Jump to content


  • Content Count

  • Joined

  • Last visited

Everything posted by gnarlymarley

  1. I had thought they turned off the "Please make sure this email IS spam:" warning when they promote V5 as I have not seen the warning in quite a while. I suspect spamcop is checking the headers for a particular format and it might only pop up if the headers matches legitimate email.
  2. gnarlymarley

    No Headers

    I typed in your URL from the image https://www.spamcop.net/sc?id=z6598002198z8fb6021e44f26436f7ebe6fd86760940z so we can have a clickable link. I have not seen a problem on my side. I did notice your submission is missing all "Received:" header lines. When I went to check out my hotmail account on both the webmail and imap sides, I see the "Received:" header lines all intact.
  3. Without the tracking URL, I would guess this is the line that it is stopping at right above the "identified internal IP as source" message: It would appear that you need to update your mailhost configuration but resending a message to your account. Then you should be able to return to the spam report page and it should work.
  4. I have seen this before. It came in the reply of email I had forwarded to my submit address. Most email providers are doing the forward inline, where the forward is like a reply and headers are lost. Once I figured out how to forward as an attachment (Some used the ctrl key on the forward button) my problem was solved. You may find as in my case the email providers change the key regularly. It may be better to "view source" and then submit that in the reporting form.
  5. gnarlymarley

    How to automatically submit spam?

    There are some ways to accomplish this. Since not all of my email providers support forwarding as an attachment, I did it using a unix program called fetchmail and a perl scri_pt. (The perl scri_pt encapsulates the email as an attachment and sends it to the reporting address.) I will offer a word of caution about full automation of reporting, as I have recently had one group send me an email fifteen years after I had signed up on the list to my main email address. (Yes, they went quiet for more than a decade.) If someone were to do a restore or grab the old email address, then you could be trying to report legitimate email. That said, I have not had any problems with reporting from my accounts I signed up and never used for email.
  6. gnarlymarley

    How Do I Use SC on MY Mail Server?

    Outernaut, For me, I have migrated away from the spamcop filter when I found that SpamAssassin contains a spamcop rule called RCVD_IN_BL_SPAMCOP_NET. (I abandoned filtering at the SMTP level when I found emails I was interested showed up on the blocklist.) Since you already have spam Assassin, you may have this rule already enabled. If you have it, you may need to use the "score" keyword to manipulate the rankings. (I currently just use the defaults for this one item.)
  7. I have not seen this happen to me when I changed servers. IrvSp, When you logged into your reporting account, were you greeted with a reject or bounce message on the reporting page? I have seen gmail bounce the replies for me and it stopped the replies.
  8. dr_bobbs, One thing to note if you forward as an attachment to your submit address, submit.XXXXXXXX@spam.spamcop.net, then it will automatically truncate for you.
  9. I have not seen any recent reports of mine for this spammer. I am not sure if they stopped or just moved on to other addresses for the time.
  10. gnarlymarley

    Apple Mail SpamCop Reporting

    I have not used applescript since OS9, so I may not be of help, but this page (https://macscripter.net/viewtopic.php?id=30296) seems it looks a little bit familiar and may be of help. For me, what I do is to create a new email and then drag and drop all the messages I want to submit on that email. (Yes, you can do more than one attachment to the email you submit to your submit address.) Just make sure when you get the reply you can click all the links.
  11. gnarlymarley

    SpamCop isn't working right with Outlook.com

    Me too, so sorry about my late reply. I also noticed that some of the messages are coming in without proper line endings. How I am fixing it is to copy the message to notepad (on windows) and if I see no line wrapping, then I paste into word pad, then select all, and past into notepad. Once done, I remove the space on the lines in front of the words (Received:, From:, X-, To:, Subject:, and Reply-To:). The rest of the spaces should stay. Once I cleaned up with the above header lines, I paste into spamcop and it accepts my submissions.
  12. gnarlymarley

    SpamCop isn't working right with Outlook.com

    Jeff2019, i think I found the problem. I got an email today from in my hotmail's outlook.com account where it seems that microsoft decided to add an extra space to some of the headers. If you look at the below, the first received line is okay, but the second Received line has a space that is reserved for line wrapping. I don't like it when companies refuse to follow RFCs. Received: from MW2NAM10HT110.eop-nam10.prod.protection.outlook.com (2603:10b6:5:190::40) by DM6PR14MB2170.namprd14.prod.outlook.com with HTTPS via DM6PR11CA0027.NAMPRD11.PROD.OUTLOOK.COM; Tue, 12 Nov 2019 12:00:39 +0000 Received: from MW2NAM10FT066.eop-nam10.prod.protection.outlook.com ( by MW2NAM10HT110.eop-nam10.prod.protection.outlook.com ( with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2430.20; Tue, 12 Nov 2019 12:00:38 +0000 it should look like this as I had to remove the extra spaces from some of the lines: Received: from MW2NAM10HT110.eop-nam10.prod.protection.outlook.com (2603:10b6:5:190::40) by DM6PR14MB2170.namprd14.prod.outlook.com with HTTPS via DM6PR11CA0027.NAMPRD11.PROD.OUTLOOK.COM; Tue, 12 Nov 2019 12:00:39 +0000 Received: from MW2NAM10FT066.eop-nam10.prod.protection.outlook.com ( by MW2NAM10HT110.eop-nam10.prod.protection.outlook.com ( with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2430.20; Tue, 12 Nov 2019 12:00:38 +0000
  13. gnarlymarley

    "spam" from Spamcop

    I suspect that on https://www.spamcop.net/fom-serve/cache/125.html, this is the part you are talking about: "If the recipient agreed to receive it, then it is not spam." Even though the content of them is unwanted, unsolicited, and bulk, the notifications from the forum for legitamite posts might be desired and therefore the all notifications are not spam.
  14. gnarlymarley

    Why am I paying with my time?

