No Headers

[Dracosse]

I have been submitting spam to SpamCop for years. The last few days have really shocked me. Normally in a month I may see an error message from the SpamCop server that states no header information was found, this might happen perhaps 1 or 2 times [per month]. A week ago without warning I started receiving hundreds of spam messages on 4 different email accounts that I own, Hotmail, Outlook and Comcast. I dutifully reported all of the messages that came into my Thunderbird email client [right click - Forward as Attachment]. Starting 3 days ago at least 98% of the 100’s of messages I submitted return with this "no header" error. Thinking that maybe I had reached a SpamCop ceiling I used mxtoolbox to check the headers… These messages do NOT have an originating IPAddress.

My question is simply this. Has anyone else noticed the same problem? If spammers have devised a way to send spam without headers what good would it do to continue to use SpamCop in the future? How can the Block list continue to be useful?

[Lking]

sure wish you had included the Tracking URL as a link vs just in a graphic so others could follow the link without typing in those random char.

What is visible in the graphic must not be all the email and header. What did the rest of the email look like? at least down to the first blank line (end of header).

[gnarlymarley]

12 hours ago, Dracosse said:

My question is simply this. Has anyone else noticed the same problem? If spammers have devised a way to send spam without headers what good would it do to continue to use SpamCop in the future? How can the Block list continue to be useful?

I typed in your URL from the image https://www.spamcop.net/sc?id=z6598002198z8fb6021e44f26436f7ebe6fd86760940z so we can have a clickable link.

I have not seen a problem on my side.  I did notice your submission is missing all "Received:" header lines.  When I went to check out my hotmail account on both the webmail and imap sides, I see the "Received:" header lines all intact.

[Lking]

thanks Marley

[Dracosse]

_{No headers continue in reply to most of my reports today.}

[Lking]

Quote

No headers continue in reply to most of my reports today.

Have you change anything?

[Dracosse]

13 hours ago, Lking said:

Have you change anything?

Nope. I'm doing reporting the way I've always done it. As far as I know there isn't a way to do anything differently and still report the spam.

Dracosse

[Lking]

15 hours ago, Lking said:

Have you change anything?

The reason I ask, is that if nothing has change the results will continue to be unchanged.

On 12/5/2019 at 7:37 AM, gnarlymarley said:

 I did notice your submission is missing all "Received:" header lines.

As noted by gnarlymarley, there are no "Received:" lines in the header you provided.  It is by tracing backwards the Received entries in the header, that the spamcop parser identifies the source of the email presented.

I am not hopeful but, have you ask your ISP how they delivered an email with a mis configured header?

SpamCop or the SpamCop parser can not process an email that does not come close to meeting the email standards.

[Dracosse]

13 minutes ago, Lking said:

The reason I ask, is that if nothing has change the results will continue to be unchanged.

As noted by gnarlymarley, there are no "Received:" lines in the header you provided.  It is by tracing backwards the Received entries in the header, that the spamcop parser identifies the source of the email presented.

I am not hopeful but, have you ask your ISP how they delivered an email with a mis configured header?

SpamCop or the SpamCop parser can not process an email that does not come close to meeting the email standards.

Indeed. Nothing will change until something is done to counter the spammers new tactic. Thank you for responding. Your interest/response has given me renewed interest in following this through. 

My original question was and still is "If spammers have devised a way to send spam without headers what good would it do to continue to use SpamCop in the future? How can the Block list continue to be useful?"

I have not contacted Comcast/xfinity  to ask how these messages are being handled. It seems to me that ISP's should be able to detect the "No Headers" condition and simply delete them or refuse to forward those messages. I will contact my ISP today and when or if I get a reply I will post it here for all to see.

Thanks everyone for bouncing ideas and thoughts around it gives me fuel to run on.

Dracosse

[Lking]

keep us informed.

