Jericho Posted June 24, 2020 Share Posted June 24, 2020 Hello, I am constantly receiving spam mails which I forward to SpamCop. The servers which are spamming are always the same (there are 3 or 4 different IP addresses), but reporting them again and again does not have any effect at all. I expected to see these IPs on cbl.abuseat.org. But this does never happen, no matter what I do. The reports won't even show up on https://www.spamcop.net/w3m?action=inprogress Some examples: https://www.spamcop.net/mcgi?action=gettrack&reportid=7067133986https://www.spamcop.net/mcgi?action=gettrack&reportid=7066822721https://www.spamcop.net/mcgi?action=gettrack&reportid=7066820443https://www.spamcop.net/mcgi?action=gettrack&reportid=7066812495 I also noticed that my average reporting time never drops below 4 hours, no matter how fast I submit my reports. Is there something wrong? Please advise. Quote Link to comment Share on other sites More sharing options...
petzl Posted June 25, 2020 Share Posted June 25, 2020 18 hours ago, Jericho said: Is there something wrong? Please advise. Need a Tracking URL to look before you submit it's on page top SpamCop v 5.1.0 © 2020 Cisco Systems, Inc. All rights reserved. Here is your TRACKING URL - it may be saved for future reference:https://www.spamcop.net/sc?id=z6638897535zab568c7aa78b449e543f0c2ef2712cf7z Skip to Reports Quote Link to comment Share on other sites More sharing options...
KNERD Posted June 25, 2020 Share Posted June 25, 2020 (edited) It seems Spamcop no longer has the clout it had some years ago. I still report, but nothing usually gets done from most of those service providers. Also to get blocked, it has to be a few people reporting (not sure of the number of reports) the same spammer on the same IP address. I used to get 10+ spams a day from one provider. The fact the spams came from sequential IP addresses tells me the provider is in cahoots with the spammer. I then tried some other block lists. After reporting, I would see the spammer IP addresses listed in various spam lists, and blocking services I was using on the email server, but for some unknown reason the spam/IP address was not being blocked. I gave up on block lists and started just blocking that provider IP range. Then I got confirmation the provider is in cahoots with the spammer, when I started getting more batches of spam from another of their data centers in the same manner as before. Edited June 25, 2020 by KNERD Quote Link to comment Share on other sites More sharing options...
Jericho Posted June 25, 2020 Author Share Posted June 25, 2020 Here are some tracking URLs. https://www.spamcop.net/sc?id=z6639509621z7a19c622a2bc6157b369deafe7b080d0zhttps://www.spamcop.net/sc?id=z6639512255zbc25c04f58bafde480c7a29f13161062zhttps://www.spamcop.net/sc?id=z6639519971zd6784bd8a93469884cd18c162369e209z The spammer uses headers from a legit mailing list (which I never subscribed) and injects spam. Quote Link to comment Share on other sites More sharing options...
Jericho Posted June 27, 2020 Author Share Posted June 27, 2020 spam keeps coming in from these servers. Reporting them to Spamcop is pointless as long as the IP addresses won't show in the blocking lists. Quote Link to comment Share on other sites More sharing options...
petzl Posted June 27, 2020 Share Posted June 27, 2020 (edited) 13 hours ago, Jericho said: spam keeps coming in from these servers. Reporting them to Spamcop is pointless as long as the IP addresses won't show in the blocking lists. The German abuse desk is BlackHat ignoring many, many SpamCop reports Report to their CERT http://www.s-cert.de/eng/ email is in weblink tell in notes, "Criminal phishing, blackmail threat spam, no unsubscribe, bogus valid reply address to innocent parties" their reply address is valid but Bogus goes to innocent party, a restaurant It is a non-registered Website no registra?http://195.62.32.155/#contact - contact@195.62.32.155 is bogus not valid Include weblinks in report? which to me also seem bogus links to innocent parties Select TAB Preferences Show Technical Details during reporting Simple output Show technical data Their provider https://xsserver.eu Seem dodgy as well? Registrant: NOT DISCLOSED! Visit www.eurid.eu for webbased WHOIS. has a facebook page https://www.facebook.com/XSServer Edited June 28, 2020 by petzl Quote Link to comment Share on other sites More sharing options...
Jericho Posted June 28, 2020 Author Share Posted June 28, 2020 I already contacted xsserver via facebook and complained about spam. Messages are read but not replied. Why are the IPs not included in the Spamcop blocking lists? Quote Link to comment Share on other sites More sharing options...
petzl Posted June 28, 2020 Share Posted June 28, 2020 (edited) 6 hours ago, Jericho said: I already contacted xsserver via facebook and complained about spam. Messages are read but not replied. Why are the IPs not included in the Spamcop blocking lists? German ISP's are notorious for not replying! Facebook page is not that activeSC blocklist is too forgiving Reports go back to "Submitted: 5/19/2020, 5:08:58 AM +1000:" But don't appear to be hitting spamtraps Edited June 28, 2020 by petzl Quote Link to comment Share on other sites More sharing options...
Jericho Posted July 1, 2020 Author Share Posted July 1, 2020 Woukd a staff member please double-check this. spam from xsserver.gmbh is still increasing. I believe SpamCop does not work properly, at least for my account. As the servers won't appear on the blocking list, reporting them again and again is pointless. Quote Link to comment Share on other sites More sharing options...
