From andy.lawson at bigfoot.com Thu Mar 3 21:38:01 2005 From: andy.lawson at bigfoot.com (Andy Lawson) Date: Thu Mar 3 16:40:03 2005 Subject: [SpamCop-Mail] Intermittent problems today. Message-ID: Hi all, I was having intermittent troubles accessing the Spamcop servers today. I can find no mention of it on any of the forums or the news pages. For long periods I couldn't even get ping responses from webmail.spamcop.net or imap.spamcop.net. Did anybody else notice these problems, or was it just me? I did post to this newsgroup earlier, during one of the periods of accessability, but it doesn't look like the post made it. Cheers for any info. Andy. From nobody at spamcop.net Thu Mar 3 17:40:26 2005 From: nobody at spamcop.net (Ellen) Date: Thu Mar 3 17:45:04 2005 Subject: [SpamCop-Mail] Re: Intermittent problems today. References: Message-ID: "Andy Lawson" wrote in message news:d0803r$h89$1@news.spamcop.net... > Hi all, > > I was having intermittent troubles accessing the Spamcop servers today. > I can find no mention of it on any of the forums or the news pages. > There were issues this AM with an router upstream of the colo that was sometimes responding but mostly not. Jeff worked with the colo and they worked with the backbone provider (actually a couple of levels up from the colo) to get the issue resolved. It affected very few users and about the time he/they got a handle on what was happening they were able to get it resolved. Ellen From clk at freesurf.ch Fri Mar 4 07:10:26 2005 From: clk at freesurf.ch (Christoph L. Kaufmann) Date: Fri Mar 4 01:15:02 2005 Subject: [SpamCop-Mail] Re: Intermittent problems today. References: Message-ID: <1gsw17i.ubbxp6x9js00N%clk@freesurf.ch> Ellen wrote: > It affected very few users and about the > time he/they got a handle on what was happening they were able to get it > resolved. March 4th, 0500 hours GMT: the problem is still there. Webmail slow/not responding, no chance to reach the account via POP. -- http://clk.ch From andy.lawson at bigfoot.com Fri Mar 4 08:25:11 2005 From: andy.lawson at bigfoot.com (Andy) Date: Fri Mar 4 03:30:24 2005 Subject: [SpamCop-Mail] Re: Intermittent problems today. In-Reply-To: References: Message-ID: Ellen wrote: > There were issues this AM with an router upstream of the colo that was > sometimes responding but mostly not. Jeff worked with the colo and they > worked with the backbone provider (actually a couple of levels up from the > colo) to get the issue resolved. It affected very few users and about the > time he/they got a handle on what was happening they were able to get it > resolved. Thanks for the info. No problems here today. (UK, 08:30GMT) Cheers. From nobody at spamcop.net Fri Mar 4 08:07:02 2005 From: nobody at spamcop.net (Ellen) Date: Fri Mar 4 08:20:03 2005 Subject: [SpamCop-Mail] Re: Intermittent problems today. References: <1gsw17i.ubbxp6x9js00N%clk@freesurf.ch> Message-ID: "Christoph L. Kaufmann" wrote in message news:1gsw17i.ubbxp6x9js00N%clk@freesurf.ch... > Ellen wrote: > > > It affected very few users and about the > > time he/they got a handle on what was happening they were able to get it > > resolved. > > March 4th, 0500 hours GMT: the problem is still there. Webmail slow/not > responding, no chance to reach the account via POP. > > -- > http://clk.ch I will pass this on to Jeff but I suspect this is a different problem. Ellen From clk at freesurf.ch Mon Mar 7 07:08:40 2005 From: clk at freesurf.ch (Christoph L. Kaufmann) Date: Mon Mar 7 01:10:03 2005 Subject: [SpamCop-Mail] Re: Intermittent problems today. References: <1gsw17i.ubbxp6x9js00N%clk@freesurf.ch> Message-ID: <1gt1l27.1kf5qrty2m716N%clk@freesurf.ch> Ellen wrote: [March 4th, 0500 hours GMT: Webmail slow/not responding, no chance to reach the account via POP] > I will pass this on to Jeff but I suspect this is a different problem. It probably was. My provider reported problems later. Of all the pop accounts I tried and sites I visited, only spamcop was affected, so I thought the problem was on spamcop's side. Whatever it was, it's gone now. -- http://clk.ch From me at pricacy.net Wed