Steve

That's why, whenever possible, I take the X-Originating-IP address and replace it with NTT's and then report the email again.

SC NEVER picks X-Originating-IP up in ocn.ad/ne.jp emails. I almost always (99% of the time) have to re-report the emails and replace the 1st 153.xxx.xxx.x/153.xxx.xxx.xx IP address with the IP in the X-Originating-IP field so it goes to that respective ISP. Steve

Then why haven't they stopped all spam yet despite the hundreds if not thousands of reports sent?

Is there any surefire way to get ocn.ad/ne.jp emails to stop (of course, aside from setting a filter to send them to trash) because reporting to abuse (at) ocn.ad.jp seems like NTT doesn't give a crap despite the auto-reply email they send out. Also, why doesn't SC parse the originating IP address since that's where the emails originate from despite the spammer (scammer) using NTT's servers to send this crap?

Everything is good, Lking. Why is the forum set up that way? Shouldn't members be able to edit/delete their posts without restrictions? Steve

There's no edit button on my original post with the copies of the emails. Steve

I am unable to. There is no delete button. I am using WIN10 with Chrome. I submitted everything. No new host has shown up. Steve

Mailhost I created (Gmail2) still not showing up in Mailhosts. This is really pissing me off! I had SC robot send the emails, I copied the headers and body and put them in their respective fields, submitted them all, but still nothing! If I try to do it via email, I get this error: I don't understand. I copied exactly as is from Gmail. Why would it be mangled? This happened for all emails I got from SC robot to set up Gmail 2. All 5 are included above for reference. Steve

Tried to add a new host using the current email gmail address I use for reporting spam naming it gmail 2 but it didn't show up. Steve

Not sure how to re-configure my gmail mailhost. There are no instructions there. Steve

When trying to submit the below email for reporting, I get this result (bold text at bottom): How can this be fixed so that the emails get reported correctly? BTW, this address (2002:a17:902:2468:0:0:0:0), is registered to IANA. Steve

I've reported several hundered spam messages with no let up in messages being sent from their network. Here's a recent (January 8th) auto-reply email I got from sending a report to abuse [at] ocn.ad.jp through the reporting form: Whenever possible, instead of reporting emails to OCN (abuse [at] ocn.ad.jp) using the reporting from, I look for the X-Originating-IP at the end of the email and try to report it that way by replacing OCN's IP address in the 1st Received line such as the one below: Received: from mbkd0102.ocn.ad.jp (mbkd0102.ocn.ad.jp. [153.149.230.3]) with the one in the X-Originating-IP which is usually a 41.xx.xxx.x and usually, the ISP's email address that comes up is netabuse [at] mtn.bj. Steve

It doesn't parse the X-Originating-IP most of the time. And that message is not displayed (except for the 1st received line in all www.@xxx.ocn.ne.jp emails with "xxx" taking the place of whatever happens to be first part of the email address. In this example, fuga is in front of the ocn.ne.jp part of the email address). This example is from an email dated 8/25/17: Steve

