Jump to content

gnarlymarley

Membera
  • Content Count

    284
  • Joined

  • Last visited

Community Reputation

0 Neutral

About gnarlymarley

  • Rank
    Advanced Member

Contact Methods

  • AIM
    gn02020202
  • Yahoo
    gnarlymarley

Profile Information

  • Gender
    Male
  • Location
    utah, USA
  • Interests
    reporting spam

Recent Profile Visitors

1,768 profile views
  1. gnarlymarley

    Apple Mail SpamCop Reporting

    I have not used applescript since OS9, so I may not be of help, but this page (https://macscripter.net/viewtopic.php?id=30296) seems it looks a little bit familiar and may be of help. For me, what I do is to create a new email and then drag and drop all the messages I want to submit on that email. (Yes, you can do more than one attachment to the email you submit to your submit address.) Just make sure when you get the reply you can click all the links.
  2. gnarlymarley

    SpamCop isn't working right with Outlook.com

    Me too, so sorry about my late reply. I also noticed that some of the messages are coming in without proper line endings. How I am fixing it is to copy the message to notepad (on windows) and if I see no line wrapping, then I paste into word pad, then select all, and past into notepad. Once done, I remove the space on the lines in front of the words (Received:, From:, X-, To:, Subject:, and Reply-To:). The rest of the spaces should stay. Once I cleaned up with the above header lines, I paste into spamcop and it accepts my submissions.
  3. gnarlymarley

    SpamCop isn't working right with Outlook.com

    Jeff2019, i think I found the problem. I got an email today from in my hotmail's outlook.com account where it seems that microsoft decided to add an extra space to some of the headers. If you look at the below, the first received line is okay, but the second Received line has a space that is reserved for line wrapping. I don't like it when companies refuse to follow RFCs. Received: from MW2NAM10HT110.eop-nam10.prod.protection.outlook.com (2603:10b6:5:190::40) by DM6PR14MB2170.namprd14.prod.outlook.com with HTTPS via DM6PR11CA0027.NAMPRD11.PROD.OUTLOOK.COM; Tue, 12 Nov 2019 12:00:39 +0000 Received: from MW2NAM10FT066.eop-nam10.prod.protection.outlook.com (10.13.154.53) by MW2NAM10HT110.eop-nam10.prod.protection.outlook.com (10.13.154.254) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2430.20; Tue, 12 Nov 2019 12:00:38 +0000 it should look like this as I had to remove the extra spaces from some of the lines: Received: from MW2NAM10HT110.eop-nam10.prod.protection.outlook.com (2603:10b6:5:190::40) by DM6PR14MB2170.namprd14.prod.outlook.com with HTTPS via DM6PR11CA0027.NAMPRD11.PROD.OUTLOOK.COM; Tue, 12 Nov 2019 12:00:39 +0000 Received: from MW2NAM10FT066.eop-nam10.prod.protection.outlook.com (10.13.154.53) by MW2NAM10HT110.eop-nam10.prod.protection.outlook.com (10.13.154.254) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2430.20; Tue, 12 Nov 2019 12:00:38 +0000
  4. gnarlymarley

    "spam" from Spamcop

    I suspect that on https://www.spamcop.net/fom-serve/cache/125.html, this is the part you are talking about: "If the recipient agreed to receive it, then it is not spam." Even though the content of them is unwanted, unsolicited, and bulk, the notifications from the forum for legitamite posts might be desired and therefore the all notifications are not spam.
  5. gnarlymarley

    Why am I paying with my time?

    By reporting spam through SC, it does two things: Alerts the administrators to do something about it or risk being put on the blocking list. After a certain amount of reports the offending IP is added to the blocking list. A lot of email service providers have used the SC blocking list. If you control your own email server, you could use the SC blocking list to help slow down the spam. If you use a spam filtering tool such as spamassassin, then this will most likely already be enabled.
  6. gnarlymarley

    Why am I paying with my time?