Mar 9 01:46:33 2005 From: me at pricacy.net (Caduceus) Date: Wed Mar 9 02:50:03 2005 Subject: [SpamCop-Mail] Need help with spamcop on this Message-ID: Hi: On Monday, I decided to download Pine. I thought I configured my pinerc file correctly, however whenever I try to connect Pine will say "Trouble reading remote collections, Try Again?". Also, Pine will not connect to my imap server. Here is how I have the pinerc file configured. Can anyone tell me what I'm doing wrong, and what changes I need to do to make it work? ---------------- #Example: user-id=xyz123 user-id=shorn@spamcop.net #Example: personal-name=My Name personal-name=Steve Horn #Example: user-domain=u.washington.edu user-domain=imap.spamcop.net #Example: smtp-server=smtp.foobar.edu smtp-server=mail.mailcircuit.com #Example: nntp-server=news.foobar.edu nntp-server= #Example: inbox-path={imapserver.foobar.edu}inbox inbox-path={imap.spamcop.net/user=shorn@spamcop.net/tls/novalidate-cert}INBOX #Example: incoming-folders= "WIDGETS" {imapserver.foobar.edu}widgets, # "CompMailPine" {imapserver.foobar.edu}{news.foobar.edu/nntp}#news.comp.mail.pine #Note: the second example requires a recent version of the UW IMAP server, which is acting as a news proxy in this case incoming-folders= #Example: folder-collections=MAIN {imapserver.foobar.edu}mail/[*], PROJECTS {imapserver.foobar.edu}projects/[*] folder-collections={imap.spamcop.net/user=shorn@spamcop.net/tls/novalidate-cert}INBOX.[] #You can leave the following group of variables blank; Pine will pick default names news-collections= default-fcc= postponed-folder= read-message-folder= signature-file= #Example: address-book=MYBOOK {imapserver.foobar.edu}addrbook #Note: this example identifies a Pine addressbook being stored on your IMAP server address-book= feature-list=delete-skips-deleted, use-current-dir, enable-mail-check-cue, auto-open-next-unread, enable-incoming-folders, news-read-in-newsrc-order, news-post-without-validation, select-without-confirm, news-approximates-new-status, compose-maps-delete-key-to-ctrl-d, enable-mouse-in-xterm, enable-aggregate-command-set, enable-bounce-cmd, enable-flag-cmd, enable-full-header-cmd, enable-jump-shortcut, enable-suspend, enable-tab-completion, enable-unix-pipe-cmd, quit-without-confirm, enable-alternate-editor-cmd, single-column-folder-list, enable-8bit-nntp-posting, enable-8bit-esmtp-negotiation, enable-verbose-smtp-posting, compose-cut-from-cursor, auto-zoom-after-select, auto-unzoom-after-apply, print-offers-custom-cmd-prompt, print-formfeed-between-messages, auto-move-read-msgs, enable-dot-files, enable-dot-folders, tab-visits-next-new-message-only, use-subshell-for-suspend, enable-newmail-in-xterm-icon, expanded-view-of-distribution-lists, save-will-not-delete, compose-posts-in-background, enable-background-sending, enable-goto-in-file-browser, no-print-index-enabled, enable-delivery-status-notification, enable-search-and-replace, enable-arrow-navigation, expunge-without-confirm, enable-msg-view-urls, enable-msg-view-web-hostnames, enable-exit-via-lessthan-command, enable-partial-match-lists, enable-fast-recent-test, add-ldap-result-to-addrbook initial-keystroke-list=i default-composer-hdrs=To, Cc, Bcc, Subject customized-hdrs=Reply-To:, Organization: Not Much But I Keep Trying saved-msg-name-rule=by-recipient fcc-name-rule= sort-key= character-set=ISO-8859-1 editor= image-viewer= use-only-domain-name=No#Example: user-id=xyz123 user-id=shorn@spamcop.net #Example: personal-name=My Name personal-name= #Example: user-domain=u.washington.edu user-domain=imap.spamcop.net #Example: smtp-server=smtp.foobar.edu smtp-server=mail.mailcircuit.com #Example: nntp-server=news.foobar.edu nntp-server= #Example: inbox-path={imapserver.foobar.edu}inbox inbox-path={imap.spamcop.net/user=shorn@spamcop.net/tls/novalidate-cert}INBOX #Example: incoming-folders= "WIDGETS" {imapserver.foobar.edu}widgets, # "CompMailPine" {imapserver.foobar.edu}{news.foobar.edu/nntp}#news.comp.mail.pine #Note: the second example requires a recent version of the UW IMAP server, which is acting as a news proxy in this case incoming-folders= #Example: folder-collections=MAIN {imapserver.foobar.edu}mail/[*], PROJECTS {imapserver.foobar.edu}projects/[*] folder-collections={imap.spamcop.net/user=shorn@spamcop.net/tls/novalidate-cert}INBOX.