lnesseler Posted November 26, 2011 Share Posted November 26, 2011 This clever spammer, HGIHosting.com, has added spamcop to the TO line of every one of its spams, insuring that I'd get banned by reporting them! They've even made it difficult for me to post it here. I had to first export the email as raw text. These emails are essentially unreportable! ************** From: "Energy Group Networks - EGIHosting.com - Phone Support: 888-808-8806" <support[at]egihosting.com> Subject: Welcome to Energy Group Networks - EGIHosting.com - Phone Support: 888-808-8806 Support Center Date: November 25, 2011 11:10:03 PM PST To: 5653958839[at]reports.spamcop.net Reply-To: support[at]egihosting.com This message serves as confirmation that you are now successfully registered in our support center. Registered Email: 5653958839[at]reports.spamcop.net Password: lajzijt20g You can visit the Support Desk at any time by going to http://livesupport.egihosting.com/ Please do let us know if you have any questions. Regards, Energy Group Networks - EGIHosting.com - Phone Support: 888-808-8806 Support Center: http://livesupport.egihosting.com/index.php?/default_import Oh, I forgot to add that when I get a new source of spam, I routinely double report it to RoadRunner. That's how RR got involved in my banning! Link to comment Share on other sites More sharing options...
SpamCopAdmin Posted November 26, 2011 Share Posted November 26, 2011 >- To: 5653958839[at]reports.spamcop.net That emil is not spam. It is a reply to your SpamCop report #5653958839, which you sent to abuse[at]egihosting.com. ISP responses are not spam and should not be reported. The content of the response is irrelevant. Your complaints go out using a "From" address like this: From: 5653958839[at]reports.spamcop.net Your address is not exposed by SpamCop. Our system deletes your address from the headers and then sends the complaints out using the report ID number as an internal SpamCop address. When someone replies to a complaint, their message comes to us and our system translates the report ID number to the user who filed the report and sends the message along to them. Your reporting account got suspended because you are telling Road Runner that mail from SpamCop is spam. - Don D'Minion - SpamCop Admin - - service[at]admin.spamcop.net - . Link to comment Share on other sites More sharing options...
lnesseler Posted November 26, 2011 Author Share Posted November 26, 2011 >- To: 5653958839[at]reports.spamcop.net That emil is not spam. It is a reply to your SpamCop report #5653958839, which you sent to abuse[at]egihosting.com. ISP responses are not spam and should not be reported. The content of the response is irrelevant. Your complaints go out using a "From" address like this: From: 5653958839[at]reports.spamcop.net Your address is not exposed by SpamCop. Our system deletes your address from the headers and then sends the complaints out using the report ID number as an internal SpamCop address. When someone replies to a complaint, their message comes to us and our system translates the report ID number to the user who filed the report and sends the message along to them. Your reporting account got suspended because you are telling Road Runner that mail from SpamCop is spam. - Don D'Minion - SpamCop Admin - - service[at]admin.spamcop.net - . Ok, I'm confused. What in this email tells me that this is a SCOP report other than the TO line? Ok, I'm confused. What in this email tells me that this is a SCOP report other than the TO line? Here's the actual spam report, which I didn't dual report: From: "EGIHosting.com - Abuse" <abuse[at]egihosting.com> Subject: [ABUSE #DIB-962-54661]: [spamCop (http://livesupport.egihosting.com/index.php?/default_import<br'>http://livesupport.egihosting.com/index.php?/default_import<br) id:5653956760]Welcome to Energy Group Networks - EGIHosting.com .. Date: November 25, 2011 11:03:05 PM PST To: 5653956760[at]reports.spamcop.net Reply-To: abuse[at]egihosting.com Rufina, Thank you for contacting us. This is an automated response confirming the receipt of your ticket. One of our agents will get back to you as soon as possible. For your records, the details of the ticket are listed below. When replying, please make sure that the ticket ID is kept in the subject line to ensure that your replies are tracked appropriately.    Ticket ID: DIB-962-54661    Subject: [spamCop (http://livesupport.egihosting.com/index.php?/default_import    Department: Mail Abuse    Type: Issue    Status: Open    Priority: Medium You can check the status of or reply to this ticket online at: http://livesupport.egihosting.com/index.ph...w/DIB-962-54661 Kind regards, Energy Group Networks - EGIHosting.com - Phone Support: 888-808-8806 Support Center: http://livesupport.egihosting.com/index.php?/default_import Link to comment Share on other sites More sharing options...