[Hanco]

I’ve seen this before but I had inadvertently clicked the link “Select outlook/eudora workaround” on the submission form...Then I was only pasting the entire email headers/plain text into one box on the workaround form!! 🙄

Sounds like not the same cause. But just in case it helps someone in the future, attached images show what my problem was... (well, my problem was me)

 

 

 

 

Edited December 11, 2019 by Lking
Graphics revieled private code

[Dracosse]

On 12/10/2019 at 5:21 AM, Hanco said:

I’ve seen this before but I had inadvertently clicked the link “Select outlook/eudora workaround” on the submission form...Then I was only pasting the entire email headers/plain text into one box on the workaround form!! 🙄

Sounds like not the same cause. But just in case it helps someone in the future, attached images show what my problem was... (well, my problem was me)

 

 

Yes Thanks for your help but I do not process messages this way. I use Thunderbird to Forward Message(s) as Attachments. 12 to 13 at a time.

Edited December 11, 2019 by Lking
Graphics revieled private code

[Lking]

@Dracosse, thanks for the information.  I too have been using FF for years, and forwarding as attachment with FireFly works just fine as a process. 

The problem remains with the header's lack of "Received:" line as identified by @gnarlymarley

On 12/6/2019 at 9:18 AM, Dracosse said:

have not contacted Comcast/xfinity  to ask how these messages are being handled.

Have you gotten any answer for Comcast or you email provider?  I would suggest that Comcast/xfinity is just the deliver 'pipe'  connecting you to you email host, @gmail, @hotmail, @outlook or whoever.  They are the ones that received and passed on to you the email with the badly formed header.

NOTE:  The previous two post (by @Hanco and copied by @Dracosse) revealed the private code for submitting spam - and have been deleted.

[Dracosse]

I have been in contact with Comcast/Xfinity support several times This issue has been escalated 2 times. I am now waiting to hear from level 3 support. Contacting Hotmail results in the expected zero support. I've tried many times and the Hotmail Admins do not care. I should be noted that they DO care that I am sending so many messages to Spamcop. They think that I AM A SPAMMER.

I have continued to submit messages to Spamcop but it is getting old to submit 100 messages and only 5 or 6 of them are successfully reported. I may have to quit it is beginning to feel like a failed and time wasting exercise.

In the interest of providing as much information as possible to this community I have pasted the entire contents of one of these offending email messages.

____________________________________________________________________________________________________________________________________________________

[snip]

Return-Path: <Support@sienZMuc.de>
Reply-To: "Health Care News" <reply@bestforever.space>
From: "Health Care News" <Support@WGwCKu84.de>
To: <xxx>
Subject: CBD Infused Coffee Now Available In All 50 States!
Date: Wed, 11 Dec 2019 04:55:14 -0800
Message-ID: <b767e49b-203c-41a4-98e9-3e79e1eeb8a8@BN3NAM04FT018.eop-NAM04.prod.protection.outlook.com>
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_0483_01D5AFF7.E937D170"
X-Mailer: Microsoft Outlook 14.0
List-Unsubscribe: <mailto:JaPvtSarimHynd.sara@bestforever.space?subject=unsubscribe&body=unsubscribe>
X-MS-Exchange-Organization-AuthSource: BN3NAM04FT018.eop-NAM04.prod.protection.outlook.com
X-MS-PublicTrafficType: Email
Thread-Index: AQKOwwDqY+pyKnUJwshSFArqZQUGfg==
X-OlkEid: F564B82D245306C0684BE1478011FAB7D691B2E8
MIME-Version: 1.0

------=_NextPart_000_0483_01D5AFF7.E937D170
Content-Type: text/plain;
    charset="utf-8"
Content-Transfer-Encoding: 7bit

 