    By reporting spam through SC, it does two things: Alerts the administrators to do something about it or risk being put on the blocking list. After a certain amount of reports the offending IP is added to the blocking list. A lot of email service providers have used the SC blocking list. If you control your own email server, you could use the SC blocking list to help slow down the spam. If you use a spam filtering tool such as spamassassin, then this will most likely already be enabled.
  15. gnarlymarley

    Why am I paying with my time?

    The NAG screen was started around the turn of the century after lots of people started using the sevice. The minimum time (If I remember correctly) was set to three seconds and only went higher if there were lots of people submitting their spam at the same time. The highest I saw back in the day (Just before Cisco came on) was a over a minute. What I would do at that time if I was not paying is to open up a second window/tab and submit more spam while I was waiting for the first window's nag to time out.
  16. gnarlymarley

    October 2019 - A month different to others?

    I did notice on the source of spam page lately there are a lot of "ISP has indicated spam will cease" from IP ranges such as and where it appears that they are just marking the option to prevent reports from being submitted. (It seems to be more than one IP in their range.) It appears they have been doing this for more than 48 hours and marking this maybe every six hours as the time after the message seems to jump up by around six hours. Could this be part of the why the spikes have changed?
  17. gnarlymarley

    obscuring personal IDs in reports

    Some browsers might call this mode "incognito". And yes, I use it too.
  18. gnarlymarley


    I also find it interesting that they hid the real spam link in the visible text instead of making it a clickable link using the HTML tags like they did with the nopammer.net section. Probably to hide it from parsers that report the links.
  19. gnarlymarley

    obscuring personal IDs in reports

    hank, it is a good idea to make sure it was munged before sending the reports to the admins. (The admins that "could be" the actual spammers.)
  20. gnarlymarley

    IP being used, but not in whois

    Thanks, good to know. Yeah, it was picked up by Media Land as an be seen in BGP tables, https://bgp.he.net/AS206728#_prefixes out of Russia. I had contacted RIPE and all I got is Media Land is what I currently know about it. My contact at RIPE seems to think has never been allocated to any organization (which leads me to believe they are only looking at what I can see and their front end support is not very helpful.) Hello, Thank you for coming back to us. The AS206728 belongs to MEDIALAND. However the range is not allocated. https://apps.db.ripe.net/db-web-ui/#/query?searchtext=AS206728 So they are announcing a network with a range which is unassigned from their own servers. Hope to have informed you sufficiently at this stage. Kind Regards,
  21. Sounds to me like the IP registries are confused. Seems to be that is said by arin to be RIPE, but by everyone else to be IANA. The IP is in use and is routable. Does anyone else see what I am seeing returned from RIPE or is this just me? https://www.spamcop.net/sc?id=z6578180134z80ef26afa691a5047d301c474dcaaf8bz https://www.spamcop.net/sc?id=z6578095270z15fc50e4b2d4dad674d00394b23c6c24z https://www.spamcop.net/sc?action=rcache;ip= $ whois [whois.ripe.net] % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf % Note: this output has been filtered. % To receive output for a database update, use the "-B" flag. % Information related to ' -' % No abuse contact registered for - inetnum: - netname: IANA-BLK descr: The whole IPv4 address space
  22. gnarlymarley

    hetzner.de spam source

    A few ways to do this. One is traceroute. If they have a firewall, then this may not get you to their border servers. The other way is to use a looking glass, such as http://lg.he.net. I also use http://bgp.he.net to find the upstream AS number and then I can use it to find the peers. It appears that hetzner.de is much larger than I though as they have 216 peers. That would take way too much time to get their ISPs to chat with them about their spam hosting. It is interesting that all their networks all point to abuse[at]hetzner.de.
  23. gnarlymarley

    Domain abuse reporting contact

    This is because the abuse address of the domain itself is usually the spammer themselves. So SpamCop reports it to the abuse address where the content is stored, which is on the IP. The domain is pointed to an IP that seems to be in a Microsoft data center. Host hipmie.com (checking ip) = details for[refresh/show] Cached whois for : abuse@microsoft.com
  24. gnarlymarley

    No Data Found

    Apparently, there was a problem between the database and the email servers. Works for me now. You will want to try your old tracking URLs.
  25. gnarlymarley

    spamcop report spam

    apparently, there was an issue between the database and one of the mail servers. Your tracking URL seems to be working for me now.