From abuse at treenetnz.com  Wed Dec  1 15:26:33 2004
From: abuse at treenetnz.com (Windows User)
Date: Tue Nov 30 21:25:06 2004
Subject: [SC-Help] Re: SpamCop Parser not responding
References: <MPG.1c155f1827fb62db989680@news.spamcop.net>
	<coedq0$nc0$1@news.spamcop.net>
Message-ID: <MPG.1c17f306e96a5833989681@news.spamcop.net>

In article <coedq0$nc0$1@news.spamcop.net>, dsp4ever2002@yahoo.com 
says...
> 
> "Abuse treenetnz.com" <abuse@treenetnz.com> wrote in message > posted to 
> spamcop, .geeks and .help followup set to .help
> >
> > For the last 12+ hours I have been unable to get the web parser to
> > complete a job. It appears to hang sometime before processing the
> > received headers.
> >
> > Is spamcop under some sort of temporay overload I should continue to
> > wait out or is it deeper?
> >
> > -- 
> > AJ
> > Treehouse Networks abuse@
> > www.treenetnz.com
> 
>   I'm having similar troubles...only getting responses about half the time 
> and not any if I forward multiple attachments.  Have written to the 
> deputies.    Good luck....let me know if you get it fixed.
> 
> Scott C. 
> 

That is strange. Sounds like a different problem though.
I am sending in multiples and always getting responses back. But the 
trackers go to dead links or incomplete parse pages.


-- 
AJ
Treehouse Networks abuse@
www.treenetnz.com
From abuse at treenetnz.com  Wed Dec  1 15:27:48 2004
From: abuse at treenetnz.com (Windows User)
Date: Tue Nov 30 21:30:05 2004
Subject: [SC-Help] Re: SpamCop Parser not responding
References: <MPG.1c155f1827fb62db989680@news.spamcop.net>
	<cogdb1$u82$1@news.spamcop.net>
Message-ID: <MPG.1c17f34e973f0679989682@news.spamcop.net>

In article <cogdb1$u82$1@news.spamcop.net>, nobody@spamcop.net says...
> 
> "Abuse treenetnz.com" <abuse@treenetnz.com> wrote in message
> news:MPG.1c155f1827fb62db989680@news.spamcop.net...
> > posted to spamcop, .geeks and .help followup set to .help
> >
> > For the last 12+ hours I have been unable to get the web parser
> to
> > complete a job. It appears to hang sometime before processing the
> > received headers.
> 
> Apparently, for most people it is working just fine, but there are
> a couple of other people who are having problems.  I would write to
> the deputies and give them as much information as I can (times,
> browser, IP address, provider, tracking URL's, whatever you can
> think of) so they can see if there is a common thread among those
> who are having problems.
> 
> Miss Betsy
> 

Thanks guys for all your replies.
It disappeared suddenly after certain messages expired over the 24 hours 
age limit. But it has just started again so these ones will be passed on 
to the depuities.

-- 
AJ
Treehouse Networks abuse@
www.treenetnz.com
From ric.gates at bigsleep.org  Wed Dec  1 04:24:39 2004
From: ric.gates at bigsleep.org (Blammo)
Date: Tue Nov 30 23:25:04 2004
Subject: [SC-Help] Re: Annoying bug - Skip to Reports link goes nowhere
References: <cof08j$1t6$1@news.spamcop.net>
Message-ID: <Xns95B1CFB7DCFC3blammo@216.154.195.61>

On 29 Nov 2004 Stewart Gordon entered spamcop.help and left 
news:cof08j$1t6$1@news.spamcop.net:

> The link target should be generated regardless of whether there is any 
> actual reporting to do.  A sensible place to put it for "nothing to do" 
> reports is at the error message itself.
> 
> 

I've noticed this myself, but only now really looked at the code.
I compared two reports of the same message, the second was too old. Now 
this page is of course dynamically generated and I can only guess as to 
what the template looks like.
The "Skip to Reports" link points to an anchor named "report"...
------------

<div class="warning">Cannot resolve http://www.asdg32.biz/book/</div>
<a name="report">
    	<p><strong>Please make sure this email IS spam:</strong><br>

> Note: This is invalid HTML as <A> may not contain <p>.

<font face="courier" size=2>
    	From: "tester" &lt;test@somewhere.com&gt;     
	(<strong>testing</strong>)<br>
    	First line of message<br>
</font>
<a href="/sc?id=SpamCopId&action=display">View full message</a>
<p></a>

> ---^ hmm... somethings wrong there!

------------

<div class="warning">
    	Using postmaster#publicf.bta.net.cn@devnull.spamcop.net for 
statistical tracking.
</div>
<div class="error">
    	Sorry, this email is too old to file a spam report.  You must report 
spam within 2 days of receipt.  This mail was received on [date]
</div>
Message is [days] old<br>
<div class="error">Nothing to do.</div>

------------
Now I would write this completely different, for one, there's very few IDs, 
and lots of "anonymous" blocks, and DIV is used in places where something 
like <EM>, <B> or <i> should be used. And <P> isn't often closed so the 
browser gets to guess at where it should be closed.
I would do something like this...
------------

<div id="resolve">
     	<em class="warning">using devnull...</em><br>
    	text...<br>
   	<em class="warning">Cannot resolve http://www.url.dom</em><br>
    	Regular message here<br>
</div>
<div id="report">
    	<p><strong>Please make sure this email IS spam:</strong></p>

<p>
    	<tt class="messagesummary">From: "tester" &lt;test@somewhere.com&gt;     
	(<strong>testing</strong>)<br>
    	First line of message<br></tt>
</p>
<a href="/sc?id=spamid&action=display">View full message</a>
<p>...</p>
<form>...</form>
</div>

-----------
Here I have a block defined for the report section, so we can link to the 
ID in that block - this won't work in some older browsers, but this is 
really the least of their problems. This will make the entire section a 
target and has the added benefit of allowing the entire target to be 
styled. The "nothing to do" simply goes inside that block...
-----------

<div id="report">
<p class="error">
    	Sorry, this email is too old to file a spam report.  You must report 
spam within 2 days of receipt.  This mail was received on [date]
</p>
<p class="error">Nothing to do.</p>
</div>

-----------
In my experience, rewriting something like this can be a major task, you 
may be able to simply move the area where the <a name="report"> anchor is 
written, though depending on how the parsing code is written, this could 
take days. Well written code allows you to easily change the template, but 
this is rarely the case since the coder is probably more concerned with 
just getting it to work. I suspect that most of the old HTML code has been 
replaced but some of it still lurks in there.
I often look at stuff others have written, figure out how it works, then 
throw it away and rewrite it myself. I even have some old script that I 
need to rewrite to change the page layout, but it's not designed well for 
that and I wouldn't be wasting any time just rewriting the whole thing. 
Nothing quite as complex as SpamCop, but I've figured out ways to make 
templates where I can rewrite the HTML without effecting the script that 
generates it.

-- 
| Ric
|
From smjg_1998 at yahoo.com  Wed Dec  1 13:18:07 2004
From: smjg_1998 at yahoo.com (Stewart Gordon)
Date: Wed Dec  1 08:20:02 2004
Subject: [SC-Help] Re: Annoying bug - Skip to Reports link goes nowhere
In-Reply-To: <Xns95B1CFB7DCFC3blammo@216.154.195.61>
References: <cof08j$1t6$1@news.spamcop.net>
	<Xns95B1CFB7DCFC3blammo@216.154.195.61>
Message-ID: <cokga0$i79$1@news.spamcop.net>

Blammo wrote:
<snip>
> In my experience, rewriting something like this can be a major task, you 
> may be able to simply move the area where the <a name="report"> anchor is 
> written, though depending on how the parsing code is written, this could 
> take days.
<snip>

Why _move_ anything?  Why not just change it so that in place of the first

     <p class="error">

it writes

     <p class="error"><a name="report"></a>

?

Stewart.

-- 
My e-mail is valid but not my primary mailbox.  Please keep replies on 
the 'group where everyone may benefit.
From ric.gates at bigsleep.org  Wed Dec  1 19:53:07 2004
From: ric.gates at bigsleep.org (Blammo)
Date: Wed Dec  1 14:55:03 2004
Subject: [SC-Help] Re: Annoying bug - Skip to Reports link goes nowhere
References: <cof08j$1t6$1@news.spamcop.net>
	<Xns95B1CFB7DCFC3blammo@216.154.195.61> <cokga0$i79$1@news.spamcop.net>
Message-ID: <Xns95B278FE7A7CEblammo@216.154.195.61>

On 01 Dec 2004 Stewart Gordon entered spamcop.help and left
news:cokga0$i79$1@news.spamcop.net: 

> Blammo wrote:
> <snip>
>> In my experience, rewriting something like this can be a major task,
>> you may be able to simply move the area where the <a name="report">
>> anchor is written, though depending on how the parsing code is
>> written, this could take days.
> <snip>
> 
> Why _move_ anything?  Why not just change it so that in place of the
> first 
> 
>      <p class="error">
> 
> it writes
> 
>      <p class="error"><a name="report"></a>
> 

Certainly that could work, but when I looked at the source it appeared to 
me that that section isn't written when there's "nothing to do", only 
speculation of course. There's a lot of "if ...else"'s in the parser and 
the part that contains the "report" link probably doesn't exist in that "if 
.. else". So he would probably have to move or rewrite that part of the 
script.
My first thought was this is a feature, not a bug, but then if there's 
nothing to do you want to go to the next report anyway, so your suggestion 
makes sense. I'm only speculating on why it was written this way in the 
first place.


-- 
| Ric
|
From MikeE at ster.invalid  Wed Dec  1 17:17:50 2004
From: MikeE at ster.invalid (Mike Easter)
Date: Wed Dec  1 20:20:03 2004
Subject: [SC-Help] Re: Being Spammed By G4-TechTV?
References: <colfh4$7mc$1@news.spamcop.net>
Message-ID: <colqep$f3u$1@news.spamcop.net>

The usual routine is to only use spamcop.spam for posting spams, not for
discussion.  The idea is that spamcop and spamcop.help are for
discussion, and no spams are to be posted there.  So, one way to work it
is to post a spam into .spam, but not discuss it there, and to start a
thread in spamcop or .help which references the spam in .spam and to
discuss it in the other groups.  Sounds complicated, and it certainly is
now that there is a better way of doing it.

The better way of doing it is to not post the spam at all in .spam, but
instead to feed the spam to the parser and copy the tracking url.  Then,
either send or cancel the reports and paste the tracker into the
discussion group spamcop.help or spamcop.

So, now, in order to perform tidy little housekeeping, I'm going to do
about 3 things.  I'm going to make a tracker out of your spam, I'm going
to crosspost this reply into spamcop.help and .spam, and I'm going to
structure followups to spamcop help.

And, I'm going to address your questions inline below.

Ryan Smith wrote:
> Ok, here's a real odd one. I've recieved several odd pieces of email
> lately that Spamcop is tracking back to G4's email servers, but due
> to the content of the message(a fake PayPal email with a 169.* link),
> I find it hard to believe someone is purposely trying to spam me.
> Below is the entirity of the email, would someone mind telling me
> what's going on?
>
> For reference: HomeLan/ControlNet email servers are trusted mailhosts

This tracker isn't exactly what yours would look like because you have
mailhosts enabled;  but the tracker and its environs look like this from
the top of the parse [I snip off http://www to prevent some wrapping]:

Here is your TRACKING URL - it may be saved for future reference:
spamcop.net/sc?id=z698319261z1b9a6f71fd59877d92293174036d35e9z

I prefer to talk about headers by abbreviating them

  Abbreviated Received lines *comment
  from (192.168.1.105) by blade4.cesmail.net *serves you
  from mailgate.cesmail.net (216.154.195.36) by c60.cesmail.net  *serves
you
  from (192.168.1.101)  by mailgate.cesmail.net  *serves you
  from pop.homelanfed.com [38.113.222.30] by mailgate.cesmail.net
*serves you
  from ([192.168.51.10]  by mail.mcw.controlnet.com   *serves you
  from [63.173.148.11] (helo=paypal.com) by mail1sj.controlnet.com
*sourceline
  from (TRUSSO.g4media.com [169.254.101.152]) by g4media.com *bogusline

Call that 7 lines where line 6 is the sourceline and line 7 is the
bogusline.

Others may disagree with me here, because some people like to examine
the 'mind' of the spammer, where 'spammer' means the 'person' or
whatever who constructed the item which did something which caused it to
be injected into the smtp stream which caused you to receive it.

My approach is somewhat simpler.  I decide if it is reportable as a
spam, and then I decide how to report it.  I don't do any spammer
mindreading.

So, I look at that item and determine its spamsource.  I also determine
that it looks like a PayPal phish except that the payload site doesn't
work, because it is of an IANA special use IP block.  The spam is also
misconstructed by having the header call it multipart alternative with a
boundary, when in fact it is texthtml with no boundary.  As a result,
SpamCop doesn't even find the useless link.

Finding links in message body
no links found


Then, I would notify/report the spamsource.  SpamCop would notify
tscholz@g4media.com  which is the tech/admin contact for the arin
registration;  there is no reg'd abuse.net notify.  Because of that, I
personally would also notify the parent arin reg'd  abuse@sprint.net

whois -h whois.arin.net 63.173.148.11 ...
Sprint  63.160.0.0 - 63.175.255.255
   abuse@sprint.net
G4 Media 63.173.148.0 - 63.173.148.255
   tscholz@g4media.com [no reg'd abusenet]

I would spend no time whatsoever on wondering why the spammersource
screwed up the phishing expedition.  I think there are better things to
spend time on;  like, notifying PayPal or investigating whether or not
the source IP is compromised.


-- 
Mike Easter
kibitzer, not SC admin

From virgedx at spamcop.net  Wed Dec  1 21:14:45 2004
From: virgedx at spamcop.net (Ryan Smith)
Date: Wed Dec  1 21:15:03 2004
Subject: [SC-Help] Re: Being Spammed By G4-TechTV?
References: <colfh4$7mc$1@news.spamcop.net> <colqep$f3u$1@news.spamcop.net>
Message-ID: <coltqn$hjq$1@news.spamcop.net>

Thanks, and sorry about posting in the wrong newsgroup(Spamcop help says 
that .spam is for discussion spam, and doesn't list .help, so it was the 
closest match). Anyhow, I've already done as you've described(sent a report 
off to tscholz), but otherwise I'm just puzzled about this. Their link is to 
a non-routable IP, and to port 0 no less, and the email makes no attempt to 
replicate a real PayPal email, so it just strikes me as very odd, as if they 
wanted this phising scheme to fail.

To add more oddness to it, I just received a bounced email that originally 
came from the same source. But this one used my address as the From address, 
and was advertising a blog/webcam site(and not a specific one, just a link 
saying to "check out my blog", but used the same text/background style and 
bad link. You're right in that I probably shouldn't pursue this any further 
since its doubtful anything will come of it, but at this point, I'm not sure 
if someone is screwing with my head, or what.

-Ryan Smith

"Mike Easter" <MikeE@ster.invalid> wrote in message 
news:colqep$f3u$1@news.spamcop.net...
> The usual routine is to only use spamcop.spam for posting spams, not for
> discussion.  The idea is that spamcop and spamcop.help are for
> discussion, and no spams are to be posted there.  So, one way to work it
> is to post a spam into .spam, but not discuss it there, and to start a
> thread in spamcop or .help which references the spam in .spam and to
> discuss it in the other groups.  Sounds complicated, and it certainly is
> now that there is a better way of doing it.
>
> The better way of doing it is to not post the spam at all in .spam, but
> instead to feed the spam to the parser and copy the tracking url.  Then,
> either send or cancel the reports and paste the tracker into the
> discussion group spamcop.help or spamcop.
>
> So, now, in order to perform tidy little housekeeping, I'm going to do
> about 3 things.  I'm going to make a tracker out of your spam, I'm going
> to crosspost this reply into spamcop.help and .spam, and I'm going to
> structure followups to spamcop help.
>
> And, I'm going to address your questions inline below. 


From nobody at devnull.spamcop.net  Wed Dec  1 20:29:25 2004
From: nobody at devnull.spamcop.net (Cat)
Date: Wed Dec  1 21:30:03 2004
Subject: [SC-Help] Re: Being Spammed By G4-TechTV?
In-Reply-To: <coltqn$hjq$1@news.spamcop.net>
References: <colfh4$7mc$1@news.spamcop.net> <colqep$f3u$1@news.spamcop.net>
	<coltqn$hjq$1@news.spamcop.net>
Message-ID: <colum1$i58$1@news.spamcop.net>

(Top posting fixed)

Ryan Smith wrote:

> "Mike Easter" <MikeE@ster.invalid> wrote in message 
> news:colqep$f3u$1@news.spamcop.net...

<snip>

>>So, now, in order to perform tidy little housekeeping, I'm going to do
>>about 3 things.  I'm going to make a tracker out of your spam, I'm going
>>to crosspost this reply into spamcop.help and .spam, and I'm going to
>>structure followups to spamcop help.
>>
>>And, I'm going to address your questions inline below. 

 > Thanks, and sorry about posting in the wrong newsgroup(Spamcop help says
 > that .spam is for discussion spam, and doesn't list .help, so it was the
 > closest match).