Delivered-To: x Received: by 10.25.215.152 with SMTP id q24csp535241lfi; Thu, 24 Aug 2017 09:51:44 -0700 (PDT) X-Received: by 10.98.139.141 with SMTP id e13mr7047592pfl.192.1503593504252; Thu, 24 Aug 2017 09:51:44 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1503593504; cv=none; d=google.com; s=arc-20160816; b=fBJmIS25wTFiKufRoEtHIR4yY+RxpAmVw1qETMO6BmHmkoD/kNAByCdzdg2gLc+9OB EV5W7bmHtpyYOl7HVu+Q27UOcRSno/9RUQBhdIGmxouQDwkxgCFfIRp8NJph2zqXl347 7y14tU6P8NQ5SD9m/X3vMXFzfyOs4l28urC/MFYWzcAyKHfeEL9/JwIOjDUIB49xSTlX jjLpRDuEe2lqlwLY6w/qa8QBqqzFZ34g7OkM6AvjNFknBhjKuyD82blBy+7nhRg0vzgH PcoRRilbtrkshECm+fbMIfB8hyLBf+mMc0M/XwX3sHY3tRsnZ7zdMP44Gc/BY7mu7pNw N4Hg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:subject:message-id:reply-to :from:date:arc-authentication-results; bh=rPAAmo/5jRgIb94r0jqE8K1b0fFvRv5wn0ibit2p+KY=; b=Qtk+gWgPsqzkTIZEX98e505OVUCCR7xNDkxlaxrk0tMknMfZQq+fA3QfzxdHMpoS5P Irze7G9SvkNz7aWjG46mTjiY6ouYdX6bh8hZfoO7TjCombVU9iu9jRnVhb8NT5jGaMCN Iy66gywmK36qdgd5TgkswLHZ42TqdLO6Wt2Sb1HqG+YzFlJXYpxOkICVe4vtIuVQ0esI s71PSMYp/ZsEi7+rqxjlJKl+dslH0dUtYeyfmKDoCFD85aTg5w3Tfb3rsV4ae3u+lDPe 5BSy12/zva0/BbIva4sZ/vWxXoYxUYAZnefPmLuB8Z/YvUy0ROjRx9aeq9pKHWtANcy5 iQwQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of www.@athena.ocn.ne.jp designates 153.149.236.41 as permitted sender) smtp.mailfrom=WWW.@athena.ocn.ne.jp Return-Path: <WWW.@athena.ocn.ne.jp> Received: from mbkd0340.ocn.ad.jp (mbkd0340.ocn.ad.jp. [153.149.236.41]) by mx.google.com with ESMTP id j125si1438059pfg.305.2017.08.24.09.51.30; Thu, 24 Aug 2017 09:51:44 -0700 (PDT) Received-SPF: pass (google.com: domain of www.@athena.ocn.ne.jp designates 153.149.236.41 as permitted sender) client-ip=153.149.236.41; Authentication-Results: mx.google.com; spf=pass (google.com: domain of www.@athena.ocn.ne.jp designates 153.149.236.41 as permitted sender) smtp.mailfrom=WWW.@athena.ocn.ne.jp Received: from mf-smf-ucb005.ocn.ad.jp (mf-smf-ucb005.ocn.ad.jp [153.149.231.4]) by mbkd0340.ocn.ad.jp (Postfix) with ESMTP id 9F0BC128035D; Fri, 25 Aug 2017 01:50:59 +0900 (JST) Received: from mf-smf-ucb005.ocn.ad.jp (mf-smf-ucb005 [153.149.231.4]) by mf-smf-ucb005.ocn.ad.jp (Postfix) with ESMTP id 7C6D760709; Fri, 25 Aug 2017 01:50:59 +0900 (JST) Received: from ntt.pod01.mv-mta-ucb026 (mv-mta-ucb026.ocn.ad.jp [153.149.142.100]) by mf-smf-ucb005.ocn.ad.jp (Switch-3.3.4/Switch-3.3.4) with ESMTP id v7OGoXcD065068; Fri, 25 Aug 2017 01:50:55 +0900 Received: from vcwebmail.ocn.ad.jp ([153.149.227.165]) by ntt.pod01.mv-mta-ucb026 with id 14qu1w0013akymp014quba; Thu, 24 Aug 2017 16:50:55 +0000 Received: from mzcstore142.ocn.ad.jp (mz-cb142p.ocn.ad.jp [114.147.59.200]) by vcwebmail.ocn.ad.jp (Postfix) with ESMTP; Fri, 25 Aug 2017 01:50:54 +0900 (JST) Date: Fri, 25 Aug 2017 01:50:54 +0900 (JST) From: Taka Benson <"WWW."@athena.ocn.ne.jp> Reply-To: Taka Benson <dhlcourierservicebej@hotmail.com> Message-ID: <1703504187.5321643.1503593454940.JavaMail.root@athena.ocn.ne.jp> Subject: Information MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-2022-JP Content-Transfer-Encoding: 7bit X-Originating-IP: [5.45.62.153] Information Contact DHL Courier for your compensation Bank card valued $1,500,000.00 USD is been registered and your ATM CARD package is under Mr. Albert Godwin's care reach him via email: (dhlcourierservicebej@hotmail.com) for more information on how to claim it. Greetings, I almost always have problems getting SC to parse the X-Originating-IP in OCN/NTT emails I receive (such as the one above). I end up having to report the emails with those IP addresses separately through SpamCop to the ISP. Why won't it recognize those IP addresses? Most originate from Benin (41.xx.xxx.xxx/197.xxx.xxx.xx). In this case, when I parsed the email again with this IP address, the X-Originating-IP resulted in the email being sent to abuse@avast.com Tracking link: https://www.spamcop.net/sc?id=z6401117976z6d5deab26600019361ed7458288314dez Steve

? How exactly would I add AOL? Steve Tried the instructions in the email SC sent to my Verizon address on AOL Mail and got this error: Host mtaiw-aaf07.mx.aol.com (checking ip) IP not found ; mtaiw-aaf07.mx.aol.com discarded as fake. Sorry, SpamCop has encountered errors: The email sample you submitted for s*********@v******.net (obscured for obvious reasons - spambots) appears to traverse more than one domain. Please ensure that you configure each mailhost individually and in order. Proceed here: <https://www.spamcop.net/mcgi?mhc2=Ez2CZ0s7jSOYgdKz>