Jump to content


  • Content Count

  • Joined

  • Last visited

Everything posted by gnarlymarley

  1. dr_bobbs, One thing to note if you forward as an attachment to your submit address, submit.XXXXXXXX@spam.spamcop.net, then it will automatically truncate for you.
  2. I have not seen any recent reports of mine for this spammer. I am not sure if they stopped or just moved on to other addresses for the time.
  3. gnarlymarley

    Apple Mail SpamCop Reporting

    I have not used applescript since OS9, so I may not be of help, but this page (https://macscripter.net/viewtopic.php?id=30296) seems it looks a little bit familiar and may be of help. For me, what I do is to create a new email and then drag and drop all the messages I want to submit on that email. (Yes, you can do more than one attachment to the email you submit to your submit address.) Just make sure when you get the reply you can click all the links.
  4. gnarlymarley

    SpamCop isn't working right with Outlook.com

    Me too, so sorry about my late reply. I also noticed that some of the messages are coming in without proper line endings. How I am fixing it is to copy the message to notepad (on windows) and if I see no line wrapping, then I paste into word pad, then select all, and past into notepad. Once done, I remove the space on the lines in front of the words (Received:, From:, X-, To:, Subject:, and Reply-To:). The rest of the spaces should stay. Once I cleaned up with the above header lines, I paste into spamcop and it accepts my submissions.
  5. gnarlymarley

    SpamCop isn't working right with Outlook.com

    Jeff2019, i think I found the problem. I got an email today from in my hotmail's outlook.com account where it seems that microsoft decided to add an extra space to some of the headers. If you look at the below, the first received line is okay, but the second Received line has a space that is reserved for line wrapping. I don't like it when companies refuse to follow RFCs. Received: from MW2NAM10HT110.eop-nam10.prod.protection.outlook.com (2603:10b6:5:190::40) by DM6PR14MB2170.namprd14.prod.outlook.com with HTTPS via DM6PR11CA0027.NAMPRD11.PROD.OUTLOOK.COM; Tue, 12 Nov 2019 12:00:39 +0000 Received: from MW2NAM10FT066.eop-nam10.prod.protection.outlook.com ( by MW2NAM10HT110.eop-nam10.prod.protection.outlook.com ( with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2430.20; Tue, 12 Nov 2019 12:00:38 +0000 it should look like this as I had to remove the extra spaces from some of the lines: Received: from MW2NAM10HT110.eop-nam10.prod.protection.outlook.com (2603:10b6:5:190::40) by DM6PR14MB2170.namprd14.prod.outlook.com with HTTPS via DM6PR11CA0027.NAMPRD11.PROD.OUTLOOK.COM; Tue, 12 Nov 2019 12:00:39 +0000 Received: from MW2NAM10FT066.eop-nam10.prod.protection.outlook.com ( by MW2NAM10HT110.eop-nam10.prod.protection.outlook.com ( with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2430.20; Tue, 12 Nov 2019 12:00:38 +0000
  6. gnarlymarley

    "spam" from Spamcop

    I suspect that on https://www.spamcop.net/fom-serve/cache/125.html, this is the part you are talking about: "If the recipient agreed to receive it, then it is not spam." Even though the content of them is unwanted, unsolicited, and bulk, the notifications from the forum for legitamite posts might be desired and therefore the all notifications are not spam.
  7. gnarlymarley

    Why am I paying with my time?

    By reporting spam through SC, it does two things: Alerts the administrators to do something about it or risk being put on the blocking list. After a certain amount of reports the offending IP is added to the blocking list. A lot of email service providers have used the SC blocking list. If you control your own email server, you could use the SC blocking list to help slow down the spam. If you use a spam filtering tool such as spamassassin, then this will most likely already be enabled.
  8. gnarlymarley

    Why am I paying with my time?

    The NAG screen was started around the turn of the century after lots of people started using the sevice. The minimum time (If I remember correctly) was set to three seconds and only went higher if there were lots of people submitting their spam at the same time. The highest I saw back in the day (Just before Cisco came on) was a over a minute. What I would do at that time if I was not paying is to open up a second window/tab and submit more spam while I was waiting for the first window's nag to time out.
  9. gnarlymarley

    October 2019 - A month different to others?