[] #You can leave the following group of variables blank; Pine will pick default names news-collections= default-fcc= postponed-folder= read-message-folder= signature-file= #Example: address-book=MYBOOK {imapserver.foobar.edu}addrbook #Note: this example identifies a Pine addressbook being stored on your IMAP server address-book= feature-list=delete-skips-deleted, use-current-dir, enable-mail-check-cue, auto-open-next-unread, enable-incoming-folders, news-read-in-newsrc-order, news-post-without-validation, select-without-confirm, news-approximates-new-status, compose-maps-delete-key-to-ctrl-d, enable-mouse-in-xterm, enable-aggregate-command-set, enable-bounce-cmd, enable-flag-cmd, enable-full-header-cmd, enable-jump-shortcut, enable-suspend, enable-tab-completion, enable-unix-pipe-cmd, quit-without-confirm, enable-alternate-editor-cmd, single-column-folder-list, enable-8bit-nntp-posting, enable-8bit-esmtp-negotiation, enable-verbose-smtp-posting, compose-cut-from-cursor, auto-zoom-after-select, auto-unzoom-after-apply, print-offers-custom-cmd-prompt, print-formfeed-between-messages, auto-move-read-msgs, enable-dot-files, enable-dot-folders, tab-visits-next-new-message-only, use-subshell-for-suspend, enable-newmail-in-xterm-icon, expanded-view-of-distribution-lists, save-will-not-delete, compose-posts-in-background, enable-background-sending, enable-goto-in-file-browser, no-print-index-enabled, enable-delivery-status-notification, enable-search-and-replace, enable-arrow-navigation, expunge-without-confirm, enable-msg-view-urls, enable-msg-view-web-hostnames, enable-exit-via-lessthan-command, enable-partial-match-lists, enable-fast-recent-test, add-ldap-result-to-addrbook initial-keystroke-list=i default-composer-hdrs=To, Cc, Bcc, Subject customized-hdrs=Reply-To:, Organization: Not Much But I Keep Trying saved-msg-name-rule=by-recipient fcc-name-rule= sort-key= character-set=ISO-8859-1 editor= image-viewer= use-only-domain-name=No ----------------- If anyone can tell me what changes I need to make to my pinerc file I would appreciate it. TIA. -- Steve From eddie at eddie.web Wed Mar 9 15:39:22 2005 From: eddie at eddie.web (eddie) Date: Wed Mar 9 15:40:03 2005 Subject: [SpamCop-Mail] Re: Need help with spamcop on this References: Message-ID: On Wed, 09 Mar 2005 01:46:33 -0600, Caduceus scratched out the following: > Hi: > > On Monday, I decided to download Pine. I thought I configured my pinerc > file correctly, however whenever I try to connect Pine will say "Trouble > reading remote collections, Try Again?". Also, Pine will not connect to > my imap server. Here is how I have the pinerc file configured. Can > anyone tell me what I'm doing wrong, and what changes I need to do to make > it work? Crossposting will probably get you nowhere. Most likely less than nowhere. It is not an accepted practice in any newsgroup. Also, posting a long message with lots of minutia will also get you nowhere My guess is you should have first posted a question in "geeks" and only then, when asked, posted all the other stuff. -- Once movie theaters gave out steak knives Today they confiscate them From me at pricacy.net Wed Mar 9 15:20:52 2005 From: me at pricacy.net (Caduceus) Date: Wed Mar 9 16:25:04 2005 Subject: [SpamCop-Mail] Re: Need help with spamcop on this In-Reply-To: References: Message-ID: eddie wrote: > On Wed, 09 Mar 2005 01:46:33 -0600, Caduceus scratched out the following: > > >>Hi: >> >>On Monday, I decided to download Pine. I thought I configured my pinerc >>file correctly, however whenever I try to connect Pine will say "Trouble >>reading remote collections, Try Again?". Also, Pine will not connect to >>my imap server. Here is how I have the pinerc file configured. Can >>anyone tell me what I'm doing wrong, and what changes I need to do to make >>it work? > > > Crossposting will probably get you nowhere. Most likely less than nowhere. > It is