bob424 Posted February 9, 2012 Share Posted February 9, 2012 I sent a phishing email I received to spamcop. What happened after I reported the phishing email was I lost my internet service from cox.net communications as spamcop reported that I was the source of the spam email. I had to call to get my internet restored. For some reason when spamcop read the header, it reported me as the source along with dimenoc.com and theplanet.com. I fully trusted spamcop to determine where the spam was coming from but then found that by reporting the spam I was complaining about myself as well. I have submitted all my email addresses to the hosts program of spamcop. I thought that doing so would prevent such issues. Can someone tell me what happened? I will always watch for any abuse reports sent to cox.net from now on but how will I know if I'm blocking a legitimate complaint about spam or not now? Thanks, Bob I've received four phishing emails now saying the same thing. An access to your account from a location other the one assigned by our online security protocol was captured by our system and your account has therefore been limited. To restore your chase account and online access, please click the link below and follow the instruction to restore your account. http://www.chase.com/account_protection After we have verified the necessary information, your account access will be reinstated. To see all of the Alerts available to you, please click the link above and complete the process Thank you for Chase. Chase Fraud Prevention Department See: http://www.spamcop.net/mcgi?action=gettrac...rtid=5701658413 5701658418 ( http://waltdiel.com/wp-includes/images/chase.co... ) To: spamcop[at]dimenoc.com 5701658417 ( http://clk.websitewelcome.com/~caroxcom/chseonl... ) To: abuse[at]theplanet.com 5701658413 ( 68.96.119.91 ) To: abuse[at]cox.net The phishing links go to: http://www.szkola.najlepsza.pl/images/chas...ation/index.htm http://waltdiel.com/wp-includes/images/cha...ation/index.htm http://kokotow.najlepsza.pl/images/chseonline/index.html Link to comment Share on other sites More sharing options...
petzl Posted February 9, 2012 Share Posted February 9, 2012 I sent a phishing email I received to spamcop. What happened after I reported the phishing email was I lost my internet service from cox.net communications as spamcop reported that I was the source of the spam email. I had to call to get my internet restored. You have set-up your "mailhosts" log-in and click the TAB Link to comment Share on other sites More sharing options...
SpamCopAdmin Posted February 9, 2012 Share Posted February 9, 2012 This is a Mailhosts issue. I fixed the cox.net host and the parse is working correctly now. - Don D'Minion - SpamCop Admin - - service[at]admin.spamcop.net - Link to comment Share on other sites More sharing options...
turetzsr Posted February 9, 2012 Share Posted February 9, 2012 Hi, bob424, ...Sorry to hear of your problem and happy that Don was able to find and fix the problem. ...Mostly for other's reference, I'll not a couple of things: <snip> I fully trusted spamcop to determine where the spam was coming from but then found that by reporting the spam I was complaining about myself as well. <snip>Yes, unfortunately SpamCop, like any tool, must be used carefully. As the parses themselves mention, below the "Send spam Report(s) Now" button,ATTENTION: Report only those e-mail addresses and web sites that you think your spammer has used. <snip> Further information about the Mailhosts tool mentioned by both petzl and Don D'Minion is available in the SpamCop FAQ (links are near the top of each SpamCop Forum page) entry labeled "Why does SpamCop want to send a report to my own network administrator?" and SpamCop Wiki (links also at the top of SpamCop Forum pages entries "MyReportingAccountHasBeenSuspended" and "MailHostConfiguration." Link to comment Share on other sites More sharing options...
bob424 Posted February 9, 2012 Author Share Posted February 9, 2012 This stuff is confusing. I read it and read it again and still... Thank you all for the replies and help. How do I know that Cox.net now complies with this sentence from: http://www.spamcop.net/fom-serve/cache/13.html Why does SpamCop want to send a report to my own network administrator? "One reason this problem can occur is because your internal mail server does not indicate the source IP address of the spam. Talk to your network administrator about fixing the problem." Link to comment Share on other sites More sharing options...
Farelf Posted February 10, 2012 Share Posted February 10, 2012 ...How do I know that Cox.net now complies with this sentence from: http://www.spamcop.net/fom-serve/cache/13.html Why does SpamCop want to send a report to my own network administrator? "One reason this problem can occur is because your internal mail server does not indicate the source IP address of the spam. Talk to your network administrator about fixing the problem." Don said he fixed your mailhosts detail and parsing is now okay. That's the "proof" all is okay. Check that previous report parse and look (using the "Parse" link) at the "If reported today ..." detail down the bottom. Cox will not appear. Since you didn't supply a tracking URL, only you and SC staff can see that detail at present. Of course Cox might change at some future time so, if you are quick reporting you really should check your outgoing reports from time to time to be sure that hasn't happened - if you are using standard/long reporting simply ensure that Cox is not the report recipient before releasing the report. The odds of Cox "suddenly" changing would not seem very high ... but some reporters avoid quick reporting just in case - and in case there are new routing issues within their service provider network which might have a similar effect. Until you are confident (and you will be, it might all seem a bit much at first but you will get the hang of it soon enough) I would suggest you stick with standard reporting where you get to see see the proposed destination of all reports before you release them. Link to comment Share on other sites More sharing options...
bob424 Posted February 10, 2012 Author Share Posted February 10, 2012 I'm not questioning Don. Just trying to understand this and make sure everything is ok. It's not fixed. http://www.spamcop.net/sc?id=z5248798527z0...26cf0a869cb9b1z This phishing email tried to report me as the source of the spam again. Link to comment Share on other sites More sharing options...
turetzsr Posted February 10, 2012 Share Posted February 10, 2012 Hi, bob424, ...Please consider reporting this most recent incident to Don at service[at]admin.spamcop.net. For brevity, you might just consider providing a link to your recent post, http://forum.spamcop.net/forums/index.php?...ost&p=79918 and including a brief reminder of the nature of the problem. As Don replied here, below, this suggestion is no longer necessary. Link to comment Share on other sites More sharing options...
petzl Posted February 10, 2012 Share Posted February 10, 2012 I'm not questioning Don. Just trying to understand this and make sure everything is ok. It's not fixed. http://www.spamcop.net/sc?id=z5248798527z0...26cf0a869cb9b1z This phishing email tried to report me as the source of the spam again. Just log into your SpamCop reporting page and click the TAB "Mailhosts" it's self explaining Requires you to send an email to yourself from ALL your email addresses (at least 2), when you get them (yes them). You just click the confirmation link in each email and this will register Cox email host as yours and won't report them. After clicking and once all seems to be working fine you can then go back to your Mailhost page and activate quick reporting Link to comment Share on other sites More sharing options...
SpamCopAdmin Posted February 10, 2012 Share Posted February 10, 2012 Cox is adding new servers that are not part of the Cox.net Mailhost. This is NOT the users's problem. It is a Mailhost problem. I fixed it again. - Don D'Minion - SpamCop Admin - - service[at]admin.spamcop.net - Link to comment Share on other sites More sharing options...
turetzsr Posted February 11, 2012 Share Posted February 11, 2012 Cox is adding new servers that are not part of the Cox.net Mailhost. This is NOT the users's problem. It is a Mailhost problem. <snip> ...Thanks, Don, that was what I was assuming but didn't want to mention as I was not positive. ...bob424: so the problem appears to be what is mentioned in SpamCop Wiki entry "Why does SpamCop want to send a report to my own network administrator?" in the next-to-last bullet near the very end. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.