scottbomb Posted June 2, 2016 Share Posted June 2, 2016 /dev/null'ing report for nomaster@devnull.spamcop.net That message is all I get every time I report a spam message. I'm getting SPAMMED by the same people, 2-4 times per day. I signed up for spamcop because their host (Godaddy) seems to be ignoring the over 50 messages I've forwarded to them. Does this most unhelpful error/message mean that my reports are just going into the trash? Why? I'm including full headers and if they do a simple WHOIS on the info. in the headers, they'll see it's hosted by Godaddy. Any ideas? Here's an example of an spam I recently reported: Return-Path: <return-a1081-385520-385524-scott=scottbomb.com=4@if.inboxfirst.com> Received: from smtp1-38.if.inboxfirst.com ([64.21.76.101]) by mx.perfora.net (mxeueus004) with ESMTP (Nemesis) id 0MSbzO-1b0hub1heG-00RZVs for <scott@scottbomb.com>; Thu, 02 Jun 2016 18:59:33 +0200 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=americanactiondaily.com; s=defaultif; t=1464886773; bh=+i3xCgUVQc5mPDZCn0xNo/xz/Ik=; h=Subject:From:To:Sender:Reply-To:Date:List-Unsubscribe: X-CampaignID:Message-ID:X-Mailer-Info:MIME-Version:Content-Type; b=SrDevA0is1198GnYuFRQzQezNrkgPgwb4RfBM8RqB0Xa/RfLhwYrx5KKOn17cpBEB iJopCGitmHST7yWtdn1dAnrerrypVrTJ0GrLfS6/xT8kFI9kUqSUG8zhei0vOuUJQ4 w1LzJSlMKXsgIhjKDmas7j5dCsXZshyOlTb2KPTs= Subject: =?UTF-8?Q?Refugeehad=3A=20Muslim=20Immigrant=20Attacks=20Patri?= =?UTF-8?Q?otic=20American=20Family=20=2D=20Hillary=20or=20Bernie=3F=20?= =?UTF-8?Q?Trump=20Reveals=20Which=20Opponent=20He=27d=20Rather=20Face?= =?UTF-8?Q?=20=2D=20Obama=20Agency=20Approved=20This=20Islamic=20War=20?= =?UTF-8?Q?Criminal=20To=20Keep=20You=20Safe?= From: "American Action News" <news@americanactiondaily.com> To: scott@scottbomb.com Sender: news@americanactiondaily.com Reply-To: news@americanactiondaily.com Date: 02 Jun 2016 16:59:33 -0000 List-Unsubscribe: <http://nbxfrst.com/ga/unsubscribe/2-321521784-1081-181673-385524-e1ab453d748b72f-cbfd538eca>, <mailto:return-a1081-385520-385524-scott=scottbomb.com=4u@if.inboxfirst.com> X-CampaignID: s4:385520-c882d8dd8d18d08f Message-ID: <mid-cf2cbd5f0582522fde4221fe7380a0de@if.inboxfirst.com> X-Mailer-Info: 4.EWMwgTM.zgTN1IDM.wcj9Gd0B0cj9Gd0J2btJmLj9Wb.zgTN1IDN MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="==d984532cd1f22bcc62a6234fc053188e" Envelope-To: <scott@scottbomb.com> X-UI-Filterresults: junk:10;V01:K0:IDb+zhneYkM=:ltO3311wlOUFFm2I14Jgfwj5iDKh BXFebWF/T5cSuGKh+NdaF8mv10vvLlbr34hDgvZhfCJWVsV+HhlEvauAAXwz1UFU44n4EvEt1 KX/dveaju6kSaQuEhaJDAB9EmIQHGp1CT/BZhgvfdLoY3S+nomztplwCUcndIbWcTJ7xhvrPk rwX7vnJ7Uhk/qT+aN6JDo7X1K+O/WBZk8VoG3CSK8BZSnPwYsTimxRcm7HZZM7h51A1u2LOEg 5dKUrYsgkutw9nUoffep4r7Ew0u7Dq6yryEAaH+VZvMqHF29DngebBsJ9nWQeRmo57h+QTleN 68ZW8cEtcpPVtgBbSTYGHeFH3jteUP9SoTmK5FAsbw08HWsL6Bir6waeqYUi3bKFIlWzNw5vT qAVfXx9uksBpec5MvFf8p8Ckmo7o9tXYKAp0tE4AMy1bm+M+5aUMN/kyUp9pqjgIL+nDXm4to haVKZAqAwrCl0/MN0Wci6lbFU+2+PNxVbscCihqntj2yRzEFk028OyFpp79mxJ/SWEBJZ8Vab F+a3NyvLFrJv0wnHzff0MqfYzqbavVMncWOSerTMLmIalfIjPdyspRVwqhWOMslWgdbLkM6L9 aG77ATdwlzuFAYlJRIxkmp1Uh1EHvgs9lhJqed0FrYM1JAgYHAbu2en9OK+oF2PurK9AnKxIh 6SfgQnUmErPi85FhiVL7+ZZ4jlh5kq03evwv65cZlZze4S25ApGZcv53u8FF9Fdx/6//v7n5h xTQC/yQnk0kmO7TVi02THMW6YokaS9QnbZbEsLVAyzGNqp2K7MK3HTh41cAaUT1VwChlItIUm 8ze8p8+LoltjO9D8zXt1mLsyUT92q/sulq8GE4NtyrJrGX7dHZhj6vf3QLH62IkjG06Lhq4V2 zGKbQjNHZufD+ZktHbH7+8IyE82d89/bjY8U8a5Rxw0LaZ+MjmIrWEJZGaARb9d4ti20b1msu 