not an accepted practice in any newsgroup. > > Also, posting a long message with lots of minutia will also get you > nowhere My guess is you should have first posted a question in "geeks" and > only then, when asked, posted all the other stuff. > Well excuse me. I was only asking a question. I'm a medical student so your opinion doesn't matter. Save it for the little people like yourself. -- Steve From devnull at spamcop.net Thu Mar 10 10:06:17 2005 From: devnull at spamcop.net (Frog Prince) Date: Thu Mar 10 10:10:04 2005 Subject: [SpamCop-Mail] Re: Need help with spamcop on this References: Message-ID: "Caduceus" | > | Well excuse me. I was only asking a question. I'm a medical student so | your opinion doesn't matter. Save it for the little people like yourself. | | -- | Steve Come hat in hand to our parlor and insult the other guest? the spamcop.micro.give.a.sh|t goup is that way. ===> Reminds me of an old joke. A doctor (md type) died and ends up in the que at the Pearly Gates in his doctor suit. The good doctor gets antsy and complains to St. Peter with the qualification 'I'm a doctor and doctors are too important to have to wait in line' St. Peter directs him back in line with a scowl About that time another person comes along, likewise dressed in a doctor suit and is waved right in. The doctor gets all riled and again speaks to St. Peter with the comment 'he's a doctor and he did not have to wait' St. Peter advised that was God, he just likes to play doctor now and again. From MikeE at ster.invalid Thu Mar 10 08:10:25 2005 From: MikeE at ster.invalid (Mike Easter) Date: Thu Mar 10 11:10:03 2005 Subject: [SpamCop-Mail] Re: Need help with spamcop on this References: Message-ID: Frog Prince wrote: > St. Peter advised that was God, he just likes to play doctor now and > again. Heh. -- Mike Easter kibitzer, not SC admin From eddie at eddie.web Thu Mar 10 12:12:33 2005 From: eddie at eddie.web (eddie) Date: Thu Mar 10 12:15:30 2005 Subject: [SpamCop-Mail] Re: Need help with spamcop on this References: Message-ID: On Wed, 09 Mar 2005 15:20:52 -0600, Caduceus scratched out the following: > eddie wrote: >> On Wed, 09 Mar 2005 01:46:33 -0600, Caduceus scratched out the >> following: >> > Well excuse me. I was only asking a question. I'm a medical student so > your opinion doesn't matter. Save it for the little people like > yourself. What a load of BS. You are not a medical student! They all know better than to crosspost and while my opinion doesn't matter to you, I suggest you get a second opinion and even a third. Clearly you are a failure in school, if you are a student at all, and I am about to PLONK you so I don't have to ever read your idiotic trash again If you are a medical student, I hope all the other little people get a real doctor. You come across as a moron and jerk. And calling people "little" is called "projection" which you should have learned in psycho 101. I suggest transferring to law school. It fits your personality better. PLONK!!!!! -- Once movie theaters gave out steak knives Today they confiscate them From jeffg at spamcop.net Thu Mar 10 17:39:47 2005 From: jeffg at spamcop.net (Jeff G.) Date: Thu Mar 10 17:40:30 2005 Subject: [SpamCop-Mail] Re: Need help with spamcop on this References: Message-ID: Caduceus wrote: > #Example: inbox-path={imapserver.foobar.edu}inbox > inbox-path={imap.spamcop.net/user=shorn@spamcop.net/tls/novalidate-cert} INBOX Have you tried following the example and getting rid of "/user=shorn@spamcop.net/tls/novalidate-cert" or perhaps remming out the whole inbox-path? > #Example: folder-collections=MAIN {imapserver.foobar.edu}mail/[*], > PROJECTS {imapserver.foobar.edu}projects/[*] > folder-collections={imap.spamcop.net/user=shorn@spamcop.net/tls/novalida te-cert}INBOX.[] Same here. > #Example: inbox-path={imapserver.foobar.edu}inbox > inbox-path={imap.spamcop.net/user=shorn@spamcop.net/tls/novalidate-cert} INBOX Why is this in the file a second time? > #Example: folder-collections=MAIN {imapserver.foobar.edu}mail/[*], > PROJECTS {imapserver.foobar.edu}projects/[*] > folder-collections={imap.spamcop.net/user=shorn@spamcop.net/tls/novalida te-cert}INBOX.