Jump to content

Incorrect identification by spamcop


Recommended Posts

spamcop.net,Oct 8 2005, 09:41 PM]I then report any spam in the held mail. (I hate spammers, so I like to report them)

33863[/snapback]

You are checking where you are sending your reports like you agreed when you signed up, correct?

You are checking that valid messages are not ending up in yourHeld Mail folder, correct?

You have registered all of your email paths with the mailhost configuration to limit the possibility of reporting your own hosts, correct?

Beyond that, we would need to see a tracking URL for one of the messages that reported your mail host as a spammer. Please remember YOU are sending the reports, not spamcop. Spamcop is simply the tool you are using to prepare and send them.

Link to comment
Share on other sites

Just to fill in the blanks in my ignorance, that e-mail sample loooks like it would parse OK if it were in a valid format. (didn't spend that much time on it, but didn't see anything nasty jumping out at me) What created the terrible sample that was provided? Who / what added the line Headers: Show Limited Headers ???? I see that it's after the added SpamCop/SpamAssassin data lines, but ... it's something I've not seen (or noticed) before???? (Of course, I don't think I've ever seen the Content-Type: line as the very first line of an e-mail header either ...???)

My attempted re-creation of your provided sample resulted in;

Sorry, this email is too old to file a spam report.

If reported today, reports would be sent to:

Re: 200.207.123.56 (Administrator of IP block - statistics only)

security[at]telesp.net.br

postmaster[at]cert.br

abuse[at]empresas.telefonica.com.br

Internal spamcop handling: (spambr)

mail-abuse[at]nic.br

mail-abuse[at]cert.br

nothing to do with your ISP ...????

And, of course, have you looked at / read the Announcements Forum section?

Link to comment
Share on other sites

dang it, HUGE pic not really required (if I check the Portal page and it's hosed again, will simply delete them) ... and after all the stuff just put into place to mung displayed e-mail address, you've got way too many showing up in those pics ....

As far as your cut * paste, that's great, you handled that well. However, I'd suggest you take the time and read a number of other posts, Topics, and Discussions in here. It's already been pointed out that you are the decision maker in the process of what reports go out and where they go, but if you're copying that displayed data and pasting it in as your spam submittal, it's amazing that you've ever had any of those items actually parse at all ... so it's very surprising to me that reports went out, though if they did, then it's not surprising that they went to the wrong place.

Edit: Portal only showing the first post of the Topic, thus not hammered by the graphics ....

Link to comment
Share on other sites

Despite the original poster coming back and deleting his posts, information, etc. .... I have sent the info upstream, going with that the Deputies can pull up this user's reporting history and get a better feel for the 'real' story ....

Link to comment
Share on other sites

Just so folks coming after the fact can figure out what's going on, the OP (original poster) arrived here with a request that SpamCop quit making mistakes in the reporting of his spam. The first post offered up a sample of a submittal, identified in a later post that it wasn't one of the spam that was sent to his ISP, just a spam "so the ISP routing" could be seen. Based on my initial response about the appearnce of the sample spam, two HUGE images were inserted into his next post, showing a screenshot of an e-mail being displayed in the web-mail application. He then went on to say that this displayed item is what was cut/pasted as a spam submittal. As he chose to delete his question, his sample, his pictures, all his data, the following is provided to show what was being discussed ....

Please note it is the website I am reporting. I have my mail forwarded by visitech IP address 218.214.32.201 they are not spammers. When I have reported in the past you have contacted there ISP and complained they are the spammers. They are not, just the forwarder of my mail. Someone at spamcop has gotten it wrong. Please have the website http://www.optinemailings.org added to the list. I have had 12 spam messages from them today alone.

Date:    Fri, 7 Oct 2005 17:57:54 +1000 (EST) [10/07/2005 05:57:54 PM EST]

Delivered-To:  

    * spamcop-net-Peter.Mercer[at]spamcop.net

    * peter[at]visitech.com.au

From:   "Mrs. Leblanc" <charityinfo[at]mail.com>

Message-Id:   <2005_________________8FF3[at]mail.visitech.com.au>

Received:  

    * (qmail 18899 invoked from network); 7 Oct 2005 07:58:20 -0000

    * from unknown (192.168.1.103) by blade6.cesmail.net with QMQP; 7 Oct 2005 07:58:20 -0000

    * from adsl-32-201.swiftdsl.com.au (HELO mail.visitech.com.au) (218.214.32.201) by mx53.cesmail.net with SMTP; 7 Oct 2005 07:58:19 -0000

    * by mail.visitech.com.au (Postfix) id 87F9318FF4; Fri, 7 Oct 2005 17:57:58 +1000 (EST)

    * from GUJW (unknown [222.69.198.116]) by mail.visitech.com.au (Postfix) with SMTP id 076BF18FF3 for <x>; Fri, 7 Oct 2005 17:57:54 +1000 (EST)

Return-Path:   <charityinfo[at]mail.com>

Subject:   x

To:   x

X-spam-Checker-Version:   SpamAssassin 3.0.2 (2004-11-16) on blade6

X-spam-Level:   ***

X-spam-Status:   hits=3.7 tests=ADDRESS_IN_SUBJECT,FORGED_RCVD_HELO, SARE_RECV_IP_222064 version=3.0.2

X-SpamCop-Checked:   192.168.1.103 218.214.32.201 222.69.198.116

X-SpamCop-Disposition:   Blocked bl.spamcop.net

Headers:   Show Limited Headers

x is your non-profit/charity contact email address right?

