Jump to content

Oriolus

Members
  • Content Count

    57
  • Joined

  • Last visited

Community Reputation

0 Neutral

About Oriolus

  • Rank
    Member
  1. As soon as I'm reporting, there is an almost endless turning of 'a wheel' in the tab where I'm reporting. This lasts for several minutes, and ends up with the message: got sigalarm, taking too long to process, aborted. Suggestion is to try later again: no change at all. I seem to being not able any more to report spams... Please help! Oriolus
  2. Oriolus

    [Resolved] Is this spam?

    Whah, Farelf offered me a ready-to-use-link to The Boulder Pledge Thank you even more, Farelf! And accept my apologies, please! I think a knot can be made in this end of the thread. Thank you all for your kind help! Oriolus
  3. Oriolus

    [Resolved] Is this spam?

    I had to look this up, and found the meaning of it. Thank you Miss Betsy! "Under no circumstances will I ever purchase anything offered to me as the result of an unsolicited e-mail message. Nor will I forward chain letters, petitions, mass mailings, or virus warnings to large numbers of others. This is my contribution to the survival of the online community."
  4. Oriolus

    [Resolved] Is this spam?

    You are right, and I didn't wipe that out! Yes, that's what I was realizing; please see my earlier reply. Not commercial. As a matter of fact I have Outlook to block pictures, therefor I forwarded it to my Gmail address, where I can see the pictures, and from the accompanying text I concluded that they were pictures of Mugabe's estate and so on: Shame on him. But forwarding the mail to my Gmail resulted in a block by my ISP, another problem that I'm trying to solve: I cannot forward spams anymore to either Frontbridge or Coldrain because of this blocking by my ISP. They refuse to open more than one (SpamCop!) address to where I can forward spam to... There was only my friend's address as Receiver, typically a mail that uses Bcc. Nothing wrong, but thus there were no other addresses. I fully agree. Please see my earlier reply. I Think I have to leave things as they are: I was not annoyed by my friends forwarded mail, I only was worried about the fact that it was marked as spam and apparently not by my friend's e-mail program. I am very glad to read about how Notes are handled in practice; thank you. So it was of no use if I had done so, apart from my stupidity... Again thank you for you great explanations!
  5. Oriolus

    [Resolved] Is this spam?

    Sorry for being not more clear about the sender. It's a friend who sent it; that's why I am careful with his identity. I would like to know whether this chain letter is more than that: does it contain malicious stuff? I was not sure if it would be wise to publish everything in this forum, but if its safe to do, I will publish the url. Though, in there, my reporting address, and my friend's name will be visible. Won't that be dangerous? Please, don't misunderstand me: If I were sure that I wouldn't do any harm to my friend (as the sender of the chain letter), I would report the mail, but since he is not the 'primary creator' of the mail, I would only cause damage to him in stead of the original creator of the mail. That's why I wiped out his address: he received this mail without having been triggered of the fact that the mail might be spam. Normally I'm reporting in the proper way, of course, but since I didn't want to report before being sure the mail contains harmful matter, I wanted to ask the forum about this mail. In my PS I tried to ask whether I could have asked the same question as I do in this forum: "Before I report this mail, could you look into the report being offered whether this mail is malicious. If so, would this report harm my friend as the forwarder of a mail that was spam when he received it?" All seems to sound rather stupid, but I don't know how to handle this matter in a correct way. And after all I realize now, that I am stupid, and that the primary sender who sent the mail to my friend via-via-via cannot be retrieved any more: I should find the first victim of this chain mail to recognize the real creator, and I think I'm not able to find him. So, I'm afraid I have to think harder before I try to get help in this case. If you agree to that, we can stop this discussion, and I'm saying sorry for my stupidity...
  6. Oriolus

    [Resolved] Is this spam?

