for a long time, and I just opened a new SpamCop account. When I select Held Email, I get the list I'm accustomed to seeing. And when I select one or more items and choose Delete or Quick-Report Immediately and Trash, then Release/Delete selected messages, I get, after the normal pause, the list showing that the requested action was taken for each of the selected messages. All ok so far, just as it's always worked. The problem is, that the same list of messages, with check boxes and same message numbers, appears again below the list of actions which were taken. If I recheck them and delete them again, the same thing happens -- there they are again. There are now more than 100, so there's no way I can access any message above number 100, since I can't get rid of the first 100. I have set up a trash folder. I assume this problem is because of some option setting I've failed to make correctly. What do I need to do to get the deleted messages out of the held email list?
  2. I've searched and searched the detailed forum FAQ for the answer to a simple question about forum use, but can't find the answer anywhere. But I also can't find any forum category which seems appropriate for posting questions about forum use. If there is such a section, could that be made a bit more clear in the forum section description? If there isn't, I think it would be a great service to create one.
  3. groupw@spamcop.net

    Held email returns

    Thanks, but I'll just pursue this with support. Although it's slow, it has been effective and not nearly as abrasive, time consuming, and frustrating as this forum. Not wanting to get my wrist slapped yet again, I carefully read the FAQ to find out how to request a name change. It explains in detail that a PM must be sent, and what the PM must contain. But a lengthy search failed to reveal where to send the PM. (I'm sure it's there somewhere. But I couldn't find it.) So I went to post a question about where to send the PM but couldn't find any category in this forum where it's appropriate to ask questions about using the forum. I ended up making a posting in the suggestions category that such a category be made. So after the category is made, I can (maybe) find out where to send the PM, after which I could request a name change. I did learn that I'm forbidden to create a new forum account (even though I paid for two SpamCop accounts). This is way more frustrating than it's worth, and I just don't have the time for this. I'm quite obviously not bright enough to participate here, and so far all I've done is waste the valuable time of the folks who do take the time and trouble to try and answer questions. So I'll let you spend your time more productively helping those folks who are able to benefit from it.
  4. groupw@spamcop.net

    Held email returns

    Wow, I'm having a terrible time communicating. Those are exactly the two controls I've been trying to describe. The checkbox under the paste-in window ("Show Technical Details") is unchecked, and the "Simple Output" radio button -- NOT the "Show Technical Details" button -- is selected.
  5. groupw@spamcop.net

    Held email returns

    The second sentence in my recent posting says, The "Show Technical Details" box is unchecked, and the "Simple Output" button is selected in Reporting Preferences/Show Technical Details. I read the forum topic you referred to some time ago, and I can't see any reference to any preferences other than the ones I've set and/or checked. But it sounds from your response that I must have missed one. Would you please be so kind as to tell me exactly what preference I need to set, other than the ones I mentioned in my recent posting and re-quoted above?
  6. groupw@spamcop.net

    Held email returns

    I see full technical details every time I submit a spam for parsing/reporting, and I can't turn it off to get the simple output. The "Show Technical Details" box is unchecked, and the "Simple Output" button is selected in Reporting Preferences/Show Technical Details. This behavior started when I got a new SpamCop account -- I didn't have this problem with the old account. All messages I've submitted with the new account (around 30 - 40 so far) have displayed full technical details, so the problem isn't a single defective submission or two, and I haven't changed the way I collect or submit messages. I've looked over the FAQ pretty thoroughly, and don't see any other option setting I've overlooked, but there might be one. If so, does anyone have a clue what it is? Thanks!
  7. groupw@spamcop.net

    Held email returns

    SpamCop support has fixed the problem. I was told that the web mail trash folder, even after I had caused it to be created automatically, had the wrong name. My mistake must have been to create one manually first -- maybe that name persisted after I deleted it and had the system create it automatically.
  8. groupw@spamcop.net

    Held email returns

    I see it was carelessness as well as ignorance which made it necessary for me to change my user name. I'm guilty as charged. So I guess I deserve this problem. Sorry, my intent wasn't to report this as another problem -- I've always had better success sticking to one at a time. I mentioned it only because I thought (apparently incorrectly) that it might have some bearing on the problem I was reporting by showing some setup problem, for instance. It is interesting that I never saw the detailed analysis for any messages with my old account, and I'm seeing it with all messages for my new account. If it's caused by some problem with the submitted spam, then the 20 or so spams I've submitted so far with the new account all have some kind of problem, while the hundreds I submitted before I changed accounts virtually never did. But I'll pursue that later, after this one is resolved. In the meantime, it's just a matter of having to scroll down each time the report for a pasted message appears.
  9. groupw@spamcop.net

