Jump to content
Sign in to follow this  
btech

Not sending reports to ISP!? Nothing to do

Recommended Posts

Same here. 2 spams, no message to ISP, no mention of the clearly present spamvertised URLs.

Sumpin's gotta be broke!

- Manchot

Share this post


Link to post
Share on other sites

I just noticed that too.. the URLs didn't parse either.

Share this post


Link to post
Share on other sites
I just noticed that too.. the URLs didn't parse either.

???? There is no URL to parse ... payload is in a graphic ....

As far as the reports .. agreed .. e-mail sent

From: "WazoO"

To: "SpamCop, Argyle"

Cc: "SpamCop, Deputies"

Subject: SpamCop v 1.573 is broken

Date: Fri, 26 May 2006 13:40:33 -0500

The parse results it for spam source are not listed as choices

for sending reports. Strangely, only Cyveillence as a Third-Party

shows up.

Forum posting:

http://forum.spamcop.net/forums/index.php?showtopic=6436

MailHosted Tracking URL:

http://www.spamcop.net/sc?id=z954839818z87...e9ca43104796d6z

Non-MailHosted Account Tracking URL:

http://www.spamcop.net/sc?id=z954862692z95...da09e992a9b316z

SpamCop v 1.573 Copyright © 1998-2005

No date offered, but in my documentation;

24 May 2006 - SpamCop v 1.564.2.1 Copyright © 1998-2005

Share this post


Link to post
Share on other sites

I have just tried to report 3 UCE in a row and the system came back with 'nothing to do' every time. Is there maintenance going on?

Share this post


Link to post
Share on other sites

I have just tried to report 3 UCE in a row and the system came back with 'nothing to do' every time. Is there maintenance going on?

Me too - there seem to be reportable addresses parsed but no reports generated except for user defined/third party addresses. (Sorry - no tracking URL available).

Share this post


Link to post
Share on other sites

Always on the long weekends....argh

They must be telling me to take the weekend off from reporting :)

Just to add more info, submissions at 6:30 AM EST went through. Those at 10:45, did not.

Submitted: Friday, May 26, 2006 10:45:06 AM -0400:

Re: Account # 03664457U

No reports filed

--------------------------------------------------------------------------------

Submitted: Friday, May 26, 2006 6:30:31 AM -0400:

loongger -Carolina

1765699253 ( 58.81.74.131 ) To: postmaster[at]usen.ad.jp

1765699232 ( 58.81.74.131 ) To: abuse[at]usen.ad.jp

P.S. Ther is another thread with the same complaint. These should be merged.

P.S.S. And it was, while I was editing this message :lol

Share this post


Link to post
Share on other sites
Looks like the issue is resolved:

Heh! As I was typing up the Announcement ... it looks like the code got rolled back .. as your last successful parse not shows;

SpamCop v 1.564.2.1 Copyright © 1998-2005 again ....

Share this post


Link to post
Share on other sites

Something in the new code was broken and caused the parse to not send reports to abuse addresses.

The problem has been fixed and everything seems to be back to normal now.

Sorry for the freakout!

- Don D'Minion - SpamCop Admin -

Share this post


Link to post
Share on other sites
P.S. Ther is another thread with the same complaint. These should be merged.

P.S.S. And it was, while I was editing this message :lol

Wish I could do the same thing in the newsgroups .. what a mess .. flashbacks to the "techy stuff to be handled over there discussions" ... geeze ....

Dang! Another problem ran into ... I was going to pull a listing of the crazy posting going on over there (in multiple newsgroups) but .... newsgroup archives are off-line .... am I the only one that cares about those things? wierd ...

Edit much later: bit toggled on my main machine, firewall "interactive mode" got turned off somehow, turns out that there was a bunch of sites that were "off-line" for a while <g>

Anyway, my reply "over there" that's sure to tick some folks off (copy from the spamcop.mail group as that covers the most ground) ....

Path: news.spamcop.net!not-for-mail

From: "WazoO"

Newsgroups: spamcop.mail

Subject: Re: Reporting system not reporting to source ISPs

Date: Fri, 26 May 2006 15:14:01 -0500

Message-ID: <e57ni9$2uh$1[at]news.spamcop.net>

References: <op.s96avxsxyax69d[at]qi>

"Mr. King of-my-forest Pin" wrote

in message news:op.s96avxsxyax69d[at]qi...

> Has anyone else noticed a problem with SC version 1.573? It appears

> that it was implemented late this morning, and now the only party I can

> report my spam to is the "Cyveillance spam collection." Even the

> responsible party for the source IP of the spam isn't listed at all.

