Jump to content
db17

re. @devnull.spamcop.net

Recommended Posts

Posted (edited)

Have read the FAQ on this, https://www.spamcop.net/fom-serve/cache/253.html

After reporting spam, seeing that it goes nowhere, just to  @devnull.spamcop.net. Plus not seeing "Internal SpamCop Handling" anywhere in the report, so it seems it can't be reported to the host via spamcop. But seems I can forward the offending message directly to the spammer host via abuse@mailjet.com, if I contact them with my own email. But don't trust this host, so definitely don't want to use my own email address to do this.

Is there any way to report this spammer via spamcop anonymously to this hosting service, or by using some other method? Or am I just stuck?

 

NB. Is anyone looking at this forum?, this page is completely littered with spam.

Edited by db17
Additional info

Share this post


Link to post
Share on other sites

As I understand it, Spamcop's primary focus is to maintain a blocking/blacklist of sources of spam. Any reports that get sent out and are actually actioned by provider are a bonus. Even if the reports get dev-null'ed, Spamcop can still.  use the spam you report to help provide data for its blocking list.

There are other ways of tracking down a suitable reporting address. I rarely bother manually sending reports to providers,  but occasionally visit sites such as multirbl.valli.org and mxtoolbox that can assist in provide information that is of some help. Other volunteers at this forum might be able to jump in and suggest approaches that more directly address what you are asking.

Share this post


Link to post
Share on other sites

There are several reasons that SC may send a spam report to @devnull.spamcop.net

  • SC does not find a valid abuse address for the source IP.
  • spam reports sent to the identified/ listed abuse address have bounced 6 or more time. (No need to clutter the internet or wast the bandwidth)
  • The abuse address has ask SC not to send reports.  (SC does not want to be a spammer).
  • SC has reason to believe that the ISP passes the report onto the spammer
6 hours ago, db17 said:

Is there any way to report this spammer via spamcop anonymously to this hosting service, or by using some other method?

When you submit your spam example, at the bottom of the screen you should see "Report spam to:"

Quote
Report spam to:

Re: xxx.xxx.xx.xx (Administrator of network where email originates)
To: abuse#xxx.com@devnull.spamcop.net (Notes)

Re: User Notification (Notes)
To:

Additional notes (optional - max 2000 characters):

Notice the "Re: User Notification" with the unchecked selection box. By checking the box and entering an email address you can send the report to anyone you wish.

Share this post


Link to post
Share on other sites
Posted (edited)
Quote

Notice the "Re: User Notification" with the unchecked selection box. By checking the box and entering an email address you can send the report to anyone you wish.

Thanks Lking. In that case, I would like to submit the report to abuse@mailjet.com (from what I can see, pretty certain that's the hosting for the spammer, but first need to know if that will be sent anonymously with my email address or anything else identifying removed. Don't want to subject myself to even more spam. I assume that's how it's sent when it can go directly to an abuse address, not to the dead letter box ...@devnull.spamcop.net. Or at least that's what I've always thought happens when submitting a report.

Edited by db17

Share this post


Link to post
Share on other sites

db17 the report will be sent by SC.  If you are unsure you could always, as a test, send a random spam to yourself and evaluate how all the SC spam reports you generate look.

Share this post


Link to post
Share on other sites

There's a Catch 22 in the use of the "User Notification" that you should be aware of:

If the recipient addr you specify in the "User Notification" field is one that SpamCop routinely sends to /dev/null, then SpamCop will NOT send a user report to said addr as requested, but will instead /dev/null your user report, just as it would with any parser-generated report for said addr.

Three implications:

• Taking a cleaned-up /dev/null addr from the parse and sticking it into the "User Notification" field will NOT cause a user report to be sent to that addr. Your user report will also get sent to /dev/null, just like the parser report.

• The reporting addr you find through your own research, e.g. via whois, will NOT cause a user report to be sent IF SpamCop normally /dev/nulls the addr you specify.

• You cannot know in advance if the user report addr you supply is clean or not. It only becomes clear after you hit submit and look at the submission results.