[] More from the Dept. of Redundancy Department. :) -- Thanks and Best Regards, Jeff G. I have been a SpamCop User/Member/Customer since 1999 and am a Moderator of the new web-based forums (now the primary method for getting help, http://forum.spamcop.net). Please reply via Forum, Group, or List only. From me at pricacy.net Thu Mar 10 23:08:20 2005 From: me at pricacy.net (Caduceus) Date: Fri Mar 11 00:10:02 2005 Subject: [SpamCop-Mail] Re: Need help with spamcop on this In-Reply-To: References: Message-ID: Jeff G. wrote: > > Thanks Jeff I will give your suggestions a try. -- Steve From fuckofflittleeddie at fuckofflittleeddie.edu Thu Mar 10 23:26:09 2005 From: fuckofflittleeddie at fuckofflittleeddie.edu (little eddie is a puff) Date: Fri Mar 11 00:30:03 2005 Subject: [SpamCop-Mail] Re: Need help with spamcop on this In-Reply-To: References: Message-ID: eddie wrote: > On Wed, 09 Mar 2005 15:20:52 -0600, Caduceus scratched out the following: > > >>eddie wrote: >> >>>On Wed, 09 Mar 2005 01:46:33 -0600, Caduceus scratched out the >>>following: > > > >>Well excuse me. I was only asking a question. I'm a medical student so >> your opinion doesn't matter. Save it for the little people like >> yourself. > > What a load of BS. You are not a medical student! They all know better > than to crosspost and while my opinion doesn't matter to you, I suggest > you get a second opinion and even a third. > Clearly you are a failure in school, if you are a student at all, and I am > about to PLONK you so I don't have to ever read your idiotic trash again > If you are a medical student, I hope all the other little people get a > real doctor. You come across as a moron and jerk. And calling people > "little" is called "projection" which you should have learned in psycho > 101. I suggest transferring to law school. It fits your personality better. > PLONK!!!!! > 1. Your attempts at being a troll are weak, and your flamming show it to be so. 2. You TILT to easily. 3. There are ways to get around kill files. 4. Now fuck off and go back to reading your pedophilic kiddie porn. Seems like it's the only thing you can handle you freak. -- Steve From gavan+mail_list at spamcop.net Sat Mar 12 01:07:25 2005 From: gavan+mail_list at spamcop.net (Gavan Schneider) Date: Fri Mar 11 09:07:34 2005 Subject: [SpamCop-Mail] Re: Need help with spamcop on this In-Reply-To: Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Where is the UN when you need them... before our very eyes we are seeing crimes against humanity... >>>>On Wed, 09 Mar 2005 01:46:33 -0600, Caduceus scratched out the >>>>following: >> >>>Well excuse me. I was only asking a question. I'm a medical >>>student so your opinion doesn't matter. Save it for the little >>>people like yourself. >>>-- >>>Steve >>> I was a medical student once, but I got over it. >>On or about 2005-03-10 04:12 AM (-0500) eddie wrote: >> >> What a load of BS. You are not a medical student! They all know >> better than ... >> They don't know shit, but they can learn fast. The good ones actually learn the medicine when they have to, the others cover their arse/ass. On or about 2005-03-10 04:26 PM (-0600) little eddie is a puff (aka Caduceus Steve) wrote: > >4. Now fuck off and go back to reading your pedophilic kiddie porn. > Tautology! bad boy, six lashes with a wet noodle. Sorry, but I can't contribute to the original question on configuring Pine. Good luck with that. Apparently the original question was cross posted which can't be good, but Jeff has managed to find something relevant to spamcop mail, so all is not lost. Regards Gavan (who is only a doctor these days :) -----BEGIN PGP SIGNATURE----- Version: PGP SDK 3.2.2 iQA/AwUBQjGmHM86FtnpdFMWEQJUqwCgxl5+gs4P1OYywMagMW0y1l/ltCQAoJ7Y 9kDzoxv1YJzNXxb3O1pYi8Pk =/B+x -----END PGP SIGNATURE----- From devnull at spamcop.net Fri Mar 11 09:22:46 2005 From: devnull at spamcop.net (Frog Prince) Date: Fri Mar 11 09:35:03 2005 Subject: [SpamCop-Mail] Re: Need help with spamcop on this References: Message-ID: "Gavan Schneider" I was a medical student