petzl

Sounds like you have it you may be able to put "www.enchanter.net" after IP?

Your email server needs to stamp it's own IP (216.53.249.115) as well as the sending IP. The only IP it shows is the "From" IP. 106.75.87.56. This needs fixing More Information About Smtp Banner Check The SMTP banner issued by your email server did not contain the hostname we resolved for your server’s IP address. This also needs fixing (ask your ISP) as many services will discard email from you More Information About Smtp Reverse Dns Mismatch The forward lookup (A) of the hostname hostname did not match the reverse lookup (PTR) for the IP Address. Example of a correctly matching pair of records: (A) lookup for smtp.mxtoolbox.com resolves to 208.123.79.38 (PTR) lookup for 208.123.79.38 reverses to smtp.mxtoolbox.com

https://www.spamcop.net/sc?id=z6647673526z717f1b3f9f3bda2be59f7a5a44fe732ez Not stamping received IP only and only the from Botnet IP Your email server test https://mxtoolbox.com/SuperTool.aspx?action=smtp%3a216.53.249.115&run=toolpage Here is a older spam I parsed, the spammer is faking a Amazon IP but SpamCop picks it up https://www.spamcop.net/sc?id=z6646871784z9df15b8889614b273871f0e99d31a66fz

Showing a "SpamCop tracking URL" would help The only IP shown is a Chinese Botnet, You Chinese? https://www.abuseat.org/lookup.cgi?ip=106.75.103.146

Can you provide a SpamCop Tracking URL? I don't believe Hotmail provides a source IP, just the IP of their own email server.

Only staff might be able to access that link. I are just a SpamCop member.

As always a SpamCop tracking URL would help?

Thanks my poor eyesight did not pickup the spaces in IP https://mxtoolbox.com/SuperTool.aspx?action=smtp%3a173.249.157.30&run=toolpage Some problems with the email server SMTP TLS Warning - Does not support TLS. Means you need to change password often, your email can be easily compromised

That is not a traceable IP? Problem getting IP Address for 17 3.249. 157 .3 0 It does show as a web address? http://173.249.157.30/cgi-sys/defaultwebpage.cgi

17.128.115.105 17.171.2.60 both are Apple addresses yours? Scan your device 85.143.166.232abuse actuall abuse address is abuse[AT]comfortel[DOT]pro The address it is sent to has been coded into SpamCop two years ago?

I get auto-acks but no action, All the google redirects show the pornsite is down? https://www.spamcop.net/w3m?action=checkblock&ip=51.68.136.176 It's important to note that most of our services are rented "unmanaged" to our customers. This means that we only have physical access to the server and cannot access its content (no root, administrator, or user access). We are technically unable to modify or delete content, or making an abusive behavior stop by intervening directly on the server, as it is not managed by us.

probem with adding IP's/ providers to a blacklist is it becomes a political "sh*tlist Sometimes this is to me a good thing I would have "Namecheap" OVH China but that is not good thing to everyone!

this going through a internal network/intranet? Through email server Ecuador needs password change (no TLS) 190.152.46.226 no abuse address try CERT https://www.first.org/members/teams/#Ecuador From Botnet in India 106.210.0.13 https://www.abuseat.org/lookup.cgi?ip=106.210.0.13

51.79.145.214 is where it came from and reported correctly to OVH Add to notes Child porn spammer pictures under 18 or made to look under 18 NO PROOF OF AGE available! SENT TO MINORS

Can't log-in to paid reporting account from Australia? But can go here? https://www.spamcop.net/sc?id=z6640595520za6b456852b82bb903ea1937266b051bbz

2a01:111:e400:7ebd:0:0:0:51 abuse[AT]microsoft[dot]com If your email is going through a internal network it's hard to report?

Each country has a "Computer emergency response team" (CERT) which can override abuse desks. They often give a ISP a "hurry-up" order to get things fixed https://www.first.org/members/teams/ The problem is a lot of these addresses are run by companies just for their company, This creates confusion because many are not English and hard to differentiate between business and Government!

Probably email is too large, learn to truncate below the spam headers look at the bottom of spam shown in link below for word "Truncated" https://www.spamcop.net/sc?id=z6643015246zbc86c5610081722fba5bae72dba9b145z;action=display

Well I don't see the "received by" line Which should be followed with the "Received: from" vedicisland.com (vedicisland.com. [77.32.212.194]) As with this example (Gmail) https://www.spamcop.net/sc?id=z6643015246zbc86c5610081722fba5bae72dba9b145z

look at the abuse address Windows Freeware Whois program below, http://www.nirsoft.net/utils/ipnetinfo.html

thats normal you need to contact your ISP to get it to stamp it's own IP "received: by"? example belowhttps://www.spamcop.net/sc?id=z6643015246zbc86c5610081722fba5bae72dba9b145z Delivered-To: x Received: by 2002:a0c:9b89:0:0:0:0:0 with SMTP id o9csp1186644qve;

SpamCop has them ALL whitelisted/won't report them. So your mailhosts seem ok. Assuming you clicked add new hosts and received a email, to which you clicked the embedded link? https://www.spamcop.net/sc?id=z6642947923z6d9895034f835eced8ac22b50e215d41z Your ISP has not stamped it's own IP "received: by"? example below https://www.spamcop.net/sc?id=z6643015246zbc86c5610081722fba5bae72dba9b145z

Don't do them all just a few to website the rest via SpamCop handling abuse try their website https://www.ovh.com/world/abuse/ put in notes something like Criminal phishing, bogus reply address, bogus unsubscribe (NEVER subscribed), DDoS In windows to find registar of websiteI use this freeware program http://www.gena01.com/win32whois/ http://www.uhcphysicianfinder.com/main.html/z9zIiTTp 65.181.123.252 support[AT]dedicatednow[DOT]com Registrar Abuse Contact Email: mailto:abuse[AT]nameking[DOT]com

Came from 94.100.177.110 abuse[AT]corp.mail[DOT]ru Not seeing your received IP your receiving email server? Add/edit your mailhost configuration log in to SpamCop click TAB Mailhosts Before you Submit a spam Top of page is tracking URL - example https://www.spamcop.net/sc?id=z6642853265z193d6fb05ee9b701404ec2d508af48b0z

Not disagreeing However the worst I get is being listwashed