Share this post


Link to post
Share on other sites

Hey EstherD,

1. If the recipient addr you specify in the "User Notification" field is one that SpamCop routinely sends to /dev/null, then SpamCop will NOT send a user report to said addr as requested, but will instead /dev/null your user report, just as it would with any parser-generated report for said addr.

>>>  Taking a cleaned-up /dev/null addr from the parse and sticking it into the "User Notification" field will NOT cause a user report to be sent to that addr. Your user report will also get sent to /dev/null, just like the parser report.

  • What outcome do you think should happen?

 2. The reporting addr you find through your own research, e.g. via whois, will NOT cause a user report to be sent IF SpamCop normally /dev/nulls the addr you specify.

  • What outcome do you think should happen?


Curious?

Share this post


Link to post
Share on other sites
Posted (edited)

Still waiting for the outcome of the intervening discussion. In the meantime, wanted to try the user notification option. However, don't have a new spam message that goes to /dev/null, or any new spam, for that matter, so reentered the one under discussion, parsed again without resubmitting. But after doing so, not seeing the user notification field. Is it missing the user notification field because it's an already submitted report?

 

637873636_ScreenShot2019-04-17at10_35_53AM.thumb.png.b3b6a669b211de19b0196f2bae00f645.png

 

Edited by db17

Share this post


Link to post
Share on other sites
6 hours ago, db17 said:

not seeing the user notification field

Only shows before spam is submitted
87.253.234.133  "abuse[AT]mailjet[DOT]com" may bounce?

Share this post


Link to post
Share on other sites
9 hours ago, db17 said:

1. Is anyone looking at this forum?, this page is completely littered with spam.
2. Still waiting for the outcome of the intervening discussion.
3. Is it missing the user notification field because it's an already submitted report?

Hey db17,

1. There's posts in SCF forum, discussing spammers targeting SCF & the daily actions taken remediate.

2. While you're waiting, how about posting a SC Tracking URL please?

3. No.

Cheers!

Share this post


Link to post
Share on other sites

Hopefully I am NOT the one everyone seems to be waiting on to supply "the outcome of the intervening discussion"? If you are, then please be advised: Not going to happen.

Because I was NOT advocating either for or against ANY particular "outcome". Simply reporting the facts as I see them, and nothing but the facts, so that:

• Someone wouldn't get the clever idea that they could bypass the /dev/null assigned by the parser by plugging the unmunged reporting addr into the "user notice" field.

• Some other one(s) wouldn't be surprised (as I was) when, after spending far too much time finding a suitable reporting addr, SpamCop promptly routed my "user notice" to /dev/null.

IOW, I'm OK with the current outcomes. Just wish they had been documented somewhere. Would have saved me some consternation I didn't need.

Share this post


Link to post
Share on other sites

Hey db17, 

Re: missing [User Notification] field

Did you change/replace (all) dates (in your test spam) to current date, before parsing?

Also check
[ https://www.spamcop.net/mcgi?action=showadvanced ] [ 3rd party report default ] [Send by defaultON

Cheers!

Share this post


Link to post
Share on other sites
Posted (edited)
Quote

Re: missing [User Notification] field

Did you change/replace (all) dates (in your test spam) to current date, before parsing?

Also check
[ https://www.spamcop.net/mcgi?action=showadvanced ] [ 3rd party report default ] [Send by defaultON

Yep, just changed all dates in original (copied headers to text editor first to be able to do this), then entered and parsed  to get new test report.  Also checked prefs, which were already set as above. Still no user notification field. Seem to be getting conflicting opinions about whether this field should be visible. Probably will have to bail on this for now until I get a new devnull spam.

But if interested, URL for new test report:

https://www.spamcop.net/sc?id=z6538949575z8ad9e97c1309c2bc4e1d6010ca7eebedz

 

 1166557548_ScreenShot2019-04-18at10_54_18AM.png.b438567f06afb94ccaa35ad5d38b07cc.png

 

 

Edited by db17

Share this post


Link to post
Share on other sites

 

Hey db17,

Is [User Notification]  field missing with/for every spam you process through SC parser?

