Jump to content

New spammer trick?


Spamnophobic

Recommended Posts

3 hours ago, Spamnophobic said:

OK I know we have been here before, but could somebody examine my tracking url:

https://www.spamcop.net/sc?id=z6634628358z460dafae0c54205ace1fe027dc2ff311z

perhaps forum seniors or SpamCop staff can suggest how to get these new ones reported?

spam came from  IP 31.145.190.66  "abuse[AT]vodafone[DOT]net[DOT]tr"
Seems you need to check/update your mailhosts or you will be reporting yourself!
Logon to SpamCop then go here
https://www.spamcop.net/mcgi?action=mhedit
Paying member go here
https://mailsc.spamcop.net/mcgi

Link to comment
Share on other sites

@Petzl, my mailhosts haven't changed, although just to be sure I'm re-running the mailhosts "app". However, 31[dot]onefourfive[dot]190<fullstop>66 is definitely not one of my mailhosts. It is the closest the parse gets to the original spam sending address. It is a mail server in Turkey. The parse quotes one more IP, called "User", 176<dot>thirtytwo[dot]25[dot]27, which I am unable to ping (times out).

My point is that SpamCop is unable to parse the spam mail ("No source IP address found") In the past spammers have tricked SpamCop into giving this error message. See my earlier posts in this forum. (This was eventually resolved with the help of a SpamCop administrator.)

Edited by Spamnophobic
Fully munged eye-pea addresses
Link to comment
Share on other sites

9 hours ago, Spamnophobic said:

@Petzl, my mailhosts haven't changed, although just to be sure I'm re-running the mailhosts "app". However, 31[dot]onefourfive[dot]190<fullstop>66 is definitely not one of my mailhosts. It is the closest the parse gets to the original spam sending address. It is a mail server in Turkey. The parse quotes one more IP, called "User", 176<dot>thirtytwo[dot]25[dot]27, which I am unable to ping (times out).

My point is that SpamCop is unable to parse the spam mail ("No source IP address found") In the past spammers have tricked SpamCop into giving this error message. See my earlier posts in this forum. (This was eventually resolved with the help of a SpamCop administrator.)

Well 83.96.176.84 (proserve[DOT]nl, signet[DOT]nl) at a guess seems to be your email provider or network.
You seem to be picking your email from a internal  network which probably changes?

AFTER deleting your mailhost entry try redoing.
If this don't update
Contact SpamCop support
logon and go here (there is  email address but I forget it)
https://mailsc.spamcop.net/fom-serve/cache/401.html
or free user
https://www.spamcop.net/fom-serve/cache/401.html
Other reasons for contact
 (put in) "Mailhosts"

Edited by petzl
Link to comment
Share on other sites

On 5/19/2020 at 12:05 PM, Spamnophobic said:

OK I know we have been here before, but could somebody examine my tracking url:

https://www.spamcop.net/sc?id=z6634628358z460dafae0c54205ace1fe027dc2ff311z

 perhaps forum seniors or SpamCop staff can suggest how to get these new ones reported?

Okay, I am confused with the tracking URL.  It seems to be the message you tried to report is one that was sent directly to your submit address.  I see the vmx and the app009.  Are you trying to report a spam from someone that sent it directly to your submit address?  (I am glad your submit address was replaced by an x in here as I don't want to know what it is.)  If your submit address is in the wild, I would suggest you contact deputies[at]admin[dot]spamcop[dot]net.

Link to comment
Share on other sites

On 5/19/2020 at 12:05 PM, Spamnophobic said:

OK I know we have been here before, but could somebody examine my tracking url:

https://www.spamcop.net/sc?id=z6634628358z460dafae0c54205ace1fe027dc2ff311z

with the double header I think things have gotten confused. @gnarlymarley without knowing @Spamnophobic 's 16 digit code "they" could not have sent to the reporting address.

UNLESS they replied to a spam report with the following sequence:

  • @Spamnophobic a spam (email #1) and reported it to spamcop (email #2)
  • spamcop sent a spam report to the the source (email #3)
  • the spammer/his ISP... received email #3 and auto responded (?) with email #4 sent to a coded address at spamcop
  • spamcop received email #4 send to a coded mail box associated with the spam report (email #3) and forwarded the email to @Spamnophobic
  • @Spamnophobic received email #4 which has the spamcop connection hidden and thinking it is spam @Spamnophobic reports email #4
  • The reporting of email #4 generates the tracking URL above.

It has been a really long time sense I have received a reply to an spam report. Looking at the full email in the tracking URL there are spamcop.net ironpost references in both headers (at the top and bottom of the email)

to paraphrase Cicero, Mark Twain, Blaise Pascal  'If I had more time this would have been shorter.'

 

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...