<snip>

It's ok. The good thing is that you posted your spam in .spam instead of 
one of the other newsgroups. The forum page doesn't really explain it 
well, but like Mike said, the discussion part should be posted to the 
main spamcop newsgroup or here in .help while the spam part is posted in 
.spam or post the tracking URL instead.

One more thing that will help you to be able to communicate easier in 
the newsgroup...
Notice how Mike posted his comments inline below each quoted point while 
snipping the rest except for the part that he posted at the top 
directing you on where to post certain things. When you post your 
comments at the top, it forces the reader to have to scroll back and 
forth to understand the context and makes people less likely to read 
your posts. The logical and polite order is to post your own comments 
inline below each quoted point like Mike did.

See #6 at http://linux.sgms-centre.com/misc/netiquette.php and #1 and #2 
at http://www.river.com/users/share/etiquette/ for more snipping and 
inline posting netiquette.


-Cat
  SpamCop user, not an admin
From MikeE at ster.invalid  Wed Dec  1 18:35:36 2004
From: MikeE at ster.invalid (Mike Easter)
Date: Wed Dec  1 21:35:03 2004
Subject: [SC-Help] Re: Being Spammed By G4-TechTV?
References: <colfh4$7mc$1@news.spamcop.net> <colqep$f3u$1@news.spamcop.net>
	<coltqn$hjq$1@news.spamcop.net>
Message-ID: <colv0i$ift$1@news.spamcop.net>

Ryan Smith wrote:
> Thanks, and sorry about posting in the wrong newsgroup(Spamcop help
> says that .spam is for discussion spam, and doesn't list .help, so it
> was the closest match).

Yes.  Local 'lore' and the routines or popular behaviors are different
from the faq.  Sometimes there's a tiny bit of discussion which goes on
in .spam, but the problem with carrying on a discussion in there is that
no one reads it -- why would they?  It only contains spam by
'tradition'.   So, as a result, any discussions in .spam are limited to
a few people who peek in there and see if anything is going on that
hasn't been flagged in .help or spamcop.  It is better to move it out
here where more people can see it.

Also, spamcop.help [where we are] is also a little 'lame' as well.
Without getting into all of the details about why, currently
spamcop.help lacks a link from an important set of links to the
newsgroups;  so it is like the 'other side' or alternate persona of a
'lame duck', more like a dead duck which is still flying.

> Anyhow, I've already done as you've
> described(sent a report off to tscholz), but otherwise I'm just
> puzzled about this. Their link is to a non-routable IP, and to port 0
> no less, and the email makes no attempt to replicate a real PayPal
> email, so it just strikes me as very odd, as if they wanted this
> phising scheme to fail.

I agree that it is very strange looking.  Spammers are all kinds of
things;  totally incompetent, all mixed up, pretty smart, dumb, liars,
and $deity knows what else.

Try to keep the rules in order, rule 1 & 2 involves spammers lying, and
rule 3 sez they're stupid.  After you go beyond the rules, things get
more complicated.  For example, there is the 'Quirk Objection' - which
sez, after bringing up questions about things such as 'brains'
"Objection!  Assumes organs not in evidence!"

http://www.spamfaq.net/terminology.shtml

> To add more oddness to it, I just received a bounced email that
> originally came from the same source. But this one used my address as
> the From address, and was advertising a blog/webcam site(and not a
> specific one, just a link saying to "check out my blog", but used the
> same text/background style and bad link. You're right in that I
> probably shouldn't pursue this any further since its doubtful
> anything will come of it, but at this point, I'm not sure if someone
> is screwing with my head, or what.

The only way someone can screw with your head is if you 'let' [or invite
or some other word] them do it.

-- 
Mike Easter
kibitzer, not SC admin

From ric.gates at bigsleep.org  Thu Dec  2 03:17:21 2004
From: ric.gates at bigsleep.org (Blammo)
Date: Wed Dec  1 22:20:03 2004
Subject: [SC-Help] Re: Being Spammed By G4-TechTV?
References: <colfh4$7mc$1@news.spamcop.net> <colqep$f3u$1@news.spamcop.net>
	<coltqn$hjq$1@news.spamcop.net> <colv0i$ift$1@news.spamcop.net>
Message-ID: <Xns95B2C44FBE971blammo@216.154.195.61>

On 01 Dec 2004 Mike Easter entered spamcop.help and left 
news:colv0i$ift$1@news.spamcop.net:

> I agree that it is very strange looking.  Spammers are all kinds of
> things;  totally incompetent, all mixed up, pretty smart, dumb, liars,
> and $deity knows what else.
> 
> Try to keep the rules in order, rule 1 & 2 involves spammers lying, and
> rule 3 sez they're stupid.  After you go beyond the rules, things get
> more complicated.  For example, there is the 'Quirk Objection' - which
> sez, after bringing up questions about things such as 'brains'
> "Objection!  Assumes organs not in evidence!"
> 

Like most discussion involving spammer logic, that I skim over and pay 
little attention to, my first assumption is that the spamware is doing all 
the thinking, thus : garbage in garbage out. Seems futile to try to sort 
some order out of chaos.

-- 
| Ric
|
From PossumTrot at dont.spam.me  Fri Dec  3 14:27:21 2004
From: PossumTrot at dont.spam.me (Possum Trot)
Date: Fri Dec  3 17:35:02 2004
Subject: [SC-Help] Reports regarding this spam have already been sent:
Message-ID: <coqpev$m82$1@news.spamcop.net>

Are others experiencing frequent unfathomable cases of this message?  In the 
past couple of weeks I see this about every 15 to 30 spam.  I submit the 
spam from OE in groups of about 15.  I Shift-right click to select a batch, 
then send, delete those 15 and select and send the next batch.  I could see 
forgetting to delete and then re-submitting a whole batch, but I see no way 
I could resend one, especially one in the middle of a group.

To this point I haven't saved links or the originals for analysis.  It's 
sort of a nit, but confusing. 


From dogworkings at DELETE.pobox.THIS.com  Sun Dec  5 08:19:22 2004
From: dogworkings at DELETE.pobox.THIS.com (Jim Carroll)
Date: Sun Dec  5 09:25:02 2004
Subject: [SC-Help] "No body provided.  Check format of submission"
Message-ID: <cov5fi$6ke$1@news.spamcop.net>

Many of the spam messages that flood my inbox have no "body" per se, just an 
attachment.

Spamcop is rejecting my submission of these as spam, with the subject 
message.

These messages ARE spam, and they're every bit as annoying as messages with 
bodies.  Why is Spamcop giving a free ride to spammers who undoubtedly know 
that Spamcop seems to ignore spam with no message body but with an 
attachment?

Thanks in advance. 


From mrichter at cpl.net  Sun Dec  5 07:45:47 2004
From: mrichter at cpl.net (Mike Richter)
Date: Sun Dec  5 10:50:03 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
In-Reply-To: <cov5fi$6ke$1@news.spamcop.net>
References: <cov5fi$6ke$1@news.spamcop.net>
Message-ID: <covaf5$95n$1@news.spamcop.net>

Jim Carroll wrote:

> Many of the spam messages that flood my inbox have no "body" per se, just an 
> attachment.
> 
> Spamcop is rejecting my submission of these as spam, with the subject 
> message.
> 
> These messages ARE spam, and they're every bit as annoying as messages with 
> bodies.  Why is Spamcop giving a free ride to spammers who undoubtedly know 
> that Spamcop seems to ignore spam with no message body but with an 
> attachment?
> 
> Thanks in advance. 

Posted by a (mostly) happy SC user, not an official:

SC rejects them because it has nothing of substance to report. If the 
attachment is TXT, copy the contents into your report as though it were 
inline.

Mike
-- 
mrichter@cpl.net
http://www.mrichter.com/

From MikeE at ster.invalid  Sun Dec  5 07:49:03 2004
From: MikeE at ster.invalid (Mike Easter)
Date: Sun Dec  5 10:50:05 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
References: <cov5fi$6ke$1@news.spamcop.net>
Message-ID: <coval5$9df$1@news.spamcop.net>

Jim Carroll wrote:
> Many of the spam messages that flood my inbox have no "body" per se,
> just an attachment.
>
> Spamcop is rejecting my submission of these as spam, with the subject
> message.
>
> These messages ARE spam, and they're every bit as annoying as
> messages with bodies.  Why is Spamcop giving a free ride to spammers
> who undoubtedly know that Spamcop seems to ignore spam with no
> message body but with an attachment?

Oh goody!  A guessing game!  I already have an idea!

First, in reply to what you have 'stated' -- it doesn't work that way
you said.  A properly submitted mailitem which has an attachment will
parse just fine, where the key words are 'properly submitted'.

Your newsreader is Outlook Express OE.  It is an excellent agent for
submitting spam either by pasting into the webparser or by using the
submit email address.

When pasting into the webparser, you access the original what I call
'smtp mime' or complete headers plus unrendered spambody by selecting
the item and using File/ Properties/ Details/ Message source/ and then
select all of that, copy and paste it into the webparser.

That item will have the 'attachment' with whatever is its appropriate
mime structure under the complete headers.

If you are using OE to submit by mail, you would use 'forward as
attachment' function *NOT* 'forward'.

If you open a piece of spam with OE, which I rcommend against, and you
see an empty body with an attachment in the attachment field above the
body section, and then you  *FORWARD* the item instead of forwarding it
as an attachment, you will get the effect you have described.

So, if you are using OE you are forwarding not as an attachment.

The other possibility is that you aren't using OE for your mailuser
agent, but are using Outlook OL, the part of the MS Office suite for
your mail and just using OE for your newsing.  That is a whole different
discussion, since OL *can't* forward as attachment.

-- 
Mike Easter
kibitzer, not SC admin

From Kilgallen at SpamCop.net  Sun Dec  5 11:13:15 2004
From: Kilgallen at SpamCop.net (Larry Kilgallen)
Date: Sun Dec  5 12:15:03 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
References: <cov5fi$6ke$1@news.spamcop.net>
Message-ID: <qBVkb85cbKfs@eisner.encompasserve.org>

In article <cov5fi$6ke$1@news.spamcop.net>, "Jim Carroll" <dogworkings@DELETE.pobox.THIS.com> writes:
> Many of the spam messages that flood my inbox have no "body" per se, just an 
> attachment.
> 
> Spamcop is rejecting my submission of these as spam, with the subject 
> message.
> 
> These messages ARE spam, and they're every bit as annoying as messages with 
> bodies.  Why is Spamcop giving a free ride to spammers who undoubtedly know 
> that Spamcop seems to ignore spam with no message body but with an 
> attachment?

Because the most frequent method for SpamCop getting a body-free message
has historically been user error (including in their choice of email
client).

But it is certainly not the _only_ source, as it is possible to get
this even from messages trapped by the SpamCop Filtering Service.
From David1 at suescornerweb.com  Sun Dec  5 16:31:59 2004
From: David1 at suescornerweb.com (David 1)
Date: Sun Dec  5 16:35:04 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
In-Reply-To: <coval5$9df$1@news.spamcop.net>
References: <cov5fi$6ke$1@news.spamcop.net> <coval5$9df$1@news.spamcop.net>
Message-ID: <covumb$m5e$1@news.spamcop.net>

Mike Easter wrote:
> Jim Carroll wrote:
> 
>>Many of the spam messages that flood my inbox have no "body" per se,
>>just an attachment.
>>
>>Spamcop is rejecting my submission of these as spam, with the subject
>>message.
>>
>>These messages ARE spam, and they're every bit as annoying as
>>messages with bodies.  Why is Spamcop giving a free ride to spammers
>>who undoubtedly know that Spamcop seems to ignore spam with no
>>message body but with an attachment?
> 
> 
> Oh goody!  A guessing game!  I already have an idea!
> 
> First, in reply to what you have 'stated' -- it doesn't work that way
> you said.  A properly submitted mailitem which has an attachment will
> parse just fine, where the key words are 'properly submitted'.
> 
> Your newsreader is Outlook Express OE.  It is an excellent agent for
> submitting spam either by pasting into the webparser or by using the
> submit email address.
> 
> When pasting into the webparser, you access the original what I call
> 'smtp mime' or complete headers plus unrendered spambody by selecting
> the item and using File/ Properties/ Details/ Message source/ and then
> select all of that, copy and paste it into the webparser.
> 
> That item will have the 'attachment' with whatever is its appropriate
> mime structure under the complete headers.
> 
> If you are using OE to submit by mail, you would use 'forward as
> attachment' function *NOT* 'forward'.
> 
> If you open a piece of spam with OE, which I rcommend against, and you
> see an empty body with an attachment in the attachment field above the
> body section, and then you  *FORWARD* the item instead of forwarding it
> as an attachment, you will get the effect you have described.
> 
> So, if you are using OE you are forwarding not as an attachment.
> 
> The other possibility is that you aren't using OE for your mailuser
> agent, but are using Outlook OL, the part of the MS Office suite for
> your mail and just using OE for your newsing.  That is a whole different
> discussion, since OL *can't* forward as attachment.
> 
I've recently Switched from OE to T-Bird 0.08 & has been working great 
Accept I really don't know if the attachments are getting checked I just 
report what ever SC tells me to report & if the spam ticked me off I 
also check the little preset button I made for the feds. So now that 
I've rambled Do I really need to check if the attachments are being 
checked & if I do how do I go about doing that????
David 1
From nobody at devnull.spamcop.net  Sun Dec  5 16:05:37 2004
From: nobody at devnull.spamcop.net (Cat)
Date: Sun Dec  5 17:10:04 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
In-Reply-To: <covaf5$95n$1@news.spamcop.net>
References: <cov5fi$6ke$1@news.spamcop.net> <covaf5$95n$1@news.spamcop.net>
Message-ID: <cp00n7$ngk$1@news.spamcop.net>

Mike Richter wrote:

<snip>

> SC rejects them because it has nothing of substance to report. If the 
> attachment is TXT, copy the contents into your report as though it were 
> inline.
> 
> Mike

But doesn't that count as materially changing the submitted spam, which 
would be against SpamCop rules? If he forwards as attachment, that 
should work fine to get it all in there.
From nobody at devnull.spamcop.net  Sun Dec  5 16:08:23 2004
From: nobody at devnull.spamcop.net (Cat)
Date: Sun Dec  5 17:10:07 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
In-Reply-To: <covumb$m5e$1@news.spamcop.net>
References: <cov5fi$6ke$1@news.spamcop.net> <coval5$9df$1@news.spamcop.net>
	<covumb$m5e$1@news.spamcop.net>
Message-ID: <cp00sd$ngk$2@news.spamcop.net>

David 1 wrote:

<giant snip>

> I've recently Switched from OE to T-Bird 0.08 & has been working great 

<snip>

Thunderbird 0.8? You're behind a bit. It's up to 0.9 now, which is what 
I'm using since I switched from Netscape to Firefox.
From MikeE at ster.invalid  Sun Dec  5 15:00:07 2004
From: MikeE at ster.invalid (Mike Easter)
Date: Sun Dec  5 18:05:03 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
References: <cov5fi$6ke$1@news.spamcop.net> <coval5$9df$1@news.spamcop.net>
	<covumb$m5e$1@news.spamcop.net>
Message-ID: <cp03tm$poi$1@news.spamcop.net>

David 1 wrote:
> Accept I really don't know if the attachments are getting checked I
> just report what ever SC tells me to report & if the spam ticked me
> off I also check the little preset button I made for the feds. So now
> that I've rambled Do I really need to check if the attachments are
> being checked & if I do how do I go about doing that????

When you say 'attachments' and wonder if they are being checked you are
thinking of a mail as it appears to a spam reader.

First, don't be a spamreader unless there is some very good reason to do
so, and then only be a secure spamreader.

Second, from the point of view of the SC parser, there is no such thing
as an 'attachment'.  A mail consists of headers and then whatever comes
after that.  That is, everything that is not part of the header is part
of the 'body'.  That is, everything which is in the body includes all
manner of 'structure' and all parts of that structure are evaluated
according to their content type.  The body isn't 'subdivided' by the
parser into what is an 'attachment' to a reader accustomed to an
'attachment' field;  it is only subdivided according to its content
type.

Said yet another way, you should look at your spamitem in the same way
that it would be pasted into the webparser.  There is only the headers
and everything which comes after the headers.  The headers are parsed
for source and everything which comes after is parsed for spamvertiser.

-- 
Mike Easter
kibitzer, not SC admin

From ftabor at direcway.com  Sun Dec  5 18:29:55 2004
From: ftabor at direcway.com (Frank Tabor)
Date: Sun Dec  5 18:30:03 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
In-Reply-To: <cp00sd$ngk$2@news.spamcop.net>
References: <cov5fi$6ke$1@news.spamcop.net> <coval5$9df$1@news.spamcop.net>
	<covumb$m5e$1@news.spamcop.net> <cp00sd$ngk$2@news.spamcop.net>
Message-ID: <cp05l6$qjt$1@news.spamcop.net>

Cat wrote:
> David 1 wrote:
> 
> <giant snip>
> 
>> I've recently Switched from OE to T-Bird 0.08 & has been working great 
> 
> 
> <snip>
> 
> Thunderbird 0.8? You're behind a bit. It's up to 0.9 now, which is what 
> I'm using since I switched from Netscape to Firefox.