    I received an e-mail that was recognized as spam, but I am in doubt about whether it is spam indeed. Could someone, please, judge whether â€sender“ is in danger because he is not aware of the fact that this might be a dangerous e-mail? I hope it's OK that I wiped out â€sender’s“ real name, and that I flushed the link to the real report and my KnujOn reporting address. Should I flush any more, to be safer, by the way? If this is spam indeed, I'll report it for real, of course. I would be very grateful if someone could tell something about this supposed spam. If more information is needed, I'm glad to write it down, as long as I don't do any harm whatsoever to whoever. Please find hereunder what the SpamCop reporting service would have sent, if I didn’t cancel the sending of this report. SpamCop v 2 Copyright © 1998-2006, IronPort Systems, Inc. All rights reserved. Here is your TRACKING URL - it may be saved for future reference: http://www.spamcop.net/ <flushed> Skip to Reports Return-Path: <x> Received: from mwinf6621.online.nl (mwinf6621.online.nl) by mwinb6006 (SMTP Server) with LMTP; Sun, 04 Jan 2009 12:06:25 +0100 X-Sieve: Server Sieve 2.2 Received: from me-wanadoo.net (localhost [127.0.0.1]) by mwinf6621.online.nl (SMTP Server) with ESMTP id A67792800091 for <x>; Sun, 4 Jan 2009 12:06:25 +0100 (CET) Received: from imo-m22.mail.aol.com (imo-m22.mx.aol.com [64.12.137.3]) by mwinf6621.online.nl (SMTP Server) with ESMTP id 81D03280009D; Sun, 4 Jan 2009 12:06:23 +0100 (CET) X-ME-UUID: 20090104110623531.81D03280009D[at]mwinf6621.online.nl Received: from x by imo-m22.mx.aol.com (mail_out_v39.1.) id h.d33.484c4c19 (37520) for <x>; Sun, 4 Jan 2009 06:04:06 -0500 (EST) Received: from privefd60913cd (3e33a5f7.dslaccess.aol.com [62.51.165.247]) by cia-ma08.mx.aol.com (v121_r5.5) with ESMTP id MAILCIAMA085-92904960977e376; Sun, 04 Jan 2009 06:03:40 -0500 Reply-To: <x> From: "sender" <x> To: "x" <x> Subject: FW: Fw: unbelievable Date: Sun, 4 Jan 2009 12:01:35 +0100 Message-ID: <LPBB________________________________erFH[at]cs.com> MIME-Version: 1.0 X-Content-Type: multipart/related; boundary="----=_NextPart_000_0004_01C96E64.31293960" X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 Importance: Normal X-AOL-IP: 62.51.165.247 X-spam-Flag:NO Content-Type: text/html X-SpamCop-note: Converted to text/html by SpamCop (outlook/eudora hack) View entire message Parsing header: 0: Received: from imo-m22.mail.aol.com (imo-m22.mx.aol.com [64.12.137.3]) by mwinf6621.online.nl (SMTP Server) with ESMTP id 81D03280009D; Sun, 4 Jan 2009 12:06:23 +0100 (CET) Hostname verified: imo-m22.mx.aol.com orange.nl received mail from sending system 64.12.137.3 1: Received: from privefd60913cd (3e33a5f7.dslaccess.aol.com [62.51.165.247]) by cia-ma08.mx.aol.com (v121_r5.5) with ESMTP id MAILCIAMA085-92904960977e376; Sun, 04 Jan 2009 06:03:40 -0500 No unique hostname found for source: 62.51.165.247 Trusted site mx.aol.com received mail from 62.51.165.247 Sender relay: 64.12.137.3 Routing details for 64.12.137.3 [refresh/show] Cached whois for 64.12.137.3 : domains[at]aol.net Using abuse net on domains[at]aol.net abuse net aol.net = abuse[at]aol.com Using best contacts abuse[at]aol.com Tracking message source: 62.51.165.247: Routing details for 62.51.165.247 [refresh/show] Cached whois for 62.51.165.247 : domains[at]aol.net Using abuse net on domains[at]aol.net abuse net aol.net = abuse[at]aol.com Using best contacts