once, but I got over it. Regards Gavan (who is only a doctor these days :) Love it!!! It's important to have a physician who knows what (s)he is doing. Having a doc with a sharp sense of humor makes hurting or being scared easy to deal with. From eddie at eddie.web Fri Mar 11 18:47:43 2005 From: eddie at eddie.web (eddie) Date: Fri Mar 11 18:50:03 2005 Subject: [SpamCop-Mail] Re: Need help with spamcop on this References: Message-ID: On Thu, 10 Mar 2005 23:26:09 -0600, little eddie is a puff scratched out the following: > eddie wrote: Well I see I got to you. Score one for little eddie and a kick in the moron's rear heh heh heh Once movie theaters gave out steak knives Today they confiscate them From me at privacy.net Sat Mar 12 11:16:27 2005 From: me at privacy.net (Caduceus) Date: Sat Mar 12 12:20:03 2005 Subject: [SpamCop-Mail] Re: Need help with spamcop on this In-Reply-To: References: Message-ID: eddie wrote: > On Thu, 10 Mar 2005 23:26:09 -0600, little eddie is a puff scratched out > the following: > > >>eddie wrote: > > > Well I see I got to you. > Score one for little eddie and a kick in the moron's rear > heh heh heh > > Once movie theaters gave out steak knives > > Today they confiscate them You're not a happy person are you? Steve From me at privacy.net Sat Mar 12 11:18:44 2005 From: me at privacy.net (Caduceus) Date: Sat Mar 12 12:20:06 2005 Subject: [SpamCop-Mail] Re: Need help with spamcop on this In-Reply-To: References: Message-ID: It didn't work but thanks anyhow for the help. Steve From none at domain.invalid Sun Mar 13 02:11:41 2005 From: none at domain.invalid (Anonymous) Date: Sun Mar 13 05:15:33 2005 Subject: [SpamCop-Mail] 123STORE.BIZ, 1SECURESTORE.INFO, 123SECURESTORE.COM, SALEZSITE.INFO spammer Message-ID: If you're tired of getting spam day in and day out from these spammers (offering a device to steal cable TV signals, and credit repair), then please feel free to load up the SpamVampire and hit them for all their worth. SpamVampire: http://www.hillscapital.com/antispam/ They use several tricks to remain in operation... 1) They use redirect domains (see below), so automated parsers such as SpamCop can't report the actual spamvertised website. 2) They heavily Javascript-munge their websites. In order to view their websites, you must have Javascript enabled. You can learn more about that in one of my posts here: http://groups-beta.google.com/group/news.admin.net-abuse.email/msg/b4490e9b8062440c 3) They delay DNS resolution of their end-of-the-redirect-chain spamvertised websites just long enough that it tricks SpamCop into thinking that the websites are not resolving. 4) In the redirect chain, if you follow it manually, you'll find that you have to set proper referrers for each hop in the redirect chain, otherwise you're redirected off to nowhere. They've been spamming away for months now, it's time they're stopped. They've used the following websites in their spam, all of which redirects to one of the domains mentioned in the Subject line: http://123ez.org/ http://www.1safeshop.net/ http://cacti5.shopsafe33.com/ http://annuli9k.whatadeal4me.com http://heroin6v.whatadeal4me.com http://dunedin9c.whatadeal4me.com http://plump8w.whatadeal4me.com http://bowfin4z.whatadeal66.com http://disdain2l.whatadeal66.com http://durango8l.whatadeal66.com http://colorimeter5d.whatadeal66.com http://skye7r.whatadeal66.com http://skye7r.whatadeal66.com http://crosswort7b.whatadeal66.com http://volstead9c.whatadeal66.com http://hour0e.whatadeal66.com http://polyphony4g.whatadeal88.com http://drink4u.whatadeal88.com http://block8s.aboutmarket.info http://oviform0c.aboutmarket.info http://walrus5x.aboutmarket.info http://seventeenth1t.aboutmarket.info http://omicron1u.aboutmarket.info http://anode1r.aboutmarket.info http://junco3n.aboutmarket.info http://indiscriminate7g.aboutmarket.info http://aboutmarket.info http://terminology6v.aboutmarket.info http://weasel1x.aboutmarket.info http://downstream2p.shopadvisor.info http://immovable6o.shopadvisor.info http://UWfreeway.quickwww.info The most telling 'mark' of their spam at the moment is that there is always the name "lisa" somewhere in the URL. From TheFatherMind at Dangerous-Minds.NET Sun Mar 13 04:02:38 2005 From: TheFatherMind at Dangerous-Minds.NET (The Father Mind of DM Industries) Date: Sun Mar 13 07:05:03 2005 Subject: [SpamCop-Mail] Reporting My own IP? Message-ID: I attempted to post in the Reporting forum as I saw a post with the similar problem but it seems I do not have permission to post there. Here is my problem. 