Release Candidate 1.0RC has been out for several days.
From David1 at suescornerweb.com  Sun Dec  5 19:17:02 2004
From: David1 at suescornerweb.com (David 1)
Date: Sun Dec  5 19:20:03 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
In-Reply-To: <cp00sd$ngk$2@news.spamcop.net>
References: <cov5fi$6ke$1@news.spamcop.net> <coval5$9df$1@news.spamcop.net>
	<covumb$m5e$1@news.spamcop.net> <cp00sd$ngk$2@news.spamcop.net>
Message-ID: <cp08c0$t4k$1@news.spamcop.net>

Cat wrote:
> David 1 wrote:
> 
> <giant snip>
> 
>> I've recently Switched from OE to T-Bird 0.08 & has been working great 
> 
> 
> <snip>
> 
> Thunderbird 0.8? You're behind a bit. It's up to 0.9 now, which is what 
> I'm using since I switched from Netscape to Firefox.
Yeah, I'm waiting on the disk, I thought it would be here by now don't 
want to really D/L with dial up I MISS MY DSL
From David1 at suescornerweb.com  Sun Dec  5 19:22:26 2004
From: David1 at suescornerweb.com (David 1)
Date: Sun Dec  5 19:25:03 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
In-Reply-To: <cp03tm$poi$1@news.spamcop.net>
References: <cov5fi$6ke$1@news.spamcop.net> <coval5$9df$1@news.spamcop.net>
	<covumb$m5e$1@news.spamcop.net> <cp03tm$poi$1@news.spamcop.net>
Message-ID: <cp08m7$thh$1@news.spamcop.net>

Mike Easter wrote:
> David 1 wrote:
> 
>>Accept I really don't know if the attachments are getting checked I
>>just report what ever SC tells me to report & if the spam ticked me
>>off I also check the little preset button I made for the feds. So now
>>that I've rambled Do I really need to check if the attachments are
>>being checked & if I do how do I go about doing that????
> 
> 
> When you say 'attachments' and wonder if they are being checked you are
> thinking of a mail as it appears to a spam reader.
> 
> First, don't be a spamreader unless there is some very good reason to do
> so, and then only be a secure spamreader.
> 
> Second, from the point of view of the SC parser, there is no such thing
> as an 'attachment'.  A mail consists of headers and then whatever comes
> after that.  That is, everything that is not part of the header is part
> of the 'body'.  That is, everything which is in the body includes all
> manner of 'structure' and all parts of that structure are evaluated
> according to their content type.  The body isn't 'subdivided' by the
> parser into what is an 'attachment' to a reader accustomed to an
> 'attachment' field;  it is only subdivided according to its content
> type.
> 
> Said yet another way, you should look at your spamitem in the same way
> that it would be pasted into the webparser.  There is only the headers
> and everything which comes after the headers.  The headers are parsed
> for source and everything which comes after is parsed for spamvertiser.
> 
Well if I understand everything you just said correctly, then if the 
spammer sends an attachment it just don't matter cause the reader 
whether it be from SC or any other service Just ain't going/equipt to 
deal with it.

I've already seen enough of your post to know if I got this wrong you'll 
correct me fairly fast <G> so I'll wait.
David 1
From h9vzc2i02 at sneakemail.com  Sun Dec  5 17:14:25 2004
From: h9vzc2i02 at sneakemail.com (Anon_)
Date: Sun Dec  5 20:15:03 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
References: <cov5fi$6ke$1@news.spamcop.net> <coval5$9df$1@news.spamcop.net>
	<covumb$m5e$1@news.spamcop.net>
Message-ID: <cp0bq0$van$1@news.spamcop.net>


"David 1" <David1@suescornerweb.com> wrote in message
news:covumb$m5e$1@news.spamcop.net...
> Mike Easter wrote:
> > Jim Carroll wrote:
> >
> >>Many of the spam messages that flood my inbox have no "body" per se,
> >>just an attachment.
> >>
> >>Spamcop is rejecting my submission of these as spam, with the subject
> >>message.
> >>
> >>These messages ARE spam, and they're every bit as annoying as
> >>messages with bodies.  Why is Spamcop giving a free ride to spammers
> >>who undoubtedly know that Spamcop seems to ignore spam with no
> >>message body but with an attachment?
> >
> >
> > Oh goody!  A guessing game!  I already have an idea!
> >
> > First, in reply to what you have 'stated' -- it doesn't work that way
> > you said.  A properly submitted mailitem which has an attachment will
> > parse just fine, where the key words are 'properly submitted'.
> >
> > Your newsreader is Outlook Express OE.  It is an excellent agent for
> > submitting spam either by pasting into the webparser or by using the
> > submit email address.
> >
> > When pasting into the webparser, you access the original what I call
> > 'smtp mime' or complete headers plus unrendered spambody by selecting
> > the item and using File/ Properties/ Details/ Message source/ and then
> > select all of that, copy and paste it into the webparser.
> >
> > That item will have the 'attachment' with whatever is its appropriate
> > mime structure under the complete headers.
> >
> > If you are using OE to submit by mail, you would use 'forward as
> > attachment' function *NOT* 'forward'.
> >
> > If you open a piece of spam with OE, which I rcommend against, and you
> > see an empty body with an attachment in the attachment field above the
> > body section, and then you  *FORWARD* the item instead of forwarding it
> > as an attachment, you will get the effect you have described.
> >
> > So, if you are using OE you are forwarding not as an attachment.
> >
> > The other possibility is that you aren't using OE for your mailuser
> > agent, but are using Outlook OL, the part of the MS Office suite for
> > your mail and just using OE for your newsing.  That is a whole different
> > discussion, since OL *can't* forward as attachment.
> >
> I've recently Switched from OE to T-Bird 0.08 & has been working great
> Accept I really don't know if the attachments are getting checked I just
> report what ever SC tells me to report & if the spam ticked me off I
> also check the little preset button I made for the feds. So now that
> I've rambled Do I really need to check if the attachments are being
> checked & if I do how do I go about doing that????
> David 1

****
Easy test to see what SC is getting - just "submit" to yourself and see if
the attachment is identical to what you received.

Since the parser looks at the attachment only (not the body of the e-mail
submittal) THAT (the attachment) is the important thing.

--
A SpamCop user and forum reader,
Not Admin
***



From MikeE at ster.invalid  Sun Dec  5 17:52:13 2004
From: MikeE at ster.invalid (Mike Easter)
Date: Sun Dec  5 20:55:04 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
References: <cov5fi$6ke$1@news.spamcop.net> <coval5$9df$1@news.spamcop.net>
	<covumb$m5e$1@news.spamcop.net> <cp03tm$poi$1@news.spamcop.net>
	<cp08m7$thh$1@news.spamcop.net>
Message-ID: <cp0e0c$s0$1@news.spamcop.net>

David 1 wrote:
> Well if I understand everything you just said correctly,

You didn't understand me correctly.

>  then if the
> spammer sends an attachment it just don't matter cause the reader
> whether it be from SC or any other service Just ain't going/equipt to
> deal with it.

Not correct;  ie 'Wrong.'.   As in, 'bzzzztttt'.

> I've already seen enough of your post to know if I got this wrong
> you'll correct me fairly fast <G> so I'll wait.

What I said was [in less words than before] ...

... forget about the concept of 'attachments'.

>From a parser's point of view, there's no such thing as that.

There's only headers and then everything else.

Or, said yet another way, 'Attachments are not a problem.' in any way,
shape, or form.

You should stop there if too many words get in the way of understanding.


There are many problems for the parser which can arise from the body.
None of them have anything to do with the 'spamreader's concept' of an
'attachment'.  My 'concept' of the parser is that it doesn't even
see/recognize the notion of an 'attachment', only content type -- which
content type is not something a 'spamreader' will see.  That content
type is only something which someone who examines the message /source/
will see;  which is the way the parser sees it, the spamitem.

So, the idea I'm trying to get over to you is that if you are seeing and
thinking about 'attachments', and want to talk about how the parser sees
them, where 'them' = attachments, then you aren't on the same 'page' as
the parser;  ie you and the parser aren't thinking in the same way about
what a spam is made of.

-- 
Mike Easter
kibitzer, not SC admin

From h9vzc2i02 at sneakemail.com  Sun Dec  5 20:21:46 2004
From: h9vzc2i02 at sneakemail.com (Anon_)
Date: Sun Dec  5 23:25:03 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
References: <cov5fi$6ke$1@news.spamcop.net> <coval5$9df$1@news.spamcop.net>
	<covumb$m5e$1@news.spamcop.net> <cp03tm$poi$1@news.spamcop.net>
	<cp08m7$thh$1@news.spamcop.net> <cp0e0c$s0$1@news.spamcop.net>
Message-ID: <cp0mpa$6a9$1@news.spamcop.net>


"Mike Easter" <MikeE@ster.invalid> wrote in message
news:cp0e0c$s0$1@news.spamcop.net...
> David 1 wrote:
> > Well if I understand everything you just said correctly,
>
> You didn't understand me correctly.
>
> >  then if the
> > spammer sends an attachment it just don't matter cause the reader
> > whether it be from SC or any other service Just ain't going/equipt to
> > deal with it.
>
> Not correct;  ie 'Wrong.'.   As in, 'bzzzztttt'.
>
> > I've already seen enough of your post to know if I got this wrong
> > you'll correct me fairly fast <G> so I'll wait.
>
> What I said was [in less words than before] ...
>
> ... forget about the concept of 'attachments'.
>
> From a parser's point of view, there's no such thing as that.
>
> There's only headers and then everything else.
>

**
If you look at the 'message source' you will see that that is correct.

If there are attachments, they just appear in line with everything else with
a 'note' that the following text is an attachment to the e-mail.

As said above, the parser doesn't care whether that part of the e-mail is an
attachment or just more 'message', it just plugs merrily along.

--
A SpamCop user and forum reader,
Not Admin
***
<clip>


From David1 at suescornerweb.com  Mon Dec  6 00:46:26 2004
From: David1 at suescornerweb.com (David 1)
Date: Mon Dec  6 00:45:04 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
In-Reply-To: <cp0e0c$s0$1@news.spamcop.net>
References: <cov5fi$6ke$1@news.spamcop.net> <coval5$9df$1@news.spamcop.net>
	<covumb$m5e$1@news.spamcop.net> <cp03tm$poi$1@news.spamcop.net>
	<cp08m7$thh$1@news.spamcop.net> <cp0e0c$s0$1@news.spamcop.net>
Message-ID: <cp0rk9$8tj$2@news.spamcop.net>

Mike Easter wrote:
> David 1 wrote:
> 
>>Well if I understand everything you just said correctly,
> 
> 
> You didn't understand me correctly.
> 
> 
>> then if the
>>spammer sends an attachment it just don't matter cause the reader
>>whether it be from SC or any other service Just ain't going/equipt to
>>deal with it.
> 
> 
> Not correct;  ie 'Wrong.'.   As in, 'bzzzztttt'.
> 
> 
>>I've already seen enough of your post to know if I got this wrong
>>you'll correct me fairly fast <G> so I'll wait.
> 
> 
> What I said was [in less words than before] ...
> 
> ... forget about the concept of 'attachments'.
> 
> From a parser's point of view, there's no such thing as that.
> 
> There's only headers and then everything else.
> 
> Or, said yet another way, 'Attachments are not a problem.' in any way,
> shape, or form.
> 
> You should stop there if too many words get in the way of understanding.
> 
> 
> There are many problems for the parser which can arise from the body.
> None of them have anything to do with the 'spamreader's concept' of an
> 'attachment'.  My 'concept' of the parser is that it doesn't even
> see/recognize the notion of an 'attachment', only content type -- which
> content type is not something a 'spamreader' will see.  That content
> type is only something which someone who examines the message /source/
> will see;  which is the way the parser sees it, the spamitem.
> 
> So, the idea I'm trying to get over to you is that if you are seeing and
> thinking about 'attachments', and want to talk about how the parser sees
> them, where 'them' = attachments, then you aren't on the same 'page' as
> the parser;  ie you and the parser aren't thinking in the same way about
> what a spam is made of.
> 
Ok, I think, yeah ok, well Thanks for replying.
David 1 <G>
From David1 at suescornerweb.com  Mon Dec  6 00:47:40 2004
From: David1 at suescornerweb.com (David 1)
Date: Mon Dec  6 00:50:03 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
In-Reply-To: <cp0mpa$6a9$1@news.spamcop.net>
References: <cov5fi$6ke$1@news.spamcop.net> <coval5$9df$1@news.spamcop.net>
	<covumb$m5e$1@news.spamcop.net> <cp03tm$poi$1@news.spamcop.net>
	<cp08m7$thh$1@news.spamcop.net> <cp0e0c$s0$1@news.spamcop.net>
	<cp0mpa$6a9$1@news.spamcop.net>
Message-ID: <cp0rmj$8tj$3@news.spamcop.net>

Anon_ wrote:
> "Mike Easter" <MikeE@ster.invalid> wrote in message
> news:cp0e0c$s0$1@news.spamcop.net...
> 
>>David 1 wrote:
>>
>>>Well if I understand everything you just said correctly,
>>
>>You didn't understand me correctly.
>>
>>
>>> then if the
>>>spammer sends an attachment it just don't matter cause the reader
>>>whether it be from SC or any other service Just ain't going/equipt to
>>>deal with it.
>>
>>Not correct;  ie 'Wrong.'.   As in, 'bzzzztttt'.
>>
>>
>>>I've already seen enough of your post to know if I got this wrong
>>>you'll correct me fairly fast <G> so I'll wait.
>>
>>What I said was [in less words than before] ...
>>
>>... forget about the concept of 'attachments'.
>>
>>From a parser's point of view, there's no such thing as that.
>>
>>There's only headers and then everything else.
>>
> 
> 
> **
> If you look at the 'message source' you will see that that is correct.
> 
> If there are attachments, they just appear in line with everything else with
> a 'note' that the following text is an attachment to the e-mail.
> 
> As said above, the parser doesn't care whether that part of the e-mail is an
> attachment or just more 'message', it just plugs merrily along.
> 
> --
> A SpamCop user and forum reader,
> Not Admin
> ***
> <clip>
> 
> 
NOW that I understood, Thank You.

David 1
From dogworkings at DELETE.pobox.THIS.com  Mon Dec  6 07:33:52 2004
From: dogworkings at DELETE.pobox.THIS.com (Jim Carroll)
Date: Mon Dec  6 09:00:04 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
References: <cov5fi$6ke$1@news.spamcop.net> <coval5$9df$1@news.spamcop.net>
Message-ID: <cp1of3$pp7$1@news.spamcop.net>


"Mike Easter" <MikeE@ster.invalid> wrote in message 
news:coval5$9df$1@news.spamcop.net...
>
>
> If you are using OE to submit by mail, you would use 'forward as
> attachment' function *NOT* 'forward'.

I do "forward as attachment" using Outlook Express and occasionally I still 
receive the "no body provided" message.

> If you open a piece of spam with OE, which I rcommend against,

I've disabled the preview pane for just this reason.  I highlight spam, and 
use "forward as attachment".  Sometimes several at a batch.

> So, if you are using OE you are forwarding not as an attachment.

Again, I do NOT "forward".

> Oh goody!  A guessing game!  I already have an idea!

> First, in reply to what you have 'stated'

I'm sorry I'm not as knowledgeable as you, and that I didn't know the answer 
before I asked.  My sword is nailed to the wall above the fireplace, 
otherwise I'd fall on it.

Thanks for your "help". 


From dogworkings at DELETE.pobox.THIS.com  Mon Dec  6 07:55:26 2004
From: dogworkings at DELETE.pobox.THIS.com (Jim Carroll)
Date: Mon Dec  6 09:00:06 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
References: <cov5fi$6ke$1@news.spamcop.net> <covaf5$95n$1@news.spamcop.net>
	<cp00n7$ngk$1@news.spamcop.net>
Message-ID: <cp1of3$pp7$2@news.spamcop.net>


"Cat" <nobody@devnull.spamcop.net> wrote in message
news:cp00n7$ngk$1@news.spamcop.net...

>> SC rejects them because it has nothing of substance to report. If the
>> attachment is TXT, copy the contents into your report as though it were
>> inline.
>
> But doesn't that count as materially changing the submitted spam, which
> would be against SpamCop rules?

That was my understanding.

> If he forwards as attachment, that  should work fine to get it all in
> there.

That was what Julian Haight himself told me to do when I long ago tried to
"forward" a message from Outlook Express instead of "forward as attachment".

Today, I got two more "no body provided, check format of submission." error
messages.  Appended to this is what showed up when I selected the "tracking
URL" of one and then selected "view original message".

