captkirk Posted July 8 Share Posted July 8 I am starting to get a not insignificant number of spams sent using MS Outlook that when processed gets: Re: 40.92.23.16 (Third party interested in email source) To: Internal spamcop handling: (bondedsender) (Notes) The IP is in the MS range I should mention that these emails are generally for professional web services like SEO or website design which is rather ironic since my website (admittedly old and out of date haha!) advertises those very types of services. Admittedly these are not rated as spam by the spam detection engines etc, but they are sent repeatedly, often with numerous "did you get my last email" replies. Is being a bondedsender a get out of jail free card? And is this an MS product now? Quote Link to comment Share on other sites More sharing options...
petzl Posted July 9 Share Posted July 9 4 hours ago, captkirk said: I am starting to get a not insignificant number of spams sent using MS Outlook that when processed gets: Re: 40.92.23.16 (Third party interested in email source) To: Internal spamcop handling: (bondedsender) (Notes) The IP is in the MS range I should mention that these emails are generally for professional web services like SEO or website design which is rather ironic since my website (admittedly old and out of date haha!) advertises those very types of services. Admittedly these are not rated as spam by the spam detection engines etc, but they are sent repeatedly, often with numerous "did you get my last email" replies. Is being a bondedsender a get out of jail free card? And is this an MS product now? 40.92.23.16 is a microsoft IP Send a SpamCop Tracking URL for better info If they have a unsubscribe use it (they already have your email address) Microsoft are flogging free office365 accounts that are being taken up by naïve marketeers and spammers. Microsoft IP hop, so it is difficult for spam to be blocked, While being complete  ignoramuses they would know this generates hate! So in true Microsoft fashion they are to big to fail attitude! Quote Link to comment Share on other sites More sharing options...
gnarlymarley Posted July 9 Share Posted July 9 captkirk, good luck sending a tracking URL that shows this. I have seen this and I refresh the page with the tracking URL and it goes back to normal. Seems to be intermittent for me. Quote Link to comment Share on other sites More sharing options...
Tesseract Posted July 12 Share Posted July 12 I saw the same thing for this one which was relayed via Google rather than MS: https://www.spamcop.net/sc?id=z6904141603z1da5cef05dea0875060747b9f9753680z As mentioned above, it changed to the expected behaviour after reloading, and seems to have stayed that way. The first time I clicked Report the result was: Reports disabled for bondedsender AT admin.spamcop.net  Quote Link to comment Share on other sites More sharing options...
petzl Posted July 12 Share Posted July 12 (edited) 10 hours ago, Tesseract said: I saw the same thing for this one which was relayed via Google rather than MS: https://www.spamcop.net/sc?id=z6904141603z1da5cef05dea0875060747b9f9753680z As mentioned above, it changed to the expected behaviour after reloading, and seems to have stayed that way. The first time I clicked Report the result was: Reports disabled for bondedsender AT admin.spamcop.net SC link, don't se it now "Reports disabled"? 136.243.18.213 is Germany not Russia? Still seeing SpamCop check what I think is the years old defunct IP reporting Abuse net? "Using abuse net on abuse [at] spd-mgts [DOT] ru" Edited July 13 by petzl Quote Link to comment Share on other sites More sharing options...
davem Posted July 17 Share Posted July 17 I'm getting these too.... getting tired of Melvin Hewitt Jr Same text but from a variety of senders. Quote Link to comment Share on other sites More sharing options...
cwg Posted July 20 Share Posted July 20 So is this just a new way for spammers to pay off spamcop so they can continue to send spam? Quote Link to comment Share on other sites More sharing options...
gnarlymarley Posted July 20 Share Posted July 20 I managed to get a few screenshots of refreshing your tracking URL a few times. From what I can see, sometimes only the bondedsender is there and sometimes the address it should be reporting to is there. Seems Good but no bondedsender:  BondedSender only? Where is the ru report address?: Both good (seems okay): Quote Link to comment Share on other sites More sharing options...