abuse[at]aol.com Message is 8 hours old 62.51.165.247 not listed in dnsbl.njabl.org 62.51.165.247 not listed in dnsbl.njabl.org 62.51.165.247 not listed in cbl.abuseat.org 62.51.165.247 not listed in dnsbl.sorbs.net 62.51.165.247 not listed in accredit.habeas.com 62.51.165.247 not listed in plus.bondedsender.org 62.51.165.247 not listed in iadb.isipp.com Finding links in message body Parsing HTML part Resolving link obfuscation https://www.invite2messenger.nl/Default.aspx http://www.avg.com/ http://events.live.com/ Host events.live.com (checking ip) = 65.55.103.54 host 65.55.103.54 (getting name) no name http://www.spamfighter.com/lnl Host www.spamfighter.com (checking ip) = 12.190.48.107 host 12.190.48.107 (getting name) no name http://www.nod32.nl/ Host www.nod32.nl (checking ip) = 213.133.34.161 host 213.133.34.161 (getting name) = notused.is.nl. Tracking link: https://www.invite2messenger.nl/Default.aspx [report history] Resolves to 213.199.165.50 Routing details for 213.199.165.50 [refresh/show] Cached whois for 213.199.165.50 : bharatr[at]microsoft.com Using last resort contacts bharatr[at]microsoft.com bharatr[at]microsoft.com bounces (533 sent : 267 bounces) Using bharatr#microsoft.com[at]devnull.spamcop.net for statistical tracking. Tracking link: http://www.spamfighter.com/lnl No recent reports, no history available www.spamfighter.com hosted by akamai - no reports Cannot resolve http://www.spamfighter.com/lnl Tracking link: http://events.live.com/ [report history] Resolves to 65.55.103.54 Routing details for 65.55.103.54 [refresh/show] Cached whois for 65.55.103.54 : abuse[at]hotmail.com Using best contacts report_spam[at]hotmail.com Tracking link: http://www.nod32.nl/ [report history] ISP does not wish to receive report regarding http://www.nod32.nl/ Resolves to 213.133.34.161 Routing details for 213.133.34.161 [refresh/show] Cached whois for 213.133.34.161 : abuse[at]is.nl. Using abuse net on abuse[at]is.nl. abuse net is.nl = postmaster[at]is.nl, abuse[at]is.nl, klantenservice[at]is.nl, helpdesk[at]is.nl, administratie[at]is.nl Using best contacts postmaster[at]is.nl abuse[at]is.nl klantenservice[at]is.nl helpdesk[at]is.nl administratie[at]is.nl ISP does not wish to receive reports regarding http://www.nod32.nl/ - no date available Please make sure this email IS spam: From: "sender" <x> (FW: Fw: unbelievable) [tab][/tab] Who is living in this house. The enormous luxury. View full message Report spam to: Re: 62.51.165.247 (Administrator of network where email originates) To: abuse[at]aol.com (Notes) Re: 62.51.165.247 (User defined recipient) To: <flushed>[at]coldrain.net (Notes) Re: 64.12.137.3 (Administrator interested in intermediary handling of spam) To: abuse[at]aol.com (Notes) Re: http://events.live.com/ (Administrator of network hosting website referenced in spam) To: report_spam[at]hotmail.com (Notes) Re: https://www.invite2messenger.nl/Default.aspx (Administrator of network hosting website referenced in spam) To: bharatr#microsoft.com[at]devnull.spamcop.net (Notes) PS. Would a filled in “Additional notes (optional - max 2000 characters):-box†be a better solution than the way I copy this report with some changes for security matters? I don't know how Additional notes are handled: Are they always be read and will the reader sometimes decide not to pass the report as a spam report to get handled like there were no Additional notes? Thank you in advance for your answer!
  7. Oriolus