Status:  U
Return-Path: <svxhbgky@fresh.de>
Received: from adsl-68-255-147-105.dsl.akrnoh.ameritech.net
([68.255.1xx.1xx])
by timothy.mail.atl.earthlink.net (EarthLink SMTP Server) with SMTP id
1cB2nyap3Nl3pw0
Sun, 5 Dec 2004 14:49:04 -0500 (EST)
Received: from contest.pop11.odn.ne.jp ([0.128.216.158])
 by polio.pop11.odn.ne.jp (Sun Java System Messaging Server 6.1 HotFix 0.06
(built
 Aug 25 2004)) with ESMTP id <0C5I00DW4[3
From: <svxhbgky@fresh.de>
Message-Id: <2004____________________3pw0@timothy.mail.atl.earthlink.net>
Date: Sun, 5 Dec 2004 14:49:04 -0500 (EST)
X-ELNK-AV: 0



From dogworkings at DELETE.pobox.THIS.com  Mon Dec  6 07:56:29 2004
From: dogworkings at DELETE.pobox.THIS.com (Jim Carroll)
Date: Mon Dec  6 09:00:10 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
References: <cov5fi$6ke$1@news.spamcop.net> <coval5$9df$1@news.spamcop.net>
	<covumb$m5e$1@news.spamcop.net> <cp03tm$poi$1@news.spamcop.net>
	<cp08m7$thh$1@news.spamcop.net> <cp0e0c$s0$1@news.spamcop.net>
Message-ID: <cp1of4$pp7$3@news.spamcop.net>


"Mike Easter" <MikeE@ster.invalid> wrote in message
news:cp0e0c$s0$1@news.spamcop.net...
>
> ... forget about the concept of 'attachments'.
>
> From a parser's point of view, there's no such thing as that.
>
> There's only headers and then everything else.
>
> Or, said yet another way, 'Attachments are not a problem.' in any way,
> shape, or form.

What I was saying, said another way, is that "forward as attachment" isn't
working as it once did.

I don't know if OE has changed as regards WHAT it forwards as an attachment,
if the spammers are sending something different, or if Spamcop has changed
as regards what it will accept as a submission, but SOMEthing has changed,
at least as I see it.  I've been submitting spam to Spamcop since it was
julianhaight.com, and have found the process to be fairly intuitive, and
have not seen the "no body provided.  Check format of submission" message
until just lately, and I'm seeing it a couple of times per day.

Formerly, before the volume of spam that got past two filters (pobox and
earthlink) got as large as it is, I reported the occasional spam by "view
message source" (ctrl-F3 in Outlook Express), copying the resulting text,
and pasting it to Spamcop, and that worked, but much more slowly than
"forward as attachment".

What I referred to as "attachments" in the original post may have been in
error.  Whatever the "content" of the spam, OE shows the message in the
inbox as having an attachment with the small attachment icon.  I have never
opened such a post to see whether it truly carries an "attachment" or not.
Nor will I -- I may be stupid, but I'm not crazy.

I may try using "forward as attachment" only with the messages that show up
WITHOUT the "attachment" icon, and use the old "view message source"
strategy with those messages displaying as having attachments.  If that
doesn't work, I guess it's back to "just hit delete".  I'm going to let the
scholars like you report spam.  I'll go back to being part of the problem.


From MikeE at ster.invalid  Mon Dec  6 06:42:18 2004
From: MikeE at ster.invalid (Mike Easter)
Date: Mon Dec  6 09:45:03 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
References: <cov5fi$6ke$1@news.spamcop.net> <covaf5$95n$1@news.spamcop.net>
	<cp00n7$ngk$1@news.spamcop.net> <cp1of3$pp7$2@news.spamcop.net>
Message-ID: <cp1r46$rqp$1@news.spamcop.net>

Jim Carroll wrote:
> Today, I got two more "no body provided, check format of submission."
> error messages.  Appended to this is what showed up when I selected
> the "tracking URL" of one and then selected "view original message".

Posting the tracking url here would be best.

> Status:  U

> X-ELNK-AV: 0

Those look like the first and last headerlines of an email received by
an EL subscriber;  and what you posted looks like what I call an 'empty
spam' -- that is, a message with no body.

That appears to be a different type of item than the initial onset of
this thread

Jim Carroll wrote:
> Many of the spam messages that flood my inbox have no "body" per se,
> just an attachment.

Where is the 'evidence' of an /attachment/ to this particular item?

-- 
Mike Easter
kibitzer, not SC admin

From MikeE at ster.invalid  Mon Dec  6 06:56:34 2004
From: MikeE at ster.invalid (Mike Easter)
Date: Mon Dec  6 10:00:03 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
References: <cov5fi$6ke$1@news.spamcop.net> <coval5$9df$1@news.spamcop.net>
	<covumb$m5e$1@news.spamcop.net> <cp03tm$poi$1@news.spamcop.net>
	<cp08m7$thh$1@news.spamcop.net> <cp0e0c$s0$1@news.spamcop.net>
	<cp1of4$pp7$3@news.spamcop.net>
Message-ID: <cp1ruu$sff$1@news.spamcop.net>

Jim Carroll wrote:
> Formerly, before the volume of spam that got past two filters (pobox
> and earthlink) got as large as it is, I reported the occasional spam
> by "view message source" (ctrl-F3 in Outlook Express), copying the
> resulting text, and pasting it to Spamcop, and that worked, but much
> more slowly than "forward as attachment".

Control-F3 will not work to view the message source with a message both
closed and unpreviewed.

If a selected message is unopened and unpreviewed, you have to use File/
Properties/ Details tab/ Message source button to access the complete
headers contiguous with the message body, and....

.... if you only use File/ Properties/ Details tab and do *NOT* go
further to the Message source button, you will access only the complete
headers and will be missing the message body and if submitted to
spamcop's webparser you will get 'no body provided - check format of
submission'

If a message is either open /or/ previewed, control-F3 will display the
message source.

> What I referred to as "attachments" in the original post may have
> been in error.  Whatever the "content" of the spam, OE shows the
> message in the inbox as having an attachment with the small
> attachment icon.  I have never opened such a post to see whether it
> truly carries an "attachment" or not. Nor will I -- I may be stupid,
> but I'm not crazy.

I just did a survey of the last 10 spam items with an attachment icon in
my Junk folder.  They were all simply multiparts consisting of a
plaintext part and a text/html part.

> I may try using "forward as attachment" only with the messages that
> show up WITHOUT the "attachment" icon, and use the old "view message
> source" strategy with those messages displaying as having
> attachments.  If that doesn't work, I guess it's back to "just hit
> delete".  I'm going to let the scholars like you report spam.  I'll
> go back to being part of the problem.

IMO, the best way to troubleshoot a problem is to *NOT* use the forward
as attachment method, because that introduces layers of complexity which
are not necessary for the webparser.

By using the webparser, you can *see* exactly what you are asking the
parser to do, and if you are 'familiar' with the process from previous
parsings, you can even see when something is wrong with something.

Further, if you are /not/ familiar with what is going on, you can simply
post the tracking url to this newsgroup so that we can use the tracker
to access what you fed the parser and see for ourselves what is going
on.

-- 
Mike Easter
kibitzer, not SC admin

From dogworkings at DELETE.pobox.THIS.com  Mon Dec  6 09:08:39 2004
From: dogworkings at DELETE.pobox.THIS.com (Jim Carroll)
Date: Mon Dec  6 10:10:04 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
References: <cov5fi$6ke$1@news.spamcop.net> <coval5$9df$1@news.spamcop.net>
	<covumb$m5e$1@news.spamcop.net> <cp03tm$poi$1@news.spamcop.net>
	<cp08m7$thh$1@news.spamcop.net> <cp0e0c$s0$1@news.spamcop.net>
	<cp1of4$pp7$3@news.spamcop.net> <cp1ruu$sff$1@news.spamcop.net>
Message-ID: <cp1sml$t1i$1@news.spamcop.net>


"Mike Easter" <MikeE@ster.invalid> wrote in message 
news:cp1ruu$sff$1@news.spamcop.net...
> Further, if you are /not/ familiar with what is going on, you can simply
> post the tracking url to this newsgroup so that we can use the tracker
> to access what you fed the parser and see for ourselves what is going
> on.

Or maybe "just hit delete".

Is there a way to donate my unused SpamCop privileges to a knowledgeable 
user?

This is a lot more trouble than it's worth.

I'm not as stupid as this thread has made me sound; I've been using 
computers since 1981.  But spam has kicked my ass and I'm about to give up 
trying to do something constructive about it.



From nobody at spamcop.net  Mon Dec  6 10:20:09 2004
From: nobody at spamcop.net (Miss Betsy)
Date: Mon Dec  6 10:25:02 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
References: <cov5fi$6ke$1@news.spamcop.net> <coval5$9df$1@news.spamcop.net>
	<covumb$m5e$1@news.spamcop.net> <cp03tm$poi$1@news.spamcop.net>
	<cp08m7$thh$1@news.spamcop.net> <cp0e0c$s0$1@news.spamcop.net>
	<cp1of4$pp7$3@news.spamcop.net> <cp1ruu$sff$1@news.spamcop.net>
	<cp1sml$t1i$1@news.spamcop.net>
Message-ID: <cp1tc8$tia$1@news.spamcop.net>


"Jim Carroll" <dogworkings@DELETE.pobox.THIS.com> wrote in message
news:cp1sml$t1i$1@news.spamcop.net...
<snip>
> I'm not as stupid as this thread has made me sound; I've been using
> computers since 1981.  But spam has kicked my ass and I'm about to
give up
> trying to do something constructive about it.

Submitting spam is not as difficult as it seems either, but most of the
responders are either people who know so many different ways to get
errors that they need a lot of information to make a specific helpful
reply or they have seen the same question so many times and, for
whatever reason, feel sarcastic today.

If there is truly no body (which happens), it is permissible to submit
with 'no body provided' or similar language to get the parser to work.
If it is an attachment, I don't understand why that is not showing up.
There was someone else who thought that a spam that had one word in
HTML and one word in plain text created that error.  That probably had
something to do with his mail reader, but it's not been resolved yet.

Otherwise, if you don't have time to figure out the nuances, don't
worry about those that don't make it through the parser.  There are
plenty that do.  A little reporting is better than none.

HTH

Miss Betsy



From MikeE at ster.invalid  Mon Dec  6 07:41:16 2004
From: MikeE at ster.invalid (Mike Easter)
Date: Mon Dec  6 10:45:03 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
References: <cov5fi$6ke$1@news.spamcop.net> <coval5$9df$1@news.spamcop.net>
	<covumb$m5e$1@news.spamcop.net> <cp03tm$poi$1@news.spamcop.net>
	<cp08m7$thh$1@news.spamcop.net> <cp0e0c$s0$1@news.spamcop.net>
	<cp1of4$pp7$3@news.spamcop.net> <cp1ruu$sff$1@news.spamcop.net>
	<cp1sml$t1i$1@news.spamcop.net>
Message-ID: <cp1uip$ua1$1@news.spamcop.net>

Jim Carroll wrote:
> Or maybe "just hit delete".

There's nothing wrong with deleting spams.

> This is a lot more trouble than it's worth.

My philosophy is that spam reporting should be 'secondary' to the
primary mission/s of the management of the Inbox.  That management
should be done in some way which is both secure and nonfrustrating, so
it would be best if there were no spam or viruses in the Inbox at all.

A mailuser agent mua like OE isn't 'designed' to be distinguishing spams
from nonspams by the human user eyeball reading spamsubjects and froms,
so ideally the spam would have been subject tagged with something like
SpamPal before they got to the mua.  Then, OE could mesage rule send all
of the spams to the Junk folder and end all of the spam's frustration
and 'contamination' and interference with the Inbox.

Only if the user felt like 'visiting' hir spam would s/he go to Junk.
If s/he wanted to be a spam reporter, s/he could.  If s/he just wanted
to mass delete all of the spam s/he could.  The annoyance of the spam
would be over.

Similarly I would configure OE to have a BigMail folder so that any
virms, including those missed by the AV agents of provider or other
would be corralled into there.


-- 
Mike Easter
kibitzer, not SC admin

From h9vzc2i02 at sneakemail.com  Mon Dec  6 08:17:06 2004
From: h9vzc2i02 at sneakemail.com (Anon_)
Date: Mon Dec  6 11:20:03 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
References: <cov5fi$6ke$1@news.spamcop.net> <coval5$9df$1@news.spamcop.net>
	<covumb$m5e$1@news.spamcop.net> <cp03tm$poi$1@news.spamcop.net>
	<cp08m7$thh$1@news.spamcop.net> <cp0e0c$s0$1@news.spamcop.net>
	<cp1of4$pp7$3@news.spamcop.net>
Message-ID: <cp20mg$vrh$1@news.spamcop.net>


"Jim Carroll" <dogworkings@DELETE.pobox.THIS.com> wrote in message
news:cp1of4$pp7$3@news.spamcop.net...
>
> "Mike Easter" <MikeE@ster.invalid> wrote in message
> news:cp0e0c$s0$1@news.spamcop.net...
> >
> > ... forget about the concept of 'attachments'.
> >
> > From a parser's point of view, there's no such thing as that.
> >
> > There's only headers and then everything else.
> >
> > Or, said yet another way, 'Attachments are not a problem.' in any way,
> > shape, or form.
>
> What I was saying, said another way, is that "forward as attachment" isn't
> working as it once did.
>
> I don't know if OE has changed as regards WHAT it forwards as an
attachment,

**
I'm still using oe and submitting as attachment - SC has been responding
correctly - so it appears that there has been no change in how SC handles
attachments.
**

<clip>

**
My submittals mentioned above sometimes contained spam with attachments -
those also worked OK.

--
A SpamCop user and forum reader,
Not Admin
***



From h9vzc2i02 at sneakemail.com  Mon Dec  6 08:28:14 2004
From: h9vzc2i02 at sneakemail.com (Anon_)
Date: Mon Dec  6 11:30:04 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
References: <cov5fi$6ke$1@news.spamcop.net> <coval5$9df$1@news.spamcop.net>
	<covumb$m5e$1@news.spamcop.net> <cp03tm$poi$1@news.spamcop.net>
	<cp08m7$thh$1@news.spamcop.net> <cp0e0c$s0$1@news.spamcop.net>
	<cp1of4$pp7$3@news.spamcop.net> <cp1ruu$sff$1@news.spamcop.net>
	<cp1sml$t1i$1@news.spamcop.net>
Message-ID: <cp21bc$h5$1@news.spamcop.net>


"Jim Carroll" <dogworkings@DELETE.pobox.THIS.com> wrote in message
news:cp1sml$t1i$1@news.spamcop.net...
>
> "Mike Easter" <MikeE@ster.invalid> wrote in message
> news:cp1ruu$sff$1@news.spamcop.net...
> > Further, if you are /not/ familiar with what is going on, you can simply
> > post the tracking url to this newsgroup so that we can use the tracker
> > to access what you fed the parser and see for ourselves what is going
> > on.
>
> Or maybe "just hit delete".
>
> Is there a way to donate my unused SpamCop privileges to a knowledgeable
> user?
>
> This is a lot more trouble than it's worth.
>
> I'm not as stupid as this thread has made me sound; I've been using
> computers since 1981.  But spam has kicked my ass and I'm about to give up
> trying to do something constructive about it.
>

**
HEY please bear with us and do not give up!!!!

We are all trying to help so when something asked is answered in an unclear
manner, just ask again or look at further posts - just because one poster's
response is muddy, do not assume all posts are going to be unclear.

Usually Mike Easter's responses are the best around.

--
A SpamCop user and forum reader,
Not Admin
***



From nobody at devnull.spamcop.net  Mon Dec  6 11:46:59 2004
From: nobody at devnull.spamcop.net (WazoO)
Date: Mon Dec  6 12:50:04 2004
Subject: [SC-Help] Re: Add mailhost not working quite right
References: <Xns95B75C98D21A8blarp@216.154.195.61>
Message-ID: <cp25uj$3nv$1@news.spamcop.net>

"Tom Geldner" <tom@blarpxx.com> wrote in message
news:Xns95B75C98D21A8blarp@216.154.195.61...
> This comes up when I paste the entire email into the Paste headers box.
>
> Sorry, SpamCop has encountered errors:
> Confirmation codes do not match:
>
> From recipient address: 9sDvHMpNySr3f9yi
> From header:            9sDvHMpNySr3f9yi
> From body:
>
> If I do it separately as headers and body, it will accept it.

  Per all the traffic over in the web-based Forum on your
scenario, you are dealing with white-space issues.  Of course,
I also thought that those probe e-mails had some silly sentence
in them about not making some data public ... but what do
I know?


From buzzard554 at fastmail.co.uk  Mon Dec  6 18:25:14 2004
From: buzzard554 at fastmail.co.uk (Martin Edwards)
Date: Mon Dec  6 13:25:03 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
In-Reply-To: <cp1tc8$tia$1@news.spamcop.net>
References: <cov5fi$6ke$1@news.spamcop.net> <coval5$9df$1@news.spamcop.net>
	<covumb$m5e$1@news.spamcop.net> <cp03tm$poi$1@news.spamcop.net>
	<cp08m7$thh$1@news.spamcop.net> <cp0e0c$s0$1@news.spamcop.net>
	<cp1of4$pp7$3@news.spamcop.net> <cp1ruu$sff$1@news.spamcop.net>
	<cp1sml$t1i$1@news.spamcop.net> <cp1tc8$tia$1@news.spamcop.net>
Message-ID: <cp2855$5bn$1@news.spamcop.net>

Miss Betsy wrote:
> 
> Otherwise, if you don't have time to figure out the nuances, don't
> worry about those that don't make it through the parser.  There are
> plenty that do.  A little reporting is better than none.
> 
> HTH
> 
> Miss Betsy
> 

Well, yeah, Miss Betsy.  Seems to me though that some of 'em feel 
sarcastic quite a lot.

