Jump to content
Spamnophobic

New spammer trick?

Recommended Posts

3 hours ago, Spamnophobic said:

OK I know we have been here before, but could somebody examine my tracking url:

https://www.spamcop.net/sc?id=z6634628358z460dafae0c54205ace1fe027dc2ff311z

perhaps forum seniors or SpamCop staff can suggest how to get these new ones reported?

spam came from  IP 31.145.190.66  "abuse[AT]vodafone[DOT]net[DOT]tr"
Seems you need to check/update your mailhosts or you will be reporting yourself!
Logon to SpamCop then go here
https://www.spamcop.net/mcgi?action=mhedit
Paying member go here
https://mailsc.spamcop.net/mcgi

Share this post


Link to post
Share on other sites
Posted (edited)

@Petzl, my mailhosts haven't changed, although just to be sure I'm re-running the mailhosts "app". However, 31[dot]onefourfive[dot]190<fullstop>66 is definitely not one of my mailhosts. It is the closest the parse gets to the original spam sending address. It is a mail server in Turkey. The parse quotes one more IP, called "User", 176<dot>thirtytwo[dot]25[dot]27, which I am unable to ping (times out).

My point is that SpamCop is unable to parse the spam mail ("No source IP address found") In the past spammers have tricked SpamCop into giving this error message. See my earlier posts in this forum. (This was eventually resolved with the help of a SpamCop administrator.)

Edited by Spamnophobic
Fully munged eye-pea addresses

Share this post


Link to post
Share on other sites
Posted (edited)
9 hours ago, Spamnophobic said:

@Petzl, my mailhosts haven't changed, although just to be sure I'm re-running the mailhosts "app". However, 31[dot]onefourfive[dot]190<fullstop>66 is definitely not one of my mailhosts. It is the closest the parse gets to the original spam sending address. It is a mail server in Turkey. The parse quotes one more IP, called "User", 176<dot>thirtytwo[dot]25[dot]27, which I am unable to ping (times out).

My point is that SpamCop is unable to parse the spam mail ("No source IP address found") In the past spammers have tricked SpamCop into giving this error message. See my earlier posts in this forum. (This was eventually resolved with the help of a SpamCop administrator.)

Well 83.96.176.84 (proserve[DOT]nl, signet[DOT]nl) at a guess seems to be your email provider or network.
You seem to be picking your email from a internal  network which probably changes?

AFTER deleting your mailhost entry try redoing.
If this don't update
Contact SpamCop support
logon and go here (there is  email address but I forget it)
https://mailsc.spamcop.net/fom-serve/cache/401.html
or free user
https://www.spamcop.net/fom-serve/cache/401.html
Other reasons for contact
 (put in) "Mailhosts"

Edited by petzl

Share this post


Link to post
Share on other sites
On 5/19/2020 at 12:05 PM, Spamnophobic said:

OK I know we have been here before, but could somebody examine my tracking url:

https://www.spamcop.net/sc?id=z6634628358z460dafae0c54205ace1fe027dc2ff311z

 perhaps forum seniors or SpamCop staff can suggest how to get these new ones reported?

Okay, I am confused with the tracking URL.  It seems to be the message you tried to report is one that was sent directly to your submit address.  I see the vmx and the app009.  Are you trying to report a spam from someone that sent it directly to your submit address?  (I am glad your submit address was replaced by an x in here as I don't want to know what it is.)  If your submit address is in the wild, I would suggest you contact deputies[at]admin[dot]spamcop[dot]net.

Share this post


Link to post
Share on other sites
On 5/19/2020 at 12:05 PM, Spamnophobic said:

OK I know we have been here before, but could somebody examine my tracking url:

https://www.spamcop.net/sc?id=z6634628358z460dafae0c54205ace1fe027dc2ff311z

with the double header I think things have gotten confused. @gnarlymarley without knowing @Spamnophobic 's 16 digit code "they" could not have sent to the reporting address.

UNLESS they replied to a spam report with the following sequence:

  • @Spamnophobic a spam (email #1) and reported it to spamcop (email #2)
  • spamcop sent a spam report to the the source (email #3)
  • the spammer/his ISP... received email #3 and auto responded (?) with email #4 sent to a coded address at spamcop
  • spamcop received email #4 send to a coded mail box associated with the spam report (email #3) and forwarded the email to @Spamnophobic
  • @Spamnophobic received email #4 which has the spamcop connection hidden and thinking it is spam @Spamnophobic reports email #4
  • The reporting of email #4 generates the tracking URL above.

It has been a really long time sense I have received a reply to an spam report. Looking at the full email in the tracking URL there are spamcop.net ironpost references in both headers (at the top and bottom of the email)

to paraphrase Cicero, Mark Twain, Blaise Pascal  'If I had more time this would have been shorter.'

 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×