    No IP-address, cannot report

    Yes, you are certainly right! I did the wrong thing, I'm very sorry! I better delete my post! I'm lost... I've to look into the FAQ's to remember how I should handle things. Again, I'm sorry! This is what the second code-part should have been: Reporting via Forwarding as an attachment: SpamCop v 2 Copyright (C) 1998-2006, IronPort Systems, Inc. All rights reserved. Here is your TRACKING URL - it may be saved for future reference: http://www.spamcop.net/sc?id=z2124366960z3aa112245dd63618300448808611770cz Skip to Reports Received: from me-wanadoo.net (localhost [127.0.0.1]) by mwinf6617.online.nl (SMTP Server) with ESMTP id DFC8B280008A for &lt;x&gt;; Mon, 4 Aug 2008 19:13:54 +0200 (CEST) Received: from mwinf6617.online.nl (mwinf6617.online.nl) by mwinb6006 (SMTP Server) with LMTP; Mon, 04 Aug 2008 19:13:54 +0200 Received: from ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr (ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr [86.217.132.218]) by mwinf6617.online.nl (SMTP Server) with ESMTP id AFD3C2800086 for &lt;x&gt;; Mon, 4 Aug 2008 19:13:54 +0200 (CEST) Return-Path: &lt;witczak[at]iag.se&gt; From: "gabbie michel" &lt;witczak[at]iag.se&gt; To: &lt;x&gt; Subject: For:&lt;y&gt; Britney still has cool t*tsWatch. Date: Mon, 4 Aug 2008 17:24:31 +0200 Message-ID: &lt;0009______________________c9be[at]fngixw&gt; MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0013_01C8F682.B5DEAD70" X-Mailer: Microsoft Outlook Express 6.00.2900.3138 X-Sieve: Server Sieve 2.2 X-ME-UUID: 20080804171354720.AFD3C2800086[at]mwinf6617.online.nl X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 Thread-Index: Acj2VXjV50ZxfALKQd6Aj+rooZMsYw== View entire message Parsing header: 0: Received: from ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr (ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr [86.217.132.218]) by mwinf6617.online.nl (SMTP Server) with ESMTP id AFD3C2800086 for &lt;x&gt;; Mon, 4 Aug 2008 19:13:54 +0200 (CEST) No unique hostname found for source: 86.217.132.218 orange.nl received mail from sending system 86.217.132.218 Tracking message source: 86.217.132.218: Routing details for 86.217.132.218 [refresh/show] Cached whois for 86.217.132.218 : postmaster[at]wanadoo.fr Using abuse net on postmaster[at]wanadoo.fr abuse net wanadoo.fr = postmaster[at]wanadoo.fr, abuse[at]wanadoo.fr, abuse[at]orange.fr Using best contacts postmaster[at]wanadoo.fr abuse[at]wanadoo.fr abuse[at]orange.fr postmaster[at]wanadoo.fr bounces (205 sent : 103 bounces) Using postmaster#wanadoo.fr[at]devnull.spamcop.net for statistical tracking. Message is 3 hours old 86.217.132.218 not listed in dnsbl.njabl.org 86.217.132.218 not listed in dnsbl.njabl.org 86.217.132.218 not listed in cbl.abuseat.org 86.217.132.218 listed in dnsbl.sorbs.net ( 127.0.0.10 ) 86.217.132.218 not listed in accredit.habeas.com 86.217.132.218 not listed in plus.bondedsender.org 86.217.132.218 not listed in iadb.isipp.com Finding links in message body Recurse multipart: Parsing text part Parsing HTML part Resolving link obfuscation http://back495.com/videos/live.html Host back495.com (checking ip) = 200.46.83.233 host 200.46.83.233 = 233-83-46-200-ip.alianzaviva.net (cached) Tracking link: http://back495.com/videos/live.html [report history] Resolves to 200.46.83.233 Routing details for 200.46.83.233 [refresh/show] Cached whois for 200.46.83.233 : ipadmin[at]net2net.com.pa Using abuse net on ipadmin[at]net2net.com.pa abuse net net2net.com.pa = ipadmin[at]net2net.com.pa, abuse[at]net2net.com.pa, postmaster[at]net2net.com.pa Using best contacts ipadmin[at]net2net.com.pa abuse[at]net2net.com.pa postmaster[at]net2net.com.pa Please make sure this email IS spam: From: "gabbie michel" &lt;witczak[at]iag.se&gt; (For:&lt;y&gt; Britney still has cool t*tsWatch.) Dit is een meerdelig bericht met een MIME-indeling. ------=_NextPart_000_0013_01C8F682.B5DEAD70 View full message Furthermore exactly the same as in the first code-part. I cannot judge whether this differs from the first code-part, but the result is fortunately the same. Sorry for the embarrassing confusion.
  8. Oriolus