From nobody at devnull.spamcop.net  Mon Dec  6 14:42:28 2004
From: nobody at devnull.spamcop.net (WazoO)
Date: Mon Dec  6 15:45:05 2004
Subject: [SC-Help] Re: Is this a valid Received: line?
References: <Xns95B7694A2890Eblarp@216.154.195.61>
Message-ID: <cp2g7h$a9d$1@news.spamcop.net>

"Tom Geldner" <tom@blarpxx.com> wrote in message
news:Xns95B7694A2890Eblarp@216.154.195.61...
> I am having trouble with SpamCop parsing my spam reports. It's started to
> complain that it can't determine the source. I suspect my ISP has changed
> the way they write headers but I don't know enough about this to really
> tell. Here are the received headers from a sample email. I've munged all
> the mail addresses -- the servers are the actual servers.

  Try providing a Tracking URL of one of these failed items.  Your
"sample" is hosed due to the vagaries of the manipulations used
to post it/read it 'here' .. and not enough data provided to waste
time trying to build a 'fake' spam to try to submit it ....


From nobody at spamcop.net  Mon Dec  6 16:44:14 2004
From: nobody at spamcop.net (Miss Betsy)
Date: Mon Dec  6 16:45:03 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
References: <cov5fi$6ke$1@news.spamcop.net> <coval5$9df$1@news.spamcop.net>
	<covumb$m5e$1@news.spamcop.net> <cp03tm$poi$1@news.spamcop.net>
	<cp08m7$thh$1@news.spamcop.net> <cp0e0c$s0$1@news.spamcop.net>
	<cp1of4$pp7$3@news.spamcop.net> <cp1ruu$sff$1@news.spamcop.net>
	<cp1sml$t1i$1@news.spamcop.net> <cp1tc8$tia$1@news.spamcop.net>
	<cp2855$5bn$1@news.spamcop.net>
Message-ID: <cp2jsc$d25$1@news.spamcop.net>


"Martin Edwards" <buzzard554@fastmail.co.uk> wrote in message
news:cp2855$5bn$1@news.spamcop.net...
> Miss Betsy wrote:
> >
> > Otherwise, if you don't have time to figure out the nuances, don't
> > worry about those that don't make it through the parser.  There are
> > plenty that do.  A little reporting is better than none.
> >
> > HTH
> >
> > Miss Betsy
> >
>
> Well, yeah, Miss Betsy.  Seems to me though that some of 'em feel
> sarcastic quite a lot.

That's just the way they talk.  When you talk to a mechanic about your
car, you don't get customer service type terms - they tell it like it
is (it's only good for parking in your yard and planting flowers in -
actual quote).  It's the same thing with the techies here.  They talk
to each other like that and don't get insulted so they don't quite
understand why posters do.  It's a whole lot 'friendlier' than when I
first started posting because there are more non-techs here, but they
still aren't talking to 'customers' - they are talking to 'peers'

I remember when people first started to ask for more politeness.  One
poster (an admin) was extremely angry because he was blocked.  The
exchange between him and admin posters was very acrimonious and full of
'personal' references.  Other posters tried to intervene with customer
service type posts, but were mainly ignored by the combatants.  At the
end, the original poster posted, "Been a real interesting discussion."
and went away satisfied.

Miss Betsy



From fredfighter at spamcop.net  Tue Dec  7 03:51:42 2004
From: fredfighter at spamcop.net (Fred the Red Shirt)
Date: Mon Dec  6 22:20:04 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
References: <cov5fi$6ke$1@news.spamcop.net>
Message-ID: <41B528CE.BDFDA64C@spamcop.net>



Jim Carroll wrote:

> Many of the spam messages that flood my inbox have no "body" per se, just an
> attachment.
>

Many of mine have no body and no attachment.  They look like maybe dumb
attempts to check the validity of harvested address lists.

Regardless, I type the word "BLANK." in the body and submit it.

I do not consider that to be a material alteration of the spam.

--

FF


From fredfighter at spamcop.net  Tue Dec  7 04:05:15 2004
From: fredfighter at spamcop.net (Fred the Red Shirt)
Date: Mon Dec  6 22:30:02 2004
Subject: [SC-Help] Re: Political unsolicited email?
References: <cj6q74$utc$1@news.spamcop.net>
Message-ID: <41B52BFB.B7168D77@spamcop.net>



Jim Wasson wrote:

> I just reported a political e-mail that was sent to me "because you are
> registered to vote in the state ..."  I have reported maybe two or three
> like this in the past. Personally I consider these to be spam.
>

I define spam as unsolicted bulk email without regard to content.  I report
as _probable_ spam, unsolicted email that I _presume_ to be bulk.

It doesn't matter to me if it is political, commercial, promotional,
religious,
or absolute nonsense.   I do get a fair bit of spam with indeterminate
content
becuase I cannot read it for any of a variety of reasons.   I get a lot more

that I do not read becuase I am confident that it is unsolicited bulk email
from the subject line and from: header alone.

Political spam may be exempt from (they) CAN SPAM (you) as are many
other spams.  I don't care, I don't have to care, after all, I'm not an AG,
so (they) CAN SPAM (you) is totally irrelevant to me.

Neither, AFAIK, does SpamCop nor do users of the SCBL care about
other definitions or legal exemptions.   Nor should any of us.

--

FF





From fredfighter at spamcop.net  Tue Dec  7 04:22:01 2004
From: fredfighter at spamcop.net (Fred the Red Shirt)
Date: Mon Dec  6 22:50:03 2004
Subject: [SC-Help] Does SpamCop Whitelisting ever work?
Message-ID: <41B52FE9.69DA57D5@spamcop.net>

I've "Released and Whitelisted" the same four emails, all of them are
SpamCop
spam reports, about a dozen times over the last week or two.  They keep
going
back to my "Held Mail" directory.  Is this something that should be
reported, or
is it a bug that has been ignored for a long time now?  Or both?  };-)

Here are example headers:

Date:    Tue, 30 Nov 2004 18:01:17 -0500 [2004-11-30 11:01PM GMT]
Delivered-To:   spamcop-net-fredfighter@spamcop.net
From:   Fred <1303929294@reports.spamcop.net>
Message-ID:   <rid_1303929294@msgid.spamcop.net>
Precedence:   list
Received:

    * (qmail 24820 invoked from network); 1 Dec 2004 15:29:37 -0000
    * from unknown (192.168.1.103) by blade4.cesmail.net with QMQP; 1
Dec 2004 15:29:37 -0000
    * from vmx2.spamcop.net (64.74.133.250) by mailgate2.cesmail.net
with SMTP; 1 Dec 2004 15:29:37 -0000
    * from sc-app3.eq.ironport.com (HELO spamcop.net) (192.168.19.203)
by vmx2.spamcop.net with SMTP; 01 Dec 2004 07:29:37 -0800
    * from [4.159.77.15] by spamcop.net with HTTP; Wed, 01 Dec 2004
15:29:37 GMT

Return-Path:   <1303929294@bounces.spamcop.net>
Subject:   [SpamCop (66.131.9.73) id:1303929294]christmass sale _ MS
Streets and Trips 2004
To:   fredfighter@spamcop.net
X-Mailer:   Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt; JUNO)
via http://www.spamcop.net/ v1.389
X-Spam-Checker-Version:   SpamAssassin 3.0.0 (2004-09-13) on blade4
X-Spam-Level:
X-Spam-Status:   hits=-78.8
tests=BIZ_TLD,FORGED_MUA_MOZILLA,FORGED_RCVD_HELO,
FROM_ENDS_IN_NUMS,LONGWORDS,SARE_OEM_PRODS_1,SARE_OEM_PRODS_2,
SARE_OEM_PRODS_3,SARE_OEM_PRODS_FEW,SARE_PRODS_LOTS,SARE_PRODUCTS_02,
SARE_PRODUCTS_03,SARE_PRODUCTS_04,URIBL_OB_SURBL,URIBL_SBL,
URIBL_SC_SURBL,URIBL_WS_SURBL,USER_IN_WHITELIST version=3.0.0
X-SpamCop-Checked:   192.168.1.103 64.74.133.250 192.168.19.203
4.159.77.15
X-SpamCop-Disposition:   Blocked dnsbl.sorbs.net
X-SpamCop-Whitelisted:   spamcop.net
X-SpamCop-sourceip:   66.131.9.73

I also have a filter rule that is supposed to catch these reports, it is
also being
superceded, evidently, by my use of teh sorbs blacklist.

BTW, doesn't this also mean that a SpamCop IP is on the sorbs blacklist?

What's up with that?

--

FF

From nobody at devnull.spamcop.net  Mon Dec  6 22:17:19 2004
From: nobody at devnull.spamcop.net (WazoO)
Date: Mon Dec  6 23:20:02 2004
Subject: [SC-Help] Re: Does SpamCop Whitelisting ever work?
References: <41B52FE9.69DA57D5@spamcop.net>
Message-ID: <cp3asf$rku$1@news.spamcop.net>

"Fred the Red Shirt" <fredfighter@spamcop.net> wrote in message
news:41B52FE9.69DA57D5@spamcop.net...
> X-SpamCop-Checked:   192.168.1.103 64.74.133.250 192.168.19.203
> 4.159.77.15
> X-SpamCop-Disposition:   Blocked dnsbl.sorbs.net
> X-SpamCop-Whitelisted:   spamcop.net
> X-SpamCop-sourceip:   66.131.9.73
>
> I also have a filter rule that is supposed to catch these reports, it is
> also being superceded, evidently, by my use of teh sorbs blacklist.
>
> BTW, doesn't this also mean that a SpamCop IP is on the sorbs blacklist?
>
> What's up with that?

For starters, you need to learn to use your tools a bit better.
You chose not to use a Tracking URL, so everyone else is
stuck having to work around all the issues of what you are
describing, what you saw, what you think you copied,
what actually made the transition to 'here', and the final
what really is displayed here on others' screens.

  For instance, I was disbelieving that the decision point on
your sample was 192.168.19.203 .. but then I noticed the
bad line-wraps ... so the decision point was actually made
on the IP 4.159.77.15 .. which is the IP listed on sorbs ...

  At that point, I decided to simply suggest that you'd
probably be better off taking your query to either the
spamcop.mail newsgroup of over to the web-based
Forum for perhaps a better / quicker answer from
other SpamCop E-Mail account users.  I know for a
fact that there are a number of entries on this over in
the web-based Forum version of the FAQ.


From Kilgallen at SpamCop.net  Tue Dec  7 07:42:49 2004
From: Kilgallen at SpamCop.net (Larry Kilgallen)
Date: Tue Dec  7 08:45:02 2004
Subject: [SC-Help] Re: Political unsolicited email?
References: <cj6q74$utc$1@news.spamcop.net> <41B52BFB.B7168D77@spamcop.net>
Message-ID: <ZAxNNnJQzlrp@eisner.encompasserve.org>

In article <41B52BFB.B7168D77@spamcop.net>, Fred the Red Shirt <fredfighter@spamcop.net> writes:
> 
> 
> Jim Wasson wrote:
> 
>> I just reported a political e-mail that was sent to me "because you are
>> registered to vote in the state ..."  I have reported maybe two or three
>> like this in the past. Personally I consider these to be spam.
>>
> 
> I define spam as unsolicted bulk email without regard to content.  I report
> as _probable_ spam, unsolicted email that I _presume_ to be bulk.

The next step is done by SpamCop, which only lists in the DNSbl after
evidence of bulk.
From tjtmdREMOVE_THIS at attglobal.net  Tue Dec  7 10:07:41 2004
From: tjtmdREMOVE_THIS at attglobal.net (Tanya)
Date: Tue Dec  7 10:35:04 2004
Subject: [SC-Help] help stopping spammer -- please advise
Message-ID: <41B5C73D.D5A6D95B@attglobal.net>

hello,
i am getting bombarded by porn and have been reporting it to uce@ftc.gov
and spamCop and it seems to have multiplied!
(at least 5 per day -- <it seems> from the same source)
when i click on the webSite where "Administrator of network hosting
website referenced in spam" even though it has a number of characters
the email address reduces to my isp (postmaster@myISP.net) ALWAYS
(however sometimes it only has anti-spam not postmaster)
anti-spam@myISP.net)
(also sometimes under the originating isp)
none of the other spams have this (very rarely do they refer to my isp)
NOTHING like a sig. file is in the body of the messages that i send

here is the tracking url (fwiw)
http://www.spamcop.net/sc?id=z700151331z4e249db60f7fe4cce7232b313ea4e41bz

please advise


From Kilgallen at SpamCop.net  Tue Dec  7 09:46:48 2004
From: Kilgallen at SpamCop.net (Larry Kilgallen)
Date: Tue Dec  7 10:50:03 2004
Subject: [SC-Help] Technical details even though they are disabled
Message-ID: <Vneh7Cm4hdwn@eisner.encompasserve.org>

After a bad parse, Julian suggested I turn on Mailhosts.

I have done that, but now every parse seems to show technical details,
even though I have Simple Output set in my preferences.

Has anyone else encountered this ?

Does anyone know a solution ?
From MikeE at ster.invalid  Tue Dec  7 10:40:25 2004
From: MikeE at ster.invalid (Mike Easter)
Date: Tue Dec  7 13:45:02 2004
Subject: [SC-Help] Re: help stopping spammer -- please advise
References: <41B5C73D.D5A6D95B@attglobal.net>
Message-ID: <cp4teg$tst$1@news.spamcop.net>

Tanya wrote:
> i am getting bombarded by porn and have been reporting it to
> uce@ftc.gov and spamCop and it seems to have multiplied!

As a general rule, notifying for spam does not do anything directly to
reduce the spam.  The FTC is busy doing whatever it is the FTC does, but
merely 'accumulates' spams at their uce address, and SpamCop notifies
contribute to the SCbl for spamsource, generally open proxies, and
publicize spamvertisers for the sc-surbl lists - while notifying the
spamsource providers and spamvertiser providers so they can do with that
information what they like.

> (at least 5 per day -- <it seems> from the same source)
> when i click on the webSite

When you do /what/?  I'm not clear on those words you said.  Does that
say that you are clicking on the spamvertised website?  Or are you
saying that you are checking the spamcop form to notify for the
spamvertiser?

> where "Administrator of network hosting
> website referenced in spam" even though it has a number of characters
> the email address reduces to my isp (postmaster@myISP.net) ALWAYS
> (however sometimes it only has anti-spam not postmaster)
> anti-spam@myISP.net)
> (also sometimes under the originating isp)
> none of the other spams have this (very rarely do they refer to my
> isp) NOTHING like a sig. file is in the body of the messages that i
> send

I'm not understanding any part of that part of the par.

spamcop.net/sc?id=z700151331z4e249db60f7fe4cce7232b313ea4e41bz

That is a live tracker [you should report or cancel it] for a porn spam
sourced at a .cn provider which SC wants to notify for and a
ptolemaeus.info spamvertiser site which is also at a .cn provider which
SC wants to notify.

Inside the spam are URLs and links to graphics.  One link I checked is
redirected to a 'remove' at
http://4.78.57.78/ptolemaeus.info/b9a1a4d40a8891c3a6b510d8d/remove.php

4.78.57.78 no rDNS is spews S1660 listed as the /23

1, 4.78.22.0/23, Level3 (Bruce Louis Goldberg / adult.foxcounter.com /
vh3.techiemedia.net)

and whose provider structure is

whois -h whois.arin.net 4.78.57.78 ...
Level 3 Communications, Inc 4.0.0.0 - 4.255.255.255
Co-Location.com Inc.  4.78.56.0 - 4.78.57.255


-- 
Mike Easter
kibitzer, not SC admin

From nobody at spamcop.net  Tue Dec  7 14:06:31 2004
From: nobody at spamcop.net (Ellen)
Date: Tue Dec  7 14:10:03 2004
Subject: [SC-Help] Re: Technical details even though they are disabled
References: <Vneh7Cm4hdwn@eisner.encompasserve.org>
Message-ID: <cp4uvc$v02$2@news.spamcop.net>


"Larry Kilgallen" <Kilgallen@SpamCop.net> wrote in message
news:Vneh7Cm4hdwn@eisner.encompasserve.org...
> After a bad parse, Julian suggested I turn on Mailhosts.
>
> I have done that, but now every parse seems to show technical details,
> even though I have Simple Output set in my preferences.
>
> Has anyone else encountered this ?
>
> Does anyone know a solution ?

Yes you get details once you have mailhosts set up and no I don't think
there is a solution. What bothers you about it?

Ellen


From Kilgallen at SpamCop.net  Tue Dec  7 13:16:58 2004
From: Kilgallen at SpamCop.net (Larry Kilgallen)
Date: Tue Dec  7 14:20:03 2004
Subject: [SC-Help] Re: Technical details even though they are disabled
References: <Vneh7Cm4hdwn@eisner.encompasserve.org>
	<cp4uvc$v02$2@news.spamcop.net>
Message-ID: <mKCI4JQtoRHQ@eisner.encompasserve.org>

In article <cp4uvc$v02$2@news.spamcop.net>, "Ellen" <nobody@spamcop.net> writes:
> 
> "Larry Kilgallen" <Kilgallen@SpamCop.net> wrote in message
> news:Vneh7Cm4hdwn@eisner.encompasserve.org...
>> After a bad parse, Julian suggested I turn on Mailhosts.
>>
>> I have done that, but now every parse seems to show technical details,
>> even though I have Simple Output set in my preferences.
>>
>> Has anyone else encountered this ?
>>
>> Does anyone know a solution ?
> 
> Yes you get details once you have mailhosts set up and no I don't think
> there is a solution. What bothers you about it?

