Rammstein Posted October 22, 2006 Share Posted October 22, 2006 All of the suddon I start receiving these error emails. I have changed nothing from the way I report. I am using Outlook Pro 2003, Going to the Spamcop.net site and pasting the header then blank line then body. I then receive this error mail. I also notice the return addresses for this are not from the spam that I report. I think this is spam being sent out from your server IP somehow. Like I said, I have not changed they way I report and in the past it always has gone threw. Please help me, I have read the same old replies that do not cover completely. I am not new at this and I have been reporting for over 5 years and this is now a new change. Thank you Link to comment Share on other sites More sharing options...
Wazoo Posted October 22, 2006 Share Posted October 22, 2006 not enough information for me .... what do the error messages say? Most are pretty explicit. No idea on what you are talking about in "return addresses for this are not from the spam that I report" ... based on submitting at the web-site, there wouldn't normally be any e-mail to you .... Link to comment Share on other sites More sharing options...
Farelf Posted October 22, 2006 Share Posted October 22, 2006 All of the suddon I start receiving these error emails. I have changed nothing from the way I report. I am using Outlook Pro 2003, Going to the Spamcop.net site and pasting the header then blank line then body. I then receive this error mail. I also notice the return addresses for this are not from the spam that I report. I think this is spam being sent out from your server IP somehow. Like I said, I have not changed they way I report and in the past it always has gone threw. Please help me, I have read the same old replies that do not cover completely. I am not new at this and I have been reporting for over 5 years and this is now a new change. Thank you Yikes - you use the web page paste-in method and get an email back? That is bizarre/new to me. You are adding a blank line between head and body when you paste in? Have you tried using the two-part "workaround form"? What does your report history say about the spam you parsed/reported? Has it been handled correctly? I know this doesn't address the "something has changed" scenario immediately (don't know what) but there may be other ways to retrieve your report functionality before the SC staff are called in. Link to comment Share on other sites More sharing options...
Rammstein Posted October 22, 2006 Author Share Posted October 22, 2006 Yikes - you use the web page paste-in method and get an email back? That is bizarre/new to me. You are adding a blank line between head and body when you paste in? Have you tried using the two-part "workaround form"? What does your report history say about the spam you parsed/reported? Has it been handled correctly? I know this doesn't address the "something has changed" scenario immediately (don't know what) but there may be other ways to retrieve your report functionality before the SC staff are called in. SpamCop encountered errors while saving spam for processing: SpamCop could not find your spam message in this email: Return-Path: <tenant851[at]coo.net> Received: from