Jump to content

[Resolved] Reported phish to Spamcop and then I'm the one blocked


bob424
 Share

Recommended Posts

I sent a phishing email I received to spamcop. What happened after I reported the phishing email was I lost my internet service from cox.net communications as spamcop reported that I was the source of the spam email. I had to call to get my internet restored. For some reason when spamcop read the header, it reported me as the source along with dimenoc.com and theplanet.com. I fully trusted spamcop to determine where the spam was coming from but then found that by reporting the spam I was complaining about myself as well. I have submitted all my email addresses to the hosts program of spamcop. I thought that doing so would prevent such issues. Can someone tell me what happened? I will always watch for any abuse reports sent to cox.net from now on but how will I know if I'm blocking a legitimate complaint about spam or not now?

Thanks,

Bob

I've received four phishing emails now saying the same thing.

An access to your account from a location other the one assigned by our online security protocol was captured by our system and your account has therefore been limited.

To restore your chase account and online access, please click the link below and follow the instruction to restore your account.

http://www.chase.com/account_protection

After we have verified the necessary information, your account access will be reinstated.

To see all of the Alerts available to you, please click the link above and complete the process

Thank you for Chase.

Chase Fraud Prevention Department

See:

http://www.spamcop.net/mcgi?action=gettrac...rtid=5701658413

5701658418 ( http://waltdiel.com/wp-includes/images/chase.co... ) To: spamcop[at]dimenoc.com

5701658417 ( http://clk.websitewelcome.com/~caroxcom/chseonl... ) To: abuse[at]theplanet.com

5701658413 ( 68.96.119.91 ) To: abuse[at]cox.net

The phishing links go to:

http://www.szkola.najlepsza.pl/images/chas...ation/index.htm

http://waltdiel.com/wp-includes/images/cha...ation/index.htm

http://kokotow.najlepsza.pl/images/chseonline/index.html

Edited by bob424
Link to comment
Share on other sites

I sent a phishing email I received to spamcop. What happened after I reported the phishing email was I lost my internet service from cox.net communications as spamcop reported that I was the source of the spam email. I had to call to get my internet restored.

You have set-up your "mailhosts" log-in and click the TAB

Link to comment
Share on other sites

Hi, bob424,

...Sorry to hear of your problem and happy that Don was able to find and fix the problem.

...Mostly for other's reference, I'll not a couple of things:

  • <snip>
    I fully trusted spamcop to determine where the spam was coming from but then found that by reporting the spam I was complaining about myself as well.
    <snip>
    Yes, unfortunately SpamCop, like any tool, must be used carefully. As the parses themselves mention, below the "Send spam Report(s) Now" button,
    ATTENTION: Report only those e-mail addresses and web sites that you think your spammer has used. <snip>
  • Further information about the Mailhosts tool mentioned by both petzl and Don D'Minion is available in the SpamCop FAQ (links are near the top of each SpamCop Forum page) entry labeled "Why does SpamCop want to send a report to my own network administrator?" and SpamCop Wiki (links also at the top of SpamCop Forum pages entries "MyReportingAccountHasBeenSuspended" and "MailHostConfiguration."

Link to comment
Share on other sites

This stuff is confusing. I read it and read it again and still...

Thank you all for the replies and help.

How do I know that Cox.net now complies with this sentence from:

http://www.spamcop.net/fom-serve/cache/13.html

Why does SpamCop want to send a report to my own network administrator?

"One reason this problem can occur is because your internal mail server does not indicate the source IP address of the spam. Talk to your network administrator about fixing the problem."

Edited by bob424
Link to comment
Share on other sites

...How do I know that Cox.net now complies with this sentence from:

http://www.spamcop.net/fom-serve/cache/13.html

Why does SpamCop want to send a report to my own network administrator?

"One reason this problem can occur is because your internal mail server does not indicate the source IP address of the spam. Talk to your network administrator about fixing the problem."

Don said he fixed your mailhosts detail and parsing is now okay. That's the "proof" all is okay. Check that previous report parse and look (using the "Parse" link) at the "If reported today ..." detail down the bottom. Cox will not appear. Since you didn't supply a tracking URL, only you and SC staff can see that detail at present.

Of course Cox might change at some future time so, if you are quick reporting you really should check your outgoing reports from time to time to be sure that hasn't happened - if you are using standard/long reporting simply ensure that Cox is not the report recipient before releasing the report.

The odds of Cox "suddenly" changing would not seem very high ... but some reporters avoid quick reporting just in case - and in case there are new routing issues within their service provider network which might have a similar effect. Until you are confident (and you will be, it might all seem a bit much at first but you will get the hang of it soon enough) I would suggest you stick with standard reporting where you get to see see the proposed destination of all reports before you release them.

Link to comment
Share on other sites

Hi, bob424,

...Please consider reporting this most recent incident to Don at service[at]admin.spamcop.net. For brevity, you might just consider providing a link to your recent post, http://forum.spamcop.net/forums/index.php?...ost&p=79918 and including a brief reminder of the nature of the problem.

As Don replied here, below, this suggestion is no longer necessary.

Edited by turetzsr
Link to comment
Share on other sites

I'm not questioning Don. Just trying to understand this and make sure everything is ok.

It's not fixed.

http://www.spamcop.net/sc?id=z5248798527z0...26cf0a869cb9b1z

This phishing email tried to report me as the source of the spam again.

Just log into your SpamCop reporting page and click the TAB "Mailhosts" it's self explaining

Requires you to send an email to yourself from ALL your email addresses (at least 2), when you get them (yes them). You just click the confirmation link in each email and this will register Cox email host as yours and won't report them. After clicking and once all seems to be working fine you can then go back to your Mailhost page and activate quick reporting

Link to comment
Share on other sites

Cox is adding new servers that are not part of the Cox.net Mailhost.

This is NOT the users's problem.

It is a Mailhost problem.

<snip>

...Thanks, Don, that was what I was assuming but didn't want to mention as I was not positive.

...bob424: so the problem appears to be what is mentioned in SpamCop Wiki entry "Why does SpamCop want to send a report to my own network administrator?" in the next-to-last bullet near the very end.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...