re. @devnull.spamcop.net

[db17]

Have read the FAQ on this, https://www.spamcop.net/fom-serve/cache/253.html

After reporting spam, seeing that it goes nowhere, just to  @devnull.spamcop.net. Plus not seeing "Internal SpamCop Handling" anywhere in the report, so it seems it can't be reported to the host via spamcop. But seems I can forward the offending message directly to the spammer host via abuse@mailjet.com, if I contact them with my own email. But don't trust this host, so definitely don't want to use my own email address to do this.

Is there any way to report this spammer via spamcop anonymously to this hosting service, or by using some other method? Or am I just stuck?

 

NB. Is anyone looking at this forum?, this page is completely littered with spam.

[lisati]

As I understand it, Spamcop's primary focus is to maintain a blocking/blacklist of sources of spam. Any reports that get sent out and are actually actioned by provider are a bonus. Even if the reports get dev-null'ed, Spamcop can still.  use the spam you report to help provide data for its blocking list.

There are other ways of tracking down a suitable reporting address. I rarely bother manually sending reports to providers,  but occasionally visit sites such as multirbl.valli.org and mxtoolbox that can assist in provide information that is of some help. Other volunteers at this forum might be able to jump in and suggest approaches that more directly address what you are asking.

[Lking]

There are several reasons that SC may send a spam report to @devnull.spamcop.net

• SC does not find a valid abuse address for the source IP.
• spam reports sent to the identified/ listed abuse address have bounced 6 or more time. (No need to clutter the internet or wast the bandwidth)
• The abuse address has ask SC not to send reports.  (SC does not want to be a spammer).
• SC has reason to believe that the ISP passes the report onto the spammer

6 hours ago, db17 said:

Is there any way to report this spammer via spamcop anonymously to this hosting service, or by using some other method?

When you submit your spam example, at the bottom of the screen you should see "Report spam to:"

Quote

Report spam to:

Re: xxx.xxx.xx.xx (Administrator of network where email originates)
To: abuse#xxx.com@devnull.spamcop.net (Notes)

Re: User Notification (Notes)
To:

Additional notes (optional - max 2000 characters):

Notice the "Re: User Notification" with the unchecked selection box. By checking the box and entering an email address you can send the report to anyone you wish.

[db17]

Quote

Notice the "Re: User Notification" with the unchecked selection box. By checking the box and entering an email address you can send the report to anyone you wish.

Thanks Lking. In that case, I would like to submit the report to abuse@mailjet.com (from what I can see, pretty certain that's the hosting for the spammer, but first need to know if that will be sent anonymously with my email address or anything else identifying removed. Don't want to subject myself to even more spam. I assume that's how it's sent when it can go directly to an abuse address, not to the dead letter box ...@devnull.spamcop.net. Or at least that's what I've always thought happens when submitting a report.

[Lking]

db17 the report will be sent by SC.  If you are unsure you could always, as a test, send a random spam to yourself and evaluate how all the SC spam reports you generate look.

[EstherD]

There's a Catch 22 in the use of the "User Notification" that you should be aware of:

If the recipient addr you specify in the "User Notification" field is one that SpamCop routinely sends to /dev/null, then SpamCop will NOT send a user report to said addr as requested, but will instead /dev/null your user report, just as it would with any parser-generated report for said addr.

Three implications:

• Taking a cleaned-up /dev/null addr from the parse and sticking it into the "User Notification" field will NOT cause a user report to be sent to that addr. Your user report will also get sent to /dev/null, just like the parser report.

• The reporting addr you find through your own research, e.g. via whois, will NOT cause a user report to be sent IF SpamCop normally /dev/nulls the addr you specify.

• You cannot know in advance if the user report addr you supply is clean or not. It only becomes clear after you hit submit and look at the submission results.

[MIG]

Hey EstherD,

1. If the recipient addr you specify in the "User Notification" field is one that SpamCop routinely sends to /dev/null, then SpamCop will NOT send a user report to said addr as requested, but will instead /dev/null your user report, just as it would with any parser-generated report for said addr.

>>>  Taking a cleaned-up /dev/null addr from the parse and sticking it into the "User Notification" field will NOT cause a user report to be sent to that addr. Your user report will also get sent to /dev/null, just like the parser report.

• What outcome do you think should happen?

 2. The reporting addr you find through your own research, e.g. via whois, will NOT cause a user report to be sent IF SpamCop normally /dev/nulls the addr you specify.

• What outcome do you think should happen?

Curious?

[db17]

Still waiting for the outcome of the intervening discussion. In the meantime, wanted to try the user notification option. However, don't have a new spam message that goes to /dev/null, or any new spam, for that matter, so reentered the one under discussion, parsed again without resubmitting. But after doing so, not seeing the user notification field. Is it missing the user notification field because it's an already submitted report?

 

 

[petzl]

6 hours ago, db17 said:

not seeing the user notification field

Only shows before spam is submitted
87.253.234.133  "abuse[AT]mailjet[DOT]com" may bounce?

[MIG]

9 hours ago, db17 said:

1. Is anyone looking at this forum?, this page is completely littered with spam.
2. Still waiting for the outcome of the intervening discussion.
3. Is it missing the user notification field because it's an already submitted report?

Hey db17,

1. There's posts in SCF forum, discussing spammers targeting SCF & the daily actions taken remediate.

2. While you're waiting, how about posting a SC Tracking URL please?

3. No.

Cheers!