If so... WE WILL EMAIL YOUR WEB SITE TO 2,500,00 OPT-IN EMAILS FOR FREE

http://www.optinemailings.org

Inserting a "personal message" in the submittal, providing the contents of a web page, to include the bad formatting, munged/changed data, on and on ... Try as I can, I've failed to come up with any instructions, tutorials, suggestions that could have led to the belief that this is the way to submit a spam ....

Deputy response pretty much follows (much editing done ...)

Went and read the thread and there is absolutely nothing here to work

with.  I did a search on his login IP, and only the one account exists

under that.

His reporting history shows only two reports, one filed and one

abandoned (the abandoned one is a mess).  The second report looks fine.

<snip>

Seeing nothing in his history and without the whole story, not much I can do.

Deputy

Please include all previous correspondence with replies

-------

Wazoo wrote:

> peter.mercer[at]spamcop.net

> http://forum.spamcop.net/forums/index.php?showtopic=5080

> See that while I was busy doing other things, he got ticked and

> deleted the data in his original post.

>

> His ISP threatened him with "one more SpamCop complaint

> and you're account here is terminated" ... Problem displayed

> was the he was using SpamCop web-mail, cut/pasting data

> off that screen .. which included the additional (and converted)

> data showing in the "form" (?) part showing all the header lines,

> his sample including the ...

> Received:

> * by xxxx

> * from ....

> * by xxx

>

> as stated, I had never seen the Context-Type: line as the

> very first line of an e-mail .. turns out that this is the first

> line showing in the sample screenshot he'd uploaded of

> his web-mail handling of that spam ....

>

> As I stated, I was amazed that he'd had any spam submittals parse

> at all, based on his initial sample .. blank lines galore, those

> asterisks starting all the Received lines, etc.  That some of them

> parsed but went to the wrong address ...????

>

> My "fixed" attempted re-creation of his sample spam has

> a Tracking URL of

> http://www.spamcop.net/sc?id=z813576727z47...deeaafe74a707ez

> As I indicated, the resulting parse would have had nothing to

> do with his ISP, but he countered (and since deleted) that the

> sample had only been posted to show the routing to his ISP

Data provided to re-paint the picture for the latecomers, show that there was an attempt to 'resolve' the OP's issue, and as bit of education for someone else that attempts to submit something in this fashion ... do not try this at home! It absolutely, positively will not work! Beyond that, if one really, really wants some kind of help, deleting posts, deleting data, not following up on other suggestions, questions asked, etc. is hardly the way to work out the problem.

Link to comment
Share on other sites

Data provided to re-paint the picture for the latecomers, show that there was an attempt to 'resolve' the OP's issue, and as bit of education for someone else that attempts to submit something in this fashion ... do not try this at home!  It absolutely, positively will not work!  Beyond that, if one really, really wants some kind of help, deleting posts, deleting data, not following up on other suggestions, questions asked, etc. is hardly the way to work out the problem.

To be clear on why I deleted my posts. I posted to get help on an issue that is affecting my business.

First reply from StevenUnderwood, in my mind seemed to lay the blame firmly all at my feet. This may not have been the authors intention but the tone of his post seemed like I was being chastised for being stupid.

You are checking where you are sending your reports like you agreed when you signed up, correct?

Then you asked me to show you where I got the detail "show limited headers". I thought I was helping by taking the time to put up a picture. ( open spamcop webmail, go through trash, find email so it is the same one posted, print screen, save jpeg, upload to site, put on page...) .

Then I get a reply that all but states I am destroying, on purpose, your forum. Whats wrong with a polite thanks for posting the pic, could you reduce the size or remove them as they are causing a problem.

At this point I thought why bother if this is the kind of reply I am to expect from the forum. Probably the wrong place to ask. I resolved to try and contact Spamcop in a different manor. I started to delete the post with the pictures to stop you having problems and decided to just delete the lot.

It very well may be what I am doing that is causing the problem (or it may not be).

However, since I am a customer and paying to use spamcop (for +- 2 years) I aint going to put myself through having to deal with anything less than polite customer service.

Your truly

PM

Link to comment
Share on other sites

Who / what added the line Headers: Show Limited Headers ????