SpamCopAdmin Posted November 26, 2011 Share Posted November 26, 2011 Ok, I'm confused. What in this email tells me that this is a SCOP report other than the TO line? Here's the actual spam report, which I didn't dual report: From: "EGIHosting.com - Abuse" <abuse[at]egihosting.com> Subject: [ABUSE #DIB-962-54661]: [spamCop (http://livesupport.egihosting.com/index.php?/default_import<br'>http://livesupport.egihosting.com/index.php?/default_import<br) id:5653956760]Welcome to Energy Group Networks - EGIHosting.com .. Date: November 25, 2011 11:03:05 PM PST To: 5653956760[at]reports.spamcop.net Reply-To: abuse[at]egihosting.com Rufina, Thank you for contacting us. This is an automated response confirming the receipt of your ticket. One of our agents will get back to you as soon as possible. For your records, the details of the ticket are listed below. When replying, please make sure that the ticket ID is kept in the subject line to ensure that your replies are tracked appropriately. Ticket ID: DIB-962-54661 Subject: [spamCop (http://livesupport.egihosting.com/index.php?/default_import Department: Mail Abuse Type: Issue Status: Open Priority: Medium You can check the status of or reply to this ticket online at: http://livesupport.egihosting.com/index.ph...w/DIB-962-54661 Kind regards, Energy Group Networks - EGIHosting.com - Phone Support: 888-808-8806 Support Center: http://livesupport.egihosting.com/index.php?/default_import You might want to take a moment and scrutinize the email you say is spam. - Don D'Minion - SpamCop Admin - - service[at]admin.spamcop.net - . Link to comment Share on other sites More sharing options...
lnesseler Posted November 26, 2011 Author Share Posted November 26, 2011 You might want to take a moment and scrutinize the email you say is spam. - Don D'Minion - SpamCop Admin - - service[at]admin.spamcop.net - . I apologize for being obtuse even after I've had two cups of coffee. After reporting the spam, they signed me up as a user with name and login, why, I don't know. That's all it says: there's no acknowledgement of the original report. If I log in, which I hated to do, the site tells me I'm the administrator the the reporting site, along with an IP address that isn't mine. The original spam that set this off was the notification of my having an account with them, which I didn't have and don't want. I tried to check the reporting history to find the original report, but apparently those aren't saved. Now kindly give a 66-year-old half-blind spam hater a clue: how am I to tell from the so-called "spam" I posted that's it's actually a response to a report and not spam? Especially when the outfit sends me a perfectly clear report? I've tried taking a moment and I'm still confused. Link to comment Share on other sites More sharing options...
petzl Posted November 27, 2011 Share Posted November 27, 2011 I apologize for being obtuse even after I've had two cups of coffee. After reporting the spam, they signed me up as a user with name and login, why, I don't know. That's all it says: there's no acknowledgement of the original report. If I log in, which I hated to do, the site tells me I'm the administrator the the reporting site, along with an IP address that isn't mine. The original spam that set this off was the notification of my having an account with them, which I didn't have and don't want. I tried to check the reporting history to find the original report, but apparently those aren't saved. Now kindly give a 66-year-old half-blind spam hater a clue: how am I to tell from the so-called "spam" I posted that's it's actually a response to a report and not spam? Especially when the outfit sends me a perfectly clear report? I've tried taking a moment and I'm still confused. Open a super secret Gmail account. Like full name and house number like 123JohnSmith Use this as your SpamCop contact address Should help avoid confusion Gmail addresses are very powerfull and very good however the do electronically read your email (called "Data Mining") Their software for doing this is very good. I have never given them my real name or age. I also use Gmail for 'specail offers" from local stores supermarket they have got y age from birthday greetings and ads now target my age Link to comment Share on other sites More sharing options...