    I did notice on the source of spam page lately there are a lot of "ISP has indicated spam will cease" from IP ranges such as and where it appears that they are just marking the option to prevent reports from being submitted. (It seems to be more than one IP in their range.) It appears they have been doing this for more than 48 hours and marking this maybe every six hours as the time after the message seems to jump up by around six hours. Could this be part of the why the spikes have changed?
  10. gnarlymarley

    obscuring personal IDs in reports

    Some browsers might call this mode "incognito". And yes, I use it too.
  11. gnarlymarley


    I also find it interesting that they hid the real spam link in the visible text instead of making it a clickable link using the HTML tags like they did with the nopammer.net section. Probably to hide it from parsers that report the links.
  12. gnarlymarley

    obscuring personal IDs in reports

    hank, it is a good idea to make sure it was munged before sending the reports to the admins. (The admins that "could be" the actual spammers.)
  13. gnarlymarley

    IP being used, but not in whois

    Thanks, good to know. Yeah, it was picked up by Media Land as an be seen in BGP tables, https://bgp.he.net/AS206728#_prefixes out of Russia. I had contacted RIPE and all I got is Media Land is what I currently know about it. My contact at RIPE seems to think has never been allocated to any organization (which leads me to believe they are only looking at what I can see and their front end support is not very helpful.) Hello, Thank you for coming back to us. The AS206728 belongs to MEDIALAND. However the range is not allocated. https://apps.db.ripe.net/db-web-ui/#/query?searchtext=AS206728 So they are announcing a network with a range which is unassigned from their own servers. Hope to have informed you sufficiently at this stage. Kind Regards,
  14. Sounds to me like the IP registries are confused. Seems to be that is said by arin to be RIPE, but by everyone else to be IANA. The IP is in use and is routable. Does anyone else see what I am seeing returned from RIPE or is this just me? https://www.spamcop.net/sc?id=z6578180134z80ef26afa691a5047d301c474dcaaf8bz https://www.spamcop.net/sc?id=z6578095270z15fc50e4b2d4dad674d00394b23c6c24z https://www.spamcop.net/sc?action=rcache;ip= $ whois [whois.ripe.net] % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf % Note: this output has been filtered. % To receive output for a database update, use the "-B" flag. % Information related to ' -' % No abuse contact registered for - inetnum: - netname: IANA-BLK descr: The whole IPv4 address space
  15. gnarlymarley

    hetzner.de spam source

    A few ways to do this. One is traceroute. If they have a firewall, then this may not get you to their border servers. The other way is to use a looking glass, such as http://lg.he.net. I also use http://bgp.he.net to find the upstream AS number and then I can use it to find the peers. It appears that hetzner.de is much larger than I though as they have 216 peers. That would take way too much time to get their ISPs to chat with them about their spam hosting. It is interesting that all their networks all point to abuse[at]hetzner.de.
  16. gnarlymarley

    Domain abuse reporting contact

    This is because the abuse address of the domain itself is usually the spammer themselves. So SpamCop reports it to the abuse address where the content is stored, which is on the IP. The domain is pointed to an IP that seems to be in a Microsoft data center. Host hipmie.com (checking ip) = details for[refresh/show] Cached whois for : abuse@microsoft.com
  17. gnarlymarley

    No Data Found

    Apparently, there was a problem between the database and the email servers. Works for me now. You will want to try your old tracking URLs.
  18. gnarlymarley

    spamcop report spam

    apparently, there was an issue between the database and one of the mail servers. Your tracking URL seems to be working for me now.
  19. gnarlymarley

    No data found--Spamcop do not see header

    Was intermittent for me and maybe was prod-sc-app007. It is working for me now and all my old links that were broken are fixed. You may need to note down if this was a different server than app007 and get the deputies to put in a trouble ticket.
  20. gnarlymarley

    spamcop report spam

    It was only a handful of spammers that tried to figure out who I was. They kept sending similar emails to my hotmail at the time while changing the To: header and a number at the bottom of the body. Been a while since I have seen their attempt to detect me. Awesome!
  21. gnarlymarley

    spamcop report spam

    The spammers will try to change headers or unique identifiers to try to figure out who is reporting. Hopefully they get shutdown first instead. About two decades ago, I was seeing it jump from 5 to around 70 seconds. At that time there were factors such as DB speed and webservers and it would try to detect high loads and put in a higher time. The amount of reports would change that wait number. The spamgraph might be good for you to check out to see if that is still happening with the number of reports and the wait time. https://www.spamcop.net/spamgraph.shtml?spamstats
  22. gnarlymarley


    spammers like to make their stuff look legitimate. I believe gmail has fallen to the spammers level. If they are paid enough, they will probably continue to have the domain unblocked.
  23. I wonder if this has something to do with mailhosts. It almost seems the parser might be dying on this line: Received: from singlehosti.com (singlehosti.com. Does it change if you remove only that one line?
  24. gnarlymarley

    Can I copy reports to my ISP

    When you add fuel to your account, there is a third party report option that shows up on each report that you can add your ISP's email. I am not sure I would use it as your ISP would probably just turn off the reports such as noted with sendgrid in this forum post.
  25. gnarlymarley


    Also, the (Notes) portion is a link to some text boxes further down on the page where you can add some information to the particular report that goes out. The group text box for is up by the "Send Reports" button, and the individual text boxes are below.