Jump to content


  • Content Count

  • Joined

  • Last visited

Posts posted by gnarlymarley

  1. On 1/19/2020 at 5:00 PM, Lodewijk said:

    "Bounce error
    Your email address, (xxx) has returned a bounce:
    Subject: Delivery Status Notification (Failure)
    Reason: 5.1.0 - Unknown address error 550-'Sorry, we do not accept connections from="

    I had this happen with my account on gmail.  I had to find all the related message in my spam folder and mark them as "not spam" in order to get their spam rules to stop rejecting it.  For me, it all started when google changed their rule system and needed every thing to be setup again.  So far I have all seems good for me.  Hopefully this might help you.

  2. 6 hours ago, Gingko said:

    Most of the received messages are already outdated, meaning that if I use Spamcop for reporting them, they are rejected because they are more than 2 days old, despite the fact that I submit them as soon as they are received.

    A tracking URL would be useful.  Also if you look at the headers, is your border server putting on an old date?  Spammers have been known to put in faked headers with old dates to try to confuse the SpamCop parser.  This is why the mailhosts setup now exists is to cause the parser to stop at your border server.  This is so that the correct IP and date can be picked up by the parser.

  3. 23 hours ago, petzl said:

     That said I still get the odd multiple spam splurge at once all from different IP's 

    I do find it interesting that I still get the occasional spam from a specific "claimed" helo name and from.  Seems like the spammer is able to stand up new EC2 instances almost as soon as amazon "claims" they are resolved the issue.

  4. 4 hours ago, Asha Kanta Sharma said:

    I get hundreds of spam emails daily and it is cumbersome to forward each emails to spam reporting. Can I forward all such spam mails as attachments ?

     Will the system recognize and extract/check necessary data from such emails ?

    Yes, just attach the spams to an email that is heading to your submit address.  The parser only recognizes them as an attachment.

  5. On 1/18/2020 at 9:32 PM, petzl said:

    Just got a couple today from Amazon

    Interesting that my amazon spam has nearly all stopped after I had submitted ten reports in a four day period.

    On 11/28/2018 at 2:33 PM, its8up said:

    You could manually forward spam reports, but the people in the abuse@amazonaws department are USELESS.  Try sending a copy of the full header/email to stop-spoofing@amazon dot com.

    What I also find is interesting is that I had one come back where the tech support person was not familiar with the date/time format in email headers and they needed it defined separately.

    * Complete, accurate timestamps of the activity including:
        - Date
        - Time
        - Time Zone
    * Full e-mail header and HTML content of the spam message


  6. 11 hours ago, HeatherReid43 said:

    any idea how do take care of this and stop the spam source ?

    Heather, I have been getting that and it is coming from all over amazon's ip ranges.  Google seems to have no interest, and neither does amazon.  I setup my email server to reject it and they still try to send it.  At this point, I am not sure there is a way to stop it without a firewall that can drop the tcp connection before it connects.  Right now, I am mainly feeding the blocking list, but the spammer changes to a new IP every few minutes, so blocking based on a single IP seems pointless.  If I hear of anything that works, then I can post it here.

  7. On 1/15/2020 at 10:12 AM, jprogram said:

    So, my question is: what to do next?

    Is there anything different I need to know about once I got Mailhost set up? Anything I should be looking for?

    Like Lking said just start reporting.  Somethings to note is that your Mailhost setup is effective for previous submitted spam, so if you go to any of those to report them they should properly detect the correct spammer.

    Without the mailhost setup, spamcop would try to guess the IP that sent your email spam.  With it, it will detect the spammer's IP that connected to your border email server.

  8. On 1/14/2020 at 3:16 PM, petzl said:

    It looks to me Amazon must block port 25 to prevent viruses and spam tools managing to connect directly from infected machines through their NAT?

    Ah, but it appears that one can request port 25 to be unblocked.  I am not sure if there is a related fee or if it is free.

  9. 9 hours ago, klappa said:

    since they ask for  addition information, apparently send the whole spam e-mail and the send IP isn't enough for them.

    I am guessing this is because amazon appears to be rotating public IPs every minute.  They seem to want to know the minute and since I have NTP enabled, it should make just fine into their systems.  I wish that they would just enable IPv6 and stop with the NAT stuff.

  10. On 1/5/2020 at 1:54 PM, Dracosse said:

    I don't know for sure but I believe that something is going on at SpamCop. I even paid $15.00 thinking that they might be wanting to be paid for the service and CPU time I was using. Nope, no change.

    Both of my paid and non-paid SpamCop accounts work fine for me.  The only advice I think I can add is maybe it is a formatting issue.

    Maybe this will help: The first space when reading down the email that you encounter is between your headers and the body as well as the "Received:" lines should have start at the beginning of the line.  The "Received:" line will have lines below it and those should be indented with a space or a tab.

  11. On 1/5/2020 at 9:10 AM, styncer said:

    The email sample you submitted for *****@mac.com
    appears to traverse more than one domain.  
    Please ensure that you configure each mailhost individually and in order.

    Apparently @mac.com emails could be forwarded to another account.  If you can read the headers, then a part such as "for user@example.com;".  You might want to remove some of the "Received:" lines to split up the email if it is being forwarded.

  12. 12 hours ago, Dracosse said:

    I decided to roll back to an earlier version of Thunderbird. v38.0 to be exact and the problem completely disappeared."

    However the next day the problem arose again but this morning I didn't have the problem for about an hour and then the holiday season interrupted my reporting and testing opportunities.

    I wonder if your thunderbird automatically updated to a newer version between the day it worked and the day it didn't.