sc-smtp1-bulkmx.soma.ironport.com (sc-smtp1-bulkmx.soma.ironport.com [204.15.82.123]) by sc-app4.soma.ironport.com (Postfix) with ESMTP id A09F4514D for <submit.pygsqrcmzxb8rtpr[at]spam.spamcop.net>; Sat, 21 Oct 2006 22:23:56 -0700 (PDT) Received: from pc11.broad.dynamic.fz.fj.cn.cndata.com ([218.85.82.11]) by sc-smtp1-bulkmx.soma.ironport.com with SMTP; 21 Oct 2006 22:27:19 -0700 X-Message-Info: ALLFJfUXQ1pPY69YLPiagK67TDLduHIO74Y3SX9opo866YI Received: (from lp589extol[at]localhost) by s11-curdle5.sd766w.lycos.co.jp (2.25.84/0.06.55) id jjt4YL35hr1; Sun, 22 Oct 2006 06:20:38 +0100 GMT X-Authentication-Warning: bfo30-bacteria7.pn5zois.hotmail.com: omc481plexiglas set sender to tenant851[at]coo.net using -v MIME-Version: 1.0 Date: Sun, 22 Oct 2006 10:24:38 +0500 From: ì“c Žé—¢ <tenant851[at]coo.net> Subject: ‚¨‹v‚µ‚Ô‚è‚Å‚· To: submit.pygsqrcmzxb8rtpr[at]spam.spamcop.net Message-Id: <x39wim00-198833245080241529-59414120068650856146797985800609[at]violet52> Content-Type: multipart/alternative; boundary="--97805778961109205" ----97805778961109205 Content-Type: text/plain; Content-Transfer-Encoding: base64 gaGBoYSqhKqEqoSqhKqEqoSqhKqEqoSqhKqEqoSqgaGBoQ0Ki3SJh4+VjPCN24LwivOWXYLM j5eQq4Lwj9CJ7pKGgUINCoGhgaGEqoSqhKqEqoSqhKqEqoSqhKqEqoSqhKqEqoGhgaEgICAg ICANCg0KgUCBeYF5kmqQq4nviPWR5ZXlj1eShoF6gXoNCg0KIJBWi0uJ74j1k2+YXoLNiq6R U5azl7+CxoLIgsGCxIKoguiC3IK3gUINCoFAkmqQq4nviPWCzJX7gsmCzZPBlcqXRJHSl0yC 6IFJDQqBQIFAgUANCoF5j9qCtYKig3aDjYN0g0KBW4OLgs2CsYK/gueCqYLngXoNCg0KaHR0 cDovL3NjcmlwdGlvbi5pa2Vpa2Vnb2dvLm5ldC9hMi8NCiANCiCTb5hejOOCzYK3gq6CyYKy l5iXcILFgquC3IK3gUINCoFAgUCC4IK1gqmCtYK9gueBYw0KgUCPl5CrgqmC54LMgqiXVYKi gqqCoILpgqmC4IK1guqC3IK5gvGBYw0Kg ----97805778961109205-- The email which triggered this auto-response had the following headers: Return-Path: <tenant851[at]coo.net> Received: from sc-smtp1-bulkmx.soma.ironport.com (sc-smtp1-bulkmx.soma.ironport.com [204.15.82.123]) by sc-app4.soma.ironport.com (Postfix) with ESMTP id A09F4514D for <submit.pygsqrcmzxb8rtpr[at]spam.spamcop.net>; Sat, 21 Oct 2006 22:23:56 -0700 (PDT) Received: from pc11.broad.dynamic.fz.fj.cn.cndata.com ([218.85.82.11]) by sc-smtp1-bulkmx.soma.ironport.com with SMTP; 21 Oct 2006 22:27:19 -0700 X-Message-Info: ALLFJfUXQ1pPY69YLPiagK67TDLduHIO74Y3SX9opo866YI Received: (from lp589extol[at]localhost) by s11-curdle5.sd766w.lycos.co.jp (2.25.84/0.06.55) id jjt4YL35hr1; Sun, 22 Oct 2006 06:20:38 +0100 GMT X-Authentication-Warning: bfo30-bacteria7.pn5zois.hotmail.com: omc481plexiglas set sender to tenant851[at]coo.net using -v MIME-Version: 1.0 Date: Sun, 22 Oct 2006 10:24:38 +0500 From: ì“c Žé—¢ <tenant851[at]coo.net> Subject: ‚¨‹v‚µ‚Ô‚è‚Å‚· To: submit.pygsqrcmzxb8rtpr[at]spam.spamcop.net Message-Id: <x39wim00-198833245080241529-59414120068650856146797985800609[at]violet52> Content-Type: multipart/alternative; boundary="--97805778961109205" SpamCop encountered errors while saving spam for processing: SpamCop could not find your spam message in this email: Return-Path: <tenant851[at]coo.net> Received: from sc-smtp1-bulkmx.soma.ironport.com (sc-smtp1-bulkmx.soma.ironport.com [204.15.82.123]) by sc-app4.soma.ironport.com (Postfix) with ESMTP id A09F4514D for <submit.pygsqrcmzxb8rtpr[at]spam.spamcop.net>; Sat, 21 Oct 2006 22:23:56 -0700 (PDT) Received: from