3hm1kBw3DaJ7kRIugIhgmPrKLbDSPVbQ5+QGmYDqeRwkl8OPeyhxewul4TV434TOJ3kMy5dMs qUmiN0y5o/VfM0z0HncTp5BFWPvgvoC06SS/fCY0+XtrKv/6vW05MFR9/JPwMhCQP/6n+EfI7 MYbxNXeCMO3zPJauD49xMqSoRRU/msnCju6leYyUVNuMBM6+411QrCon9wYzV5OPdqj2Se+10 Mc9pC4NnNKbWXd6eUIm35AsvnUVTv0PnmoTolz3tVcEvqEuFtVzihrkwP4Rhjp5DD49Z+dnnb MjuH65FPdTc37n1Pb2x06uRhQ7yYvQE2CvbUjxUQ2h+oO0bE2UkrjDRWtlIpSAjQi4jTJZYGp GGMfe54Yp3CELLHhKGcVsdb8uXX6zP/3PhErvw2p5/aqTWQIxXPOu+YBTzg/cWODbB8hbI1le ERfXssi31tPqhLO04nRzivTx+iXevl4Vy5ey4pi/lG/yXHEZjNXuh64eS7lsM/8mIt0LkodzD 5h9fYhBm6rg2HOG+N5kLNe8AomUJEavhzNvUfu5x4efYGSo9PueN6na4x2bv1HhRHtSWRg== -----Original Message----- From: news@americanactiondaily.com [mailto:news@americanactiondaily.com] Sent: Thursday, June 02, 2016 12:00 PM To: scott@scottbomb.com Subject: Refugeehad: Muslim Immigrant Attacks Patriotic American Family - Hillary or Bernie? Trump Reveals Which Opponent He'd Rather Face - Obama Agency Approved This Islamic War Criminal To Keep You Safe BREAKING: UCLA Shooter Identified <http://nbxfrst.com/ga/click/2-321521784-1081-181673-385524-2762065-67af39bc01-cbfd538eca> <https://if.inboxfirst.com/ga/campaign_images/103495/AAN%20Header%20New.png> <http://nbxfrst.com/ga/click/2-321521784-1081-181673-385524-2762069-967b01e58c-cbfd538eca> <http://li.americanactionnews.com/imp?s=180730&sz=1x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=180731&sz=1x1&li=160526&e=scott@scottbomb.com&p=181673> <http://nbxfrst.com/ga/click/2-321521784-1081-181673-385524-2762070-f7221ec4e7-cbfd538eca> <http://nbxfrst.com/ga/click/2-321521784-1081-181673-385524-2762071-6225d989b9-cbfd538eca> Refugeehad: Muslim Immigrant Attacks Patriotic American Family <http://nbxfrst.com/ga/click/2-321521784-1081-181673-385524-2762066-fa971aab10-cbfd538eca> You won't believe why Hillary or Bernie? Trump Reveals Which Opponent He'd Rather Face <http://nbxfrst.com/ga/click/2-321521784-1081-181673-385524-2762067-2ef85ae210-cbfd538eca> It might surprise you Obama Agency Approved This Islamic War Criminal To Keep You Safe <http://nbxfrst.com/ga/click/2-321521784-1081-181673-385524-2762068-576293d5fd-cbfd538eca> Where's he working is terrifying <http://nbxfrst.com/ga/click/2-321521784-1081-181673-385524-2762072-7078422f23-cbfd538eca> <http://li.americanactionnews.com/imp?s=180724&sz=1x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=180725&sz=1x1&li=160526&e=scott@scottbomb.com&p=181673> <http://nbxfrst.com/ga/click/2-321521784-1081-181673-385524-2762073-b7731efc4f-cbfd538eca> <http://nbxfrst.com/ga/click/2-321521784-1081-181673-385524-2762074-f7fc267d2b-cbfd538eca> <http://nbxfrst.com/ga/click/2-321521784-1081-181673-385524-2762075-348cf8ff63-cbfd538eca> <http://li.americanactionnews.com/imp?s=180727&sz=1x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=180728&sz=1x1&li=160526&e=scott@scottbomb.com&p=181673> <http://nbxfrst.com/ga/click/2-321521784-1081-181673-385524-2762073-b7731efc4f-cbfd538eca> <http://nbxfrst.com/ga/click/2-321521784-1081-181673-385524-2762074-f7fc267d2b-cbfd538eca> Like Us on Facebook and Follow Us on Twitter! <http://nbxfrst.com/ga/click/2-321521784-1081-181673-385524-2762076-81fb0a847e-cbfd538eca> <http://nbxfrst.com/ga/click/2-321521784-1081-181673-385524-2762077-9288b0e20d-cbfd538eca> Sent by American Action News, 203 S. Union St., Suite 320, Alexandria, VA 22314 Unsubscribe me from this mailing list <http://nbxfrst.com/ga/unsubscribe/2-321521784-1081-181673-385524-e1ab453d748b72f-cbfd538eca> or