The issue is that this wasn't a SpamCop E-Mail Account issue, so

traffic on this was seen in the spamcop newsgroup and the Forum.

As I posted into the spamcop newsgroup;

From: "WazoO"

Newsgroups: spamcop

Subject: Re: spamcop not reporting to abuse address?

Date: Fri, 26 May 2006 15:07:14 -0500

Message-ID: <e57n5i$2m2$1[at]news.spamcop.net>

References: <e57k7u$uar$1[at]news.spamcop.net>

"cwg" wrote in message

news:e57k7u$uar$1[at]news.spamcop.net...

>

> What? Not going to report the spam to the listed abuse address?

Forum Topic/Discussion, same subject:

Not sending reports to ISP!? Nothing to do

Staff Notifications sent

http://forum.spamcop.net/forums/index.php?showtopic=6436

Announcement posted

New Parsing code broken

- maybe fixed now?

http://forum.spamcop.net/forums/index.php?showtopic=6438

As seen, instead of making multiple posts, starting multiple

threads, a bit of analysis was applied, e-mail sent to the

necessary people ... code was rolled back before I got a

reply, but .. that's what one would like to have happen ...

issue seems to be resolved at the moment ....

Share this post


Link to post
Share on other sites
As noted, we are back to the old code with it's problems (finding, but not reporting links).

Not sure what I'm missing .. I scrolled up/fown through that < span > crap .. but didn't notice another link in there (admitting that my eyesite and this monitor are not getting along)

Resolving link obfuscation

http://geocities.com/josetalhoganobles/

Host geocities.com (checking ip) = 66.218.77.68

host 66.218.77.68 = intl1.geo.vip.scd.yahoo.com (cached)

Cached whois for 66.218.77.68 : network-abuse[at]cc.yahoo-inc.com

Reports regarding this spam have already been sent:

Re: http://geocities.com/josetalhoganobles/ (Administrator of network hosting website referenced in spam)

Reportid: 1766277065 To: network-abuse[at]cc.yahoo-inc.com

If reported today, reports would be sent to:

Re: http://geocities.com/josetalhoganobles/ (Administrator of network hosting website referenced in spam)

network-abuse[at]cc.yahoo-inc.com

maybe a bad example?

Share this post


Link to post
Share on other sites

I could have sworn it did not originally report the geocities link, but it has been a very long week here, so I will not swear to anything.

Share this post


Link to post
Share on other sites

I found a new HTML trick that the spammers are using to fool the parser:

http://www.spamcop.net/sc?id=z959721178zc8...65262a28b6528dz

The parser misses the link in this code:

&lt;/title&gt;&lt;DIV class=RTE&gt;&lt;FONT face=Verdana size=2&gt;&lt;A href="http://www.timetohatekill.com"&gt;http://www.timetohatekill.com&lt;/A&gt;&lt;/FONT&gt;&lt;/DIV&gt; 

But not this code:

&lt;/title&gt;&lt;DIV class=RTE&gt;&lt;FONT face=Verdana size=2&gt;&lt;A href="http://www.timetohatekill.com"&gt;http://www.timetohatekill.com &lt;/A&gt;&lt;/FONT&gt;&lt;/DIV&gt;

The space between the closing href code is not allowing the link to be parsed... though it IS detected.

Edited by btech

Share this post


Link to post
Share on other sites
I found a new HTML trick that the spammers are using to fool the parser:

Are you suggesting that you have an e-mail client that rendered this e-mail in HTML? There are no "Content-Type:" lines in the header, so technically this should be handled as plain text ....

From: "WazoO"

To: <deputies[at]admin.spamcop.net>

Subject: HTML URL not 'seen' by the parser

Date: Wed, 31 May 2006 18:21:05 -0500

Tracking URL

http://www.spamcop.net/sc?id=z959721178zc8...65262a28b6528dz

Brought up in a Forum discussion at

http://forum.spamcop.net/forums/index.php?showtopic=6436

(not sure why the user added to this Topic, but for now ...)

Issue is:

e-mail seems to be missing any Content-Type lines

HTML parse code not invoked as there is no HTML defined in header

Text part of parse sees the IB of Vonage sites, but not the payload URL

User states that adding a space before the HTML </a> closing tag

then results in the parser picking up the payload URL ...

So the "Text parse" code seems to be impacted by the HTML

wrapping of the payload URL ...????

Share this post


Link to post
Share on other sites

Possibly... this was received in my Hotmail, but I manually copy and paste the message content, if that matters. I don't believe I've come across this issue in my SCMail, but I can't see how the text of a href link would prevent the actual coded link from being picked up.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×