AmyLynn Posted July 20 Share Posted July 20 (edited) Everything I reported today no matter what has been redirected to "bondedsender" I can't help but believe spamcop is having issues. And it started last night. Edited July 20 by AmyLynn Quote Link to comment Share on other sites More sharing options...
nh905 Posted July 20 Share Posted July 20 I have been seeing similar issues over the last few weeks. Most recently email in Japanese from an IP that appears to be in Buffalo, NY. Tracking message source: 172.245.191.133: Routing details for 172.245.191.133 Using smaller IP block (/ 8 vs. / 16 ) Removing 1 larger (> / 8 ) route(s) from cache [refresh/show] Cached whois for 172.245.191.133 : noc@servermania.com Using best contacts abuse@servermania.com Message is 17 hours old 172.245.191.133 not listed in cbl.abuseat.org 172.245.191.133 not listed in dnsbl.sorbs.net 172.245.191.133 listed in accredit.habeas.com ( 1 ) 172.245.191.133 listed in plus.bondedsender.org ( 1 ) BondedSender+ confirmed opt-in only 172.245.191.133 not listed in iadb.isipp.com Both habeas.com and bondersender.org redirect to https://www.validity.com/everest/returnpath/.  Are spammers buying 'get out of jail cards'? Quote Link to comment Share on other sites More sharing options...
FeMaster Posted July 20 Share Posted July 20 (edited) Getting the same thing today with multiple emails I reported. Today is the first time I've come across this. When I click to send the report (which it does allow me to do), it then pops up a message, "Reports disabled for bondedsender@admin.spamcop.net". Yet, the email is still waiting in my queue to be reported. I've attempted to report the same email 5 times and it is just an infinate loop. Report it, reporting is disabled, yet shows that I have unsent reports. Click the report now button, brings up the exact same report again, try to report again, reporting is disabled, but yet I still have exact same unsent report... Rinse and repeat.... https://www.spamcop.net/sc?id=z6904681923z00049e518b8e317fefb8d4f6508b667bz  Edited July 20 by FeMaster Quote Link to comment Share on other sites More sharing options...
captkirk Posted July 21 Author Share Posted July 21 The problem persists for me, and might be getting worse. Refreshing or reloading or re-reporting doesn't see to help. In the email headers I see that Google is a permitted sender. I also see that queries to various black lists are blocked. I think that validity.com (which claims to be associated with SpamAssassin) may be involved because the headers mention that queries to validity.com have been blocked, and it offers a url to explain what that means (https://knowledge.validity.com/hc/en-us/articles/20961730681243). And the bondedsender thing seems to be something related to validity as was mentioned! In any case, SpamCop is keeping us from being able to send reports to obvious spammers. Quote Return-Path: <> Delivered-To: me@mydomain.com Received: from p3plzcpnl505680.prod.phx3.secureserver.net    by p3plzcpnl505680.prod.phx3.secureserver.net with LMTP    id 2DxrKhhBnGZKfA8AIldFhg    (envelope-from <>)    for <me@mydomain.com>; Sat, 20 Jul 2024 15:58:32 -0700 Return-path: <> Envelope-to: me@mydomain.com Delivery-date: Sat, 20 Jul 2024 15:58:32 -0700 Received: from [103.174.115.206] (port=43023 helo=weststarexpert.org.uk)    by p3plzcpnl505680.prod.phx3.secureserver.net with esmtp (Exim 4.96.2)    id 1sVJ1w-004FeV-32    for me@mydomain.com;    Sat, 20 Jul 2024 15:58:32 -0700 Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41])        by mx.google.com with SMTPS id k20-20020a056a00135400b006c3403de48asor2595917pfu.1.2023.11.06.05.39.25        for <me@mydomain.com>        (Google Transport Security);        Mon, 06 Nov 2023 05:39:25 -0800 (PST) Received-SPF: pass (google.com: domain of me@mydomain.com designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41; Authentication-Results: mx.google.com;       dkim=pass header.i=@gmail.com header.s=20230601 header.b=FaYwsHPK;       spf=pass (google.com: domain of me@mydomain.