Jump to content

[Resolved] I seem to accuse the wrong host with SpamCop Reporting


Oriolus
 Share

Recommended Posts

Hi,

I'm very puzzled. I reported spams in the usual way , but received an email from the abused host.

Please, can someone find out if I were in err, or did I do what was right?

Please, have a look at the mail exchange underneath:

First received mail:

RE: [spamCop (http://www.nod32.nl/'>http://www.nod32.nl/) id:2946883185]Business Admin-Degree

From: abuse[at]is.nl

To: Oriolus <2946883185[at]reports.spamcop.net>

Date: 19 mrt. 2008 12:52

Subject: RE: [spamCop (http://www.nod32.nl/'>http://www.nod32.nl/) id:2946883185]Business Admin-Degree

Sent by: devnull.spamcop.net

If you would check the message ypu would see, the link to www.nod32.nl

is added by a virusscanner.

Regards,

IS Interned Abuse

>-----Oorspronkelijk bericht-----

>Van: Oriolus [mailto:2946883185[at]reports.spamcop.net]

>Verzonden: woensdag 19 maart 2008 12:14

>Aan: abuse

>Onderwerp: [spamCop (http://www.nod32.nl/'>http://www.nod32.nl/) id:2946883185]Business Admin-

>Degree

>

>[ SpamCop V647 ]

>This message is brief for your comfort. Please use links below for

>details.

>

>Spamvertised web site: http://www.nod32.nl/

>http://www.spamcop.net/w3m?i=z2946883185z026ea6a4aecb7661fe60675391903f5

>8z

>http://www.nod32.nl/'>http://www.nod32.nl/ is 213.133.34.216; Wed, 19 Mar 2008 11:45:40 GMT

>

>[ Offending message ]

>Return-Path: <cheribrandenburgstreet[at]inyork.com>

>Received: from mwinf6616.orange.nl (mwinf6616.orange.nl)

> by mwinb6006 (SMTP Server) with LMTP; Wed, 19 Mar 2008 12:14:22

>+0100

>X-Sieve: Server Sieve 2.2

>Received: from me-wanadoo.net (localhost [127.0.0.1])

> by mwinf6616.orange.nl (SMTP Server) with ESMTP id AF7ED280008C

> for <x>; Wed, 19 Mar 2008 12:14:22 +0100 (CET)

>Received: from phoenixpc (unknown [90.31.90.254])

> by mwinf6616.orange.nl (SMTP Server) with SMTP id 60B6A2800083;

> Wed, 19 Mar 2008 12:14:21 +0100 (CET)

>X-ME-UUID: 20080319111421396.60B6A2800083[at]mwinf6616.orange.nl

>Received: from localhost (localhost.localdomain [127.0.0.1])

> by host21834251.inyork.com (8.13.1/8.13.1) with SMTP id

>oEKoLSog94.898521.3mO.sX0.9793799306440

> for <x>; Wed, 19 Mar 2008 07:07:51 +0400

>Message-ID: 681f______________________a8c0[at]phoenixpc

>From: "Myrna Kilgore" <CheribrandenburgStreet[at]inyork.com>

>To: <x>, <x>,

> <x>, <x>, <x>

>Subject: Business Admin-Degree

>Date: Wed, 19 Mar 2008 07:07:51 +0400

>MIME-Version: 1.0

>X-Content-Type: text/plain;

> format=flowed;

> charset="iso-8859-1";

> reply-type=original

>X-Content-Transfer-Encoding: 7bit

>X-Priority: 3

>X-MSMail-Priority: Normal

>X-Mailer: Microsoft Outlook Express 6.00.3790.2663

>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2757

>Content-Type: text/plain

>X-SpamCop-note: Converted to text/plain by SpamCop (outlook/eudora hack)

>

>Call to register and receive your qualifications within days!

>

>You Need a Better Degree, and we can Help!

>

>Do you want for a prosperous future, increased money earning power, and

>the respect of all?

>

>1206~666~6129

>

>

>

>__________ NOD32 2956 (20080318) Informatie __________

>

>Dit bericht is gecontroleerd door het NOD32 Antivirus Systeem.

>http://www.nod32.nl

>

My reply:

Hi abuse-officer,

Indeed the message is provided with a statement that the sender (of this spam) apparently uses Eset's NOD32 Antivirus System.

This, however, doesn't imply that sender cannot send spam; and that's what I was reporting.

I received a message from SpamCop.net that you were busy trying to backfill the hole in your security settings. I wish you luck, and I hope to receive no spam anymore via your domain.

Sincerely,

Oriolus

His replywhich puzzles me substantially: Is he right? Did I do something wrong? Please, tell me and I'll try to avoid such errors!

you don't understand me.