 <http://flexibleme.myddns.me/t?0pyH6Ye7SYwA=nG%2FauCRUrh1EjN10iFhVarQ0JVmfvvhs1sgGpM9%2BYD%2F%2B%2B7r12tARB1Ja43W1WRPx8H%2FHhBQwYr5xx1hOvU8jGiaFx8Z0LG30O%2FVTCYqflItvZ2Rmnq3bs5M6rqeG%2F%2ByaCSlG4MrOM%2FS8bhmGNa%2F86lwv5NoeQVJOdp9P7ovVb5%2FY0PPVFpnb1S%2B6D0iEAH4naoqwXGlUOPxiL%2BfRzPUmFJSAn0S%2FgUQ%2Bch9zuI5GoX1UQc8YOi8nnhUsgezT4SzAT9bjFc9tu2FhDvbEcFZFQhUqNH%2B6Wy9WHZbB9JXwOkWkZUblD5%2Bpi2EktHjxLSzZ%2FR70E6RiRC4FTPVPutHByqEJ5zud4Qihs%2FbkI5JTCkYq49DjHhqg3vnJUjhzOaN3> <http://flexibleme.myddns.me/t?5IVfvf9wst5l=7nW5gOPW4ZVJLEglxeUGWpq0ZTDIgJwUg6K4%2BdQCpqJRLeJhdwjuzTFre%2BFDGKD4wHqprnjJcXNuWeDjyuV0iOER7PnbpXCgNcgjoid2uDDkrsq9izvsWb6f4ICtZdNGpW8x2Spjlz6j2aCTpo75P53AxoioKD7f8gh3zQNi96%2B3REdF9Tens%2FyNRQuuOKIEdR5AVJjO98Xe%2BqZtxkt%2B7RmD3fSTFx6N7Rxo0fyUY1HqdYvZ2upeINyHqJn4nj5h> CLICK HERE TO UNSUBSCRIBEIf you wish to unsubscribe from future mailings please click here<http://flexibleme.myddns.me/t?5IVfvf9wst5l=7nW5gOPW4ZVJLEglxeUGWpq0ZTDIgJwUg6K4%2BdQCpqJRLeJhdwjuzTFre%2BFDGKD4wHqprnjJcXNuWeDjyuV0iOER7PnbpXCgNcgjoid2uDDkrsq9izvsWb6f4ICtZdNGpW8x2Spjlz6j2aCTpo75P53AxoioKD7f8gh3zQNi96%2B3REdF9Tens%2FyNRQuuOKIEdR5AVJjO98Xe%2BqZtxkt%2B7RmD3fSTFx6N7Rxo0fyUY1HqdYvZ2upeINyHqJn4nj5h>  or write to:1261 S 820 E Suite 210 American Fork UT 84003
------=_NextPart_000_0483_01D5AFF7.E937D170
Content-Type: text/html;
    charset="utf-8"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.=
w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns=3D"http://www.w3.=
org/1999/xhtml"><head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf-8">
<title>AMAZING DEAL!</title>
    <style>
img {
    width: 100%;
    height: auto;
}
</style>
</head>

<body>
<p>&nbsp;</p>
<table width=3D"auto" height=3D"auto" border=3D"0" cellspacing=3D"0" cellpa=
dding=3D"0" align=3D"center" style=3D"border:1px solid #ccc;">
  <tr>
    <td height=3D"auto">
  <a href=3D"http://flexibleme.myddns.me/t?0pyH6Ye7SYwA=3DnG%2FauCRUrh1EjN1=
0iFhVarQ0JVmfvvhs1sgGpM9%2BYD%2F%2B%2B7r12tARB1Ja43W1WRPx8H%2FHhBQwYr5xx1hO=
vU8jGiaFx8Z0LG30O%2FVTCYqflItvZ2Rmnq3bs5M6rqeG%2F%2ByaCSlG4MrOM%2FS8bhmGNa%=
2F86lwv5NoeQVJOdp9P7ovVb5%2FY0PPVFpnb1S%2B6D0iEAH4naoqwXGlUOPxiL%2BfRzPUmFJ=
SAn0S%2FgUQ%2Bch9zuI5GoX1UQc8YOi8nnhUsgezT4SzAT9bjFc9tu2FhDvbEcFZFQhUqNH%2B=
6Wy9WHZbB9JXwOkWkZUblD5%2Bpi2EktHjxLSzZ%2FR70E6RiRC4FTPVPutHByqEJ5zud4Qihs%=
2FbkI5JTCkYq49DjHhqg3vnJUjhzOaN3"><img src=3D"https://pbs.twimg.com/media/E=
Lf6MeHWkAEG1IY?format=3Dpng&amp;name=3Dsmall"></a><tr></tr></td>
      <td><center>
        <font size=3D"2px"><a href=3D"http://flexibleme.myddns.me/t?5IVfvf9wst=
5l=3D7nW5gOPW4ZVJLEglxeUGWpq0ZTDIgJwUg6K4%2BdQCpqJRLeJhdwjuzTFre%2BFDGKD4wH=
qprnjJcXNuWeDjyuV0iOER7PnbpXCgNcgjoid2uDDkrsq9izvsWb6f4ICtZdNGpW8x2Spjlz6j2=
aCTpo75P53AxoioKD7f8gh3zQNi96%2B3REdF9Tens%2FyNRQuuOKIEdR5AVJjO98Xe%2BqZtxk=
t%2B7RmD3fSTFx6N7Rxo0fyUY1HqdYvZ2upeINyHqJn4nj5h"> CLICK HERE TO UNSUBSCRIB=
E</a> </font>
      </center></tr></table>