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=me@mydomain.com;       dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;        d=gmail.com; s=20230601; t=1699277965; x=1699882765; dara=google.com;        h=to:subject:message-id:date:from:mime-version:from:to:cc:subject         :date:message-id:reply-to;        bh=Qx4EI37vzBkYaACIldnog3jlXdaYHGnP5bQn6LbOE1g=;        b=FaYwsHPKK5q/maCqJ7TsgO3bQXRGv2GDgz/lreLZtMkBg8EpLNuqpGCnw0fKwQD6iF         pe8ue3k/nXW5nYQeJN650cv+jsgd1oRN3CibaETYpo333wjo+V6nRlucVn5GZBk1+vVj         zvbKv9otMIZZjXQYPo0uns4Smm46NI9kj3sYc4jJ/2Mmyhu71OVjsYo/z4OJ4KFBD29E         fOoga7hIojJFkx1y6BWed3u0MFpOpy2w9gncK9F9teW4jXSlLBRLQxScAppXnW+Cprln         7W2H0l/DsAUeMeYnZIRVNvNb66KW0TK4p6rusI9/ZtSeO4wN3mMCw9RtlCZqpNiMPvMB         rDaw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;        d=1e100.net; s=20230601; t=1699277965; x=1699882765;        h=to:subject:message-id:date:from:mime-version:x-gm-message-state         :from:to:cc:subject:date:message-id:reply-to;        bh=Qx4EI37vzBkYaACIldnog3jlXdaYHGnP5bQn6LbOE1g=;        b=ItlIGf4+lklAxHf5XecSMj3eLmk7qhBuWGkgztZnU+0M63SVXhwqjQJmeA2ScMBUMr         vXt9x46VBp8H4NFA2kvKg1Zg5TQkg+AtxQLja/qpy6HZ9UJPMHZ6nm8q42TeuRUOsniE         JrWzqRFVwmOqXLm16KcKf4Z2gIFnP+rfuNccRO99pjNnWpMEje3H3PDheuinhC1iTUfd         gan1PrUAAvtydqdFSD1I9vA7SU1e6u9Lj3Yl8tqydB7KQN91+GK4LhmwiIo+Q/WE8qLB         YyIvOZ6LyPFwvMrP0VnUhAEhJtUEf6CLSY7wNm0vIBE43SbxWOSadRd7FFje+1Y7ONhu         lCnA== X-Gm-Message-State: AOJu0Ywg4LjvbzgCINzq7k3hBA6mPPDa3Wb6ymyrQ8itMuuGneBtCjtz 9RC47SI0jQVSzTFmKB+Zlb0WlWeocdI3U/EtIAyBjYknwzI= X-Google-Smtp-Source: AGHT+IFHIjVowFbLrFG7pHus8z2iJf0JvJjSWAVhE3QyJ+RTylT7aTXa5Ad5qFGcXIHM9nriTTKr2WW8OU6zB5effo0= X-Received: by 2002:a05:6a20:9184:b0:181:594b:fb77 with SMTP id v4-20020a056a20918400b00181594bfb77mr15082202pzd.29.1699277964864; Mon, 06 Nov 2023 05:39:24 -0800 (PST) MIME-Version: 1.0 From: 'FREE Maga Hat' <Hat-YX2@Trump2024zyelXmnEG.com> Date: Sun, 21 Jul 2024 00:37:00 +0200 Message-ID: <CAKnhkiE3ONV3f6B4A3qRCv12TYdJhsCUcZe4+4K5mihv101LFR0ET5bS5C@mail.gmail.com> To: me@mydomain.com Content-Type: multipart/alternative; boundary="00000000000078727606097bfbf4" X-spam-Status: Yes, score=17.3 X-spam-Score: 173 X-spam-Bar: +++++++++++++++++ X-spam-Report: spam detection software, running on the system "p3plzcpnl505680.prod.phx3.secureserver.net",  has identified this incoming email as possible spam. The original  message has been attached to this so you can view it or label  similar future email. If you have any questions, see  root\@localhost for details.  Content preview: <https://google.com/gmail/ESNNIIOORRHHHEEELLPP_______8_5G.S9D=    5H49804HG68SD4H065HW10D21HSD5201......> <https://google.com/gmail/ESNNIIOORRHHHEEELLPP_______8_5G.S9D=    5H49804HG68SD4H065HW10D21HSD5201.. [...]  Content analysis details:  (17.3 points, 5.0 required)  pts rule name             description  ---- ---------------------- --------------------------------------------------  0.0 URIBL_BLOCKED         ADMINISTRATOR NOTICE: The query to URIBL was                             blocked. See                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block                              for more information.                             [URIs: amazon.fr]  5.0 BAYES_99              BODY: Bayes spam probability is 99 to 100%                             [score: 1.0000]  1.0 BAYES_999             BODY: Bayes spam probability is 99.9 to 100%                             [score: 1.0000]  0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE:                             The query to Validity was blocked. See                             https://knowledge.validity.com/hc/en-us/articles/20961730681243                              for more information.                             [103.174.115.206 listed in sa-accredit.habeas.com]  0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The                             query to Validity was blocked. See                             https://knowledge.validity.com/hc/en-us/articles/20961730681243                              for more information.                           [103.174.115.206 listed in bl.score.senderscore.com]  0.9 DKIM_ADSP_NXDOMAIN    No valid author signature and domain not in                             DNS  3.5 URI_GOOG_STO_SPAMMY   URI: Link to spammy content hosted by google                              storage  2.2 KAM_STORAGE_GOOGLE    URI: Google Storage API being abused by                             spammers  1.6 HTML_IMAGE_ONLY_24    BODY: HTML: images with 2000-2400 bytes of                             words  0.0 HTML_MESSAGE          BODY: HTML included in message  0.8 MPART_ALT_DIFF        BODY: HTML and text parts are different  0.1 DKIM_SIGNED           Message has a DKIM or DK signature, not necessarily                             valid  0.1 DKIM_INVALID          DKIM or DK signature exists, but is not valid  0.0 KAM_DMARC_STATUS      Test Rule for DKIM or SPF Failure with Strict                             Alignment  2.0 RDNS_NONE             Delivered to internal network by a host with no rDNS X-spam-Flag: YES X-BRAND: GoDaddy X-PRODUCT: cpanel-shz X-ENVIRONMENT: prod Subject: ***spam*** This is a Call to RALLY All Trump Supporters.     Quote Link to comment Share on other sites More sharing options...
petzl Posted July 21 Share Posted July 21 (edited) 3 hours ago, FeMaster said: Getting the same thing today with multiple emails I reported. Today is the first time I've come across this. When I click to send the report (which it does allow me to do), it then pops up a message, "Reports disabled for bondedsender@admin.spamcop.net". Yet, the email is still waiting in my queue to be reported. I've attempted to report the same email 5 times and it is just an infinate loop. Report it, reporting is disabled, yet shows that I have unsent reports. Click the report now button, brings up the exact same report again, try to report again, reporting is disabled, but yet I still have exact same unsent report... Rinse and repeat.... https://www.spamcop.net/sc?id=z6904681923z00049e518b8e317fefb8d4f6508b667bz  This came out in 2004 when Ironport owned SpamCop a deal with Microsoft spam https://www.marketingsherpa.com/article/how-microsofts-deal-ironports-bonded From Jeff G the owner of SpamCop email 2004  Edited July 21 by petzl Quote Link to comment Share on other sites More sharing options...
SCRE Posted July 21 Share Posted July 21 I have observed this too on all reports in the last days (aprox 200). For me it looks like every IP adress is listet in Bondedsender, so I think this can only be a technical issue or someone really got all IP adresses listed. Hope this will be fixed soon, as reporting make no sense an the moment. Quote Link to comment Share on other sites More sharing options...
davem Posted July 21 Share Posted July 21 (edited) Yes, this looks like something is broken or hacked:  Everything I've tried to report this morning has this problem. Quote 1: Received: from [203.252.1.181] (203.252.1.181) by mailsnd1.chol.com with ESMTP; Sun, 21 Jul 2024 20:32:23 +0900 (KST) No unique hostname found for source: 203.252.1.181 Possible forgery. Supposed receiving system not associated with any of your mailhosts Will not trust this Received line. Tracking message source: 203.252.1.122: Routing details for 203.252.1.122 Report routing for 203.252.1.122: ipadm@lguplus.co.kr Yum, this spam is fresh! Message is 2 hours old 203.252.1.122 not listed in cbl.abuseat.org 203.252.1.122 not listed in dnsbl.sorbs.net 203.252.1.122 listed in accredit.habeas.com ( 1 ) 203.252.1.122 listed in plus.bondedsender.org ( 1 ) BondedSender+ confirmed opt-in only 203.252.1.122 not listed in iadb.isipp.com Finding links in message body  Edited July 21 by davem Quote Link to comment Share on other sites More sharing options...
AmyLynn Posted July 21 Share Posted July 21 I emailed the ADMIN. I thought about doing it yesterday. But I thought coming here would be enough. Still broken for me as well. EVERYTHING I report. Quote Link to comment Share on other sites More sharing options...