1. I have accidentally reported my own Servers IP a few times. And once my desktop IP. I understand what I did wrong for my desktop IP but not for the Server IP. It seems that if I move the bottom header line (with the real source IP) to the top of the header when I manually report it, then it fixes the problem. I am pulling this from Outlook Express 6. I found that forwarding eMails as an attachment resolves the problem most of the time but not all of the time. I have attached one eMail header that is not working when I paste it or forward it. Can some one tell me is this something I am doing wrong or a flaw in the SpamCop logic system? (Note my Servers IP is 64.81.88.120) -- Thank You... .. Master Merlin Cul Kirkpatrick begin 666 Solid Financing for the USA!.eml M4F5T=7)N+5!A=&@Z(#Q244U535104E),4D!K7-T96U#;VYT7-T96U#;VYT#$N9'-L+G-P96%K96%S>2YN970@6S8T+C@Q+C@X+C$R M,%TI#0H)8GD@;6%I;"UI;BYT;W1A;'-YF$@0V]R;F5L:75S(B \4E%- M54U44%)23%) :W(N9W5D96PN8V]M/@T*5&\Z(#QD96%N0'!R96-I'1E;F1E9"!T;R!Y M;W4@=6YC;VYD:71I;VYA;&QY(&%N9"!Y;W5R(&-R961I="!IF$@0V]R;F5L:75S#0I296=I;VYA;"!#14\-"@T*#0H-"@T*#0H-"@T*#0IH M871T:64@=&UU(&1E=')A8W1O"!C;VYC97)T;R!M9G8@86YG M;&4@;F=O( T*B!B;V]T97,@<7(@86QE>&ES M(&%W(&%S Message-ID: The Father Mind of DM Industries wrote: > I attempted to post in the Reporting forum as I saw a post with the > similar problem but it seems I do not have permission to post there. You have to register to post there. I've never registered or posted there. I prefer to interact in newsgroups. > Here is my problem. > 1. I have accidentally reported my own Servers IP a few times. Don't do that. You should know what/who 'you' and your provider are. You should know/understand enough about headers that you have a clue about what is going on in the Received lines and who your own provider is, even if the provider's 'name' might be obscured or misleading in its Received traceline's configuration. > And > once my desktop IP. I understand what I did wrong for my desktop IP > but not for the Server IP. Don't do that either. > It seems that if I move the bottom header > line (with the real source IP) to the top of the header when I > manually report it, then it fixes the problem. Don't do that either. Good grief! You can't go around re-manufacturing ie forging headerlines for reporting. Some of 'us' [at least me] forge headers 'experimentally' - but not for reporting. If you or I forge a header we must cancel it; it is against the rules to do material changes to a spam http://www.spamcop.net/fom-serve/cache/283.html Material changes to spam > I am pulling this > from Outlook Express 6. You have attached a uuencoded .eml to your post here. That is also a 'relative' no-no. The best way to communicate about a specific spam parsing is to submit it to the parser, copy the tracking URL to paste here to discuss, and not be posting spam or attachments in this newsgroup. Once upon a time the newsgroup .spam was for posting spam, but the tracker is better. The subject of attachments and uuencoding is another topic that I'll save for later after discussing the problem you are asking about. This is the tracker of the spam you attached to your message and this is what you should've posted instead of what you did www.spamcop.net/sc?id=z741670376z53404350a858828ce0e0d17543fc1e06z I like to talk about parsing problems by abbreviating the salient parts of the headers like this: Abbreviated Received lines *comment from Server-03.DMIndustries.NET (dsl081-088-120.lax1.dsl.speakeasy.net [64.81.88.120]) by mail-in.totalsystemcontrol.com *serves you from 64.81.88.120 (unknown [61.83.201.212]) by Server-03.DMIndustries.NET *sourceline, bogus