pc11.broad.dynamic.fz.fj.cn.cndata.com ([218.85.82.11]) by sc-smtp1-bulkmx.soma.ironport.com with SMTP; 21 Oct 2006 22:27:19 -0700 X-Message-Info: ALLFJfUXQ1pPY69YLPiagK67TDLduHIO74Y3SX9opo866YI Received: (from lp589extol[at]localhost) by s11-curdle5.sd766w.lycos.co.jp (2.25.84/0.06.55) id jjt4YL35hr1; Sun, 22 Oct 2006 06:20:38 +0100 GMT X-Authentication-Warning: bfo30-bacteria7.pn5zois.hotmail.com: omc481plexiglas set sender to tenant851[at]coo.net using -v MIME-Version: 1.0 Date: Sun, 22 Oct 2006 10:24:38 +0500 From: ì“c Žé—¢ <tenant851[at]coo.net> Subject: ‚¨‹v‚µ‚Ô‚è‚Å‚· To: submit.pygsqrcmzxb8rtpr[at]spam.spamcop.net Message-Id: <x39wim00-198833245080241529-59414120068650856146797985800609[at]violet52> Content-Type: multipart/alternative; boundary="--97805778961109205" ----97805778961109205 Content-Type: text/plain; Content-Transfer-Encoding: base64 gaGBoYSqhKqEqoSqhKqEqoSqhKqEqoSqhKqEqoSqgaGBoQ0Ki3SJh4+VjPCN24LwivOWXYLM j5eQq4Lwj9CJ7pKGgUINCoGhgaGEqoSqhKqEqoSqhKqEqoSqhKqEqoSqhKqEqoGhgaEgICAg ICANCg0KgUCBeYF5kmqQq4nviPWR5ZXlj1eShoF6gXoNCg0KIJBWi0uJ74j1k2+YXoLNiq6R U5azl7+CxoLIgsGCxIKoguiC3IK3gUINCoFAkmqQq4nviPWCzJX7gsmCzZPBlcqXRJHSl0yC 6IFJDQqBQIFAgUANCoF5j9qCtYKig3aDjYN0g0KBW4OLgs2CsYK/gueCqYLngXoNCg0KaHR0 cDovL3NjcmlwdGlvbi5pa2Vpa2Vnb2dvLm5ldC9hMi8NCiANCiCTb5hejOOCzYK3gq6CyYKy l5iXcILFgquC3IK3gUINCoFAgUCC4IK1gqmCtYK9gueBYw0KgUCPl5CrgqmC54LMgqiXVYKi gqqCoILpgqmC4IK1guqC3IK5gvGBYw0Kg ----97805778961109205-- The email which triggered this auto-response had the following headers: Return-Path: <tenant851[at]coo.net> Received: from sc-smtp1-bulkmx.soma.ironport.com (sc-smtp1-bulkmx.soma.ironport.com [204.15.82.123]) by sc-app4.soma.ironport.com (Postfix) with ESMTP id A09F4514D for <submit.pygsqrcmzxb8rtpr[at]spam.spamcop.net>; Sat, 21 Oct 2006 22:23:56 -0700 (PDT) Received: from pc11.broad.dynamic.fz.fj.cn.cndata.com ([218.85.82.11]) by sc-smtp1-bulkmx.soma.ironport.com with SMTP; 21 Oct 2006 22:27:19 -0700 X-Message-Info: ALLFJfUXQ1pPY69YLPiagK67TDLduHIO74Y3SX9opo866YI Received: (from lp589extol[at]localhost) by s11-curdle5.sd766w.lycos.co.jp (2.25.84/0.06.55) id jjt4YL35hr1; Sun, 22 Oct 2006 06:20:38 +0100 GMT X-Authentication-Warning: bfo30-bacteria7.pn5zois.hotmail.com: omc481plexiglas set sender to tenant851[at]coo.net using -v MIME-Version: 1.0 Date: Sun, 22 Oct 2006 10:24:38 +0500 From: ì“c Žé—¢ <tenant851[at]coo.net> Subject: ‚¨‹v‚µ‚Ô‚è‚Å‚· To: submit.pygsqrcmzxb8rtpr[at]spam.spamcop.net Message-Id: <x39wim00-198833245080241529-59414120068650856146797985800609[at]violet52> Content-Type: multipart/alternative; boundary="--97805778961109205" I paste the header then blank line, I have been using this method for years. Now all of the sudden it starts sending error messages to my email address. The return email address in the return to section, are diferrent in the error message email than they ones that are copied and pasted to the site. I have noticed the server IP is always a bit different: Received: from sc-app6.spamcop.net ([204.15.82.25]) Received: from sc-app5.spamcop.net ([204.15.82.24]) Received: from sc-app4.spamcop.net ([204.15.82.23]) Received: from sc-app1.spamcop.net ([204.15.82.20]) Received: from sc-app3.spamcop.net ([204.15.82.22]) Link to comment Share on other sites More sharing options...