AmyLynn Posted July 21 Share Posted July 21 (edited) Sorry not sure why this posted twice. Edited July 21 by AmyLynn Quote Link to comment Share on other sites More sharing options...
xwagner76 Posted July 21 Share Posted July 21 On 7/20/2024 at 7:30 AM, cwg said: So is this just a new way for spammers to pay off spamcop so they can continue to send spam? This is what crossed my mind. Quote Link to comment Share on other sites More sharing options...
ninth Posted July 21 Share Posted July 21 (edited) On 7/9/2024 at 6:05 AM, captkirk said: Is being a bondedsender a get out of jail free card? And is this an MS product now? They block IP addresses sending spam. Have you contacted bondedsender? On 7/9/2024 at 6:05 AM, captkirk said: Re: 40.92.23.16 (Third party interested in email source) To: Internal spamcop handling: (bondedsender) (Notes) Note the spam is coming from free MS 365 shared IP range and bondedsender do not accept reports from SC. 52.96.0.0 - 52.115.255.255Â 40.74.0.0 - 40.125.127.255 Â Edited July 21 by ninth Quote Link to comment Share on other sites More sharing options...
Richard W Posted July 22 Share Posted July 22 We started getting false positives on accredit.habeas.com and plus.bondedsender.org last week. This seems to have jumped to 100% fail now. I have a ticket open and trying to figure this out with Validity. Quote Link to comment Share on other sites More sharing options...
Steve Posted July 22 Share Posted July 22 I'm getting the same thing when using SC to report a spam email to Plala and Dion: Tracking URL and screenshot for Plala: https://www.spamcop.net/sc?id=z6904687565z0021e111f0f5e046e68d701aac6ce83az  Tracking URL and screenshot for Dion: https://www.spamcop.net/sc?id=z6904736377ze33822d2a3200ff6fa8469083c521061z  Quote Link to comment Share on other sites More sharing options...
ninth Posted July 22 Share Posted July 22 Checkout japanantifraud dot org online form mate. Quote Link to comment Share on other sites More sharing options...
davem Posted July 22 Share Posted July 22 Right, seems sa-trusted.bondedsender.org is the weak link here.  In another mailbox the SpamAssassin header notes as much Another example: Return-Path: <no-reply@admindomain.biz> Delivered-To: xxxxxx@xxxxxx.com Received: from mi3-ss120.a2hosting.com    by mi3-ss120.a2hosting.com with LMTP    id kL+cIqnjnWYkJCcAV7MSgQ    (envelope-from <no-reply@admindomain.biz>)    for <xxxxxx@xxxxxx.com>; Mon, 22 Jul 2024 00:44:25 -0400 Return-path: <no-reply@admindomain.biz> Envelope-to: xxxxxx@xxxxxx.com Delivery-date: Mon, 22 Jul 2024 00:44:25 -0400 Received: from mta0.admindomain.biz ([185.117.88.243]:36262)    by mi3-ss120.a2hosting.com with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384    (Exim 4.97.1)    (envelope-from <no-reply@admindomain.biz>)    id 1sVkuM-0000000AmNI-1XKU    for xxxxxx@xxxxxx.com;    Mon, 22 Jul 2024 00:44:25 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=admindomain.biz;  h=From:Subject:To:Content-Type:MIME-Version:Reply-To:Date:Message-Id;  i=no-reply@admindomain.biz;  bh=91rVG8kn6/yKry9T3HqxltOtMRtn96eg1AmGVia6Cqs=;  b=dH1GA2ZkmyZBUSC9KBBl/3+AEh/8MRsUQhbq07VugTo8FRwZH/O+SvbuwxrfM9zZNNevF3tod1d0   a5LGsmrdG8EVH+ktQ35lltwA/SsON5Opd7f7Sx5rOPkON0Tm2pFblrxIYOM6L2szW15Wwyxiv2Cv   pmtnNrEt9sWqZJvQ7ew= From: "Etihad Air Group" <no-reply@admindomain.biz> Subject: Re: Aviation Project to xxxxxx To: <xxxxxx@xxxxxx.com> Content-Type: multipart/alternative; boundary="kfYTVSMG6qWPAUzPykc=_0YgKgPq3dtycc" MIME-Version: 1.0 Reply-To: <expoexhibition@etihadairlineprocurement.com> Date: Sun, 21 Jul 2024 21:44:20 -0700 Message-Id: <212020240744217E658A82DE-475D1A7EAA@admindomain.biz> X-spam-Status: No, score=1.1 X-spam-Score: 11 X-spam-Bar: + X-Ham-Report: spam detection software, running on the system "mi3-ss120.a2hosting.com",  has NOT identified this incoming email as spam.  The original  message has been attached to this so you can view it or label  similar future email.  If you have any questions, see  root\@localhost for details.  