email info@americanactionnews.com <mailto:info@americanactionnews.com> <http://li.americanactionnews.com/imp?s=124302900&sz=2x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=124302901&sz=2x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=124302902&sz=2x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=124302903&sz=2x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=124302904&sz=2x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=124302905&sz=2x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=124302906&sz=2x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=124302907&sz=2x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=124302908&sz=2x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=124302909&sz=2x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=124302910&sz=2x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=124302911&sz=2x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=124302912&sz=2x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=124302913&sz=2x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=124302914&sz=2x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=124302915&sz=2x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=124302916&sz=2x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=124302917&sz=2x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=124302918&sz=2x1&li=160526&e=scott@scottbomb.com&p=181673> <http://li.americanactionnews.com/imp?s=124302919&sz=2x1&li=160526&e=scott@scottbomb.com&p=181673> <http://nbxfrst.com/ga/open/2-321521784-1081-181673-385524-cbfd538eca> Link to comment Share on other sites More sharing options...
Lking Posted June 2, 2016 Share Posted June 2, 2016 It is much better if you would provide the Tracking URL instead of the spam. That way others can see what the parser did with your submitted. Do keep in mind that although [at]americanactiondaily.com may look like the source of the email based on the Sender: and From: lines in the header. These lines can easily be forged by the spammer. SpamCop uses information in the Received: lines. Although godaddy is listed as the Registrar of the domain name you see. The are a domain-name re-seller but may not be the host of the domain (provide access to the domain on the internet). Link to comment Share on other sites More sharing options...
scottbomb Posted June 2, 2016 Author Share Posted June 2, 2016 Perhaps this is what I should have posted? By the way, I've spoken with Godaddy (twice) about this and they've admitted that it's their customer. Of course, they won't do anything to stop it, which is why I signed up for Spamcop, which appears to be just as helpful: SpamCop v 4.8.4 © 2016 Cisco Systems, Inc. All rights reserved. Here is your TRACKING URL - it may be saved for future reference:https://www.spamcop.net/sc?id=z6246370056zced38f0f9968b502cfba15b72d7ab038z Skip to Reports Return-Path: <return-a1081-385682-385687-scott=scottbomb.com=4@if.inboxfirst.com> Received: from smtp1-38.if.inboxfirst.com ([64.21.76.101]) by mx.perfora.net (mxeueus001) with ESMTP (Nemesis) id 0MV41r-1az2cN1wyL-00YTou for <x>; Thu, 02 Jun 2016 21:58:46 +0200 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=americanactiondaily.com; s=defaultif; t=1464897526; bh=plITLIIyONAUj8hUNDt8MdcbBZ8=; h=Subject:From:To:Sender:Reply-To:Date:List-Unsubscribe: X-CampaignID:Message-ID:X-Mailer-Info:MIME-Version:Content-Type; b=Sf7ceWY8XTwQBn9wsiBM22l5391nf77t+/ZLt7jGVsCZIrVOaIBSjWNvCNs0oEAdS