Jump to content
Sign in to follow this  
5280 Guy

How to tell if spam is actually being Reported?

Recommended Posts

I keep getting spam from the same companies to my GMail account.  I report them, but get them again.   When I get the "[SpamCop] has accepted 1 email for processing" screen I always get the messages below.  I am able to submit the reports, but are they being processed?  Is there a way to tell?
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 
Using abuse#iana.org@devnull.spamcop.net for statistical tracking.

Using last resort contacts abuse#iana.org@devnull.spamcop.net

Chain error mx.google.com not equal to last sender received line discarded
 
Finding links in message body
Parsing text part
error: couldn't parse head
Message body parser requires full, accurate copy of message
More information on this error..

Share this post


Link to post
Share on other sites
Quote

Here is your TRACKING URL - it may be saved for future reference:<br>
https://www.spamcop.net/sc?id=z6464721556xxxxxxxxxxxxxxxxxxx
Skip to Reports

Please provide the TRACKING URL for your spam so that the rest of us can see why you got the message.

Sense you are using gmail, have you looked at the three most current threads in Reporting Help? They may provide insight.

Share this post


Link to post
Share on other sites
1 hour ago, Lking said:

Thanks.  I did look at those before.  They seem to pertain to Outlook, if I'm not mistaken.

https://www.spamcop.net/sc?id=z6464746256zfdad385c9ada00c8f7b43c3d060c910bz

 

 

1 hour ago, Lking said:

 

Please provide the TRACKING URL for your spam so that the rest of us can see why you got the message.

Sense you are using gmail, have you looked at the three most current threads in Reporting Help? They may provide insight.

 

Share this post


Link to post
Share on other sites
2 hours ago, 5280 Guy said:

I am able to submit the reports, but are they being processed?  Is there a way to tell?

Looking at the Tracking URL above.  At the bottom is

Quote
Reports regarding this spam have already been sent:

Re: 2002:a9d:37c6:0:0:0:0:0 (Administrator of network where email originates)
   Reportid: 6813552678 To: abuse#iana.org@devnull.spamcop.net

If reported today, reports would be sent to:

Re: 2002:a9d:37c6:0:0:0:0:0 (Administrator of network where email originates)

abuse#iana.org@devnull.spamcop.net

Your spam was process and a spam report generated for the source (but not for links in the body).  The report was NOT sent to "Administrator of network where email originated" for some reason.  That is why the report is to devnull.spamcop.net.  Your spam is adding to the database to ad to the SpamCop Block List.

Share this post


Link to post
Share on other sites

Thanks for checking that out and for the explanation.  The ""Report was not sent to the administrator of network where email originated" explains why I keep getting this spam.  Any suggestions?

Share this post


Link to post
Share on other sites

There are several reason why the report was not sent to the ISP: 1) they have ask not to receive spam reports, 2) It has been found that the ISP forwards the reports to the spammer 3) reports sent to the identified abuse address for the ISP bounce...

SpamCop not wanting to be part of the internet clutter, sees no point sending reports to an ISP that, at best, will not accept or ignore the report not taking action.

It is always hoped that an ISP would see a stream of spam reports related to one of their clients and cut the spammer off.  However, some ISPs are more interest in making money than being a responsible member of the internet community.

Share this post


Link to post
Share on other sites

That's understandable, but frustrating.  Is there a way to identify the ISP so that I can complain to them?

Edited by 5280 Guy

Share this post


Link to post
Share on other sites

Reading between the lines,  the devnul mail box abuse#iana.org{AT}devnull.spamcop.net gives the clue you are looking for abuse#iana,org  Going back to the Tracking URL, the IP of interest is  10.157.55.198  and that can be used with a WHOIS look-up to find contact info.  

Share this post


Link to post
Share on other sites
3 hours ago, Lking said:

Reading between the lines,  the devnul mail box abuse#iana.org{AT}devnull.spamcop.net gives the clue you are looking for abuse#iana,org  Going back to the Tracking URL, the IP of interest is  10.157.55.198  and that can be used with a WHOIS look-up to find contact info.  

The first genuine line is

ARC-Authentication-Results: i=1; mx.google.com;

 

Everything above that is spoofed by Gmail authentication (spam from ham) software. I just cut then past into notes headed "cut authentication headers below" past them in notes after parse!

Share this post


Link to post
Share on other sites

Last questions.l  The tracking URL i s here:

https://www.spamcop.net/sc?id=z6464897720ze63276d79844e2792e2000caad66b711z

The spammer is houzz.com.  I see this text:

64.235.44.15 is not an MX for mail.houzz.com.
mail.houzz.com. is 64.235.44.15

I looked up that IP address and get this:

image.png.ed383cf3bb04ce7411adad49f8cf186a.png

That doesn't seem to be the company to complain to.  Is there a way to get that from the header?  I am missing something.  Thanks.

 

Share this post


Link to post
Share on other sites
57 minutes ago, 5280 Guy said:

That doesn't seem to be the company to complain to.  Is there a way to get that from the header?  I am missing something.  Thanks.

Cut the Gmail Authentication headers out  you get https://www.spamcop.net/sc?id=z6464905037z91d5435236bd5d8ec7b97204acb1945ez

Share this post


Link to post
Share on other sites

Okay - I see some very useful information (below).  But how did you get that?  I can see where you cut the GMail stuff, but what did you have to do in order to get the stuff at the bottom?  (I think that abuse@serverpoint.com is key).

Should I just strip out the Gmail headers when submitting the initiial report via e-mail to Spamcop?

abuse@serverpoint.com
noc#premianet.com@devnull.spamcop.net
abuse#aplushosting.com@devnull.spamcop.net
abuse#premianet.com@devnull.spamcop.net
support@premianet.com

Share this post


Link to post
Share on other sites
8 hours ago, 5280 Guy said:

Should I just strip out the Gmail headers when submitting the initiial report via e-mail to Spamcop?

Yes but re-past them in comments  

Share this post


Link to post
Share on other sites

Sorry. I'm really dumb with this.  I took the earlier suggestion to use the headers without the GMail stuff - from  "ARC - Authentication-results:"  down.  I then saw the results below - very encouraging.

When submitted it before (the old way) using the full headers, the only address for reporting was abuse#iana.org@devnull.spamcop.net.

Now, when I did it copying and pasting from "ARC - Authentication-results:"  down.," I received what seem to be the same results that you did.  I also pasted the headers into comments before I submitted the report, but as the below addresses were already there in the response from Spamcop I don't think it will make any difference.

It seems this is working.

 

image.thumb.png.a2f81ff5bda0e8441f1971c0432dfb69.png

 

 

 

Share this post


Link to post
Share on other sites
6 hours ago, 5280 Guy said:

It seems this is working.

The idea is to try and get better than the Bot SpamCop who can be stupid. Get a Whois program to get real address's,  Bottom of page download link

http://www.nirsoft.net/utils/ipnetinfo.html

often SpamCop gets them wrong, but just reporting get the spam source blocked. Gmail are getting to smart for their own good. if somethings "free" you are the product!

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×