asi7 Posted February 17, 2011 Share Posted February 17, 2011 Well, I ran into a spam and pasted it into the SpamCop reporting web form. But then the submission just hangs for a long time and finally returns a page that reads: SpamCop v 4.6.1.006 © 1992-2011 Cisco Systems, Inc. All rights reserved. Here is your TRACKING URL - it may be saved for future reference: http://www.spamcop.net/sc?id=z4886641045z1...f40066ec8a3526z and no further information, or submit option. Maybe the spammers are ahead of this game. Here's a copy of the problem spam message: Return-Path: contact[at]chairpraised.com Received: from imta01.emeryville.ca.mail.comcast.net (LHLO imta01.emeryville.ca.mail.comcast.net) (76.96.30.13) by sz0108.wc.mail.comcast.net with LMTP; Wed, 16 Feb 2011 22:30:17 +0000 (UTC) Received: from handsown.info ([207.152.143.58]) by imta01.emeryville.ca.mail.comcast.net with comcast id 8mUv1g00q1FoZhb01mWFd3; Wed, 16 Feb 2011 22:30:16 +0000 X-CAA-spam: F00000 X-Authority-Analysis: v=1.1 cv=Ko2fFjfPhnE4EDvH5+9y/PqAsVoTNDv+Wd/kZPGRqc0= c=1 sm=1 a=rQN0X7SmV9cA:10 a=jPJDawAOAc8A:10 a=8nJEP1OIZ-IA:10 a=IFs+4t84Mbuz+y5BV/L7qg==:17 a=S13cx5p7AAAA:8 a=C_IRinGWAAAA:8 a=xPtkFOrgYu1IomVEGoIA:9 a=U4zOSqdOeS_xDXG5MR0A:7 a=h68f7GeNSckugP0EX9DW1YmeJLsA:4 a=wPNLvfGTeEIA:10 a=3CVoj8mO9yoA:10 a=l41ryeaqVcsA:10 a=-k8rCdDlcXsA:10 a=7qKShXWlwpcA:10 a=si9q_4b84H0A:10 a=IFs+4t84Mbuz+y5BV/L7qg==:117 From: Your Reward Inside <gaiters673[at]chairpraised.com> Subject: =?ISO-8859-1?Q?=0E=16=06Outb=04ack=20St=0Eeakhous=00e=20su=02rvey=20fr=03ee=20gi=08ft=20ca=03rd=19=06=18?= MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" X-Checking: LlKjZFbjo1iYOAgruFSF0jZ5hD <center> <a href="http://skeet.historyundo.info/t.aspx?esp=15&lnkconfig=16&u=2123784&p=99736224&e=550360792473"> <img src="http://lavers.historyundo.info/j/205934" border="0"> </a><br> <a href="http://wives.historyundo.info/t.aspx?esp=15&lnkconfig=16&u=2123785&p=99736224&e=929553979449"> <img src="http://mammee.historyundo.info/j/205935" border="0"> </a><br> <a href="http://equites.historyundo.info/t.aspx?esp=15&lnkconfig=16&u=2123786&p=99736224&e=835991574805"> <img src="http://zilch.historyundo.info/j/205936" border="0"> </a> </center> <div style="visibility: hidden; display: none;"> <img border="0" height="1" width="1" src="http://misters.historyundo.info/t.aspx?a=o&m=99736224&e=xxxxxxx[at]comcast.net"> eyelet reheard rumba cilia outdid lories freckly. miladi sloughy bogeys milks sauted anthill wolfs vainly orpins viators graplin islands pillory fatly sermons faded ominous brood ogive bashing. genua magnet damsels stomp vomica wanner encased duellos pachisi agave foggers. browned pedlar protist tipsier palea mazards guitars degerms boxlike pupil cubeb knocks kaifs reclean grift reelect putzing. nudity petrels jujuist toughie tertial diptyca togaed doggers unloose beater asdics troupe kimono typeface terser tartana malms. begrim sorbet estriol nullity redips roosed sannup rimed gropers numen getas vetoers figures louden hided affects roosed kainits tickles zonate polypod. <br> <br> resume conjure lowbrow bipack rheas gravest darted larceny ileus dittoed loathes progeny tweed grans mammet pirogue. quarte culled fractal halers lookers aboard choused pedlar. compo caymans vermian avowals doomful burler houseful davit waggish rinning strap sorbets sonsy. silly ceviche lingas cation affined lessor. regnant rinse derides. weblike unzips promise chamois sewars rescue glides audial replan curated allods guenon boccis kaliph chervil. <br> vinery flooie telexed basinet lockjaw pirates frosty warmest autisms tergum spliced neatly armour girls genomic ragtop hawker savors gonif fatly shunted. <br> <br> <br> sector copulae algal spright unhelms dandily unseam pocosin paddock miasmal isaias corded dourer dittoed windled decider toppers inurns peopled. frags suffice niffers shotts nosher pulps drawbar regnant roods denims clammy diktats tippers tingled navels seiches concoct vomitus. beamy aerosat shushed troupe bonnily kirsch protist lineup aerated sanctum unhooks. riffled algal bomber swards fimbria niffers clonk charity precious sorns tartest pocks slams oboists spurted liquefy. onefold strata parity buskin prolan fulcrum scribed sprags onefold plank jutes blocker coldish venery hoppy whirler dosed sizar winged lapins minnow primped. wells mordent. postpone sauna greys distill utopia inwalls bottles basking fluxion accusal rhumba entreat galores slicker liquefy merlot abiding mediate moons. fluxion parvenu soothe bungled liquefy floosy nectar coveted charro probe tottery raised. <br> <br> wedging monaco misbias. cowards wound madre geyser urase tickles. kendo belleek milles dizzy foolery domicil catalog liger estrums slaved stratum hormone peruke mantras traced airts yakker culled. symptom. croaky winnow tickers sallowy lakiest karts curve cussing reuses cassata cereal divots panzer cussed scours apical whooper codex glegly bolos carates terser prating. voiles. <br> muhlies rifted cloche alliums smiter guggled pyjamas upends hackled