jZjUVZjSkh1PeGK/cQI39FTyHJN7vGWgIjatvum3Kt3Sxv3eTDuUae0Dv4czBbwJYO mP6jPngLG1Dq1GL+MoJeZqHgzWIgP8Fzb+IaKsYA= Subject: BREAKING: Paul Ryan's Final Decision on Trump From: "American Action News" <news@americanactiondaily.com> To: x Sender: news@americanactiondaily.com Reply-To: news@americanactiondaily.com Date: 02 Jun 2016 19:58:46 -0000 List-Unsubscribe: <http://nbxfrst.com/ga/unsubscribe/2-321521784-1081-181765-385687-e1ab453d748b72f-0c416eb366>, <mailto:return-a1081-385682-385687-scott=scottbomb.com=4u@if.inboxfirst.com> X-CampaignID: s4:385682-858986b458ddffce Message-ID: <mid-____________________________bcd1@if.inboxfirst.com> X-Mailer-Info: 4.EWMwgTM.zgTN2gjM.wcj9Gd0B0cj9Gd0J2btJmLj9Wb.zgTN2gzN MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="==5f64cadc59b87aaed6ad3bede51f6e9f" Envelope-To: <x> X-UI-Filterresults: junk:10;V01:K0:JRGsLKpAFkc=:peAVNlgxf3DXlhRGZEkCK05NtNPJ coXEl8GrtC8sPr2gEh/UafAHrzz15bdnlF50jDzOeHwkJ62I6gQYBCP/26O+Or1nA03X6z7uV Z+5/kaBYRj2GZpMTZh9f20ChsdC9y4+MwZMytkEq4pynHEgidfmZrV429QeLpz1GvpGQiewRn TKXggbjTpsS3j3RfHJlUu/mZc3o1P5aDzMFPwD2SZLIoRyTzcNcOfyErsG5TppE6HzeJ786yi 3WcLjdYwxbK4CJheAjdU6whBkbqQ4l3La80Pq+Rq2/SuhmapODryF/6B7GvfyUQXZJLNTB78g XN5sCDs9F/oMgAMgGBpv6T1KgsClYu9eK2DZvQRyQYmB3o4LtElyAGTUTAp10JE/kXs+G6Pfc 9eGXJX+OqjFHSDgt2jQKWX9TEWF6pZ36LfkVWWWvuxm8YwtpXPmb6/b1VLR3PgpxQzr1TYpPy zraRKFjr5NVgY7BfRA2n9ueTkAZTj2mAhjy9tTnQyxz4/dFCJYsvI3O/XtAq37KBhwkutewGT QLcYOYCoj67am2VdF3YXuUdFhO9RWmH/IAQ8WlEz7msYNvsNOSC9RrWtRM3KL+bMYki+6VPUL 9yqvqj9aXFUm1GRPHWKwBL5Uk6VBjJQrsO7i3yWpzQYVjjPknF9fVeS5H0naWsbPQ7SMuqF/P Ag1TMcHIAXR3jlgreBa7cV4tS7PFWm5wyhM1xocRfn0qhz8pXNCwfZZP4514jMP5lDrhYfUYr VApBn67XyJEqLXV9RPceAFrdCwEavz29wUCmLBnEnTtQ5BCI7I4FzLhbv2XS4+SJSKJi63s5I v98Q7h/83F38o00SHp6A7Q9+XUcE30cwKbCp6Se1E8MYYYIZEr6cat4hTTPv4+ui27fktY4Zd pTCOHQVmBZ78N1giflAxg2owXvMUOQ8mdfgRQMTq55PuKaefM+pWt7YVYlj2SBsTUY3QGEs7T KIqpXz1RvEieZZmZi2Ea9CGOs/K0LirTVhb35TKWVbRZVj5us34gfvJGRigXmfGrbrWOLwRuT MRu3ctfv7CPtILxCX+zRHP3qyAM/7rVZpOg5f/wAPI5WLxCdnJ8svYE80K3x3sCXGUii/emR7 3Ybd2wSh+WFYbSFbhH4VM6DQU0pM8eUURyGDgL0y3hsmHMpvPgzJy56GW93FLjjKOzQmZbkaW oGYQtPruhv+3bIIWDziOCFuSkWtkFKRSI4UC7fruojJIjlo/lx+A5fDBMYxRXN/qhZy97U7tp 0/6OnYPp0GwR5yHGwmLa1jOwjVoXM1nfYhYMfJ8YOnCubnJ2CvxKGz/q3Eu7pAlH9kbTMsxgT u3oxreBlDcHdrHatm1f/ctC1PUT8gJ9UgSV11Tg0b4Kj4Bpv7N9Ep4IgggoGRH5oD9MGJyx4H VNIGxnpU9AyZWsNg7sRrkTGaQ3xtJ2o3KcWlRJn4FHEhnaf5IQjnI6Db4aseShqdWLrDyTICa nQSSUyuolCnNROFYm183OV/46+WgNedLyhWph1ehJcBylVxPVpDu2EoC5nlAS8L4zAzjfeSbq /11hR0W3Y7nEq26FzY= View entire message Parsing header: Received: from smtp1-38.if.inboxfirst.com ([64.21.76.101]) by mx.perfora.net (mxeueus001) with ESMTP (Nemesis) id 0MV41r-1az2cN1wyL-00YTou for <x>; Thu, 02 Jun 2016 21:58:46 +0200 host 64.21.76.101 = smtp1-38.if.inboxfirst.com (cached) smtp1-38.if.inboxfirst.com is 64.21.76.101 Possible spammer: 64.21.76.101 Received line accepted Tracking message source: 64.21.76.101: Routing details for 64.21.76.101 [refresh/show] Cached whois for 64.21.76.101 : abuse@nac.net abuse@nac.net bounces (99 sent : 99 bounces) Using best contacts No reporting addresses found for 64.21.76.101, using devnull for tracking. Yum, this spam is fresh! Message is 0 hours old 64.21.76.101 not listed in cbl.abuseat.org 64.21.76.101 not listed in dnsbl.sorbs.net 64.21.76.101 not listed in accredit.habeas.com 64.21.76.101 not listed in plus.bondedsender.org 64.21.76.101 not listed in iadb.isipp.com Finding links in message body Header data found in body, aborting link detection Reports regarding this spam have already been sent: Re: 64.21.76.101 (Administrator of network where email originates) Reportid: 6474891800 To: nomaster@devnull.spamcop.net If reported today, reports would be sent to: Re: 64.21.76.101 (Administrator of network where email originates) nomaster@devnull.spamcop.net Link to comment Share on other sites More sharing options...