    No IP-address, cannot report

    I have come across an even more amazing difference, that could cast light upon things: Reported in two parts via the Outlook/Eudora workaround form: SpamCop v 2 Copyright (C) 1998-2006, IronPort Systems, Inc. All rights reserved. Here is your TRACKING URL - it may be saved for future reference: http://www.spamcop.net/sc?id=z2124029633zd1b3646a2593fcd64f44c6e2fad4a68cz Skip to Reports Return-Path: &lt;witczak[at]iag.se&gt; Received: from mwinf6617.online.nl (mwinf6617.online.nl) by mwinb6006 (SMTP Server) with LMTP; Mon, 04 Aug 2008 19:13:54 +0200 X-Sieve: Server Sieve 2.2 Received: from me-wanadoo.net (localhost [127.0.0.1]) by mwinf6617.online.nl (SMTP Server) with ESMTP id DFC8B280008A for &lt;x&gt;; Mon, 4 Aug 2008 19:13:54 +0200 (CEST) Received: from ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr (ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr [86.217.132.218]) by mwinf6617.online.nl (SMTP Server) with ESMTP id AFD3C2800086 for &lt;x&gt;; Mon, 4 Aug 2008 19:13:54 +0200 (CEST) X-ME-UUID: 20080804171354720.AFD3C2800086[at]mwinf6617.online.nl Message-ID: &lt;0009______________________c9be[at]fngixw&gt; From: "gabbie michel" &lt;witczak[at]iag.se&gt; To: &lt;x&gt; Subject: For:&lt;y&gt; Britney still has cool t*tsWatch. Date: Mon, 04 Aug 2008 15:24:31 +0000 MIME-Version: 1.0 X-Content-Type: multipart/alternative; boundary="----=_NextPart_000_0006_01C8F655.02FCCED1" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3138 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 Content-Type: text/html X-SpamCop-note: Converted to text/html by SpamCop (outlook/eudora hack) View entire message Parsing header: 0: Received: from ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr (ABordeaux-156-1-41-218.w86-217.abo.wanadoo.fr [86.217.132.218]) by mwinf6617.online.nl (SMTP Server) with ESMTP id AFD3C2800086 for &lt;x&gt;; Mon, 4 Aug 2008 19:13:54 +0200 (CEST) No unique hostname found for source: 86.217.132.218 orange.nl received mail from sending system 86.217.132.218 Tracking message source: 86.217.132.218: Routing details for 86.217.132.218 [refresh/show] Cached whois for 86.217.132.218 : postmaster[at]wanadoo.fr Using abuse net on postmaster[at]wanadoo.fr abuse net wanadoo.fr = postmaster[at]wanadoo.fr, abuse[at]wanadoo.fr, abuse[at]orange.fr Using best contacts postmaster[at]wanadoo.fr abuse[at]wanadoo.fr abuse[at]orange.fr postmaster[at]wanadoo.fr bounces (205 sent : 103 bounces) Using postmaster#wanadoo.fr[at]devnull.spamcop.net for statistical tracking. Yum, this spam is fresh! Message is 0 hours old 86.217.132.218 not listed in dnsbl.njabl.org 86.217.132.218 not listed in dnsbl.njabl.org 86.217.132.218 not listed in cbl.abuseat.org 86.217.132.218 listed in dnsbl.sorbs.net ( 127.0.0.10 ) 86.217.132.218 not listed in accredit.habeas.com 86.217.132.218 not listed in plus.bondedsender.org 86.217.132.218 not listed in iadb.isipp.com Finding links in message body Parsing HTML part Resolving link obfuscation http://back495.com/videos/live.html Host back495.com (checking ip) = 200.46.83.233 host 200.46.83.233 = 233-83-46-200-ip.alianzaviva.net (cached) Tracking link: http://back495.com/videos/live.html [report history] Resolves to 200.46.83.233 Routing details for 200.46.83.233 [refresh/show] Cached whois for 200.46.83.233 : ipadmin[at]net2net.com.pa Using abuse net on ipadmin[at]net2net.com.pa abuse net net2net.com.pa = ipadmin[at]net2net.com.pa, abuse[at]net2net.com.pa, postmaster[at]net2net.com.pa Using best contacts ipadmin[at]net2net.com.pa abuse[at]net2net.com.pa postmaster[at]net2net.com.pa Please make sure this email IS spam: From: "gabbie michel" &lt;witczak[at]iag.se&gt; (For:&lt;y&gt; Britney still has cool t*tsWatch.) View full message Report spam to: Re: 86.217.132.218 (Administrator of network where email originates) To: postmaster#wanadoo.fr[at]devnull.spamcop.net (Notes) To: abuse[at]orange.fr (Notes) To: abuse[at]wanadoo.fr (Notes) Re: 86.217.132.218 (User defined recipient) To: jl0007[at]coldrain.net (Notes) Re: