Jump to content

Nothing to Do


Wally3178

Recommended Posts

Here is that one when I parse it - http://www.spamcop.net/sc?id=z1166098122z7...bbcdce65fb53b9z (Nothing to do). This is using non-mailhosted account. It is a MOLE account. I guess some possibilities are thusly eliminated but I have no clue what the answer might be.

I said in another post no tracking URL for nothing to do cases - obviously I was wrong, sorry to spread confusion,

Thanks for the additional information. Now I know what is happening after do a bit more testing.

It would appear that "moles" can not report bounces.

I used a free report only account with no mailhosts configuered from my testing.

I parsed the same message several times cancelling the reports each time.

When the preference setting was: Become a "mole" - Don't even send reports (mostly pointless)

the results were:

Message is 12 hours old

72.18.195.90 not listed in dnsbl.njabl.org

72.18.195.90 not listed in dnsbl.njabl.org

72.18.195.90 not listed in cbl.abuseat.org

72.18.195.90 not listed in dnsbl.sorbs.net

72.18.195.90 not listed in relays.ordb.org.

72.18.195.90 not listed in accredit.habeas.com

72.18.195.90 not listed in plus.bondedsender.org

72.18.195.90 not listed in iadb.isipp.com

Nothing to do.

When the preference setting was: Obscure identifying information or Leave spam copies intact

the results were:

Report spam to:

Re: 72.18.195.90 (Bounce)

To: abuse[at]aplushosting.com (Notes)

To: support[at]premianet.com (Notes)

Re: 72.18.195.90 (Third party interested in email source)

To: Cyveillance spam collection (Notes)

The following is only my guess on why it is happening.

We know that previously bounces were considered non-reportable.

They were changed to reportable

Since moles do not send reports anyway

(Note: they get a list that looks like the following:

Report spam to:

Re: 2.1.1.10 (Silent report about source of mail)

Re: http://abc.actsdesign.com/register.asp (Silent report about spamvertisement)

Re: http://www.elabs4.com/functions/mailing_list.html (Silent report about spamvertisement)

Re: http://www.maxsiegel.com/ (Silent report about spamvertisement)

You will note that there are no check boxes in front of the "Re" which regular reports would unclick to not send a report or would click if the box happened to be unclicked by default if that wanted to send a report to that address.

The standard reportings appear at the bottom of the screen which may lead reporters who have only used mole reporting thinking that reports were actually being sent when in reality they are not.

Apparently SpamCop is not keeping statistics on bounces like they are on normal spam which would expalin the "Nothing to do" result that mole reporters are getting when reporting bounces.

Anyway, the preceeding is only my best guess, so if someone with real knowledge cares to correct it or better expain it please do so.

Link to comment
Share on other sites

Yet more confusion offered ..... I cancelled your live report .... what I saw included;

I would consider this a serious bug in the SpamCop system.

Since the mole reporter receives the message "Nothing to do" he does not get the option to cancel the reports, but the tracking URL remains active so if he posts that Tracking URL any user who does not have their preferences set for mole reporting can report that specific spam as long as the time period for reporting has not expired. I consider this a very dangerous situation.

Link to comment
Share on other sites

Here is the tracking URL of the latest:

http://www.spamcop.net/sc?id=z1165213268z8...396b28c09d8e5ez

You're not going to get a "nothing to do" error from that message because it is a valid email sent to you from a Servage user. I assume he got spam with your address forged as the return address.

From: Servage Antispam System <antispam[at]servage.net>

Subject: Autoreply: Merry Christmas to info (validate ...)

It's a challenge/response message from a Servage user asking you to confirm that you sent the email, if you actually sent the email and it isn't spam.

SpamCop correctly finds the Servage server at 62.214.98.114 as the source of the email, because it is.

The message is not a bounce, so it's not useful to talk about it as an example of a bounce that won't process..

Also... There is NOTHING wrong with your Mailhosts... Assuming Bigpond is your only email provider.

Here is your TRACKING URL - it may be saved for future reference:

http://www.spamcop.net/sc?id=z1164786576zb...c9ba74634133e4z

If that is one of the emails you're having trouble with, it's because the email has been quoted and the headers and body all run together because of it.

If you want to post a Tracking URL from a fresh example so we can all take a look, I would be happy to review it.

