gnarlymarley

Heather, I have been getting that and it is coming from all over amazon's ip ranges. Google seems to have no interest, and neither does amazon. I setup my email server to reject it and they still try to send it. At this point, I am not sure there is a way to stop it without a firewall that can drop the tcp connection before it connects. Right now, I am mainly feeding the blocking list, but the spammer changes to a new IP every few minutes, so blocking based on a single IP seems pointless. If I hear of anything that works, then I can post it here.

And hopefully they would revoke the port 25 being open if they previous opened it and close it back down. Yes, it is up to them to fix.

Like Lking said just start reporting. Somethings to note is that your Mailhost setup is effective for previous submitted spam, so if you go to any of those to report them they should properly detect the correct spammer. Without the mailhost setup, spamcop would try to guess the IP that sent your email spam. With it, it will detect the spammer's IP that connected to your border email server.

Ah, but it appears that one can request port 25 to be unblocked. I am not sure if there is a related fee or if it is free.

If they are converting this into a sandbox, should be still be munging the address in these forums?

I am guessing this is because amazon appears to be rotating public IPs every minute. They seem to want to know the minute and since I have NTP enabled, it should make just fine into their systems. I wish that they would just enable IPv6 and stop with the NAT stuff.

Both of my paid and non-paid SpamCop accounts work fine for me. The only advice I think I can add is maybe it is a formatting issue. Maybe this will help: The first space when reading down the email that you encounter is between your headers and the body as well as the "Received:" lines should have start at the beginning of the line. The "Received:" line will have lines below it and those should be indented with a space or a tab.

Apparently @mac.com emails could be forwarded to another account. If you can read the headers, then a part such as "for user@example.com;". You might want to remove some of the "Received:" lines to split up the email if it is being forwarded.

I wonder if your thunderbird automatically updated to a newer version between the day it worked and the day it didn't.

My understanding is that the from address on each report changes as it appears to be the number is the report ID. Some ISPs like this authorize only the full address. The deputies might be able to work something out with the ISP. Under the circumstances, might just be an autoresponder that sends it to the bit bucket. Like Lking says, that this may be added to the blocklist.

I don't see this issue, but then my thunderbird is v2. Perhaps it could be a compatibility issue? I used both imap and "webmail - hotmail 1.3.2" and it works for me.

I envy you as I don't get that much. I had setup an automated forward as an attachment rule (back when that is what the freebie email providers allowed it) and I no longer get lots of spam. I think my hurdle was when I reported to the legitamite providers such as comcast and qwest is when I lost my bulk. I have no idea how 'century link' would take reports. If you can figure out how to tell the difference on who would take action on your reports and report just those, then it may help on getting your counts down.

I had thought they turned off the "Please make sure this email IS spam:" warning when they promote V5 as I have not seen the warning in quite a while. I suspect spamcop is checking the headers for a particular format and it might only pop up if the headers matches legitimate email.

I typed in your URL from the image https://www.spamcop.net/sc?id=z6598002198z8fb6021e44f26436f7ebe6fd86760940z so we can have a clickable link. I have not seen a problem on my side. I did notice your submission is missing all "Received:" header lines. When I went to check out my hotmail account on both the webmail and imap sides, I see the "Received:" header lines all intact.

Without the tracking URL, I would guess this is the line that it is stopping at right above the "identified internal IP as source" message: It would appear that you need to update your mailhost configuration but resending a message to your account. Then you should be able to return to the spam report page and it should work.

I have seen this before. It came in the reply of email I had forwarded to my submit address. Most email providers are doing the forward inline, where the forward is like a reply and headers are lost. Once I figured out how to forward as an attachment (Some used the ctrl key on the forward button) my problem was solved. You may find as in my case the email providers change the key regularly. It may be better to "view source" and then submit that in the reporting form.