http://back495.com/videos/live.html (Administrator of network hosting website referenced in spam) To: ipadmin[at]net2net.com.pa (Notes) To: abuse[at]net2net.com.pa (Notes) To: postmaster[at]net2net.com.pa (Notes) Additional notes (optional - max 2000 characters): ATTENTION: Report only those e-mail addresses and web sites that you think your spammer has used. Avoid checking any boxes left empty unless you know that your spammer has used the addresses or sites thus identified. Each false report that you submit means wasted time for a network administrator, so take care. The last thing SpamCop wants are network administrators so accustomed to false claims that they no longer take these spam reports seriously. Comments for:postmaster#wanadoo.fr[at]devnull.spamcop.net (86.217.132.218) Return to report Comments for:abuse[at]orange.fr (86.217.132.218) Return to report Comments for:abuse[at]wanadoo.fr (86.217.132.218) Return to report Comments for:jl0007[at]coldrain.net (86.217.132.218) Return to report Comments for:ipadmin[at]net2net.com.pa (http://back495.com/videos/live.html) Return to report Comments for:abuse[at]net2net.com.pa (http://back495.com/videos/live.html) Return to report Comments for:postmaster[at]net2net.com.pa (http://back495.com/videos/live.html) Return to report Copyright (C) 1998-2006, IronPort Systems, Inc. All rights reserved. HTML4 / CSS2 Firefox recommended - Policies and Disclaimers Reported via Forwarding resulting in error(s): SpamCop encountered errors while saving spam for processing: SpamCop could not find your spam message in this email: Return-Path: &lt;&lt;y&gt;[at]wanadoo.nl&gt; Received: from sc-smtp6-inbound.soma.ironport.com (sc-smtp6-inbound.soma.ironport.com [204.15.82.72]) by sc-app12.soma.ironport.com (Postfix) with ESMTP id C9C4834DBD for &lt;submit.&lt;z&gt;[at]spam.spamcop.net&gt;; Mon, 4 Aug 2008 11:06:04 -0700 (PDT) X-Fozzie-Original-To: submit.&lt;z&gt;[at]spam.spamcop.net X-Fozzie-Original-To: submit.&lt;z&gt;[at]spam.spamcop.net Received: from smtp-4.orange.nl ([193.252.22.249]) by vmx2.spamcop.net with ESMTP; 04 Aug 2008 11:06:04 -0700 Received: from me-wanadoo.net (localhost [127.0.0.1]) by mwinf6303.online.nl (SMTP Server) with ESMTP id 3B15E7000085 for &lt;submit.&lt;z&gt;[at]spam.spamcop.net&gt;; Mon, 4 Aug 2008 20:06:02 +0200 (CEST) Received: from SilverBox (s5591c49c.adsl.wanadoo.nl [85.145.196.156]) by mwinf6303.online.nl (SMTP Server) with ESMTP id DF9F97000082 for &lt;submit.&lt;z&gt;[at]spam.spamcop.net&gt;; Mon, 4 Aug 2008 20:06:01 +0200 (CEST) X-ME-UUID: 20080804180601916.DF9F97000082[at]mwinf6303.online.nl From: "&lt;y&gt;" &lt;&lt;y&gt;[at]wanadoo.nl&gt; To: "spam" &lt;submit.&lt;z&gt;[at]spam.spamcop.net&gt; Subject: FW: &lt;y&gt; Britney still has cool t*tsWatch. Date: Mon, 4 Aug 2008 20:05:31 +0200 Message-ID: &lt;000901c8f65c$af77fe80$0e67fb80$[at]&lt;xxx&gt;[at]wanadoo.nl&gt; MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000A_01C8F66D.7300CE80" X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: Acj2VXjV50ZxfALKQd6Aj+rooZMsYwABrHHg Content-Language: nl Dit is een meerdelig bericht met een MIME-indeling. ------=_NextPart_000_000A_01C8F66D.7300CE80 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Van: gabbie michel [mailto:witczak[at]iag.se] Verzonden: maandag 4 augustus 2008 17:25 Aan: &lt;y&gt;[at]wanadoo.nl Onderwerp: For:&lt;y&gt; Britney still has cool t*tsWatch. ------=_NextPart_000_000A_01C8F66D.7300CE80 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable &lt;html xmlns:v=3D"urn:schemas-microsoft-com:vml" = xmlns:o=3D"urn:schemas-microsoft-com:office:office" = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" = xmlns=3D"http://www.w3.org/TR/REC-html40"&gt; &lt;head&gt; &lt;meta http-equiv=3DContent-Type content=3D"text/html; = charset=3Dus-ascii"&gt; &lt;meta name=3DGenerator content=3D"Microsoft Word 12 (filtered medium)"&gt; &lt;style&gt; &lt;!