The person who is spamming is using nod32 antivirus, we just host the website

www.nod32.nl so stop sending us abuse email because the mail isn't send from

our networks.

As a matter of fact, I'm receiving lots of spam mail that SpamCop accuse to is.nl, but this very case is peculiar and I cannot find out whether I or IS Interned is right...

Thank you in advance,

Oriolus

Link to comment
Share on other sites

Here is another complaint from the same person: <abuse[at]is.nl> about my reporting:

RE: [spamCop (http://www.nod32.nl/'>http://www.nod32.nl/) id:2955696187]e ShortDick? Sad? you will feel happy with

Don't complain here!

>-----Oorspronkelijk bericht-----

>Van: Oriolus [mailto:2955696187[at]reports.spamcop.net]

>Verzonden: vrijdag 21 maart 2008 13:05

>Aan: abuse

>Onderwerp: [spamCop (http://www.nod32.nl/'>http://www.nod32.nl/) id:2955696187]e ShortDick?

>Sad? you will feel happy with ..

>

>[ SpamCop V647 ]

>This message is brief for your comfort. Please use links below for

>details.

>

>Spamvertised web site: http://www.nod32.nl/

>http://www.spamcop.net/w3m?i=z2955696187zb12a7ccff76ada85ca4afbd9cd9ff9d

>5z

>http://www.nod32.nl/'>http://www.nod32.nl/ is 213.133.34.216; Fri, 21 Mar 2008 12:12:58 GMT

>

>[ Offending message ]

>Return-Path: <rgodfreyda[at]arteitaly.com>

>Received: from mwinf6003.orange.nl (mwinf6003.orange.nl)

> by mwinb6006 (SMTP Server) with LMTP; Fri, 21 Mar 2008 13:04:41

>+0100

>X-Sieve: Server Sieve 2.2

>Received: from me-wanadoo.net (localhost [127.0.0.1])

> by mwinf6003.orange.nl (SMTP Server) with ESMTP id 35B011C0026A

> for <x>; Fri, 21 Mar 2008 13:04:41 +0100 (CET)

>Received: from tovbb (ble59-1-82-66-131-79.fbx.proxad.net

>[82.66.131.79])

> by mwinf6003.orange.nl (SMTP Server) with ESMTP id AA4251C00261;

> Fri, 21 Mar 2008 13:04:36 +0100 (CET)

>X-ME-UUID: 20080321120436697.AA4251C00261[at]mwinf6003.orange.nl

>Date: Fri, 21 Mar 2008 04:19:46 -0700

>From: "Rowena H. Godfrey" <rgodfreyda[at]arteitaly.com>

>To: <x>

>In-Reply-To: <beda01c8880d$969f3b97$d08f0fc4[at]0wxcv73>

>Reply-To: "Rowena H. Godfrey" <rgodfreyda[at]arteitaly.com>

>X-Sender: <rgodfreyda[at]arteitaly.com>

>Subject: e ShortDick? Sad? you will feel happy with our help,

>Click here to find out how kkqjyiyn if1kh222

>Message-ID: <1206_______5882[at]arteitaly.com>

>X-Content-Type: text/plain;

> charset="iso-8859-2"

>X-Content-Transfer-Encoding: 8bit

>Content-Type: text/plain

>X-SpamCop-note: Converted to text/plain by SpamCop (outlook/eudora hack)

>

>..Grow Your SmallDick...

>

>* ROCK SOLID hardness that feels bigger, wider and fuller (to you and to

>HER)

>* THROBBING powerful blood flow to thePenis

>* ALL-NIGHT staying power

>

>You can't go wrong. It's doctor and herbalist endorsed

>It's used and recommended bySex industry professionals

>

>http://play.whbestknow.com

>

>

>

>

>

>f7o2ghp 565cv o9r6 bftgknqh

>

>

>

>__________ NOD32 2965 (20080320) Informatie __________

>

>Dit bericht is gecontroleerd door het NOD32 Antivirus Systeem.

>http://www.nod32.nl

>

It doesn't make sense to me... What shall I do?

I received a third message from abuse at is.nl. Same story. If required, I shall post it here.

TIA

Edited by Oriolus
Link to comment
Share on other sites

It doesn't make sense to me... What shall I do?

I received a third message from abuse at is.nl. Same story. If required, I shall post it here.

TIA

I would forward it to the deputies and let them deal with it. They can better explain how he can list his site as an innocent and stop getting reports.

To the person sending you the compaints, I would reafirm that any link in a spam message is a spamvertized link and that SpamCop reports of spamvertized links are for informational purpose only and he is not being put on SpamCop's blocklist because of it. It is letting him know his link is being seen in spam around the world and he may want to take some action. He may also want to change his software so that link is not shown, since he is advertizing his software on spam messages.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...