- Don D'Minion - SpamCop Admin -

Link to comment
Share on other sites

From: "WazoO"

To: <deputies>

Subject: Mole reporting og mis-directed bounces parser results problem

Date: Thu, 14 Dec 2006 15:12:52 -0600

http://forum.spamcop.net/forums/index.php?showtopic=7644

Situation concerns "Mole" reporting and parsing results ...

may or may not be the original poster's issue, not yet clarified.

but the results seen by a long-time / experienced reporter and

others has brought up an apparent coding issue problem.

As apparently defined thus far, a Mole reporter submits a

"mis-directed bounce" for parsing/reporting. This user

gets a "nothing-to-do" parser result.

However, a 'view' as seen via the Tracking URL from a

non-Mole-Reporter ends up displaying a "live" parse /

report screen. If the Tracking URL is not advertised, no

big deal, I suppose .. yet, this does seem to be an issue

that needs some software fixes applied .....

OK, Don posted while I was composing/sending the previous e-mail ...

Link to comment
Share on other sites

It looks to me like you are trying to report a bounce of a message that seems to have come from Sales Department: mdowns[at]bigpond.net.au which I believe is your ISP

As to your question: See: http://forum.spamcop.net/scwik/SeeTechnicalDetails

Yes, the email address is mine but the message isn't.

Thanks for the link, I'm having a look at that now.

If you want to post a Tracking URL from a fresh example so we can all take a look, I would be happy to review it.

I've had absolutely no spam today, as unbelievable as that may be, its true. I will post the very next one I get.

BTW, everyone is talking about a 'mole'. Do you all mean 'mole' as in the planted among us, spy type mole? Or is it that little furry guy that digs holes in the lawn and tunnels under the carrots?

Cheers and Beer guys, have a grreat weekend

Mike Downs

15 December 2006

Link to comment
Share on other sites

... I've had absolutely no spam today, as unbelievable as that may be, its true. I will post the very next one I get.
No spam usually means your mail provider is filtering harder than usual.
... BTW, everyone is talking about a 'mole'. Do you all mean 'mole' as in the planted among us, spy type mole? Or is it that little furry guy that digs holes in the lawn and tunnels under the carrots? ,,,
OK, I'll play the "straight man" (and for the benefit of casual browsers) What is "mole" reporting?. Which is / ought to be the default selection under your reporting account "Preferences" tab - until you know the ropes/have the confidence to start doing some actual damage to the spam flow.
... Cheers and Beer guys, have a grreat weekend.
You too Mike
Link to comment
Share on other sites

What is "mole" reporting?[/url]. Which is / ought to be the default selection under your reporting account "Preferences" tab - until you know the ropes/have the confidence to start doing some actual damage to the spam flow.You too Mike

Thank you for that Farelf, very interesting reading.

I'm nearly 60 years of age, I've had a fantastic life as an aeronautical engineer in the Air Force and could pull a GE F404-400 or an Atar-9C apart and re-assemble it with my eyes shut but I am almost totally befuddled and mystified by computers. I have owned one for four years and been on the net for one, and already I have an extremely low opinion of spam and those that distribute it. What can they do to me? Bigpond provide me with seven email addresses, if the going gets tough the tough change their address!! Right? So I have opted for full reporting.

You guys have taught me more in a few days than I have learned in a year on the net and I can't thank you enough, I'm really starting to enjoy it (the internet) now. In my day we wrote letters and mailed them; spam was nice on toast for breakfast hehehe.

Merry Christmas to you all and may 2007 bring everything you desire from life, I'll be back in the New Year, if I survive all the Grandkids.

Mike Downs

16 December 2006

Link to comment
Share on other sites

  • 4 weeks later...

Bounce + Mole = "Nothing to do" ?

One of my e-mail accounts has been suddenly hit with a fair proportion of "primary" spam and a (for me) huge wave of backscatter. The "primary" spams parse OK but the bounces always end in "Nothing to do". I seem to have exactly the same problem as Mike Downs.

I can provide very recent examples (tracking URL or paste of parse, as you wish), but I will wait until asked as my problem appears identical to Mike's. I am pasting the entire message and headers into my reporting box, and have technical details turned on.

I report as a mole. I always have and intend to continue doing so because:

- I'm not technically fluent enough in DNS and mailserver stuff to start and win a long and time-consuming argument with a recalcitrant postmaster;

- I still hope that as a mole I'm nonetheless helping to keep offending IPs on the SCBL. I know this hope may be vain, but I've read so much discussion about this back and forth here, without finding any definite resolution from SpamCop staff. I realise they may have very good reasons to stay vague about it all in public. So I keep hoping.