-- /* Font Definitions */ [at]font-face {font-family:"MS Mincho"; panose-1:2 2 6 9 4 2 5 8 3 4;} [at]font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} [at]font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} [at]font-face {font-family:Tahoma; panose-1:2 11 6 4 3 5 4 4 2 4;} [at]font-face {font-family:"\[at]MS Mincho"; panose-1:2 2 6 9 4 2 5 8 3 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0cm; margin-bottom:.0001pt; font-size:12.0pt; font-family:"Times New Roman","serif";} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:purple; text-decoration:underline;} span.E-mailStijl17 {mso-style-type:personal-reply; font-family:"Calibri","sans-serif"; color:#1F497D;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;} [at]page Section1 {size:612.0pt 792.0pt; margin:70.85pt 70.85pt 70.85pt 70.85pt;} div.Section1 {page:Section1;} --&gt; &lt;/style&gt; &lt;!--[if gte mso 9]&gt;&lt;xml&gt; &lt;o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /&gt; &lt;/xml&gt;&lt;![endif]--&gt;&lt;!--[if gte mso 9]&gt;&lt;xml&gt; &lt;o:shapelayout v:ext=3D"edit"&gt; &lt;o:idmap v:ext=3D"edit" data=3D"1" /&gt; &lt;/o:shapelayout&gt;&lt;/xml&gt;&lt;![endif]--&gt; &lt;/head&gt; &lt;body bgcolor=3Dwhite lang=3DNL link=3Dblue vlink=3Dpurple&gt; &lt;div class=3DSection1&gt; &lt;p class=3DMsoNormal&gt;&lt;span = style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"; color:#1F497D'&gt;&lt;o:p&gt;Â &lt;/o:p&gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=3DMsoNormal&gt;&lt;span = style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"; color:#1F497D'&gt;&lt;o:p&gt;Â &lt;/o:p&gt;&lt;/span&gt;&lt;/p&gt; &lt;div&gt; &lt;div style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt = 0cm 0cm 0cm'&gt; &lt;p class=3DMsoNormal&gt;&lt;b&gt;&lt;span = style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'&gt;Van:&lt;/span&gt;&lt;= /b&gt;&lt;span style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'&gt; gabbie = michel [mailto:witczak[at]iag.se] &lt;br&gt; &lt;b&gt;Verzonden:&lt;/b&gt; maandag 4 augustus 2008 17:25&lt;br&gt; &lt;b&gt;Aan:&lt;/b&gt; &lt;y&gt;[at]wanadoo.nl&lt;br&gt; &lt;b&gt;Onderwerp:&lt;/b&gt; For:&lt;y&gt; Britney still has cool = t*tsWatch.&lt;o:p&gt;&lt;/o:p&gt;&lt;/span&gt;&lt;/p&gt; &lt;/div&gt; &lt;/div&gt; &lt;p class=3DMsoNormal&gt;&lt;o:p&gt;Â &lt;/o:p&gt;&lt;/p&gt; &lt;p class=3DMsoNormal&gt;&lt;o:p&gt;Â &lt;/o:p&gt;&lt;/p&gt; &lt;/div&gt; &lt;/body&gt; &lt;/html&gt; ------=_NextPart_000_000A_01C8F66D.7300CE80-- The email which triggered this auto-response had the following headers: Return-Path: &lt;&lt;y&gt;[at]wanadoo.nl&gt; Received: from sc-smtp6-inbound.soma.ironport.com (sc-smtp6-inbound.soma.ironport.com [204.15.82.72]) by sc-app12.soma.ironport.com (Postfix) with ESMTP id C9C4834DBD for &lt;submit.&lt;z&gt;[at]spam.spamcop.net&gt;; Mon, 4 Aug 2008 11:06:04 -0700 (PDT) X-Fozzie-Original-To: submit.&lt;z&gt;[at]spam.spamcop.net X-Fozzie-Original-To: submit.&lt;z&gt;[at]spam.spamcop.net Received: from smtp-4.orange.nl ([193.252.22.249]) by vmx2.spamcop.net with ESMTP; 04 Aug 2008 11:06:04 -0700 Received: from me-wanadoo.net (localhost [127.0.0.1]) by mwinf6303.online.nl (SMTP Server) with ESMTP id 3B15E7000085 for &lt;submit.&lt;z&gt;[at]spam.spamcop.net&gt;; Mon, 4 Aug 2008 20:06:02 +0200 (CEST) Received: from SilverBox (s5591c49c.adsl.wanadoo.nl [85.145.196.156]) by mwinf6303.online.nl (SMTP Server) with ESMTP id DF9F97000082 for &lt;submit.&lt;z&gt;[at]spam.spamcop.net&gt;; Mon, 4 Aug 2008 20:06:01 +0200 (CEST) X-ME-UUID: 20080804180601916.DF9F97000082[at]mwinf6303.online.nl From: "&lt;y&gt;" &lt;&lt;y&gt;[at]wanadoo.nl&gt; To: "spam" &lt;submit.&lt;z&gt;[at]spam.spamcop.net&gt; Subject: FW: &lt;y&gt; Britney still has cool t*tsWatch. Date: Mon, 4 Aug 2008 20:05:31 +0200 Message-ID: &lt;000901c8f65c$af77fe80$0e67fb80$[at]&lt;xxx&gt;[at]wanadoo.nl&gt; MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000A_01C8F66D.7300CE80" X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: Acj2VXjV50ZxfALKQd6Aj+rooZMsYwABrHHg Content-Language: nl BTW: I changed different recognizable strings in <x>, <y>, or <z> etc... Does this make sense to someone?
  9. Oriolus