33872[/snapback]

Wazoo: That looks like what happens when viewing the message within webmail after hitting the Headers: Show Full Headers link. What the OP should have done was hit the Message Source link it generate a reportable form of the message.
Link to comment
Share on other sites

spamcop.net,Oct 9 2005, 07:19 AM]First reply from StevenUnderwood, in my mind seemed to lay the blame firmly all at my feet. This may not have been the authors intention but the  tone of his post seemed like I was being chastised for being stupid.

33889[/snapback]

Please read the entire reply. You gave very little information to start with so I gave the most likely answers. A tracking URL for a message being sent to your ISP could have been discussed further.
Link to comment
Share on other sites

That looks like what happens when viewing the message within webmail after hitting the Headers: Show Full Headers link. What the OP should have done was hit the Message Source link it generate a reportable form of the message.

33891[/snapback]

I agree. SpamCop's Webmail's "Show All Headers" Link presents a simplified view for humans only (the "Webmail Show All Headers View"); the SpamCop Parser unfortunately doesn't yet understand the "Webmail Show All Headers View".

Alternatively to copying from the view presented when clicking the "Message Source" Link (the "Webmail Message Source View"), any SpamCop Email System Customer could back out to the message list and forward that complete message to its submit address. It is important to back out to the message list, as forwarding while viewing the message reduces the message's headers to only the following (if present, from a recent test): Date; From; Reply-To; Subject; and To.

Given the true nature of this issue, I have moved this Topic from the SpamCop Reporting Help Forum to the SpamCop Email System & Accounts Forum.

Link to comment
Share on other sites

SpamCop's Webmail's "Show All Headers" Link presents a simplified view for humans only (the "Webmail Show All Headers View"); the SpamCop Parser unfortunately doesn't yet understand the "Webmail Show All Headers View".

33900[/snapback]

If the SpamCop Parser were to understand the "Webmail Show All Headers View", conversion from that view might more properly be stated "Converting header from horde bizarro format" after the "Converting header from netscape bizarro format" message presented at http://news.spamcop.net/pipermail/spamcop-...ber/000685.html.
Link to comment
Share on other sites

spamcop.net,Oct 9 2005, 06:19 AM]To be clear on why I deleted my posts. I posted to get help on an issue that is affecting my business.

First reply from StevenUnderwood, in my mind seemed to lay the blame firmly all at my feet. This may not have been the authors intention but the  tone of his post seemed like I was being chastised for being stupid.

Lack of data provided, the sample posted matched no known "acceptable" form of a parser submittal, the request to basically whitelist your ISP's involved address such that you could no longer somehow report it .... nothing there to indicate a "long-time user" being involved.

Then you asked me to show you where I got the detail "show limited headers".
Actually, my query reads; What created the terrible sample that was provided? Who / what added the line Headers: Show Limited Headers ????

I didn't use the word "show" . and as far as that goes, nothing in your supplied screen captures explicitly "showed" that it was the SpamCop web-mail application in use.

I thought I was helping by taking the time to put up a picture. ( open spamcop webmail, go through trash, find email so it is the same one posted,  print screen, save jpeg, upload to site, put on page...) .

Then I get a reply that all but states I am destroying, on purpose, your forum. Whats wrong with a polite thanks for posting the pic, could you reduce the size or remove them as they are causing a problem.

Had you caught up on your reading, it was noted that being in your second or third post in this Topic, and a couple of us had already replied, there was the additional Edit: added to note that the Portal page was not impacted. I don't usually spend a lot of time on niceties .. you ask a question, I try to answer if I can, then I move on to the next issue. Again, based on the data and sample provided, a "take you by the hand and walk you through the whole process" would be silly, based on that time has already been spent on developing and posting various "How To ..." things (which were suggested as being something for you to look at .. already duplicating the "read before posting" notices on a number of them)

At this point I thought why bother if this is the kind of reply I am to expect from the forum. Probably the wrong place to ask.  I resolved to try and contact Spamcop in a different manor.

If the comments in the spam submittal presented in an earlier post are "that different manor" .. there is still an issue with you understanding the process apparently. The suggestions on you doing some research still stand.

It very well may be what I am doing that is causing the problem (or it may not be).

Any and all responses were provided based on what you presented for data .. that this data indicated a user without a clue and using some strange methodolgy in his reporting" ....???? The initial responses were targeted at trying to get those background issues cleared up .. further dialog, explanations, answers would have gone from there had the data and info not been obliterated.

However, since I am a customer and paying to use spamcop (for +- 2 years) I aint going to put myself through having to deal with anything less than polite customer service.

33889[/snapback]

Once again, it appears you''ve overlooked items intentionally placed for you to stumble over .... you are talking to other users thus far 'here' .... I did send a query on your behalf to a paid staff-member ... that turns into a small issue where his research on the data remaining when he checked into it only pointed back to two items submitted from what he could "match" on "you" .... this doesn't quite jive with the 2 year estimate that you typed in .. or maybe it's that you only now got around to trying to report your spam ...???? Again, some of those things that have yet to be explained, only you seem to have answers thus far ....

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...