Wazoo Posted October 22, 2006 Share Posted October 22, 2006 I'm lost ... from what I'm looking at, I see someone submitting their spam via e-mail .. exposing thier 'secret / pricate" submittal address in a public Forum posting, so now on top of everything else, Don/Deputies need to be contacted in order to kill off this exposed acount and generate a new one for this user. Worst case, perhaps this has already happened and someone is submitting spam under your / this account via e-mail ... about the only explanation I can come up with that could even come close to the "I paste it into the web page but I'm getting e-mail error notigication" ... Pasting your spam into the "logged in" www.spamcop.net web-page is not the same as e-mailing in a submittal ... any errors seen from a paste-ur-in-the-box web page will show those errors on the resulting web-page .. there is no e-mail involved. Therefore, I have no idea what's actually going on, based on your description .... I'm in the middle of too many other things right now to play around with your 'sample' .... Link to comment Share on other sites More sharing options...
Wazoo Posted October 22, 2006 Share Posted October 22, 2006 Account is already compromised, and continuing with the theme that it's being forged into spam spew ... here's what I've done on your behalf .... the catch is of course is that I have no idea what your Registered Reporting Account data might be ... From: "WazoO" To: "deputies" Subject: Compromised / Forged account address Date: Sun, 22 Oct 2006 01:56:48 -0500 I'm lost .... is it possible that the account; To: submit.pygsqrcmzxb8rtpr[at]spam.spamcop.net has been compromised ...???? I can't really grok the description dropped by the user at http://forum.spamcop.net/forums/index.php?showtopic=7312 States that the web-form is used, but then complains about receiving e-mail error notifications ... the only thing I can come up with is that someone else is sending to that address and he/she is receiving the fallout ....???? Link to comment Share on other sites More sharing options...
Rammstein Posted October 22, 2006 Author Share Posted October 22, 2006 I am sorry if I can't explain it enough. I am reporting VIA the web based paste in, I started receiving these error emails just this week. I have no idea where they are comming from. You needed more info so I pasted the email and the header. If it is comprimised, then how so? I have never given the email address out and I have not had this problem before the middle of the week. I see now that you say I have comprimised by posting here. I had no other way to show you and get you to understnad what I was speaking of. What do I do now? Link to comment Share on other sites More sharing options...
Farelf Posted October 22, 2006 Share Posted October 22, 2006 What do I do now?SpamCop Deputies will advise you (or whover it belongs to) of a new submission address. There are possible reasons for what has happened that it seems likely only a Deputy could sort it out anyway. Link to comment Share on other sites More sharing options...
Rammstein Posted October 22, 2006 Author Share Posted October 22, 2006 SpamCop Deputies will advise you (or whover it belongs to) of a new submission address. There are possible reasons for what has happened that it seems likely only a Deputy could sort it out anyway. Thank you so much for your time and help. I am not new to this, but I have never had any problems before with SpamCop. I use it daily to report the spam. I have a paid subscription and hope that it is well worth this Thank you again. Rammstein Link to comment Share on other sites More sharing options...