The checkboxes are off the screen and I have to scroll to get to them.

I would not care if the stuff of no interest to me were at the bottom.
From nobody at spamcop.net  Tue Dec  7 14:22:45 2004
From: nobody at spamcop.net (Ellen)
Date: Tue Dec  7 14:25:04 2004
Subject: [SC-Help] Re: Technical details even though they are disabled
References: <Vneh7Cm4hdwn@eisner.encompasserve.org>
	<cp4uvc$v02$2@news.spamcop.net> <mKCI4JQtoRHQ@eisner.encompasserve.org>
Message-ID: <cp4vsd$vr8$1@news.spamcop.net>


"Larry Kilgallen" <Kilgallen@SpamCop.net> wrote in message
news:mKCI4JQtoRHQ@eisner.encompasserve.org...
> >
>
> The checkboxes are off the screen and I have to scroll to get to them.
>
> I would not care if the stuff of no interest to me were at the bottom.

Ah - use a smaller font?

Ellen


From Kilgallen at SpamCop.net  Tue Dec  7 14:13:05 2004
From: Kilgallen at SpamCop.net (Larry Kilgallen)
Date: Tue Dec  7 15:15:01 2004
Subject: [SC-Help] Re: Technical details even though they are disabled
References: <Vneh7Cm4hdwn@eisner.encompasserve.org>
	<cp4uvc$v02$2@news.spamcop.net> <mKCI4JQtoRHQ@eisner.encompasserve.org>
	<cp4vsd$vr8$1@news.spamcop.net>
Message-ID: <YwWOHO0iDlyc@eisner.encompasserve.org>

In article <cp4vsd$vr8$1@news.spamcop.net>, "Ellen" <nobody@spamcop.net> writes:
> 
> "Larry Kilgallen" <Kilgallen@SpamCop.net> wrote in message
> news:mKCI4JQtoRHQ@eisner.encompasserve.org...
>> >
>>
>> The checkboxes are off the screen and I have to scroll to get to them.
>>
>> I would not care if the stuff of no interest to me were at the bottom.
> 
> Ah - use a smaller font?

You should insert a smiley when writing a joke.

Just as a test, I changed my browser font size from 14 points to
6 points (not that I could read the text associated with the boxes
at that size) and the following text still did not fit in one screenful.

Does it on any screen you read with ?

====================================================

Spam Header
Here is your TRACKING URL - it may be saved for future reference:
http://www.spamcop.net/sc?id=z700231063z6585b1175764f05062bbadf649068a32z
0: Received: from unknown (192.168.1.103) by blade4.cesmail.net with QMQP; 7 Dec 2004 19:30:46 -0000
Internal handoff at SpamCop

1: Received: from unknown (HELO emailgateway) (64.80.57.137) by mailgate2.cesmail.net with SMTP; 7 Dec 2004 19:30:45 -0000
No unique hostname found for source: 64.80.57.137
SpamCop received mail from SpamCop ( 64.80.57.137 )

2: Received: from bdcserver.sales ([192.168.100.14]) by emailgateway with Microsoft SMTPSVC(5.0.2195.6713); Tue, 7 Dec 2004 14:23:29 -0500
Internal handoff at SpamCop

Tracking message source: 64.80.57.137:
Routing details for 64.80.57.137
[refresh/show] Cached whois for 64.80.57.137 : ipadmin@paetec.com
Using best contacts abuse@paetec.com
Yum, this spam is fresh!
Message is 0 hours old
64.80.57.137 not listed in dnsbl.njabl.org
64.80.57.137 not listed in dnsbl.njabl.org
64.80.57.137 not listed in cbl.abuseat.org
64.80.57.137 not listed in dnsbl.sorbs.net
64.80.57.137 not listed in relays.ordb.org.
64.80.57.137 not listed in query.bondedsender.org
64.80.57.137 not listed in iadb.isipp.com
Finding links in message body
Recurse multipart:
   Recurse multipart:
      Parsing text part
      Parsing HTML part
   Ignored image/gif part
   Ignored image/gif part
Resolving link obfuscation
http://www.computerclearinghouse.com/
   host 128.121.175.102 (getting name) = www.computerclearinghouse.com.
http://www.computerclearinghouse.com
   host 128.121.175.102 = www.computerclearinghouse.com (cached)
Tracking link: http://www.computerclearinghouse.com/
[report history]
Resolves to 128.121.175.102
Routing details for 128.121.175.102
[refresh/show] Cached whois for 128.121.175.102 : ip@wh.verio.net
Using best contacts abuse@verio.net
Tracking link: http://www.computerclearinghouse.com
[report history]
ISP believes this issue is resolved http://www.computerclearinghouse.com
Resolves to 128.121.175.102
Routing details for 128.121.175.102
[refresh/show] Cached whois for 128.121.175.102 : ip@wh.verio.net
Using best contacts abuse@verio.net
ISP has already taken action against the account:http://www.computerclearinghouse.com
http://www.computerclearinghouse.com has been appealed previously.

From MikeE at ster.invalid  Tue Dec  7 13:16:42 2004
From: MikeE at ster.invalid (Mike Easter)
Date: Tue Dec  7 16:20:03 2004
Subject: [SC-Help] Re: Is this a valid Received: line?
References: <Xns95B7694A2890Eblarp@216.154.195.61>
	<cp2g7h$a9d$1@news.spamcop.net> <Xns95B88201A645Ablarp@216.154.195.61>
Message-ID: <cp56jh$50f$1@news.spamcop.net>

Tom Geldner wrote:
> "WazoO"

>>   Try providing a Tracking URL of one of these failed items.  Your
>> "sample" is hosed due to the vagaries of the manipulations used
>> to post it/read it 'here' .. and not enough data provided to waste
>> time trying to build a 'fake' spam to try to submit it ....
>
> My sample was supplied simply to ask if the received line was a
> normal RFC- compliant line. That should be evident to people who know
> those things.

No, your original 'question' was:

Tom Geldner wrote:
> I am having trouble with SpamCop parsing my spam reports. It's
> started to complain that it can't determine the source.

and that is an excellent place to start discussing the issue.

The business about whatall happens in the Received tracelines is myriad,
and the parser has a number of different strategies for coping with that
mischief.

What really matters here is how SC handles the condition, not what an
'optimal' or RFC compliant header should look like.

In this case, if we only look at the topline:

  Received: from boogabooga by juliet.affordablehost.com with
local-bsmtp (Exim 4.43) id 1Ca24e-00050b-IM for me@mydomain.yes; Thu, 02
Dec 2004 20:17:29 -0500

... we see it in the format

Received: from helo by your.affordable somestuff datestamp

That is non-compliant because it lacks an IP in the 'from' field.  But
it doesn't necessarily matter.  The parser can skip that line and go to
the next one.

  Received: from [216.207.37.198] (helo=smtp1.plextor.com) by
juliet.affordablehost.com with smtp (Exim 4.43) id 1Ca24e-0005Xn-Bx for
me@mydomain.yes; Thu, 02 Dec 2004 20:17:28 -0500

... which is in the format

Received: from [source.ip](helo) by your.affordable somestuff datestamp

But, in this case 216.207.37.198  rDNS
216-207-37-198.dia.cust.qwest.net   which is a dynamic qwest IP and not
a plextor server - so that is the 'first sign of bogosity' which is a
good place to break a chain, so it is likely that the SC parser would
break the chain there before it got to the next line

  Received: from smtp.plextor.com ([192.168.32.8]) by smtp1.plextor.com
with Microsoft  SMTPSVC(6.0.3790.211); Thu, 2 Dec 2004 17:16:38 -0800

....which is in the format

Received: from rDNS ([source.ip]) by aserver.domain somestuff datestamp

which is bogus and trying to show an internal plextor transaction.

So, the point is more about the *reality* of what a particular item
actually sez than a theoretical discussion of what a Received traceline
/should/ look like.

For that reason, it is better to post a specific tracker and talk about
that one item, than the theory of headers and Received lines.


-- 
Mike Easter
kibitzer, not SC admin

From MikeE at ster.invalid  Tue Dec  7 13:36:44 2004
From: MikeE at ster.invalid (Mike Easter)
Date: Tue Dec  7 16:40:03 2004
Subject: [SC-Help] Re: Is this a valid Received: line?
References: <Xns95B7694A2890Eblarp@216.154.195.61>
	<cp2g7h$a9d$1@news.spamcop.net> <Xns95B88201A645Ablarp@216.154.195.61>
	<cp56jh$50f$1@news.spamcop.net>
Message-ID: <cp57p3$62s$1@news.spamcop.net>

Mike Easter wrote:
>   Received: from [216.207.37.198] (helo=smtp1.plextor.com) by
> juliet.affordablehost.com with smtp (Exim 4.43) id 1Ca24e-0005Xn-Bx
> for me@mydomain.yes; Thu, 02 Dec 2004 20:17:28 -0500
>
> ... which is in the format
>
> Received: from [source.ip](helo) by your.affordable somestuff
> datestamp
>
> But, in this case 216.207.37.198  rDNS
> 216-207-37-198.dia.cust.qwest.net   which is a dynamic qwest IP and
> not a plextor server - so that is the 'first sign of bogosity' which
> is a good place to break a chain, so it is likely that the SC parser
> would break the chain there before it got to the next line

I'm still messing with this;  as it is possible that 'someone' is using
a dynamic qwest IP as a server for the plextor.com domain.  It is also
possible for all the headerlines under the top one to be bogus and for
the topone to be problematically non-compliant.

dns plextor.com
Mail for plextor.com is handled by smtp1.plextor.com
Canonical name: plextor.com
Addresses:
  206.173.5.186

smtp1.plextor.com  DNS  216.207.37.198
216.207.37.198  rDNS  216-207-37-198.dia.cust.qwest.net

... so then that would allow me to continue to chain past the dynamic
qwest IP to the next line

And the next line looks like an internal one for plextor;  so maybe we
are looking at some incomplete headers of something or other

If all of the headerlines are bogus but the top one, then it would be
essential for the server at affordablehost to be reporting the source
IP.

dns affordablehost.com
Mail for affordablehost.com is handled by apple.affordablehost.com
apple.affordablehost.com
Canonical name: affordablehost.com
Addresses:
  12.164.25.254

apple.affordablehost.com  DNS  216.46.192.60



-- 
Mike Easter
kibitzer, not SC admin

From nobody at spamcop.net  Tue Dec  7 17:11:14 2004
From: nobody at spamcop.net (Ellen)
Date: Tue Dec  7 17:15:04 2004
Subject: [SC-Help] Re: Technical details even though they are disabled
References: <Vneh7Cm4hdwn@eisner.encompasserve.org>
	<cp4uvc$v02$2@news.spamcop.net> <mKCI4JQtoRHQ@eisner.encompasserve.org>
	<cp4vsd$vr8$1@news.spamcop.net> <YwWOHO0iDlyc@eisner.encompasserve.org>
Message-ID: <cp59ol$7hp$1@news.spamcop.net>


"Larry Kilgallen" <Kilgallen@SpamCop.net> wrote in message
news:YwWOHO0iDlyc@eisner.encompasserve.org...
> In article <cp4vsd$vr8$1@news.spamcop.net>, "Ellen" <nobody@spamcop.net>
writes:
> >
> > Ah - use a smaller font?

:-)


>
> You should insert a smiley when writing a joke.
>
> Just as a test, I changed my browser font size from 14 points to
> 6 points (not that I could read the text associated with the boxes
> at that size) and the following text still did not fit in one screenful.
>
> Does it on any screen you read with ?
>

Very honestly it has been so long -- years actually -- since I saw a parse
with technical details turned off that I have no idea what shows up with
them off. Just the tracking url and the checkboxes? I'll set up an account
later and rustle up a spam to parse ....

Ellen


From johnl at spamcop.net  Tue Dec  7 22:14:24 2004
From: johnl at spamcop.net (JohnL)
Date: Tue Dec  7 17:15:11 2004
Subject: [SC-Help] Re: Technical details even though they are disabled
References: <Vneh7Cm4hdwn@eisner.encompasserve.org>
	<cp4uvc$v02$2@news.spamcop.net> <mKCI4JQtoRHQ@eisner.encompasserve.org>
	<cp4vsd$vr8$1@news.spamcop.net> <YwWOHO0iDlyc@eisner.encompasserve.org>
	<cp59ol$7hp$1@news.spamcop.net>
Message-ID: <Xns95B89B07E985Djohnlspamcopnet@216.154.195.61>

"Ellen" <nobody@spamcop.net> wrote in
news:cp59ol$7hp$1@news.spamcop.net: 

> Very honestly it has been so long -- years actually -- since I saw a
> parse with technical details turned off that I have no idea what shows
> up with them off. Just the tracking url and the checkboxes? I'll set
> up an account later and rustle up a spam to parse ....
> 
> Ellen

Can't you just click on the "Skip to Reports" link?
From Kilgallen at SpamCop.net  Tue Dec  7 16:18:20 2004
From: Kilgallen at SpamCop.net (Larry Kilgallen)
Date: Tue Dec  7 17:20:02 2004
Subject: [SC-Help] Re: Technical details even though they are disabled
References: <Vneh7Cm4hdwn@eisner.encompasserve.org>
	<cp4uvc$v02$2@news.spamcop.net> <mKCI4JQtoRHQ@eisner.encompasserve.org>
	<cp4vsd$vr8$1@news.spamcop.net> <YwWOHO0iDlyc@eisner.encompasserve.org>
	<cp59ol$7hp$1@news.spamcop.net>
	<Xns95B89B07E985Djohnlspamcopnet@216.154.195.61>
Message-ID: <FJEyc7Q+SpcZ@eisner.encompasserve.org>

In article <Xns95B89B07E985Djohnlspamcopnet@216.154.195.61>, JohnL <johnl@spamcop.net> writes:
> "Ellen" <nobody@spamcop.net> wrote in
> news:cp59ol$7hp$1@news.spamcop.net: 
> 
>> Very honestly it has been so long -- years actually -- since I saw a
>> parse with technical details turned off that I have no idea what shows
>> up with them off. Just the tracking url and the checkboxes? I'll set
>> up an account later and rustle up a spam to parse ....
>> 
>> Ellen
> 
> Can't you just click on the "Skip to Reports" link?

Neither I nor the Netscape Search command find any such text
on the reporting page.
From johnl at spamcop.net  Tue Dec  7 22:26:27 2004
From: johnl at spamcop.net (JohnL)
Date: Tue Dec  7 17:30:02 2004
Subject: [SC-Help] Re: Technical details even though they are disabled
References: <Vneh7Cm4hdwn@eisner.encompasserve.org>
	<cp4uvc$v02$2@news.spamcop.net> <mKCI4JQtoRHQ@eisner.encompasserve.org>
	<cp4vsd$vr8$1@news.spamcop.net> <YwWOHO0iDlyc@eisner.encompasserve.org>
	<cp59ol$7hp$1@news.spamcop.net>
	<Xns95B89B07E985Djohnlspamcopnet@216.154.195.61>
	<FJEyc7Q+SpcZ@eisner.encompasserve.org>
Message-ID: <Xns95B89D12EE434johnlspamcopnet@216.154.195.61>

Kilgallen@SpamCop.net (Larry Kilgallen) wrote in
news:FJEyc7Q+SpcZ@eisner.encompasserve.org: 

> In article <Xns95B89B07E985Djohnlspamcopnet@216.154.195.61>, JohnL
> <johnl@spamcop.net> writes: 
>> Can't you just click on the "Skip to Reports" link?
> 
> Neither I nor the Netscape Search command find any such text
> on the reporting page.
> 

Hmm, need to check, maybe it needs JavaScript enabled.
Let me try it with "your choice" of it disabled. ;-)
From MikeE at ster.invalid  Tue Dec  7 14:33:02 2004
From: MikeE at ster.invalid (Mike Easter)
Date: Tue Dec  7 17:35:03 2004
Subject: [SC-Help] Re: Is this a valid Received: line?
References: <Xns95B7694A2890Eblarp@216.154.195.61>
Message-ID: <cp5b2k$8kl$1@news.spamcop.net>

Tom Geldner wrote:
> Received: from boogabooga by juliet.affordablehost.com

> To my untrained eye, the first Received line does not look parsable
> since it's showing an internal relay FROM a user account (boogabooga)
> TO the server that user account resides on. Would this cause SC to
> choke?

Disregarding spamcop or the path of the mailitem in question, but just
'chatting' about what we think of how juliet.affordablehost.com handles
that particular one line in isolation, it would be more compliant if it
stamped its 'from' field with the source IP and the rDNS and the helo.

But, there's another juliet.affordablehost.com line, the top one sez:

    by juliet.affordablehost.com with local-bsmtp

whereas the 2nd one sez

    by juliet.affordablehost.com with esmtp

and they are both 'driving' Exim 4.43

The top one's 'from' field doesn't have much in it;  whereas the 2nd
one's 'from' field has

  from [216.207.37.198] (helo=smtp1.plextor.com)

which on re-analysis would make sense, because plextor's mx is that IP
and name.


If the top line is/were the only truthful line, and all of the rest is
bogus, then the top line is doing a bad job by not telling the IP of its
source.  OTOH, if the topline is just part of the internal handling by
juliet, then it doesn't matter, because it has the situation 'covered'
by the 2nd line underneath.

