safendoulis Posted December 28, 2004 Share Posted December 28, 2004 Hey, check out my previous reports: Submitted: Tuesday, December 28, 2004 08:44:37 +0800: FW: Wet Motehr wants a date 1324635587 ( 202.156.64.59 ) To: abuse[at]starhub.com that's my ISP and I live in Singapore. These people take this seriously! What's gone on here??? Link to comment Share on other sites More sharing options...
Wazoo Posted December 28, 2004 Share Posted December 28, 2004 Not enough data for folks 'here' to do any analysis. The use of a Tracking URL would allow the report to be seen. You chose also to not state how you handled your submittal either, didn't mention whether you'd gone through the MailHost configuration, whther or not you'd made any oher 'successful' spam reports/complaints .... With the exception of Quick-Reporting, the SpamCop system doesn't "Send" stuff out on its own, the user must actively agree to the listed targets and actually hit the Send button. Quick-reporting has it's pitfalls. So, the actual next line is ... have you looked at the FAQ? Link to comment Share on other sites More sharing options...
Merlyn Posted December 28, 2004 Share Posted December 28, 2004 Fist of all Spamcop did not report anything. You would have had to report yourself. I believe it is your responsibility to check where the reports are going. Second, Our servers receive tons of spam from Singapore. Next, it looks like 202.156.64.59 is a dynamic IP it shouldn't be used for an email server. Many will not accept email from it. It has also been a spam source according to a few below.... NJABLDYNA NJABL list of dynamic ip spaces: dynablock.njabl.org -> 127.0.0.3 Dynamic/Residential IP range listed by NJABL dynablock - http://njabl.org/dynablock.html JAMDSBL local bl at JAMMConsulting.com: dnsbl.jammconsulting.com -> 127.0.0.2 STBL spam Trap dnsbl: bl.spam-trap.net -> 127.0.0.5 Blocked by STBL, see http://www.stop-spam.info/lookup.php?ip=202.156.64.59 SORBS spam and Open Relay Blocking System: Aggregate zone: dnsbl.sorbs.net -> 127.0.0.10 Dynamic IP Addresses See: http://www.dnsbl.sorbs.net/lookup.shtml?202.156.64.59 SORBSDUL Dynamic IP Address ranges (NOT a Dial Up list!): dul.dnsbl.sorbs.net -> 127.0.0.10 Dynamic IP Addresses See: http://www.dnsbl.sorbs.net/lookup.shtml?202.156.64.59 DNSBLAUT1 Reynolds Technology Type 1: t1.dnsbl.net.au -> 127.0.0.2 202.156.64.59 See http://www.dnsbl.sorbs.net/cgi-bin/lookup?NAME=202.156.64.59 DNSBLAUSORBS External Block List - SORBS: sorbs.dnsbl.net.au -> 127.0.0.2 202.156.64.59 See http://www.dnsbl.sorbs.net/cgi-bin/lookup?NAME=202.156.64.59 DRBL-WORK-SANDY Distributed RBL node: sandy.ru: work.drbl.sandy.ru -> 127.0.0.2 DRBL-VOTE-GREMLIN Distributed RBL node: gremlin.ru: vote.drbl.gremlin.ru -> 127.0.0.2 spam source DRBL-WORK-GREMLIN Distributed RBL node: gremlin.ru: work.drbl.gremlin.ru -> 127.0.0.2 vote.drbl.gremlin.ru[at]ns.gremlin.ru:spam source Hope this helps. Link to comment Share on other sites More sharing options...
safendoulis Posted December 28, 2004 Author Share Posted December 28, 2004 202.156.64.59 was me and still is me. I didn't decide I was the spammer, SpamCop code did. Also, I am not running an email server and all I did was submit spam (porn) that made it through the SpamCop to my username[at]mac.com email address. I collected those (there were 2) emails over POP from mail.mac.com. Let me explain how I reported them: This was my first day using SpamCop. I went to the members area on spamcop.net and selected Report spam. I then clicked the Report spam tab. I was presented with an email address e.g. submit.7IrUnLGHWxw5N4gR[at]spam.spamcop.net or the option to cut & paste the headers on the web form. I opted to send the offending email to the provided email address from my email client. Now I suspect that what I did next *may* have some bearing on the outcome: I first "redirected" the email to the cryptic SpamCop email address provided. I am using Microsoft Entourage and this is a feature I am in the habit of using. I also forwarded both emails to the said address. I don't recall the sequence but there were 4 messages sent. When I checked back on "Past Reports" in the members area and saw this: Submitted: Tuesday, December 28, 2004 08:44:37 +0800: FW: Wet Motehr wants a date 1324635587 ( 202.156.64.59 ) To: abuse[at]starhub.com ... if I click on the incident number then parse the results I get this: SpamCop v 1.393 © SpamCop.net, Inc. 1998-2004 All Rights Reserved Removing X-Yahoo-Forwarded: from x to safendoulis[at]spamcop.net Here is your TRACKING URL - it may be saved for future reference: http://www.spamcop.net/sc?id=z706931677z05...5f66f9983bc2e7z Reports regarding this spam have already been sent: Re: 202.156.64.59 (Administrator of network where email originates) Reportid: 1324635587 To: abuse[at]starhub.com If reported today, reports would be sent to: Re: 202.156.64.59 (Administrator of network where email originates) abuse[at]starhub.com Re: 202.156.64.59 (Third party interested in email source) spamcop[at]imaphost.com Re: http://myluxembourg.info/dbb07a9e731871435e7715... (Administrator of network hosting website referenced in spam) postmaster[at]chinatietong.com I hope I am misunderstanding this. If it is as I think, that I was reported as the spammer, something should be done to understand how it went wrong. A correction also needs to be sent to abuse[at]starhub.com. Any of you out there who know anything about Singapore will know why I don't want spam, particularly porno spam, linked to me. IP = account = ID Card = black mark for me. We all live in glass houses here. Its just fine as long as we follow the rules and play nicely like good citizens Regards, Stefan Link to comment Share on other sites More sharing options...