StevenUnderwood Posted October 22, 2006 Share Posted October 22, 2006 Thank you so much for your time and help. I am not new to this, but I have never had any problems before with SpamCop. I use it daily to report the spam. I have a paid subscription and hope that it is well worth this Thank you again. Rammstein It is good you brought this problem up. It seems to me your submit address is in the hands of a spammer. Now, the more interesting part is how your submit address got exposed. Have you EVER used the submit address to try and report spam? Do you have that address in your address book? Have you been infected by one of the recent viruses? Link to comment Share on other sites More sharing options...
SpamCopAdmin Posted October 22, 2006 Share Posted October 22, 2006 I also notice the return addresses for this are not from the spam that I report. Your 'submit' address has gotten on a spammer's mailing list and he's sending spam to it. When he does that, SpamCop thinks you're submitting spam by email, and since the format of the 'submission' is not correct, you get an error message. The error messages are not related to the spam you report manually by copy/paste into our web form. I changed your 'submit' address and sent it to you by email. - Don D'Minion - SpamCop Admin - Link to comment Share on other sites More sharing options...
Wazoo Posted October 22, 2006 Share Posted October 22, 2006 Thanks Don ... Tagging this one as resolved ... Link to comment Share on other sites More sharing options...
pauladev Posted October 23, 2006 Share Posted October 23, 2006 Thanks Don ... Tagging this one as resolved ... I had experienced these 'error messages as Rammstein reported, and having visited the Spamcop site, I found the site was down for maintenance, and I assumed that was the problem. When it was up again, I noticed that i was not receiving any advisory messages having reported the spam through the box on mailwasher pro. I did a bit of copying and pasting, but that is quite tedious with the volume of spam I have been getting, so I stopped. Then I noticed that I was still not getting anything from Spamcop after reporting, logged in on the site and found lots of unreported spam had been saved. I came to this forum, registered, and waited for the activation mail - nothing for several hours, so i fired off an information. No reply, so I decided to go to my Gmail account. This is usually downloaded straight into my Thunderbird local folders, so I rarely go there. It was then I discobered that since the downtime of the server for maintenance, all my Spamcop report notifications has been sent direct to the Gmail spam folder, as had the activation for the Forum registration. Having found it I can now reply to this forum, and receive the notifications of my spam reports. Why should this happen? I have been receiving all the notifications via Gmail for a long time without problem. It is quite ironic that Gmail suddenly decided to classify Spamcop communications as spam!!! Link to comment Share on other sites More sharing options...
Wazoo Posted October 23, 2006 Share Posted October 23, 2006 Why should this happen? I have been receiving all the notifications via Gmail for a long time without problem. It is quite ironic that Gmail suddenly decided to classify Spamcop communications as spam!!! No idea. I have to remind myself also to actually hit the web-site and check the spam folder. Unlike so many others that talk about how fantatsic their filters are, I still find a lot of 'good' e-mail sitting in the wrong spot. And I'll second your experience that I can have some traffic with someone with no problem .. then somewhere down the line, GMail decides that anything further from that person is now spam .... and no, I've never gotten an answer from them as to why / how it happens. However, the subject matter of this Topic deals with the forging of a SpamCp.net reporting address into the From: and / ot Reply-To: address lines. Is this going on in your case? Link to comment Share on other sites More sharing options...
Miss Betsy Posted October 23, 2006 Share Posted October 23, 2006 The usual advice help desks give is to whitelist the address. They won't tell you why their filters sent it to the spam folder. Unfortunately, it defeats the purpose of receiving all mail so that no one is 'rejected' to have email suddenly go to the spam folder. I would much prefer that the sender know that the filters decided to 'reject' the email. Then the problem can be fixed. It also saves time instead of having to search the spam folder. Miss Betsy Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.