agism trainer. wafture duskish pupil epizoa banshee surlier cubeb. carols falsest mossy neater dictate lowbrow tertial pulpers alliums peage peats witch cavers braves supply withed pareve gurnets. painted dewar chimbs microhm fizzled adown villain reposes midribs foetus cermets manses timbre slope. plank neaps neaps experts upheaps baroque ocular mosso balder repairs dolour. tetters zetas telsons waddles haymow leggin often dolour fudged effulge deskmen cygnets cussing gnaws sannop rocket grassy linages expand shuffle ethyne attuned. <br> <br> polypi pandoor navvies gazebo etude reelect levied cites trainer caveat situp enlarge getas polypod lahar surge doomful telsons redden. lessee kremlin swives honda manger. roamer plaster. apical. neuroid fitful forger pullets supply riflery coydog orpins drossy sinner apods haled sluiced myopy midgut quoits jujuist oolite chucked. </div> Link to comment Share on other sites More sharing options...
Farelf Posted February 17, 2011 Share Posted February 17, 2011 I've had a few glitches with reporting lately but hitting the "reload" button seems to fix that. Your case seems different. The tracking link provided just hangs. The spam you presented has some line wrapping issues but regardless of whether submitted as is or with the wrapping fixed the submission just hangs, as you say. The only way out of the impass I have found is to close the session then log back in and hit "Remove unreported spam" link. Which leaves the spam unreported, as you say. SC staff will need to look at this one I think - contact Don at service[at]admin.spamcop.net [edit] Ah, don't need to close session, just use the "Stop" button and get to cancellation (remove) link via "Report spam" tab. The (process) "Unreported spam" link of course does nothing useful in this case. Link to comment Share on other sites More sharing options...
Wazoo Posted February 17, 2011 Share Posted February 17, 2011 Well, I ran into a spam and pasted it into the SpamCop reporting web form. But then the submission just hangs for a long time and finally returns a page that reads: SpamCop v 4.6.1.006 © 1992-2011 Cisco Systems, Inc. All rights reserved. Here is your TRACKING URL - it may be saved for future reference: http://www.spamcop.net/sc?id=z4886641045z1...f40066ec8a3526z and no further information, or submit option. My results were a bit different, but assume that this is because I'm set to see "full Techical results' Further testing found that some of the results were different depending on just which server was handling the parse. E-mail sent to the Deputies. Link to comment Share on other sites More sharing options...
Farelf Posted February 17, 2011 Share Posted February 17, 2011 Finally got a result with the posted tracking URL. On server prod-sc-www1 the parse halted while looking up the last spamvertized website: Tracking link: http://skeet.historyundo.info/t.aspx?esp=15&lnkconfig=16&u=1123783&p=89736223&e=450360792472 No recent reports, no history available Resolves to 207.152.143.7 Routing details for 207.152.143.7 [refresh/show] Cached whois for 207.152.143.7 : info[at]mercurytechnicalsupport.com Using abuse net on info[at]mercurytechnicalsupport.com got sigalarm, taking too long to process, aborted. Perhaps you can wait a few minutes and reload? On my own lookup, I'm seeing RAbuseEmail: eulah2p0f[at]tiltwand.com RAbuseRef: http://whois.arin.net/rest/poc/EBO44-ARIN for that one by the way. Link to comment Share on other sites More sharing options...
Wazoo Posted February 17, 2011 Share Posted February 17, 2011 Finally got a result with the posted tracking URL. On server prod-sc-www1 the parse halted while looking up the last spamvertized website: On my own lookup, I'm seeing Yeah, that was the 'different' result I saw. However, I then found that it wasn't repeatable. Issue to me at this point, the lack of HTML tags in the body and the 'div style' content. RW has replied back advising that he's looking into it. Link to comment Share on other sites More sharing options...
Farelf Posted February 17, 2011 Share Posted February 17, 2011 Seems to be mostly a problem with those websites. Substituting the href seems to restore process to something approaching normalacy. Wouldn't swear it is the whole answer though - seem to have ended up with two reports off one submission?? http://www.spamcop.net/sc?id=z4887410553z7...f71e4495915917z http://www.spamcop.net/sc?id=z4887410815z4...7e6757ecf715bfz Very odd. Link to comment Share on other sites More sharing options...
Wazoo Posted February 18, 2011 Share Posted February 18, 2011 DNS look-up issues with the sub-domains is what I've come up with. More data sent to Richard. Link to comment Share on other sites More sharing options...
asi7 Posted February 18, 2011 Author Share Posted February 18, 2011 DNS look-up issues with the sub-domains is what I've come up with. More data sent to Richard. Interesting; perhaps the spammers host their own DNS in such a way to foil us? Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.