It is really *really* much better to talk about a real item, and a
complete item, than to talk about pieces of headers in theory.  There's
a lot of talk and not much substance;  whereas it would be better if
there were actual substance, so there wouldn't have to be as much
'useless' talk.

Sometimes I don't even bother to discuss partial headers, they are such
a pain.


-- 
Mike Easter
kibitzer, not SC admin

From Kilgallen at SpamCop.net  Tue Dec  7 16:34:01 2004
From: Kilgallen at SpamCop.net (Larry Kilgallen)
Date: Tue Dec  7 17:35:06 2004
Subject: [SC-Help] Re: Technical details even though they are disabled
References: <Vneh7Cm4hdwn@eisner.encompasserve.org>
	<cp4uvc$v02$2@news.spamcop.net> <mKCI4JQtoRHQ@eisner.encompasserve.org>
	<cp4vsd$vr8$1@news.spamcop.net> <YwWOHO0iDlyc@eisner.encompasserve.org>
	<cp59ol$7hp$1@news.spamcop.net>
	<Xns95B89B07E985Djohnlspamcopnet@216.154.195.61>
	<FJEyc7Q+SpcZ@eisner.encompasserve.org>
	<Xns95B89D12EE434johnlspamcopnet@216.154.195.61>
Message-ID: <GZZWi1f6uazJ@eisner.encompasserve.org>

In article <Xns95B89D12EE434johnlspamcopnet@216.154.195.61>, JohnL <johnl@spamcop.net> writes:
> Kilgallen@SpamCop.net (Larry Kilgallen) wrote in
> news:FJEyc7Q+SpcZ@eisner.encompasserve.org: 
> 
>> In article <Xns95B89B07E985Djohnlspamcopnet@216.154.195.61>, JohnL
>> <johnl@spamcop.net> writes: 
>>> Can't you just click on the "Skip to Reports" link?
>> 
>> Neither I nor the Netscape Search command find any such text
>> on the reporting page.
>> 
> 
> Hmm, need to check, maybe it needs JavaScript enabled.
> Let me try it with "your choice" of it disabled. ;-)

Certainly implementing such a feature does not require JavaScript,
but the one you are seeing might have been implemented the hard way.

There is some question, however, as to whether we are talking about
the same thing - reporting from a username where "Technical Details"
are _disabled_, right ?
From johnl at spamcop.net  Tue Dec  7 22:35:29 2004
From: johnl at spamcop.net (JohnL)
Date: Tue Dec  7 17:40:02 2004
Subject: [SC-Help] Re: Technical details even though they are disabled
References: <Vneh7Cm4hdwn@eisner.encompasserve.org>
	<cp4uvc$v02$2@news.spamcop.net> <mKCI4JQtoRHQ@eisner.encompasserve.org>
	<cp4vsd$vr8$1@news.spamcop.net> <YwWOHO0iDlyc@eisner.encompasserve.org>
	<cp59ol$7hp$1@news.spamcop.net>
	<Xns95B89B07E985Djohnlspamcopnet@216.154.195.61>
	<FJEyc7Q+SpcZ@eisner.encompasserve.org>
	<Xns95B89D12EE434johnlspamcopnet@216.154.195.61>
	<GZZWi1f6uazJ@eisner.encompasserve.org>
Message-ID: <Xns95B89E9B4B0E6johnlspamcopnet@216.154.195.61>

Kilgallen@SpamCop.net (Larry Kilgallen) wrote in 
news:GZZWi1f6uazJ@eisner.encompasserve.org:

> There is some question, however, as to whether we are talking about
> the same thing - reporting from a username where "Technical Details"
> are _disabled_, right ?

No, this is with them enabled.
I thought that's what you had now.
From Kilgallen at SpamCop.net  Tue Dec  7 16:42:59 2004
From: Kilgallen at SpamCop.net (Larry Kilgallen)
Date: Tue Dec  7 17:45:02 2004
Subject: [SC-Help] Re: Technical details even though they are disabled
References: <Vneh7Cm4hdwn@eisner.encompasserve.org>
	<cp4uvc$v02$2@news.spamcop.net> <mKCI4JQtoRHQ@eisner.encompasserve.org>
	<cp4vsd$vr8$1@news.spamcop.net> <YwWOHO0iDlyc@eisner.encompasserve.org>
	<cp59ol$7hp$1@news.spamcop.net>
	<Xns95B89B07E985Djohnlspamcopnet@216.154.195.61>
	<FJEyc7Q+SpcZ@eisner.encompasserve.org>
	<Xns95B89D12EE434johnlspamcopnet@216.154.195.61>
	<GZZWi1f6uazJ@eisner.encompasserve.org>
	<Xns95B89E9B4B0E6johnlspamcopnet@216.154.195.61>
Message-ID: <1OPEHPZbx6Io@eisner.encompasserve.org>

In article <Xns95B89E9B4B0E6johnlspamcopnet@216.154.195.61>, JohnL <johnl@spamcop.net> writes:
> Kilgallen@SpamCop.net (Larry Kilgallen) wrote in 
> news:GZZWi1f6uazJ@eisner.encompasserve.org:
> 
>> There is some question, however, as to whether we are talking about
>> the same thing - reporting from a username where "Technical Details"
>> are _disabled_, right ?
> 
> No, this is with them enabled.
> I thought that's what you had now.

No.

By enabling technical details I could get even more of what I don't want :-)
From johnl at spamcop.net  Tue Dec  7 22:45:19 2004
From: johnl at spamcop.net (JohnL)
Date: Tue Dec  7 17:50:02 2004
Subject: [SC-Help] Re: Technical details even though they are disabled
References: <Vneh7Cm4hdwn@eisner.encompasserve.org>
	<cp4uvc$v02$2@news.spamcop.net> <mKCI4JQtoRHQ@eisner.encompasserve.org>
	<cp4vsd$vr8$1@news.spamcop.net> <YwWOHO0iDlyc@eisner.encompasserve.org>
	<cp59ol$7hp$1@news.spamcop.net>
	<Xns95B89B07E985Djohnlspamcopnet@216.154.195.61>
	<FJEyc7Q+SpcZ@eisner.encompasserve.org>
	<Xns95B89D12EE434johnlspamcopnet@216.154.195.61>
	<GZZWi1f6uazJ@eisner.encompasserve.org>
	<Xns95B89E9B4B0E6johnlspamcopnet@216.154.195.61>
	<1OPEHPZbx6Io@eisner.encompasserve.org>
Message-ID: <Xns95B8A0462B91johnlspamcopnet@216.154.195.61>

Kilgallen@SpamCop.net (Larry Kilgallen) wrote in
news:1OPEHPZbx6Io@eisner.encompasserve.org: 

> In article <Xns95B89E9B4B0E6johnlspamcopnet@216.154.195.61>, JohnL
> <johnl@spamcop.net> writes:  
>> No, this is with them enabled.
>> I thought that's what you had now.
> 
> No.
> 
> By enabling technical details I could get even more of what I don't
> want :-) 
> 

LOL, sorry about that.
I was assuming (HATE that word) that tech details had gotten turned on when 
you enabled Mailhosts.
From tjtmdREMOVE_THIS at attglobal.net  Tue Dec  7 17:24:42 2004
From: tjtmdREMOVE_THIS at attglobal.net (Tanya)
Date: Tue Dec  7 17:50:06 2004
Subject: [SC-Help] Re: help stopping spammer -- please advise
References: <41B5C73D.D5A6D95B@attglobal.net> <cp4teg$tst$1@news.spamcop.net>
Message-ID: <41B62DA9.3C1BB4C3@attglobal.net>

Mike Easter wrote:

> Tanya wrote:
> > i am getting bombarded by porn and have been reporting it to
> > uce@ftc.gov and spamCop and it seems to have multiplied!
>
> As a general rule, notifying for spam does not do anything directly to
> reduce the spam.  The FTC is busy doing whatever it is the FTC does, but
> merely 'accumulates' spams at their uce address, and SpamCop notifies
> contribute to the SCbl for spamsource, generally open proxies, and
> publicize spamvertisers for the sc-surbl lists - while notifying the
> spamsource providers and spamvertiser providers so they can do with that
> information what they like.
>
> > (at least 5 per day -- <it seems> from the same source)
> > when i click on the webSite
>
> When you do /what/?

when i click on for example <postmaster#cnc-noc.net@devnull.spamcop.net> it
returns postmaster @myIsp.net.

> I'm not clear on those words you said.  Does that
> say that you are clicking on the spamvertised website?  Or are you
> saying that you are checking the spamcop form to notify for the
> spamvertiser?

i am NOT clicking on the links in the spam what i meant was clicking on the
suggested addresses that spamCop returns

> > where "Administrator of network hosting
> > website referenced in spam" even though it has a number of characters
> > the email address reduces to my isp (postmaster@myISP.net) ALWAYS
> > (however sometimes it only has anti-spam not postmaster)
> > anti-spam@myISP.net)
> > (also sometimes under the originating isp)
> > none of the other spams have this (very rarely do they refer to my
> > isp) NOTHING like a sig. file is in the body of the messages that i
> > send
>
> I'm not understanding any part of that part of the par.

well it is clear above
if you click this <postmaster#cnc-noc.net@devnull.spamcop.net>
i don't know whether you would get postmaster@myISP.net
OR
postmaster@ster.invalid

> spamcop.net/sc?id=z700151331z4e249db60f7fe4cce7232b313ea4e41bz
>
> That is a live tracker [you should report or cancel it]

thnx

> for a porn spam
> sourced at a .cn provider which SC wants to notify for and a
> ptolemaeus.info spamvertiser site which is also at a .cn provider which
> SC wants to notify.

i know what it is for -- the graphics open automatically in email
this is W.A.Y. beyond viagra etc.
totally ILLegal --
basically aside from HOPING some "authority" would be *interested* i wonder
why my isp is ALWAYS either under the originator AND / or the referenced url
(this is all under spamCop's report)

> Inside the spam are URLs and links to graphics.  One link I checked is
> redirected to a 'remove' at
> http://4.78.57.78/ptolemaeus.info/b9a1a4d40a8891c3a6b510d8d/remove.php
>
> 4.78.57.78 no rDNS is spews S1660 listed as the /23
>
> 1, 4.78.22.0/23, Level3 (Bruce Louis Goldberg / adult.foxcounter.com /
> vh3.techiemedia.net)
>
> and whose provider structure is
>
> whois -h whois.arin.net 4.78.57.78 ...
> Level 3 Communications, Inc 4.0.0.0 - 4.255.255.255
> Co-Location.com Inc.  4.78.56.0 - 4.78.57.255

not clear on the above -- at all...
really want to know why my isp is ALWAYS in the report that spamCop shows
(prior to) either report / cancel etc.)

>
>
> --
> Mike Easter
> kibitzer, not SC admin

answers inLine above
thanks

From MikeE at ster.invalid  Tue Dec  7 15:07:34 2004
From: MikeE at ster.invalid (Mike Easter)
Date: Tue Dec  7 18:10:02 2004
Subject: [SC-Help] Re: help stopping spammer -- please advise
References: <41B5C73D.D5A6D95B@attglobal.net> <cp4teg$tst$1@news.spamcop.net>
	<41B62DA9.3C1BB4C3@attglobal.net>
Message-ID: <cp5d3c$aca$1@news.spamcop.net>

Tanya wrote:
>> When you do /what/?
>
> when i click on for example
> <postmaster#cnc-noc.net@devnull.spamcop.net> it returns postmaster
> @myIsp.net.

First, I don't know why that happens - but disregard it for now - that
isn't what you are supposed to do.

When I use the tracker which you posted earlier, the live one, what I
would be doing would be clicking the check /beside/ the address, not
/on/ the actual address link.

Second, if, for sake of the experiment, I click on the link you are
describing above, as it appears on the webpage, that is a 'mailto' link,
which opens a newmail in my mailagent and which To address is that
displayed above, which won't go anywhere [eventually], as that address
is really just for SC internal handling.

> i am NOT clicking on the links in the spam what i meant was clicking
> on the suggested addresses that spamCop returns

OK I understand now not spamlinks, but I can't think of any [good]
reason to be doing that link mailto clicking you just described.  SC is
just telling you how it is going to address the mail it sends.  There
may be something useful to be done with clicking on some of the
addresses provided so that you can send your own 'personal' mail to the
target.  Are you wanting to send a mail from yourself personally to the
intended recipients, or would you be just as happy having spamcop be
doing the notifying for you.

> well it is clear above
> if you click this <postmaster#cnc-noc.net@devnull.spamcop.net>
> i don't know whether you would get postmaster@myISP.net
> OR
> postmaster@ster.invalid

I get neither of the last 2, only a newmail trying to be addressed to:

postmaster#cnc-noc.net@devnull.spamcop.net

> basically aside from HOPING some "authority" would be *interested* i
> wonder why my isp is ALWAYS either under the originator AND / or the
> referenced url (this is all under spamCop's report)

I don't know why you are seeing what you described, unless you somewhere
told SC that you wanted your ISP notified about all of your spams, in
addition to the other notifies.

> not clear on the above -- at all...
> really want to know why my isp is ALWAYS in the report that spamCop
> shows (prior to) either report / cancel etc.)


-- 
Mike Easter
kibitzer, not SC admin

From nobody at spamcop.net  Tue Dec  7 19:08:05 2004
From: nobody at spamcop.net (Miss Betsy)
Date: Tue Dec  7 19:10:04 2004
Subject: [SC-Help] Re: help stopping spammer -- please advise
References: <41B5C73D.D5A6D95B@attglobal.net> <cp4teg$tst$1@news.spamcop.net>
	<41B62DA9.3C1BB4C3@attglobal.net>
Message-ID: <cp5ggm$cul$1@news.spamcop.net>

> i know what it is for -- the graphics open automatically in email
> this is W.A.Y. beyond viagra etc.
> totally ILLegal --
> basically aside from HOPING some "authority" would be
*interested* i wonder
> why my isp is ALWAYS either under the originator AND / or the
referenced url
> (this is all under spamCop's report)
>

There is no 'authority' who is interested because of the
international nature of the internet, there is no way that law
enforcement can work across all the different borders.

The internet is based on netiquette from the assigning of IP
addresses on down.  The best thing to do if you are receiving porn
emails is to change your address to one that is alphanumeric - for
instance t9yn9 - and be prudent about where you use it and whom you
give it to.  Many people have throwaway accounts (either free ones
like hotmail or sneakemail) for purchasing items.

The alternative is to get a filter that uses blocklists (Mailwasher
is one, but do NOT use the bounce feature which is as annoying as
spam to people whose email addresses the spammer has forged;
spamcop email service is another - you get free reporting also if
you want to use it.  There is nothing like hitting the send button
on a report for a particularly nasty spam.  Although most spam
comes from places who don't do anything to spammers (unless it is a
zombied machine in which case the operator is generally happy to be
informed), the IP address will go on the spamcop blocklist which
many people use to block spam from even entering their inboxes.

> > Inside the spam are URLs and links to graphics.  One link I
checked is
> > redirected to a 'remove' at
> >
http://4.78.57.78/ptolemaeus.info/b9a1a4d40a8891c3a6b510d8d/remove.php
> >
> > 4.78.57.78 no rDNS is spews S1660 listed as the /23
> >
> > 1, 4.78.22.0/23, Level3 (Bruce Louis Goldberg /
adult.foxcounter.com /
> > vh3.techiemedia.net)
> >
> > and whose provider structure is
> >
> > whois -h whois.arin.net 4.78.57.78 ...
> > Level 3 Communications, Inc 4.0.0.0 - 4.255.255.255
> > Co-Location.com Inc.  4.78.56.0 - 4.78.57.255
>
> not clear on the above -- at all...
> really want to know why my isp is ALWAYS in the report that
spamCop shows
> (prior to) either report / cancel etc.)

He is telling you what the records say about the person who runs
that website and who gives them bandwidth to establish their
website.

All I get when I click on that address is the same as Mike - an
email addressed to the address.  Of course, I didn 't try right
clicking.  It may be irrelevant if what you want to do is to report
spam to make it stop now - which reporting won't do.  However, if
you do want to continue reporting, maybe you need to be more
specific about what exactly you are doing and why and it will give
someone an idea about what is happening.

Miss Betsy


From nobody at spamcop.net  Tue Dec  7 19:13:25 2004
From: nobody at spamcop.net (Miss Betsy)
Date: Tue Dec  7 19:15:02 2004
Subject: [SC-Help] Re: Technical details even though they are disabled
References: <Vneh7Cm4hdwn@eisner.encompasserve.org>
	<cp4uvc$v02$2@news.spamcop.net> <mKCI4JQtoRHQ@eisner.encompasserve.org>
	<cp4vsd$vr8$1@news.spamcop.net> <YwWOHO0iDlyc@eisner.encompasserve.org>
	<cp59ol$7hp$1@news.spamcop.net>
	<Xns95B89B07E985Djohnlspamcopnet@216.154.195.61>
	<FJEyc7Q+SpcZ@eisner.encompasserve.org>
	<Xns95B89D12EE434johnlspamcopnet@216.154.195.61>
	<GZZWi1f6uazJ@eisner.encompasserve.org>
	<Xns95B89E9B4B0E6johnlspamcopnet@216.154.195.61>
	<1OPEHPZbx6Io@eisner.encompasserve.org>
Message-ID: <cp5gqm$da8$1@news.spamcop.net>


"Larry Kilgallen" <Kilgallen@SpamCop.net> wrote in message
news:1OPEHPZbx6Io@eisner.encompasserve.org...
> In article <Xns95B89E9B4B0E6johnlspamcopnet@216.154.195.61>,
JohnL <johnl@spamcop.net> writes:
> > Kilgallen@SpamCop.net (Larry Kilgallen) wrote in
> > news:GZZWi1f6uazJ@eisner.encompasserve.org:
> >
> >> There is some question, however, as to whether we are talking
about
> >> the same thing - reporting from a username where "Technical
Details"
> >> are _disabled_, right ?
> >
> > No, this is with them enabled.
> > I thought that's what you had now.
>
> No.
>
> By enabling technical details I could get even more of what I
don't want :-)

Maybe if you enabled technical details, you could see the 'skip to
reports' - it is right at the top and you click it and it takes you
to the checkboxes.  Perhaps the default Mailhosts thing doesn't
include that, but if you enabled it, it would.