Lking Posted June 3, 2016 Share Posted June 3, 2016 All you needed to include was https://www.spamcop.net/sc?id=z6246370056zced38f0f9968b502cfba15b72d7ab038z With that, the rest of us can see the spam, and more important the results. and the spam itself does not clutter the forum and help the spammer by providing more links for search engines to find giving those spemvertised sights higher ratings. If you will look at the spam header: Quote Received: from smtp1-38.if.inboxfirst.com ([64.21.76.101]) by mx.perfora.net (mxeueus001) with ESMTP (Nemesis) id 0MV41r-1az2cN1wyL-00YTou for <x>; Thu, 02 Jun 2016 21:58:46 +0200 You will see that the email you received came from the IP address 64.21.76.101 If you do a WHOIS in that IP you will see that it is controlled by Net Access Corporation (NAC), not Godaddy. If you scroll down to your spam report you will see: Quote Tracking message source: 64.21.76.101: Routing details for 64.21.76.101[refresh/show] Cached whois for 64.21.76.101 : abuse@nac.net abuse@nac.net bounces (99 sent : 99 bounces) Using best contacts No reporting addresses found for 64.21.76.101, using devnull for tracking. Note that of the 99 spam reports sent to abuse[at]nac.net they (the admin of 64.21.76.101) have bounced them all. For that reason SpamCop does not see any reason for cluttering the internet with more reports and bounce responses. For that reason the devnull address is used to track statistics on this IP. As I suspected, GoDaddy is the domain re-seller that registered the domain americanactiondaily.com. I only see that domain, in the spam in the From:, Sender: and Reply-To: lines of the header. These lines are easily, often forged by spammers. Quite often the email address of the intended recipient is forged into the From: lines in an attempt slip through spam filters. As for GoDaddy there response to you may be typical. On a list of 30,000+ unique domains that have lately sent me spam, GoDaddy registered ~10% of them. Registrar Summary eNom Inc. 8800GoDaddy.com LLC 3090.ru 1262 hope this helps you understand your spam reports. Link to comment Share on other sites More sharing options...
scottbomb Posted June 3, 2016 Author Share Posted June 3, 2016 Interesting explanation, thank you. If only the report were in plain English. So in other words, there's nothing I can do? You're saying their hosting company is basically telling everyone to buzz off? I did a WHOIS on inboxfirst.com and found some pretty lousy results until today, a record indicating ownership at http://whois.domaintools.com/inboxfirst.com Link to comment Share on other sites More sharing options...
Lking Posted June 3, 2016 Share Posted June 3, 2016 By continuing to report the spam to SpamCop your input helps build the SpamCop blocklist which helps others keep spam out of inboxes. Yep, pretty much buzz off. Not an uncommon response from ISPs that make money by providing internet access to spammers. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.