    Held email returns

    Thanks for the suggestion. Unfortunately, it didn't fix the problem. Messages deleted in webmail are in the (now new) trash folder, as they should be and as they were when I had created the folder myself. But messages deleted in the VER system still remain. I sent an email describing the problem to SpamCop support four days ago, but haven't gotten a reply yet. If I don't get any response in a few more days I'll try the deputies. Ironically, this all came about because of my ignorance in joining this forum some time ago. When signing up, it asked for my user name, so I gave my full SpamCop user name which I assumed was required. I was surprised to find it conspicuously shown with each of my postings, and as I feared, the spammers soon found it. The amount of spam sent directly to that address has been steadily increasing, so I decided to change my SpamCop user name. Because of the difficulties of coordinating my forwarding with a name changeover, I decided (wrongly) that it would be easier to get another SpamCop account, change over the forwarding, then cancel the old account or let it expire. I'm still trying to get back the functionality I had with the old account. So I recommend to anyone else anticipating a user name change not to do what I did. If your old account is working ok, hang onto it! One additional bit of information. I don't know if this is related and provides any clue or not. When I use cut-and-paste reporting, I can't get the non-verbose option to work. Every time I submit spam for analysis, I get the full detailed technical report. Selecting the brief report format in Preferences has no effect. It worked as it should with my old account.
  10. groupw@spamcop.net

    Held email returns

    That's very interesting. Unfortunately, even after I created a trash folder, reported messages in webmail as spam, and deleted messages from my held email box in webmail, the problem remains.
  11. groupw@spamcop.net

    Held email returns

    Thanks! I tried the webmail system, and the reported items disappeared from the list as they should. Guess that's how I'll have to do it from now on. One thing I really miss is that I used to be able to see the SpamAssassin score, or the blocklist which caught the message. I've found this to be a valuable tool when scanning for false positives. Is there any way to display this information in webmail?
  12. groupw@spamcop.net

    Held email returns

    "SpamCop Email System for Individuals". I think it's the same kind I've had for several years. At least, that was my intent. The latter. Firefox 2.0.0.6. It was working fine with my previous account. At http://webmail.spamcop.net/horde/services/...ver&app=imp I selected "Create a new trash folder" and made one with name "trash". It now shows "trash" as the trash folder. Thanks! Sorry it's so complicated. I had assumed that the setup would be simple and straightforward.
  13. groupw@spamcop.net

    Under attack?

    I apologize for mistaking your motives. Because none of your responses were helpful, and either referred to or gave information that's pretty much incomprehensible to me, I assumed that you weren't really trying to help. I see now that you really were, but just greatly overestimated my knowledge and ability. Putting the situation in terms more familiar to me, it's something like this: Someone posts a question on an antenna newsgroup saying his TV picture is noisy and what can he do about it. I respond by posting some links to integral equations for calculating antenna self impedance, and tell him how a spectrum analyzer can be used to determine the bandwidth of the television signal. When he expresses confusion about this, I give him a set of tranmission line equations and some information about calculating and measuring receiver noise figure. Now, if I'm actually trying to help, it certainly won't be obvious to the poor guy who posted the question. I probably did impress him with how much we engineers know about such things, and how little he knows in comparison. But he still won't have a clue about why his TV picture is noisy. If the newsgroup is one normally dealing with highly technical matters, his posting was probably inappropriate. But someone should have extended the courtesy of pointing him to some group more oriented toward consumers, assuming no one wanted to stoop to explaining things on his level. It looks to me like I'm in the wrong place here, since the assumed knowledge level is way above mine. That would explain why you assumed your postings would be helpful to me, while in fact they weren't. I apologize for coming, and for taking up time which could have been spent helping people who can benefit from your knowledge. I'll get back to the groups where I'm one of the folks who knows the subject matter, and where I can hopefully help others who don't -- and let you get back to helping the folks who are knowledgeable enough to benefit from your postings. I fully agree with your decision not to waste any more time on me. I appreciate your effort. Thanks for taking it. Roy Lewallen
  14. groupw@spamcop.net

    Under attack?

    I'm sure that anyone with a modicum of knowledge, skill, and spunk, would look at all that and say, "Of course! Now I know exactly what to do! Thanks, Wazoo!" It's also apparent that anyone who has no idea what it all means, isn't worth even a few words of explanation. So all the posting does is to further impress me with how much you know and how little I do. Assuming that was why it was posted, it was a success. I get the message -- if you don't understand this, don't even bother to ask. The experts have more important things to do. I'll leave you alone now. Roy Lewallen
  15. groupw@spamcop.net

    Under attack?

    The ROSKO listing doesn't look like the same person -- the only point of commonality I could find was the first name. Everything else appears to be different. It looks like several, if not all, of the URLs used by the spammer have the IP address 221.11.133.67. I was able to do a tracert on it, but don't know how to interpret the results. I looked over quite a few of your earlier postings about determining the upstream provider, and see that I'm very, very much out of my depth. I see talk about collection points, adjacent AS, BGP tables, and a whole pile of other terms whose meaning I don't have a clue about. As Miss Betsy accurately pointed out, you people who know how to do this don't have the time to do it for us clueless folk -- there are just too many of us and too few of you. And it looks like it would take a really extended period, months maybe, of learning the details of Internet protocol and web structure to even begin to figure out how to do it myself. So, I guess the only practical option for me is to grin and bear it. Sooner or later, I hope, the spammer will piss of somebody who has the knowledge and skill to do something about them. In the meantime, the web pretty much belongs to the spammers. Thanks very much for your time and patience. I appreciate it. Roy Lewallen
  16. groupw@spamcop.net

    Under attack?