dbiel Posted December 28, 2004 Share Posted December 28, 2004 Thanks for posting the tracking URL. Unfortunately you did report yourself as a spammer. I opted to send the offending email to the provided email address from my email client. If I am reading this correctly, you clicked on forward message instead of "forward as attachment" which is a much better way of sending the message to SpamCop. The parser was unable to work its way past your IP as the source of the message which seem to be due to the method that the spam was forwarded along with the software used to forward it. Without MailHost being setup, the parser did not have enough information to identify you and all the mail servers related to your handling of the message and to separate them from the mailservers used by those who actually sent you the spam in the first place. MailHost was created for the purpose of helping to prevent reporting yourself. I would strongly suggest that you do NOT report anymore spam until you take some time and read the FAQ and understand exactly how SpamCop works. It is a tool to help you report spam. But it is only a tool. You need to carefully check each report before it is sent to be sure that it is not being misdirected. You must uncheck any boxes that refer back to you as being the spammer and cancel the reports if none of them actually identify the spammer. It is critical (even more so for new users) to have a basic understanding of just how SpamCop works BEFORE reporting any spam. Improper use of the tool will result in reporting yourself as a spammer. I regret that this has happen to you, but please do not get discouraged. It seems that we all learn faster from our mistakes than from taking the time to read the directions first and actually understand them before trying to use any new product. I know that I am guilt of that all too often as well. Thanks for trying to do your part to help stop spam and I wish you well and hope that you will take the time to sent up Mailhosts and to read the FAQ and avoid any future self reporting problems. Link to comment Share on other sites More sharing options...
StevenUnderwood Posted December 28, 2004 Share Posted December 28, 2004 Somewhere in between the two parts below, you should have received an email message stating reports were ready to send OR you went to the web page and clicked the Report Now link. At that time, you are supposed to review spamcop's decisions and YOU send the reports by clicking the "Send reports" button. The only way reports are send automatically is with quick reporting and that can only be turned on after you have a reporting history. I opted to send the offending email to the provided email address from my email client. <snip> When I checked back on "Past Reports" in the members area and saw this Spamcop is a TOOL to use in helping YOU report spam to the offending ISP. Link to comment Share on other sites More sharing options...
safendoulis Posted December 28, 2004 Author Share Posted December 28, 2004 I am more than ready to dig deeper. I am not discouraged at all. On the contrary, I need to understand how something as ludicrous as spam is able to proliferate. For me its like an itch that needs to be scratched. I just don't like the fact it can happen technologically and more so, I don't like it bothering me. I appreciate the time and thought people here put into my issue and the advice given. I will not report any spam until I have done some groundwork. Thanks folks, Stefan Link to comment Share on other sites More sharing options...
Jeff G. Posted December 28, 2004 Share Posted December 28, 2004 You also revealed your confidential submit code. Please reregister (if you are a free user using www.spamcop.net and/or members.spamcop.net) or contact a SpamCop Admin via service at admin.spamcop.net. [edited per Don's comments below] Link to comment Share on other sites More sharing options...
SpamCopAdmin Posted December 31, 2004 Share Posted December 31, 2004 You also revealed your confidential submit code. Please reregister (if you are a free user using www.spamcop.net and/or members.spamcop.net), contact the Deputies via deputies at spamcop.net (if you are a paid reporting user using members.spamcop.net), or contact JT via support at spamcop.net (if you are a Flat-Rate SpamCop Email System Customer using mailsc.spamcop.net and/or webmail.spamcop.net). The "submit" address is controlled by the reporting side of SpamCop. JT can't help with that. Anyone who needs a new "submit" address can contact me at: service [at] admin.spamcop.net - Don - Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.