My questions here are simply whether the equation:

Bounce + Mole = "Nothing to do"

is indeed correct, and if so will it stay this way? In that case I'll just delete the misdirected bounces and report only the "primary" spam.

I'm in slight doubt about whether I should have started a new thread. I'll opt for putting this into Mike's thread for now, but feel free to move it into a new topic, in which case I'd appreciate it if the title could be:

Bounce + Mole = "Nothing to do" ?

and then I'll add a link to Mike's topic if I'm still allowed to edit the post. If not I hope Admin will do the honours.

Thanks in advance,

Penny

Link to comment
Share on other sites

Hi, Penny!

Bounce + Mole = "Nothing to do" ?

<snip>

the bounces always end in "Nothing to do". I seem to have exactly the same problem as Mike Downs.

<snip>

My questions here are simply whether the equation:

Bounce + Mole = "Nothing to do"

is indeed correct, and if so will it stay this way?

...That is the way I read Don's post, above 52195[/snapback] and, since we haven't heard anything further for almost a month, I would assume it is going to stay that way.
I can provide very recent examples (tracking URL or paste of parse, as you wish), but I will wait until asked as my problem appears identical to Mike's.

<snip>

...FWIW, I agree that there is no need.
I report as a mole. I always have and intend to continue doing so because:

- I'm not technically fluent enough in DNS and mailserver stuff to start and win a long and time-consuming argument with a recalcitrant postmaster;

...From my experience and an absence of others' posting that this has happened, I think you can assume the chance of this happening is pretty much zero.
I still hope that as a mole I'm nonetheless helping to keep offending IPs on the SCBL. I know this hope may be vain, but I've read so much discussion about this back and forth here, without finding any definite resolution from SpamCop staff. I realise they may have very good reasons to stay vague about it all in public. So I keep hoping.
...My understanding is that there is little reason for such hope. AIUI, mole reports feed the statistics and, therefore, have almost no impact on the SCBL.
I'm in slight doubt about whether I should have started a new thread. I'll opt for putting this into Mike's thread for now, but feel free to move it into a new topic, in which case I'd appreciate it if the title could be:

Bounce + Mole = "Nothing to do" ?

and then I'll add a link to Mike's topic if I'm still allowed to edit the post. If not I hope Admin will do the honours.

Thanks in advance,

Penny

...FWIW, I concur completely with your having added your post to this forum thread. :) <g>
Link to comment
Share on other sites

Hi Penny

as another technically non-fluent person, I assure you that if you do get an answer to a report and don't know what to reply, you can always post here and someone will help you. It really is not that complicated to get the concepts even if you couldn't actually do it. Sort of like understanding why an automobile needs oil, but not knowing how to change it (or even how to add it).

And, as Steve T says, answers to reports are few and far between - so much so that a good number of people post asking 'what should I do with this? Is it spam?'

Reporting may increase your spam, but mole reporting is pretty much for your own satisfaction that you are doing something. AFAICT (as far as I can tell) nobody really benefits very much from the statistics. If you have a spamcop email account, it definitely would be to your benefit to report so that it feeds the scbl.

If you picked the right thread to post to, then you are not nearly as non-fluent as you think you are!

Miss Betsy

Link to comment
Share on other sites

My questions here are simply whether the equation:

Bounce + Mole = "Nothing to do"

is indeed correct, and if so will it stay this way? In that case I'll just delete the misdirected bounces and report only the "primary" spam.

Yep, as answered by others. FWIW that was the final impetus to push me into "regular" reporting instead of mole, after some years (I'm not afflicted with a high degree of technical competence either). Mole reporting used to accomplish something once.

I don't use SpamCop reporting on my work account at all. I use Abuse! reporter as the lazy person's aid to sending manual reports (it's not nearly as good as SC in identifying and bypassing recalcitrant abuse addresses BUT that's rarely ever a factor when it comes to misdirected bounces). The reports are totally unmunged and the sky hasn't fallen - yet. Maybe that would be an alternative to deleting your misdirected bounces. Use Abuse! or manually report.

As far as getting into arguments with aggrieved admins, simply point them to Why are auto responders bad? - and "no further correspondence will be entered into". Some discussion of that FAQ (FYI) is at Why are auto-responders bad, in simple terms?.

Going direct to the source of offense is sorta satisfying. And you DO get many more responses than (regular) SC reports generate. None of them (yet) wanting to argue about it, in my experience, but that is with just UCE/UBE cases so far.

For your consideration, HTH

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...