SpamCopAdmin Posted November 27, 2011 Share Posted November 27, 2011 After reporting the spam, they signed me up as a user with name and login, why, I don't know.That is their way of creating a "trouble ticket" so they can address your complaint. I don't know why they do it that way, either, but I see it often. It doesn't make sense to create an account when all they have to do is log the complaint and assign it a number. The original spam that set this off was the notification of my having an account with them, which I didn't have and don't want.You have reported more than one of their responses. Every time you do that, it creates yet another account and generates yet another automatic reply. The actual original spam was one of those fake $30 Million "business proposals" that we all get from time to time. http://www.spamcop.net/sc?id=z5181337466ze...73dc8aa69f3fc0z You can use that link to review the original spam in your report history. The "View entire message" link will show you the full headers and text. how am I to tell from the so-called "spam" I posted that's it's actually a response to a report and not spam?OK, I'll go over it item by item. >- To: 5653956760[at]reports.spamcop.net >- Subject: [ABUSE #DIB-962-54661]: [spamCop (http://livesupport.egihosting.com/index.php?/default_import<br'>http://livesupport.egihosting.com/index.php?/default_import<br) id:5653956760] The "From" information includes a SpamCop "To" address, and more importantly, it features a SpamCop subject line. Those are your first major indicators. >- This is an automated response confirming the receipt of your ticket. >- One of our agents will get back to you as soon as possible. >- Subject: [spamCop (http://livesupport.egihosting.com/index.php?/default_import Then, the body text has "autoresponder" written all over it, and includes a second mention of the SpamCop subject line. That should clinch it for you. The email is clearly a response to a SpamCop report. - Don D'Minion - SpamCop Admin - - service[at]admin.spamcop.net - . Link to comment Share on other sites More sharing options...
lnesseler Posted November 27, 2011 Author Share Posted November 27, 2011 That is their way of creating a "trouble ticket" so they can address your complaint. I don't know why they do it that way, either, but I see it often. It doesn't make sense to create an account when all they have to do is log the complaint and assign it a number. You have reported more than one of their responses. Every time you do that, it creates yet another account and generates yet another automatic reply. The actual original spam was one of those fake $30 Million "business proposals" that we all get from time to time. http://www.spamcop.net/sc?id=z5181337466ze...73dc8aa69f3fc0z **************** I wish I could look at the above, but it tells me my authorization has been revoked. You can use that link to review the original spam in your report history. The "View entire message" link will show you the full headers and text. OK, I'll go over it item by item. >- To: 5653956760[at]reports.spamcop.net >- Subject: [ABUSE #DIB-962-54661]: [spamCop (http://livesupport.egihosting.com/index.php?/default_import<br'>http://livesupport.egihosting.com/index.php?/default_import<br) id:5653956760] ********** If I reported one of these, I acknowledge that bleary-headed mistake. However, the ones I KNOW I reported were like the one I first posted in this thread. It didn't contain anything that identified as an acknowledgement of being an abuse report. It instead simply I had a new account and gave me a login. What is now apparent to me is that this account was for you, not me, and I have no idea why this was sent to me. And because it was from them to you, with me buried in the headers as some kind of cc, I'm not at all sure how spamcop itself could have been reported as spamming. I've been reporting spam here for quite some time now: this is the only time I've received this kind of message. I just assumed it was more spam. In the future, if I ever hear from them again, I'll know what I'm looking at. The email you're dissecting in detail is not one I was confused about: it's clearly marked for what it is. Until I'm unblocked, I can't check the past reports to see if I also submitted an abuse report as spam. I did report every one of the other form, as listed at the top of this thread. **************** skipping past the analysis of the obvious email type The "From" information includes a SpamCop "To" address, and more importantly, it features a SpamCop subject line. Those are your first major indicators. >- This is an automated response confirming the receipt of your ticket. >- One of our agents will get back to you as soon as possible. >- Subject: [spamCop (http://livesupport.egihosting.com/index.php?/default_import Then, the body text has "autoresponder" written all over it, and includes a second mention of the SpamCop subject line. That should clinch it for you. The email is clearly a response to a SpamCop report. - Don D'Minion - SpamCop Admin - - service[at]admin.spamcop.net - ******** Don, we seem to be talking past each other for reasons that are unclear to me. In any case, am I permanently banned? If not, when do you plan to lift the ban? I'd like to look at the URL you posted above, and so some more tracing. I'd like to see how many of each type I may have submitted. And I'd certainly like to get back to the sport of getting back at the spammers. [quoting fixed] Link to comment Share on other sites More sharing options...