    Once again, my error -- sorry. But am I going in the right direction in trying to track down the host of the spamvertized web site, or should I backtrack, run a bunch of the spam headers through SpamCop, and post the tracking URLs? As I mentioned, running them through SpamCop gives a different origin for nearly every one, while the spamvertized web sites all seem to point back to the same person. But I don't know how to proceed beyond what I've done, and don't yet know who the host is, except maybe the nameservers NS6.DNSISGREAT.COM and NS4.4GREATDNS.COM, which I can't seem to get any more information on except that they're registered by gandi.net. A google search of "Ruslan Yavorenko" (the registree of the spamvertized web sites) brought this very interesting URL: http://eclecticdjs.com/mike/spam/spam-11-04.html. Apparently this spammer uses a large number of web sites, and quite a variety of names. Can anyone suggest how to proceed from here? Roy Lewallen
  17. groupw@spamcop.net

    Under attack?

    Guilty as charged -- I apologize. I see what you're getting at (I think) is that I shouldn't be looking at the source of the spam, but rather what SpamCop calls the "spamvertized web site" -- I admit I wasn't familiar with the term "tracking URL" but some web research indicates that's what it is. Anyway, that makes good sense -- thanks! So I looked at some of the bounces that contained the full spam message and dug out the URLs the spammer has listed for responses. Here are the ones from three of the messages: http://dexcellences.lvsdfbefd.info/3/ http://dcoteline.lobjxndfe.info/3/ http://dregimentation.lavnfjefs.info/3/ http://dpharisee.lavnfjefs.info/3/ http://dsafemaking.lvsdfbefd.info/3/ http://daphrodisian.lvsdfbefd.info/3 http://dautobiography.lavnfjefs.info/3/ http://dsphygmophonic.lobjxndfe.info/3/ http://dunscourged.lzogfefdf.info/3/ http://dmicrophotograph.lavnfjefs.info/3/ http://doverfamiliarity.lavnfjefs.info/3/ http://dtobaccoman.lzogfefdf.info/3/ Here's where my ignorance really shows, and where I can use some help. I did a whois on several of these (e.g., lvsdfbefd.info, lavnfjefs.info, etc.), and all are registered to a Ruslan Yavorenko in Leningrad. The nameservers are NS6.DNSISGREAT.COM and NS4.4GREATDNS.COM, and those are registered by gandi.net. The gandi.net website says they're just a registrar and don't do anything about spam. Attempts to reach dnsisgreat.com and 4greatdns.com brought back a "cannot reach" response. Seems I need to find the domain host and send a complaint to them, but I don't think I know it yet. I'll be perfectly willing to do the grunt work if someone can point me in the right direction, either something to do next, or a place where I can read and learn what to do. Thanks! Roy Lewallen
  18. groupw@spamcop.net

    Under attack?

    Sorry. I wrote: "using the SpamCop parser on headers from the spam appearing in some of the bounce messages . . " which I thought was clear. I'll try again. Many of the bounce messages contain a copy of the header from the spam message. This included the forged "From:" line containing my email address, plus the remainder of the header. (This is what I meant by "headers from the spam appearing in some of the bounce messages".) I copied this header from the bounce message and ran this through the SpamCop parser to get the results I posted. (For convenience, I used messages that had gotten through my SpamCop spam filtering into my ISP inbox. Most of those don't include a copy of the spam itself, because the filter catches most of the ones which do. So I appended a few characters to the spam header to serve as a body so the SpamCop parser would accept it.) I wasn't intentionally vague. I just underestimated the ability of readers to read what I wrote and believe it meant what it said. I keep forgetting that it's necessary to say things in at least two or three different ways, then repeat again after the first group of responses. If it's still not clear, I'll try to say it in yet other words. If you or anyone else thinks that posting some of the spam headers to spamcop.spam or elsewhere would help (that is, if anyone can use the headers to find a single real source for the spam), I'll be glad to post a half dozen or so. And I'd be interested in how it's done. I really would appreciate any help I can get in stopping or reducing this onslaught. Roy Lewallen
  19. groupw@spamcop.net

    Under attack?

    I was directed here from the spamcop.help newsgroup. I'm having the same problem -- a large number of bounced spams because of my email address being forged in the From or Reply-To line. When this happened in the past, the volume was low and it faded out in a few days. But this time it's been going on at high volume for about 6 weeks now, and increasing if anything. I'm currently up to about 150 per day. I looked at the suggestions for tracking down the source, but using the SpamCop parser on headers from the spam appearing in some of the bounce messages gives a different source for nearly every one -- the first six I parsed showed the source as: kornet.net (2) telesp.br grupohevi.com.mx jazztel.com verizon.net So it looks like they're coming through open relays or some other indirect path. All the spams seem to be peddling the same stuff -- on-line meds -- so it's a good guess they're all from the same spammer. Any suggestions as to how to track the turkey down?
×