No Headers

[Dracosse]

Alright an update is now due:

After 3 days of not reporting spam. I sent in about 200 spam messages and then the NOIP error came back. I fired up a retired Win7 laptop and installed Thunderbird 38.0.0 I configured my submit.xxxxxx#spamcop.net reporting contact and I reported 30 messages of which 10 messages came back with the NOIP error reappeared, 5 messages were reported successfully and the remainder simply disappeared, no error no anything.

Because there really was a reason to retire that old laptop I completely discarded it and installed Oracle VirtualBox and Linux Mint 19 as a guest OS on this PC, I then configured Thunderbird 38.0.2 with my email addresses and reported approximately 100 messages some were returned with the NOIP error and some simply disappeared never to be seen again & about 15 reported successfully.

Then just because I could I used PROxpn to connect my Linux Mint Thunderbird client to somewhere in Canada [wanting to change my IPAddress ] There was no change. Just for the heck of it I created a new SpamCop account and reported more messages using PROxpn from England. No change was noted.

I don't know for sure but I believe that something is going on at SpamCop. I even paid $15.00 thinking that they might be wanting to be paid for the service and CPU time I was using. Nope, no change.

Right now it seems pointless for me to continue to donate my time to help Spamcop with information and statistics when I'm just spinning my wheels and paying for the privilege too boot.

Because I have taken the steps I have taken I find it hard to believe that more people are not having this problem. Thanks studmoose for your contribution.

4 hours ago, studmoose said:

Dang! I just subscribed to this service as a Heavy User to report all the Hotmail spam I am receiving without first testing to see if this worked. I've tried all kinds of finagling of the message payload, and the different methods of sending it. I even tried to edit the Sender to match the format of the sample, and still rejected. Heck, I can't even confirm the new SpamCop Account Configuration method as I get missing header rejections, no matter how I send it. It's quite frustrating. I'm using the Hotmail/Outlook.Live web interface, as I am not running an email server.

I'll monitor this thread for awhile but I think nothing is going to get fixed anytime soon, and I do believe the problem is in SpamCop's sphere of influence.

[studmoose]

2 hours ago, Dracosse said:

Alright an update is now due:

After 3 days of not reporting spam. I sent in about 200 spam messages and then the NOIP error came back. I fired up a retired Win7 laptop and installed Thunderbird 38.0.0 I configured my submit.xxxxxx#spamcop.net reporting contact and I reported 30 messages of which 10 messages came back with the NOIP error reappeared, 5 messages were reported successfully and the remainder simply disappeared, no error no anything.

Because there really was a reason to retire that old laptop I completely discarded it and installed Oracle VirtualBox and Linux Mint 19 as a guest OS on this PC, I then configured Thunderbird 38.0.2 with my email addresses and reported approximately 100 messages some were returned with the NOIP error and some simply disappeared never to be seen again & about 15 reported successfully.

Then just because I could I used PROxpn to connect my Linux Mint Thunderbird client to somewhere in Canada [wanting to change my IPAddress ] There was no change. Just for the heck of it I created a new SpamCop account and reported more messages using PROxpn from England. No change was noted.

I don't know for sure but I believe that something is going on at SpamCop. I even paid $15.00 thinking that they might be wanting to be paid for the service and CPU time I was using. Nope, no change.

Right now it seems pointless for me to continue to donate my time to help Spamcop with information and statistics when I'm just spinning my wheels and paying for the privilege too boot.

Because I have taken the steps I have taken I find it hard to believe that more people are not having this problem. Thanks studmoose for your contribution.

I'll monitor this thread for awhile but I think nothing is going to get fixed anytime soon, and I do believe the problem is in SpamCop's sphere of influence.

Hi Dracosse,

Many of the emails that I receive are coming from Amazon Web Services accounts. When I take the sender information and perform an NSLOOKUP on the IP address, it comes back with some variation of  ec2-52-25-110-120.us-west-2.compute.amazonaws.com. I opened an account at AWS to report this spam, and AWS says that they researched my cases and shut down the offending application. They state that I should follow up if I continue to get more. The problem is, these AWS applications share virtual IP addresses and they need the exact time the message was sent, within a minute to track down the offending web service. Once they kill them, another variation starts under a different account within an hour or two. Many of the AWS emails have hyperlinks to NameCheap domains, and that registrar is washing their hands of any culpability.

I'm also getting a bunch that target domains registered to Digital Versance, who appears to be some guy in Delaware that is running out of two iPostal mailbox offices. I've reported the domains where these emails link to, if they don't have proper ICANN information. Most of the spam links to domains under auspices of registrars NameCheap and Dynadot and they really seem to profit from this type of arrangement--so I don't think they are motivated to shut them down. NameCheap doesn't seem to enforce the ICANN registration requirements, because many of their domains have that contact information missing. Instra and NameSilo are two other registrars that come up in 3rd and 4th place as to the domains these spam emails target in their hyperlinks.

Edited January 5, 2020 by studmoose

[gnarlymarley]

On 1/5/2020 at 1:54 PM, Dracosse said:

I don't know for sure but I believe that something is going on at SpamCop. I even paid $15.00 thinking that they might be wanting to be paid for the service and CPU time I was using. Nope, no change.

Both of my paid and non-paid SpamCop accounts work fine for me.  The only advice I think I can add is maybe it is a formatting issue.

Maybe this will help: The first space when reading down the email that you encounter is between your headers and the body as well as the "Received:" lines should have start at the beginning of the line.  The "Received:" line will have lines below it and those should be indented with a space or a tab.

[Appleseed]

"Sorry, SpamCop has encountered errors:

Headers mangled

It appears that the sample you provided has been altered.  Often, extra
line-breaks are inserted by your software in an invalid format.  Part of
the reason for this proceedure is to ensure that you and your software are
submitting spam in an error-free format.  Please review the relevant FAQ
for your software and ensure you are following a proceedure which returns
intact spam content to SpamCop.

In this sample, the problem was found near the line:
via HE1PR0401CA0052.EURPRD04.PROD.OUTLOOK.COM; Fri, 22 May 2020 03:29:37"

Outlook put stuff to headers. If you want to report messages from Outlook, you have to start copy paste from the last "Received: from" line in message source and ignore all outlooks stuff before that.

Still it would be nice if Spamcop could leant to do ignore that extra stuff itself.

Edited May 22, 2020 by Appleseed

[gnarlymarley]

17 hours ago, Appleseed said:

Outlook put stuff to headers. If you want to report messages from Outlook, you have to start copy paste from the last "Received: from" line in message source and ignore all outlooks stuff before that.

For me, if I copy the message to notepad first and maximize the window and then copy all again, I don't seem to have a problem.  There appears to be a really long line added that has weird line breaks if copied straight across.

[Absolute]

Maybe there is some pattern there.