<center>
<p style=3D"color:#919191; font-family:Arial, Helvetica, sans-serif; font-s=
ize:10px; text-
align:center">If you wish to unsubscribe from future mailings please click
<a href=3D"http://flexibleme.myddns.me/t?5IVfvf9wst5l=3D7nW5gOPW4ZVJLEglxeU=
GWpq0ZTDIgJwUg6K4%2BdQCpqJRLeJhdwjuzTFre%2BFDGKD4wHqprnjJcXNuWeDjyuV0iOER7P=
nbpXCgNcgjoid2uDDkrsq9izvsWb6f4ICtZdNGpW8x2Spjlz6j2aCTpo75P53AxoioKD7f8gh3z=
QNi96%2B3REdF9Tens%2FyNRQuuOKIEdR5AVJjO98Xe%2BqZtxkt%2B7RmD3fSTFx6N7Rxo0fyU=
Y1HqdYvZ2upeINyHqJn4nj5h">here</a> or write to:<br>
1261 S 820 E Suite 210 American Fork UT 84003

</p>
</center>

</body>
</html>

[snap]

[Lking]

edited to removed, @Dracosse email.  This of course is why a tracking URL should be used. - hiding users email and providing all other contend AND the results from the parser.

[Dracosse]

Oops, Thanks 🙂

[Hanco]

2 hours ago, Lking said:

NOTE:  The previous two post (by @Hanco and copied by @Dracosse) revealed the private code for submitting spam - and have been deleted.

Heck, sorry about that. Thanks for removal. 
 

And thanks other user for DM!

[Dracosse]

Maybe of interest to someone. In one hour I have 112 new spam messages.

I'm beginning to lose interest in reporting all of these pieces of spam.

 

[Lking]

Yes spam seems to be a never ending fight. My count sense midnight is 109. I assume you are reporting/attaching several spam a time.  I settled on 15 spam at a time.  This is a convenient cumber to visually scan and attach.  It also keeps the size small enough to pass all limits

Many users report just the number they have time or interest to report.  For example reporting just the "Canada drug" spam or other block that catch their eye.  The others are just dumped in the trash.

[Dracosse]

1 hour ago, Lking said:

Many users report just the number they have time or interest to report.

Yes. In the morning I delete everything that arrived while I was asleep. I like to keep my reporting time to something less that 2 hours. I've been striving for this since about 2000 using 2 older retired Spamcop accounts. I'm still reporting everything that comes in hourly but I don't think I'll continue doing this, I'm retired and disabled. I have little else I can do these days. Spamcop helped to make me feel useful until this happened.

 

[gnarlymarley]

19 hours ago, Dracosse said:

Maybe of interest to someone. In one hour I have 112 new spam messages.

I envy you as I don't get that much.  I had setup an automated forward as an attachment rule (back when that is what the freebie email providers allowed it) and I no longer get lots of spam.  I think my hurdle was when I reported to the legitamite providers such as comcast and qwest is when I lost my bulk.  I have no idea how 'century link' would take reports.  If you can figure out how to tell the difference on who would take action on your reports and report just those, then it may help on getting your counts down.

[Dracosse]

On 12/13/2019 at 10:27 AM, Lking said:

Many users report just the number they have time or interest to report.

I rolled back to an older version of Thunderbird [38.0] and for 2 hours I was able to report spam just like before. Then suddenly the same thing happened. Almost all messages have no tracking information.

Weird. I don't understand that?

 

 

Edited December 17, 2019 by Dracosse

[gnarlymarley]

On 12/16/2019 at 7:33 PM, Dracosse said:

I rolled back to an older version of Thunderbird [38.0] and for 2 hours I was able to report spam just like before. Then suddenly the same thing happened. Almost all messages have no tracking information.

I don't see this issue, but then my thunderbird is v2.  Perhaps it could be a compatibility issue?  I used both imap and "webmail - hotmail 1.3.2" and it works for me.