  13. On 12/15/2019 at 10:36 AM, captkirk said:

    Does this mean reporting this spam is a futile exercise since "The ticket can never be authorized"?

    My understanding is that the from address on each report changes as it appears to be the number is the report ID.  Some ISPs like this authorize only the full address.  The deputies might be able to work something out with the ISP.  Under the circumstances, might just be an autoresponder that sends it to the bit bucket.  Like Lking says, that this may be added to the blocklist.

  14. On 12/16/2019 at 7:33 PM, Dracosse said:

    I rolled back to an older version of Thunderbird [38.0] and for 2 hours I was able to report spam just like before. Then suddenly the same thing happened. Almost all messages have no tracking information.

    I don't see this issue, but then my thunderbird is v2.  Perhaps it could be a compatibility issue?  I used both imap and "webmail - hotmail 1.3.2" and it works for me.

  15. 19 hours ago, Dracosse said:

    Maybe of interest to someone. In one hour I have 112 new spam messages.

    I envy you as I don't get that much.  I had setup an automated forward as an attachment rule (back when that is what the freebie email providers allowed it) and I no longer get lots of spam.  I think my hurdle was when I reported to the legitamite providers such as comcast and qwest is when I lost my bulk.  I have no idea how 'century link' would take reports.  If you can figure out how to tell the difference on who would take action on your reports and report just those, then it may help on getting your counts down.

  16. 21 hours ago, Ricardo_63 said:

    Why does the spamcop report always indicated a warning as; verify that the message does not correspond to a spam mail.

    I had thought they turned off the "Please make sure this email IS spam:" warning when they promote V5 as I have not seen the warning in quite a while.  I suspect spamcop is checking the headers for a particular format and it might only pop up if the headers matches legitimate email.

  17. 12 hours ago, Dracosse said:

    My question is simply this. Has anyone else noticed the same problem? If spammers have devised a way to send spam without headers what good would it do to continue to use SpamCop in the future? How can the Block list continue to be useful?

    I typed in your URL from the image https://www.spamcop.net/sc?id=z6598002198z8fb6021e44f26436f7ebe6fd86760940z so we can have a clickable link.

    I have not seen a problem on my side.  I did notice your submission is missing all "Received:" header lines.  When I went to check out my hotmail account on both the webmail and imap sides, I see the "Received:" header lines all intact.

  18. Without the tracking URL, I would guess this is the line that it is stopping at right above the "identified internal IP as source" message:

    14 hours ago, styncer said:

    Received: from by (mailnotify 1916B19:12:18:22:57:59:60); Wed, 4 Dec 2019 22:57:59 GMT

    It would appear that you need to update your mailhost configuration but resending a message to your account.  Then you should be able to return to the spam report page and it should work.

  19. 18 hours ago, JoJoZ said:

    SpamCop encountered errors while saving spam for processing:
    SpamCop could not find your spam message in this email:

    What can I do about this?

    I have seen this before.  It came in the reply of email I had forwarded to my submit address.  Most email providers are doing the forward inline, where the forward is like a reply and headers are lost.  Once I figured out how to forward as an attachment (Some used the ctrl key on the forward button) my problem was solved.  You may find as in my case the email providers change the key regularly.  It may be better to "view source" and then submit that in the reporting form.

  20. On 2/25/2018 at 10:36 AM, lisali said:

    If an email is compromised, we change it at the source, and then set the compromised email to forward any incoming spam to SpamCop. Those emails will only ever receive spam so we don't need to check those reports. But there does not seem to be a way to do that?

    There are some ways to accomplish this.  Since not all of my email providers support forwarding as an attachment, I did it using a unix program called fetchmail and a perl scri_pt.  (The perl scri_pt encapsulates the email as an attachment and sends it to the reporting address.)

    I will offer a word of caution about full automation of reporting, as I have recently had one group send me an email fifteen years after I had signed up on the list to my main email address.  (Yes, they went quiet for more than a decade.)  If someone were to do a restore or grab the old email address, then you could be trying to report legitimate email.

    That said, I have not had any problems with reporting from my accounts I signed up and never used for email.

  21. On 11/27/2019 at 10:26 AM, Outernaut said:

    I asked my Host if I am permitted to use Spamcop in some way. Tech support said "Yes". I HAD access to Professional spam filter but a while ago the host raised the rates and replaced "Free" with 'Add-ons Extra' and disabled Pro spam Filter. We just have Apache spam Assassin / spam Filter.

    Outernaut, For me, I have migrated away from the spamcop filter when I found that SpamAssassin contains a spamcop rule called RCVD_IN_BL_SPAMCOP_NET.  (I abandoned filtering at the SMTP level when I found emails I was interested showed up on the blocklist.)  Since you already have spam Assassin, you may have this rule already enabled.  If you have it, you may need to use the "score" keyword to manipulate the rankings.  (I currently just use the defaults for this one item.)

  22. On 11/21/2019 at 10:24 AM, IrvSp said:

    I had to change my SMTP server. Noticed I was NOT getting return e-mails from submission and realized I had to register the new SMTP server. Did that, and got the confirmation back that it was a success...

    I have not seen this happen to me when I changed servers.

    On 11/26/2019 at 12:04 PM, Richard W said:

    I think your ISP changes and your not receiving replies are related, but not really.  Just because your smtp settings change in your mail client, doesn't mean the path of your incoming mail changes.  I'm not sure what you are expecting to see as a new mailhost. 

    IrvSp, When you logged into your reporting account, were you greeted with a reject or bounce message on the reporting page?  I have seen gmail bounce the replies for me and it stopped the replies.