There are some ways to accomplish this. Since not all of my email providers support forwarding as an attachment, I did it using a unix program called fetchmail and a perl scri_pt. (The perl scri_pt encapsulates the email as an attachment and sends it to the reporting address.) I will offer a word of caution about full automation of reporting, as I have recently had one group send me an email fifteen years after I had signed up on the list to my main email address. (Yes, they went quiet for more than a decade.) If someone were to do a restore or grab the old email address, then you could be trying to report legitimate email. That said, I have not had any problems with reporting from my accounts I signed up and never used for email.

Outernaut, For me, I have migrated away from the spamcop filter when I found that SpamAssassin contains a spamcop rule called RCVD_IN_BL_SPAMCOP_NET. (I abandoned filtering at the SMTP level when I found emails I was interested showed up on the blocklist.) Since you already have spam Assassin, you may have this rule already enabled. If you have it, you may need to use the "score" keyword to manipulate the rankings. (I currently just use the defaults for this one item.)

I have not seen this happen to me when I changed servers. IrvSp, When you logged into your reporting account, were you greeted with a reject or bounce message on the reporting page? I have seen gmail bounce the replies for me and it stopped the replies.

dr_bobbs, One thing to note if you forward as an attachment to your submit address, submit.XXXXXXXX@spam.spamcop.net, then it will automatically truncate for you.

I have not seen any recent reports of mine for this spammer. I am not sure if they stopped or just moved on to other addresses for the time.

I have not used applescript since OS9, so I may not be of help, but this page (https://macscripter.net/viewtopic.php?id=30296) seems it looks a little bit familiar and may be of help. For me, what I do is to create a new email and then drag and drop all the messages I want to submit on that email. (Yes, you can do more than one attachment to the email you submit to your submit address.) Just make sure when you get the reply you can click all the links.

Me too, so sorry about my late reply. I also noticed that some of the messages are coming in without proper line endings. How I am fixing it is to copy the message to notepad (on windows) and if I see no line wrapping, then I paste into word pad, then select all, and past into notepad. Once done, I remove the space on the lines in front of the words (Received:, From:, X-, To:, Subject:, and Reply-To:). The rest of the spaces should stay. Once I cleaned up with the above header lines, I paste into spamcop and it accepts my submissions.

Jeff2019, i think I found the problem. I got an email today from in my hotmail's outlook.com account where it seems that microsoft decided to add an extra space to some of the headers. If you look at the below, the first received line is okay, but the second Received line has a space that is reserved for line wrapping. I don't like it when companies refuse to follow RFCs. Received: from MW2NAM10HT110.eop-nam10.prod.protection.outlook.com (2603:10b6:5:190::40) by DM6PR14MB2170.namprd14.prod.outlook.com with HTTPS via DM6PR11CA0027.NAMPRD11.PROD.OUTLOOK.COM; Tue, 12 Nov 2019 12:00:39 +0000 Received: from MW2NAM10FT066.eop-nam10.prod.protection.outlook.com (10.13.154.53) by MW2NAM10HT110.eop-nam10.prod.protection.outlook.com (10.13.154.254) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2430.20; Tue, 12 Nov 2019 12:00:38 +0000 it should look like this as I had to remove the extra spaces from some of the lines: Received: from MW2NAM10HT110.eop-nam10.prod.protection.outlook.com (2603:10b6:5:190::40) by DM6PR14MB2170.namprd14.prod.outlook.com with HTTPS via DM6PR11CA0027.NAMPRD11.PROD.OUTLOOK.COM; Tue, 12 Nov 2019 12:00:39 +0000 Received: from MW2NAM10FT066.eop-nam10.prod.protection.outlook.com (10.13.154.53) by MW2NAM10HT110.eop-nam10.prod.protection.outlook.com (10.13.154.254) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2430.20; Tue, 12 Nov 2019 12:00:38 +0000

I suspect that on https://www.spamcop.net/fom-serve/cache/125.html, this is the part you are talking about: "If the recipient agreed to receive it, then it is not spam." Even though the content of them is unwanted, unsolicited, and bulk, the notifications from the forum for legitamite posts might be desired and therefore the all notifications are not spam.