    No IP-address, cannot report

    That'll be interesting! Have a nice weekend
  10. Oriolus

    No IP-address, cannot report

    I did see you mentioning (as I thought) that you were using Outlook 2003, but now I read this sentence, it was meant for me to answer (language ...). I use Outlook 2007 (12.0.6316.5000) SP1 MSO (12.0.6213.1000) MS Office Prof, under Vista Home Premium SP1. My ISP asks me to use POP3. I hope this is precise enough.
  11. Oriolus

    No IP-address, cannot report

    1. The 'normal' way, not sending a number of spams in bulk, but via the Outlook/Eudora workaround way: I find a spam in my Unwanted e-mails-folder (U-folder); I move that mail to a folder where the body is displayed in a pane under the pane where sender's name and subject line are displayed; I click right at the line in the upper pane with name and subject line and select from the roll down menu (translated) Message options, at which I get a window with what I would call the headers of that mail; I select all in that window and copy selected, i.e. Ctrl-A, Crtl-C; I switch to the SpamCop reporting site http://www.spamcop.net/sc, where we see: Report another spam? and the two panes for the workaround method: Paste headers and optionally mime separators in first box: <empty box 1> Paste decoded email body in second box: <empty box 2> I paste what I copied into box 1 and observe what kind of message body I have to expect: text/plain, which means that I can copy the message body strait away, or differently, which means that I have to extract the body's HTML-code; If it is differently (the second possibility: not text/plain) I almost always get the HTML-code with some effort and paste it into box 2. If I don't succeed getting the code, I copy the body as text, paste it into box 2, and apologize for not succeeding in getting the body in the right way into box 2 by means of a note that goes together with the report; So, I report what's in box 1 and 2; I move the spam mail from the folder to one where I keep reported spams for a while. BTW In this way I have to more or less 'open' the spam's body which I hate. 2. The bulk way: I have collected an amount of spams in my U-folder; I select New Mail and select my SpamCop-reporting e-mail-address in the To:-field; I click on the first spam in the U-folder. With Shift held, I click on the last spam in that folder. Holding down the mouse button I drag in this way all selected spams into the message pane of my New Mail; I click on Send; I wait a while until my reporting pane will show Unreported spam Saved: Report Now?; =>I click the blue Report Now? and I get the (next) report to be reported; I click the Send spam Report(s) Now-button and go back in this description to => until there is nothing more to report. ( OT: I don't get the word spam with a starting capital, very odd! ) BTW In this way I need not open any mail, so there will go no message (no matter how) back to the spammer or to some other sneaky place, where the spammer knows something more about me or gets his money for his deed. I hope this is elaborate enough to find possible faulty actions of mine I cannot find the way how to change the forwarding setting (I wouldn't like it standard like that, though), but, as described the effect is the same: by dragging them into the new mail, they appear as attachments. I don't forward my spams, I send them as attachments in a New Mail. Is that actually what's the thing that makes the headers get out of order? I wouldn't know, however, how to forward more than one mail; selecting (like I do to move them to my New Mail) an then press Forward (if possible, and what happens then?)? No, I was not expecting you to clear up my Mailhosts settings, I was thinking that you could peep into them, but that's not true, as I understand now. Pff, that was a story! I hope you are not bored by now!
  12. Oriolus

    No IP-address, cannot report

    Just to be sure: I mailed you
  13. Oriolus

    No IP-address, cannot report

    To clear up possible dark things: Wanadoo.nl was bought by orange (maybe not in this spam here), but orange.nl was in turn bought by online.nl, and this story probably goes for all of them, not only .nl, but .fr and .be and others. So, what I probably have to do, if I understan well, is to introduce online.nl (and maybe orange.nl as well) as legal isp-adresses for my accounts. But this might not solve the problem with wisecontrol.com which resides in Korea, and has probably nothing to do with online.nl as far as I heard of, but maybe I should ask that with the helpdesk of online.nl? Sorry, but I only try to understand what you are explaining to me. I get lost at the place where you suspect forgery. Would it help if I send to you the headers of an email that you sent to me? Would that distinguish ISP-related addresses from others? The reason why I prefer to bulk send spams rather than via the Outlook workaround way, is that I need not disclose the message body when sending bulk, whereas I have to, to be able to send the html-code (if I can get hold of it: sometimes I'm not!).
  14. Oriolus

    No IP-address, cannot report

    Funny mail.wisecontrol.com has, as far as I know, nothing to do with my ISP. I should not do that, if I understand well... According to Mcafee's SiteAdvisor, wisecontrol.com seems to be a trustable Korean site with lots of clients: http://www.siteadvisor.com/sites/wisecontrol.com/summary/ But maybe this is not the way of checking trustability of sites...
  15. Oriolus

    No IP-address, cannot report

    This is from the one that went wrong: Parsing header: 0: Received: from [83.10.122.98] by mail.wisecontrol.com; Wed, 30 Jul 2008 13:17:32 +0100 Hostname verified: aclu98.neoplus.adsl.tpnet.pl Possible forgery. Supposed receiving system not associated with any of your mailhosts Will not trust anything beyond this header No source IP address found, cannot proceed. Add/edit your mailhost configuration Finding full email headers Submitting spam via email (may work better) Example: What spam headers should look like Nothing to do. This makes sense indeed. Would you like to see the original spam mail? BTW, things are getting mixed up, sorry. Would the original spam mail make sense?
×