Do you have [Mailhosts] configured?

Cheers!

Share this post


Link to post
Share on other sites

Hey db17,

I processed:  https://www.spamcop.net/sc?id=z6538949575z8ad9e97c1309c2bc4e1d6010ca7eebedz

Report spam to:

Re: 87.253.234.133 (Administrator of network where email originates)
 To: mailjet@devnull.spamcop.net (Notes)

Re: 87.253.234.133 (User defined recipient)
 To: removed-grasshopper.com (Notes)

Re: http://xxyj2.mjt.lu/ (Administrator of network hosting website referenced in spam)
 To: google-cloud-compliance@google.com (Notes)

Re: https://hilason.com/ (Administrator of network hosting website referenced in spam)
 To: abuse#amazonaws.com@devnull.spamcop.net (Notes)

Re: User Notification (Notes)
 To:  

Cheers!

 

 

Share this post


Link to post
Share on other sites

Hey db17,

When/if you get [User Notification] sorted, specific to 87.253.234.133 , opsATmailjetDOTcom, does not get /dev/nulled.

I'd add notes similar to what Lking, Petzl & or Robibue write to "encourage" Mailjet SAS to deal with the "polluter".
Cheers, 

Share this post


Link to post
Share on other sites
Posted (edited)

Thanks MIG for all the suggestions and help. Obviously, since you are showing it for my URL, the user notification field should be showing for me. I've tried all your suggestions, including configuring mailhosts, and nothing seems to help. Have even tried 3 different browsers, with anything that could possibly be interfering disabled, especially uMatrix and uBlock origin. Must be something at my end, but no idea what it is. Will try again for the next spam, devnull or not, but for now think this is the end of the line. Thanks again, do appreciate it.

Edited by db17

Share this post


Link to post
Share on other sites

Just for clarification:

I do not get [User Notification] either.

Admittedly, I have not a paid account, and do not have "added fuel" either. And WRT checking the settings, tried both: on and off with no difference.

Share this post


Link to post
Share on other sites
Quote

I do not get [User Notification] either.

Admittedly, I have not a paid account,

I havve a paid account since it began, Was actually part of SpamCop email account
Maybe thats the difference?

Share this post


Link to post
Share on other sites
Posted (edited)
3 hours ago, db17 said:

Thanks MIG for all the suggestions and help. Obviously, since you are showing it for my URL, the user notification field should be showing for me. I've tried all your suggestions, including configuring mailhosts, and nothing seems to help. Have even tried 3 different browsers, with anything that could possibly be interfering disabled, especially uMatrix and uBlock origin. Must be something at my end, but no idea what it is. Will try again for the next spam, devnull or not, but for now think this is the end of the line. Thanks again, do appreciate it.

Hey db17

All good, sorry nothing so far has helped, I think Robibue & Petzl have nailed it... That's why they're MASTERS & I'm a lowly grasshopper

I have 2 SC accounts, 1 paid, 1 unpaid,  just parsed a spam / tested again, [User Notification] appears with the paid account, not the unpaid. 

What's that saying? "we get what we pay for"....

CieLeVie!

Please do keep posting Tracking URLs (when available) for us to pitch in.

Cheers!

 

Edited by MIG

Share this post


Link to post
Share on other sites

Thanks all, I had given up on this. But at least now I know why it wasn't working.

Share this post


Link to post
Share on other sites

i

21 hours ago, MIG said:

Hey db17

All good, sorry nothing so far has helped, I think Robibue & Petzl have nailed it... That's why they're MASTERS & I'm a lowly grasshopper

I have 2 SC accounts, 1 paid, 1 unpaid,  just parsed a spam / tested again, [User Notification] appears with the paid account, not the unpaid. 

What's that saying? "we get what we pay for"....

CieLeVie!

Please do keep posting Tracking URLs (when available) for us to pitch in.

Cheers!

 

That was my thought when checking new replies to this thread.

I, too, see the "user notification" option when I've added fuel, and it disappears when my "fuel" runs out.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×