[EstherD]

Hopefully I am NOT the one everyone seems to be waiting on to supply "the outcome of the intervening discussion"? If you are, then please be advised: Not going to happen.

Because I was NOT advocating either for or against ANY particular "outcome". Simply reporting the facts as I see them, and nothing but the facts, so that:

• Someone wouldn't get the clever idea that they could bypass the /dev/null assigned by the parser by plugging the unmunged reporting addr into the "user notice" field.

• Some other one(s) wouldn't be surprised (as I was) when, after spending far too much time finding a suitable reporting addr, SpamCop promptly routed my "user notice" to /dev/null.

IOW, I'm OK with the current outcomes. Just wish they had been documented somewhere. Would have saved me some consternation I didn't need.

[MIG]

Hey db17, 

Re: missing [User Notification] field

Did you change/replace (all) dates (in your test spam) to current date, before parsing?

Also check
[ https://www.spamcop.net/mcgi?action=showadvanced ] [ 3rd party report default ] [Send by default]  ON

Cheers!

[db17]

Quote

Re: missing [User Notification] field

Did you change/replace (all) dates (in your test spam) to current date, before parsing?

Also check
[ https://www.spamcop.net/mcgi?action=showadvanced ] [ 3rd party report default ] [Send by default]  ON

Yep, just changed all dates in original (copied headers to text editor first to be able to do this), then entered and parsed  to get new test report.  Also checked prefs, which were already set as above. Still no user notification field. Seem to be getting conflicting opinions about whether this field should be visible. Probably will have to bail on this for now until I get a new devnull spam.

But if interested, URL for new test report:

https://www.spamcop.net/sc?id=z6538949575z8ad9e97c1309c2bc4e1d6010ca7eebedz

 

 

 

 

[MIG]

 

Hey db17,

Is [User Notification]  field missing with/for every spam you process through SC parser?

Do you have [Mailhosts] configured?

Cheers!

[MIG]

Hey db17,

I processed:  https://www.spamcop.net/sc?id=z6538949575z8ad9e97c1309c2bc4e1d6010ca7eebedz

Report spam to:

Re: 87.253.234.133 (Administrator of network where email originates)
 To: mailjet@devnull.spamcop.net (Notes)

Re: 87.253.234.133 (User defined recipient)
 To: removed-grasshopper.com (Notes)

Re: http://xxyj2.mjt.lu/ (Administrator of network hosting website referenced in spam)
 To: google-cloud-compliance@google.com (Notes)

Re: https://hilason.com/ (Administrator of network hosting website referenced in spam)
 To: abuse#amazonaws.com@devnull.spamcop.net (Notes)

Re: User Notification (Notes)
 To:  

Cheers!

 

 

[MIG]

Hey db17,

When/if you get [User Notification] sorted, specific to 87.253.234.133 , opsATmailjetDOTcom, does not get /dev/nulled.

I'd add notes similar to what Lking, Petzl & or Robibue write to "encourage" Mailjet SAS to deal with the "polluter".
Cheers, 

[db17]

Thanks MIG for all the suggestions and help. Obviously, since you are showing it for my URL, the user notification field should be showing for me. I've tried all your suggestions, including configuring mailhosts, and nothing seems to help. Have even tried 3 different browsers, with anything that could possibly be interfering disabled, especially uMatrix and uBlock origin. Must be something at my end, but no idea what it is. Will try again for the next spam, devnull or not, but for now think this is the end of the line. Thanks again, do appreciate it.

[RobiBue]

Just for clarification:

I do not get [User Notification] either.

Admittedly, I have not a paid account, and do not have "added fuel" either. And WRT checking the settings, tried both: on and off with no difference.

[petzl]

Quote

I do not get [User Notification] either.

Admittedly, I have not a paid account,

I havve a paid account since it began, Was actually part of SpamCop email account
Maybe thats the difference?

[MIG]

3 hours ago, db17 said:

Thanks MIG for all the suggestions and help. Obviously, since you are showing it for my URL, the user notification field should be showing for me. I've tried all your suggestions, including configuring mailhosts, and nothing seems to help. Have even tried 3 different browsers, with anything that could possibly be interfering disabled, especially uMatrix and uBlock origin. Must be something at my end, but no idea what it is. Will try again for the next spam, devnull or not, but for now think this is the end of the line. Thanks again, do appreciate it.

Hey db17, 

All good, sorry nothing so far has helped, I think Robibue & Petzl have nailed it... That's why they're MASTERS & I'm a lowly grasshopper

I have 2 SC accounts, 1 paid, 1 unpaid,  just parsed a spam / tested again, [User Notification] appears with the paid account, not the unpaid. 

What's that saying? "we get what we pay for"....

CieLeVie!

Please do keep posting Tracking URLs (when available) for us to pitch in.

Cheers!

 

[db17]

Thanks all, I had given up on this. But at least now I know why it wasn't working.

[lisati]

i

21 hours ago, MIG said:

Hey db17, 

All good, sorry nothing so far has helped, I think Robibue & Petzl have nailed it... That's why they're MASTERS & I'm a lowly grasshopper

I have 2 SC accounts, 1 paid, 1 unpaid,  just parsed a spam / tested again, [User Notification] appears with the paid account, not the unpaid. 

What's that saying? "we get what we pay for"....

CieLeVie!

Please do keep posting Tracking URLs (when available) for us to pitch in.

Cheers!

 

That was my thought when checking new replies to this thread.

I, too, see the "user notification" option when I've added fuel, and it disappears when my "fuel" runs out.