Farelf Posted November 27, 2011 Share Posted November 27, 2011 **************** I wish I could look at the above, but it tells me my authorization has been revoked. ...What? Everyone in the observable universe should be able to follow that link (even forum guests - noting forum and reporting accounts are completely independent). Try logging out of reporting account and start a new, separate browsing session to view the forum if you're getting an authorization failure on that link. Let's know how that goes - but it is just an example of the original spam. Link to comment Share on other sites More sharing options...
lnesseler Posted November 28, 2011 Author Share Posted November 28, 2011 What? Everyone in the observable universe should be able to follow that link (even forum guests - noting forum and reporting accounts are completely independent). Try logging out of reporting account and start a new, separate browsing session to view the forum if you're getting an authorization failure on that link. Let's know how that goes - but it is just an example of the original spam. I did as you suggested: logged out an clicked the link. I still got this: Your authorization has been revoked. Please check your email to find an explanation for this. Mail to the address on the account (**my email**[at]san.rr.com) may be bouncing. If so, use the "Preferences" menu choice to set a working address on the account and contact service[at]admin.spamcop.net for reinstatement. Link to comment Share on other sites More sharing options...
Farelf Posted November 28, 2011 Share Posted November 28, 2011 Weird. There are several ways to access the reporting account - you may have to delete some cookies or something to cut those ties before you can access the link. Unusual for total strangers to have more privileges than a member but not unheard of, just a matter of risk management, though I can't see the need in this case. You should be able to bring up your members copy of it through your reporting account member page (http://members.spamcop.net/ and "Past Reports"). But it is not that important - just a spam from outside your host's network wanting you to contact a hotmail address for detail on a "business proposal of ($30.5 million)", a "Nigerian 419" type scam. Well, maybe it is showing you don't have your mailhosting setup configured? I can't see that it is configured in the parsing results anyway. The "unauthorized" message would be standard (but I never knew before you could get it just pulling up a "public" tracking URL). I take it you DID get an email to your san.rr.com account when all this started? But all of this is off-topic, sorry. You mustn't report messages forwarded to you via SC. If you can't see the difference between those and spam then you are going to remain suspended. You need help in interpreting the headers. I have to run, maybe another member can point you in the right direction. Link to comment Share on other sites More sharing options...
lnesseler Posted November 28, 2011 Author Share Posted November 28, 2011 Weird. There are several ways to access the reporting account - you may have to delete some cookies or something to cut those ties before you can access the link. Unusual for total strangers to have more privileges than a member but not unheard of, just a matter of risk management, though I can't see the need in this case. You should be able to bring up your members copy of it through your reporting account member page (http://members.spamcop.net/ and "Past Reports"). But it is not that important - just a spam from outside your host's network wanting you to contact a hotmail address for detail on a "business proposal of ($30.5 million)", a "Nigerian 419" type scam. Well, maybe it is showing you don't have your mailhosting setup configured? I can't see that it is configured in the parsing results anyway. The "unauthorized" message would be standard (but I never knew before you could get it just pulling up a "public" tracking URL). I take it you DID get an email to your san.rr.com account when all this started? But all of this is off-topic, sorry. You mustn't report messages forwarded to you via SC. If you can't see the difference between those and spam then you are going to remain suspended. You need help in interpreting the headers. I have to run, maybe another member can point you in the right direction. I have no problem now with interpreting the kind I first received as not spam, and the second one which was commented on is obvious, but all I can do now is wait for the suspension to be lifted, if ever. Link to comment Share on other sites More sharing options...
Farelf Posted November 28, 2011 Share Posted November 28, 2011 Back, but that is the response and assurance that Don will, no doubt, consider. Ah, I see he is looking at the topic, he will surely be in touch. Link to comment Share on other sites More sharing options...
turetzsr Posted November 28, 2011 Share Posted November 28, 2011 <snip> all I can do now is wait for the suspension to be lifted, if ever. ...If you don't hear from someone at SpamCop within a week or so, I'd suggest you follow the suggestion(s) mentioned in the SpamCop FAQ (link near top left of every SpamCop Forum page) item labeled "How can I unsend a Report?" especially the one mentioning "deputies <at> spamcop.net." You may also wish to mention this SpamCop Forum "thread" in the e-mail you send. ...Good luck! Link to comment Share on other sites More sharing options...
SpamCopAdmin Posted November 29, 2011 Share Posted November 29, 2011 ...If you don't hear from someone at SpamCop within a week or soNot to worry. I have been participating in this discussion from the beginning, and corresponding with lnesseler via email all along. - Don D'Minion - SpamCop Admin - - service[at]admin.spamcop.net - . Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.