Lking Posted July 1, 2020 Share Posted July 1, 2020 https://www.spamcop.net/fom-serve/cache/297.html scroll down to SCBL rules. Quote Link to comment Share on other sites More sharing options...
petzl Posted July 1, 2020 Share Posted July 1, 2020 (edited) 3 hours ago, Jericho said: Woukd a staff member please double-check this. spam from xsserver.gmbh is still increasing. I believe SpamCop does not work properly, at least for my account. As the servers won't appear on the blocking list, reporting them again and again is pointless. Just include "S-CERT[AT]S-CERT[DOT]de" in your reports. xsserver.gmbh seem crooked to me? The idea is to get better than SpamCop include in notes "Criminal phishing, blackmail threat, abuse@xsserver.gmbh ignore abuse reports. no unsubscribe, bogus but valid reply address go to innocent parties"their reply address is valid but Bogus goes to innocent parties, eg. a restaurantIt is a non-registered Website no registra?http://195.62.32.155/#contact - contact@195.62.32.155 is bogus not valid If you own your own server try blocking '195.62.32.0 - 195.62.33.255' IP range. bounce to abuse@xsserver.gmbh criminal activity! Edited July 1, 2020 by petzl Quote Link to comment Share on other sites More sharing options...
Jericho Posted July 1, 2020 Author Share Posted July 1, 2020 12 hours ago, petzl said: Just include "S-CERT[AT]S-CERT[DOT]de" in your reports. xsserver.gmbh seem crooked to me? The idea is to get better than SpamCop include in notes "Criminal phishing, blackmail threat, abuse@xsserver.gmbh ignore abuse reports. no unsubscribe, bogus but valid reply address go to innocent parties"their reply address is valid but Bogus goes to innocent parties, eg. a restaurantIt is a non-registered Website no registra?http://195.62.32.155/#contact - contact@195.62.32.155 is bogus not valid If you own your own server try blocking '195.62.32.0 - 195.62.33.255' IP range. bounce to abuse@xsserver.gmbh criminal activity! S-CERT replied they are not concerned, because this problem has nothing to do with the German Sparkasse (financial business) IT. Quote Link to comment Share on other sites More sharing options...
petzl Posted July 1, 2020 Share Posted July 1, 2020 (edited) 5 hours ago, Jericho said: S-CERT replied they are not concerned, because this problem has nothing to do with the German Sparkasse (financial business) IT. They did not give the nation cert contact? How German of them. Look up the right one from this list (click view all)https://www.first.org/members/teams/ Very bureaucratic Germans are. maybe this one? EU I think?https://www.bsi.bund.de/EN/TheBSI/Contact/contact_node.htmlbsi[AT]bsi.bund[DOT]de Edited July 1, 2020 by petzl Quote Link to comment Share on other sites More sharing options...
gnarlymarley Posted July 4, 2020 Share Posted July 4, 2020 On 6/24/2020 at 3:05 AM, Jericho said: I also noticed that my average reporting time never drops below 4 hours, no matter how fast I submit my reports. I probably have a million plus reports of the past few decades that sure keep my average up. On 6/27/2020 at 10:52 PM, Jericho said: Why are the IPs not included in the Spamcop blocking lists? I believe I saw the term snowshoe spamming. that explains this. I have about a thousand of my own spamtrap email accounts and one thing I noticed is that the IP never seems to be repeated. If you look at what Lking sent above, the spammer is doing that do they will not get listed. Can be amazing how many IP blocks are out there that they can use with this "hopping" method. Quote Link to comment Share on other sites More sharing options...
kevin h Posted January 13, 2021 Share Posted January 13, 2021 I can confirm after having just spoken with XSServer support at their listed phone number that they indeed do nothing regarding spam reports. They did mention that they forward all abuse reports to their customers, but also said that they have a lot of spammers on their network. When I asked if spamming was against their terms of service, they agreed. When I asked how they enforced their terms of service, the guy got pretty rude with me, refused to answer, and advised me to just block their IP addresses if it bothers me. However, no action aside from possibly forwarding abuse reports to their customers is taken by XSServer. They are definitely a spammer haven, which is likely why no response to abuse reports is ever received from them, they are well aware of the spam coming from their network, and they intend on doing nothing about it. Quote Link to comment Share on other sites More sharing options...
gnarlymarley Posted January 13, 2021 Share Posted January 13, 2021 In my past, I would just block the whole range if I were to get a reply like that. Now I just use SpamAssassin and mark the range as more likely spam. With enough of their customer's emails being blocked, they will the give up and find another provider. Quote Link to comment Share on other sites More sharing options...
StephenG Posted April 12, 2021 Share Posted April 12, 2021 Hi from Germany... 👋 Here in Germany we also have the Problems with XSServer GmbH and their Spams... I wrote a EMail to "allgemeiner-spam@internet-beschwerdestelle.de" on the German FSM-Site waiting for the reply... I made the suggestion to put them in the CC when reporting to SpamCop... I will inform you, when any answer arrives... Quote Link to comment Share on other sites More sharing options...
petzl Posted April 13, 2021 Share Posted April 13, 2021 18 hours ago, StephenG said: I made the suggestion to put them in the CC when reporting to SpamCop... Your super-secret SpamCop address you should not disclose! Send your report to "internet-beschwerdestelle" separately Quote Link to comment Share on other sites More sharing options...
StephenG Posted April 13, 2021 Share Posted April 13, 2021 Yes, you´re right and i haven´t finish thinking... 🙈 Thank You petzl 👍 Quote Link to comment Share on other sites More sharing options...
gnarlymarley Posted April 14, 2021 Share Posted April 14, 2021 I would suggest putting your super secret submit address into the bcc, except some email servers could leave that in the email as it goes out. It would be good to know your email server before trying even the bcc. Probably the only safe way is to forward separate emails. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.