    The NAG screen was started around the turn of the century after lots of people started using the sevice. The minimum time (If I remember correctly) was set to three seconds and only went higher if there were lots of people submitting their spam at the same time. The highest I saw back in the day (Just before Cisco came on) was a over a minute. What I would do at that time if I was not paying is to open up a second window/tab and submit more spam while I was waiting for the first window's nag to time out.
  7. gnarlymarley

    October 2019 - A month different to others?

    I did notice on the source of spam page lately there are a lot of "ISP has indicated spam will cease" from IP ranges such as 89.34.26.0/24 and 195.29.0.0/16 where it appears that they are just marking the option to prevent reports from being submitted. (It seems to be more than one IP in their range.) It appears they have been doing this for more than 48 hours and marking this maybe every six hours as the time after the message seems to jump up by around six hours. Could this be part of the why the spikes have changed?
  8. gnarlymarley

    obscuring personal IDs in reports

    Some browsers might call this mode "incognito". And yes, I use it too.
  9. gnarlymarley

    www.nospammer.net/SpamSubmission

    I also find it interesting that they hid the real spam link in the visible text instead of making it a clickable link using the HTML tags like they did with the nopammer.net section. Probably to hide it from parsers that report the links.
  10. gnarlymarley

    obscuring personal IDs in reports

    hank, it is a good idea to make sure it was munged before sending the reports to the admins. (The admins that "could be" the actual spammers.)
  11. gnarlymarley

    IP being used, but not in whois

    Thanks, good to know. Yeah, it was picked up by Media Land as an be seen in BGP tables, https://bgp.he.net/AS206728#_prefixes out of Russia. I had contacted RIPE and all I got is Media Land is what I currently know about it. My contact at RIPE seems to think 185.254.121.0/24 has never been allocated to any organization (which leads me to believe they are only looking at what I can see and their front end support is not very helpful.) Hello, Thank you for coming back to us. The AS206728 belongs to MEDIALAND. However the range is not allocated. https://apps.db.ripe.net/db-web-ui/#/query?searchtext=AS206728 So they are announcing a network with a range which is unassigned from their own servers. Hope to have informed you sufficiently at this stage. Kind Regards,
  12. gnarlymarley

    hetzner.de spam source

    A few ways to do this. One is traceroute. If they have a firewall, then this may not get you to their border servers. The other way is to use a looking glass, such as http://lg.he.net. I also use http://bgp.he.net to find the upstream AS number and then I can use it to find the peers. It appears that hetzner.de is much larger than I though as they have 216 peers. That would take way too much time to get their ISPs to chat with them about their spam hosting. It is interesting that all their networks all point to abuse[at]hetzner.de.
  13. Sounds to me like the IP registries are confused. Seems to be that 185.254.121.237 is said by arin to be RIPE, but by everyone else to be IANA. The IP is in use and is routable. Does anyone else see what I am seeing returned from RIPE or is this just me? https://www.spamcop.net/sc?id=z6578180134z80ef26afa691a5047d301c474dcaaf8bz https://www.spamcop.net/sc?id=z6578095270z15fc50e4b2d4dad674d00394b23c6c24z https://www.spamcop.net/sc?action=rcache;ip=185.254.121.237 $ whois 185.254.121.237@whois.ripe.net [whois.ripe.net] % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf % Note: this output has been filtered. % To receive output for a database update, use the "-B" flag. % Information related to '0.0.0.0 - 255.255.255.255' % No abuse contact registered for 0.0.0.0 - 255.255.255.255 inetnum: 0.0.0.0 - 255.255.255.255 netname: IANA-BLK descr: The whole IPv4 address space
  14. gnarlymarley

    Domain abuse reporting contact

    This is because the abuse address of the domain itself is usually the spammer themselves. So SpamCop reports it to the abuse address where the content is stored, which is on the IP. The domain is pointed to an IP that seems to be in a Microsoft data center. Host hipmie.com (checking ip) = 40.71.252.90Routing details for 40.71.252.90[refresh/show] Cached whois for 40.71.252.90 : abuse@microsoft.com
  15. gnarlymarley

    No Data Found

    Apparently, there was a problem between the database and the email servers. Works for me now. You will want to try your old tracking URLs.
×