Miss Betsy



From Kilgallen at SpamCop.net  Tue Dec  7 23:01:18 2004
From: Kilgallen at SpamCop.net (Larry Kilgallen)
Date: Wed Dec  8 00:05:06 2004
Subject: [SC-Help] Re: Technical details even though they are disabled
References: <Vneh7Cm4hdwn@eisner.encompasserve.org>
	<cp4uvc$v02$2@news.spamcop.net> <mKCI4JQtoRHQ@eisner.encompasserve.org>
	<cp4vsd$vr8$1@news.spamcop.net> <YwWOHO0iDlyc@eisner.encompasserve.org>
	<cp59ol$7hp$1@news.spamcop.net>
	<Xns95B89B07E985Djohnlspamcopnet@216.154.195.61>
	<FJEyc7Q+SpcZ@eisner.encompasserve.org>
	<Xns95B89D12EE434johnlspamcopnet@216.154.195.61>
	<GZZWi1f6uazJ@eisner.encompasserve.org>
	<Xns95B89E9B4B0E6johnlspamcopnet@216.154.195.61>
	<1OPEHPZbx6Io@eisner.encompasserve.org> <cp5gqm$da8$1@neOrganization: LJK
	Software
Message-ID: <OEykndWSb+3Y@eisner.encompasserve.org>

In article <cp5gqm$da8$1@news.spamcop.net>, "Miss Betsy" <nobody@spamcop.net> writes:
> 
> "Larry Kilgallen" <Kilgallen@SpamCop.net> wrote in message
> news:1OPEHPZbx6Io@eisner.encompasserve.org...
>> In article <Xns95B89E9B4B0E6johnlspamcopnet@216.154.195.61>,
> JohnL <johnl@spamcop.net> writes:
>> > Kilgallen@SpamCop.net (Larry Kilgallen) wrote in
>> > news:GZZWi1f6uazJ@eisner.encompasserve.org:
>> >
>> >> There is some question, however, as to whether we are talking
> about
>> >> the same thing - reporting from a username where "Technical
> Details"
>> >> are _disabled_, right ?
>> >
>> > No, this is with them enabled.
>> > I thought that's what you had now.
>>
>> No.
>>
>> By enabling technical details I could get even more of what I
> don't want :-)
> 
> Maybe if you enabled technical details, you could see the 'skip to
> reports' - it is right at the top and you click it and it takes you
> to the checkboxes.  Perhaps the default Mailhosts thing doesn't
> include that, but if you enabled it, it would.

But it does not solve the base problem, which is useless crud on the
screen.  I am on the verge of backing out of the whole mailhosts thing.
From nobody at devnull.spamcop.net  Wed Dec  8 00:05:57 2004
From: nobody at devnull.spamcop.net (Cat)
Date: Wed Dec  8 01:10:05 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
In-Reply-To: <cp1of3$pp7$2@news.spamcop.net>
References: <cov5fi$6ke$1@news.spamcop.net> <covaf5$95n$1@news.spamcop.net>
	<cp00n7$ngk$1@news.spamcop.net> <cp1of3$pp7$2@news.spamcop.net>
Message-ID: <cp65ns$pit$1@news.spamcop.net>

Jim Carroll wrote:
> "Cat" <nobody@devnull.spamcop.net> wrote in message
> news:cp00n7$ngk$1@news.spamcop.net...

<snip>

>>If he forwards as attachment, that  should work fine to get it all in
>>there.
> 
> 
> That was what Julian Haight himself told me to do when I long ago tried to
> "forward" a message from Outlook Express instead of "forward as attachment".
> 
> Today, I got two more "no body provided, check format of submission." error
> messages.  Appended to this is what showed up when I selected the "tracking
> URL" of one and then selected "view original message".

<snip>

I started having a similar problem back when I still used OE for an old 
account that got a lot of spam. I forwarded as attachment like always, 
but SpamCop reports stop coming back, and they weren't even waiting for 
me to file on the report page. I seem to recall that no one was ever 
able to come up with a solution for why it totally stopped acting right. 
Shortly afterward, I ditched that account since I'd been using it 
increasingly less and using my Yahoo account most of the time. My 
current ISP account, which I've had for a year and a half, rarely ever 
gets spam. I used Netscape for newsgroup and occasionally e-mail up 
until recently when I finally switched over to Firefox and its 
Thunderbird e-mail/news reader. I haven't had to try forward as 
attachment with either of those.
From David1 at suescornerweb.com  Wed Dec  8 02:52:39 2004
From: David1 at suescornerweb.com (David 1)
Date: Wed Dec  8 02:55:03 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
In-Reply-To: <cp65ns$pit$1@news.spamcop.net>
References: <cov5fi$6ke$1@news.spamcop.net> <covaf5$95n$1@news.spamcop.net>
	<cp00n7$ngk$1@news.spamcop.net> <cp1of3$pp7$2@news.spamcop.net>
	<cp65ns$pit$1@news.spamcop.net>
Message-ID: <cp6bqg$spv$1@news.spamcop.net>

Cat wrote:
> Jim Carroll wrote:
> 
>> "Cat" <nobody@devnull.spamcop.net> wrote in message
>> news:cp00n7$ngk$1@news.spamcop.net...
> 
> 
> <snip>
> 
>>> If he forwards as attachment, that  should work fine to get it all in
>>> there.
>>
>>
>>
>> That was what Julian Haight himself told me to do when I long ago 
>> tried to
>> "forward" a message from Outlook Express instead of "forward as 
>> attachment".
>>
>> Today, I got two more "no body provided, check format of submission." 
>> error
>> messages.  Appended to this is what showed up when I selected the 
>> "tracking
>> URL" of one and then selected "view original message".
> 
> 
> <snip>
> 
> I started having a similar problem back when I still used OE for an old 
> account that got a lot of spam. I forwarded as attachment like always, 
> but SpamCop reports stop coming back, and they weren't even waiting for 
> me to file on the report page. I seem to recall that no one was ever 
> able to come up with a solution for why it totally stopped acting right. 
> Shortly afterward, I ditched that account since I'd been using it 
> increasingly less and using my Yahoo account most of the time. My 
> current ISP account, which I've had for a year and a half, rarely ever 
> gets spam. I used Netscape for newsgroup and occasionally e-mail up 
> until recently when I finally switched over to Firefox and its 
> Thunderbird e-mail/news reader. I haven't had to try forward as 
> attachment with either of those.
Worked for me in T-bird .08 & now also in .09, except for today I didn't 
get any back for some reason
David 1
From nobody at spamcop.net  Wed Dec  8 06:12:16 2004
From: nobody at spamcop.net (Miss Betsy)
Date: Wed Dec  8 06:10:03 2004
Subject: [SC-Help] Re: Technical details even though they are disabled
References: <Vneh7Cm4hdwn@eisner.encompasserve.org>
	<cp4uvc$v02$2@news.spamcop.net> <mKCI4JQtoRHQ@eisner.encompasserve.org>
	<cp4vsd$vr8$1@news.spamcop.net> <YwWOHO0iDlyc@eisner.encompasserve.org>
	<cp59ol$7hp$1@news.spamcop.net>
	<Xns95B89B07E985Djohnlspamcopnet@216.154.195.61>
	<FJEyc7Q+SpcZ@eisner.encompasserve.org>
	<Xns95B89D12EE434johnlspamcopnet@216.154.195.61>
	<GZZWi1f6uazJ@eisner.encompasserve.org>
	<Xns95B89E9B4B0E6johnlspamcopnet@216.154.195.61>
	<1OPEHPZbx6Io@eisner.encompasserve.org> <cp5gqm$da8$1@neOrganization: LJK
	Software <OEykndWSb+3Y@eisner.encompasserve.org>
Message-ID: <cp6ne0$3ot$1@news.spamcop.net>


"Larry Kilgallen" <Kilgallen@SpamCop.net> wrote in message
news:OEykndWSb+3Y@eisner.encompasserve.org...
<snip>
> But it does not solve the base problem, which is useless crud on
the
> screen.  I am on the verge of backing out of the whole mailhosts
thing.

Most of the time one doesn't want to look at the parse, but once in
a while, it is useful to be able to see how the parser decides what
to do.  IMHO, it is a little like having to 'review' each report.
99% of the time, whatever spamcop decides is fine with me.  It is
that 1% where the parser hiccups that needs review, not only of the
results, but sometimes the technical details.

If you aren't interested in the 'useless crud', why don't you just
use quick reporting?

Miss Betsy


From korhojy at POISSPAMMIThotmail.com  Wed Dec  8 15:42:12 2004
From: korhojy at POISSPAMMIThotmail.com (Jyri Korhonen)
Date: Wed Dec  8 08:45:03 2004
Subject: [SC-Help] Re: Technical details even though they are disabled
References: <Vneh7Cm4hdwn@eisner.encompasserve.org>
	<cp4uvc$v02$2@news.spamcop.net> <mKCI4JQtoRHQ@eisner.encompasserve.org>
	<cp4vsd$vr8$1@news.spamcop.net> <YwWOHO0iDlyc@eisner.encompasserve.org>
	<cp59ol$7hp$1@news.spamcop.net>
	<Xns95B89B07E985Djohnlspamcopnet@216.154.195.61>
	<FJEyc7Q+SpcZ@eisner.encompasserve.org>
	<Xns95B89D12EE434johnlspamcopnet@216.154.195.61>
	<GZZWi1f6uazJ@eisner.encompasserve.org>
	<Xns95B89E9B4B0E6johnlspamcopnet@216.154.195.61>
	<1OPEHPZbx6Io@eisner.encompasserve.org> <cp5gqm$da8$1@neOrganization: LJK
	Software <OEykndWSb+3Y@eisner.encompasserve.org>
	<cp6ne0$3ot$1@news.spamcop.net>
Message-ID: <cp70bo$8gn$1@news.spamcop.net>

"Miss Betsy" <nobody@spamcop.net> wrote:

> If you aren't interested in the 'useless crud',
> why don't you just use quick reporting?

To be able to cancel the reports, if necessary?

From Kilgallen at SpamCop.net  Wed Dec  8 09:52:20 2004
From: Kilgallen at SpamCop.net (Larry Kilgallen)
Date: Wed Dec  8 10:55:03 2004
Subject: [SC-Help] Re: Technical details even though they are disabled
References: <Vneh7Cm4hdwn@eisner.encompasserve.org>
	<cp4uvc$v02$2@news.spamcop.net> <mKCI4JQtoRHQ@eisner.encompasserve.org>
	<cp4vsd$vr8$1@news.spamcop.net> <YwWOHO0iDlyc@eisner.encompasserve.org>
	<cp59ol$7hp$1@news.spamcop.net>
	<Xns95B89B07E985Djohnlspamcopnet@216.154.195.61>
	<FJEyc7Q+SpcZ@eisner.encompasserve.org>
	<Xns95B89D12EE434johnlspamcopnet@216.154.195.61>
	<GZZWi1f6uazJ@eisner.encompasserve.org>
	<Xns95B89E9B4B0E6johnlspamcopnet@216.154.195.61>
	<1OPEHPZbx6Io@eisner.encompasserve.org> <cp5gqm$da8$1@neOrganization: LJK
	Software
Message-ID: <Y3HNXBOaRWDi@eisner.encompasserve.org>

In article <cp6ne0$3ot$1@news.spamcop.net>, "Miss Betsy" <nobody@spamcop.net> writes:

> Most of the time one doesn't want to look at the parse, but once in
> a while, it is useful to be able to see how the parser decides what
> to do.

And in those cases I can go back and enable "show technical details".

> If you aren't interested in the 'useless crud', why don't you just
> use quick reporting?

Because I want to send reports to additional places, like NANAS.
From eddie at eddie.web  Wed Dec  8 13:55:03 2004
From: eddie at eddie.web (eddie)
Date: Wed Dec  8 13:55:02 2004
Subject: [SC-Help] Re: "No body provided.  Check format of submission"
References: <cov5fi$6ke$1@news.spamcop.net> <41B528CE.BDFDA64C@spamcop.net>
Message-ID: <pan.2004.12.08.18.55.02.245000@eddie.web>

On Tue, 07 Dec 2004 03:51:42 +0000, Fred the Red Shirt scratched out the
following:

> 
> 
> Jim Carroll wrote:
> 
>> Many of the spam messages that flood my inbox have no "body" per se,
>> just an attachment.
>>
>>
> Many of mine have no body and no attachment.  They look like maybe dumb
> attempts to check the validity of harvested address lists.
> 
> Regardless, I type the word "BLANK." in the body and submit it.
> 
> I do not consider that to be a material alteration of the spam.

I agree - I insert <no body> after a blank line after the last line of
header. I believe even a dot will work.
It is most certainly spam and may even be harassment or some kind of test
mailing. In any case, a legit ISP would want to know about it.

-- 
"I don't understand what happened. Nobody I know voted for Bush."
Dan Pauline Kael-Rather
From nobody at spamcop.net  Wed Dec  8 18:31:10 2004
From: nobody at spamcop.net (Miss Betsy)
Date: Wed Dec  8 18:30:03 2004
Subject: [SC-Help] Re: Technical details even though they are disabled
References: <Vneh7Cm4hdwn@eisner.encompasserve.org>
	<cp4uvc$v02$2@news.spamcop.net> <mKCI4JQtoRHQ@eisner.encompasserve.org>
	<cp4vsd$vr8$1@news.spamcop.net> <YwWOHO0iDlyc@eisner.encompasserve.org>
	<cp59ol$7hp$1@news.spamcop.net>
	<Xns95B89B07E985Djohnlspamcopnet@216.154.195.61>
	<FJEyc7Q+SpcZ@eisner.encompasserve.org>
	<Xns95B89D12EE434johnlspamcopnet@216.154.195.61>
	<GZZWi1f6uazJ@eisner.encompasserve.org>
	<Xns95B89E9B4B0E6johnlspamcopnet@216.154.195.61>
	<1OPEHPZbx6Io@eisner.encompasserve.org> <cp5gqm$da8$1@neOrganization: LJK
	Software <Y3HNXBOaRWDi@eisner.encompasserve.org>
Message-ID: <cp82ne$ugt$1@news.spamcop.net>


"Larry Kilgallen" <snip>
> And in those cases I can go back and enable "show technical
details".
>
> > If you aren't interested in the 'useless crud', why don't you
just
> > use quick reporting?
>
> Because I want to send reports to additional places, like NANAS.

Then it isn't really 'useless crud' - it is just superfluous.
Well, I think the 'skip to' works well - it is one more click, but
then if you want to see you only have to scroll up.  Each to his
own. Did you try enabling to see if it appears?

Miss Betsy


From Kilgallen at SpamCop.net  Wed Dec  8 22:56:49 2004
From: Kilgallen at SpamCop.net (Larry Kilgallen)
Date: Thu Dec  9 00:00:03 2004
Subject: [SC-Help] Re: Technical details even though they are disabled
References: <Vneh7Cm4hdwn@eisner.encompasserve.org>
	<cp4uvc$v02$2@news.spamcop.net> <mKCI4JQtoRHQ@eisner.encompasserve.org>
	<cp4vsd$vr8$1@news.spamcop.net> <YwWOHO0iDlyc@eisner.encompasserve.org>
	<cp59ol$7hp$1@news.spamcop.net>
	<Xns95B89B07E985Djohnlspamcopnet@216.154.195.61>
	<FJEyc7Q+SpcZ@eisner.encompasserve.org>
	<Xns95B89D12EE434johnlspamcopnet@216.154.195.61>
	<GZZWi1f6uazJ@eisner.encompasserve.org>
	<Xns95B89E9B4B0E6johnlspamcopnet@216.154.195.61>
	<1OPEHPZbx6Io@eisner.encompasserve.org> <cp5gqm$da8$1@neOrganization: LJK
	Software
Message-ID: <vMaFq740R+xj@eisner.encompasserve.org>

In article <cp82ne$ugt$1@news.spamcop.net>, "Miss Betsy" <nobody@spamcop.net> writes:
> 
> "Larry Kilgallen" <snip>
>> And in those cases I can go back and enable "show technical
> details".
>>
>> > If you aren't interested in the 'useless crud', why don't you
> just
>> > use quick reporting?
>>
>> Because I want to send reports to additional places, like NANAS.
> 
> Then it isn't really 'useless crud' - it is just superfluous.
> Well, I think the 'skip to' works well - it is one more click, but
> then if you want to see you only have to scrol