Content preview:  Recruitment Aviation Project, Skilled Contractors & Vendor/Supplies   : 2024-2025. Hi xxxxxx,  Content analysis details:  (1.1 points, 8.0 required)  pts rule name        description  ---- ---------------------- --------------------------------------------------  0.0 URIBL_BLOCKED      ADMINISTRATOR NOTICE: The query to URIBL was                blocked.  See               http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block                for more information.                [URIs: admindomain.biz]  0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The                query to Validity was blocked.  See               https://knowledge.validity.com/hc/en-us/articles/20961730681243                for more information.               [185.117.88.243 listed in bl.score.senderscore.com]  0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The                query to Validity was blocked.  See               https://knowledge.validity.com/hc/en-us/articles/20961730681243                for more information.              [185.117.88.243 listed in sa-trusted.bondedsender.org]  0.5 JMQ_SPF_NEUTRAL     ASKDNS: SPF set to ?all                [admindomain.biz TXT:v=spf1 a mx ptr]                [a:admindomain.biz ip4:185.117.88.0/24]                [?all]  -0.0 SPF_PASS        SPF: sender matches SPF record  0.0 HTML_MESSAGE      BODY: HTML included in message  0.1 DKIM_SIGNED       Message has a DKIM or DK signature, not necessarily                valid  -0.1 DKIM_VALID_EF      Message has a valid DKIM or DK signature from                envelope-from domain  -0.1 DKIM_VALID_AU      Message has a valid DKIM or DK signature from                author's domain  -0.1 DKIM_VALID       Message has at least one valid DKIM or DK signature  0.8 KAM_INFOUSMEBIZ     Prevalent use of                .info|.us|.me|.me.uk|.biz|xyz|id|rocks|life                domains in spam/malware X-spam-Flag: NO This is a multi-part message in MIME format --kfYTVSMG6qWPAUzPykc=_0YgKgPq3dtycc Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Recruitment  Aviation Project, Skilled Contractors & Vendor/Supplies : 2024-2025.  Hi xxxxxx,  We are to inform your company on our UAE AVIATION Projects, we requir= e some reliable and skilled manufacturers,contr actors and suppliers w= ho can give us their optimum services.. Quote Link to comment Share on other sites More sharing options...
cwg Posted July 22 Share Posted July 22 I went back in my past reports and reparsed several of them and they all now go to "bondedsender". Quote Link to comment Share on other sites More sharing options...
IrishMASMS Posted July 22 Share Posted July 22 same issue here - thanks for looking into this richard. Some other esamples: https://www.spamcop.net/sc?id=z6904777610z530fb6da07cdfda5e6c2f65cdd1a87d9z Tracking message source: 51.222.142.152: Routing details for 51.222.142.152 [refresh/show] Cached whois for 51.222.142.152 : abuse@ovh.ca Using abuse net on abuse@ovh.ca abuse net ovh.ca = abuse@ovh.net, abuse@ovh.ca, noc@ovh.net Using best contacts abuse@ovh.net abuse@ovh.ca noc@ovh.net Message is 47 hours old 51.222.142.152 not listed in cbl.abuseat.org 51.222.142.152 not listed in dnsbl.sorbs.net 51.222.142.152 listed in accredit.habeas.com ( 1 ) 51.222.142.152 listed in plus.bondedsender.org ( 1 ) BondedSender+ confirmed opt-in only 51.222.142.152 not listed in iadb.isipp.com  https://www.spamcop.net/sc?id=z6904777608zb98e6c1ec9f2c476850b2cb0719c2392z Tracking message source: 123.58.178.167: Routing details for 123.58.178.167 [refresh/show] Cached whois for 123.58.178.167 : sa@corp.netease.com Using last resort contacts sa@corp.netease.com Message is 4 hours old 123.58.178.167 not listed in cbl.abuseat.org 123.58.178.167 not listed in dnsbl.sorbs.net 123.58.178.167 listed in accredit.habeas.com ( 1 ) 123.58.178.167 listed in plus.bondedsender.org ( 1 ) BondedSender+ confirmed opt-in only 123.58.178.167 not listed in iadb.isipp.com   Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.