helo from carmen017.9opica.com (HELO coa05.topica.com [4.221.24.168]) by sandblast017.1opica.com *bogusline > I found that forwarding eMails as an > attachment resolves the problem most of the time but not all of the > time. The only you can submit to the parser is by pasting into the webparser or email forwarding as an attachment. There is no other alternative. > I have attached one eMail header that is not working when I > paste it or forward it. You have attached a uuencoded spam, not header, and the parser breaks the chain prematurely because of a misconfigured server which serves you. If you are going to submit items from misconfigured servers, you are going to have to use a properly configured mailhosts system which can overcome such foibles. > Can some one tell me is this something I am > doing wrong or a flaw in the SpamCop logic system? (Note my Servers > IP is > 64.81.88.120) The problem is in the configuration of 64.81.88.120 rDNS dsl081-088-120.lax1.dsl.speakeasy.net which is calling itself Server-03.DMIndustries.NET in the 'by' field and its helo. The helo isn't a problem, the problem is the 'by' field configuration. If you look at the 3 lines of Abbreviated Received headers above and if you also look at the verbose of the parse which can be seen by clicking on the tracker link above if you have configured your preferences for Show Technical Details during reporting in the Report Handling Options you will see how SC parses. SC parses by chaining backwards from top toward the bottom until the first sign of bogosity by chaining from the upper 'from' field to the lower 'by' field. In the case of the misconfigured server, SC considers 64.81.88.120 to be dsl081-088-120.lax1.dsl.speakeasy.net -- not Server-03.DMIndustries.NET -- which is found in the 2nd 'by' field, so it has to break the parse chain prematurely and name the speakeasy server. In SC's parse, it names the speakeasy as source, but the source should be 61.83.201.212 no rDNS at kornet which is using the bogus helo of your server's IP. That IP is listed on some blocklists, including cbl which is a sign of a proxified IP hitting spamtraps. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Sun Mar 13 05:15:01 2005 From: MikeE at ster.invalid (Mike Easter) Date: Sun Mar 13 08:15:02 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: Mike Easter wrote: > I like to talk about parsing problems by abbreviating the salient > parts of the headers like this: > > Abbreviated Received lines *comment > from Server-03.DMIndustries.NET > (dsl081-088-120.lax1.dsl.speakeasy.net [64.81.88.120]) by > mail-in.totalsystemcontrol.com *serves you from 64.81.88.120 > (unknown [61.83.201.212]) by Server-03.DMIndustries.NET *sourceline, > bogus helo from carmen017.9opica.com (HELO coa05.topica.com > [4.221.24.168]) by sandblast017.1opica.com *bogusline Some people hate my abbreviated Received lines, but I think they help to understand the 'from' to 'by' chaining. The configuration of your totalsystemcontrol and speakeasy server's is to make the tracelines like this: from helo (rDNS [IP]) by domainname and SC 'associates' the 'from' IP of the upper field with the 'by' domainname of the lower field. But 64.81.88.120 is not Server-03.DMIndustries.NET - so that's the end of the line, and SC sez: .... oops. Things have changed since the first time I looked at this, SC is beginning to figure things out, but it still gets the parse wrong 64.81.88.120 is an MX for Server-03.DMIndustries.NET Chain test:Server-03.DMIndustries.NET =? dsl081-088-120.lax1.dsl.speakeasy.net host dsl081-088-120.lax1.dsl.speakeasy.net (checking ip) = 64.81.88.120 64.81.88.120 is an MX for Server-03.DMIndustries.NET 64.81.88.120 is mx Server-03.DMIndustries.NET and dsl081-088-120.lax1.dsl.speakeasy.net have close IP addresses - chain verified Possible relay: 64.81.88.120 64.81.88.120 not listed in relays.ordb.org. 64.81.88.120 has already been sent to relay testers Received line accepted ... now that SC has gotten the situation about speakeasy and dmindustries misconfiguration figured out, it should be able to successfully get down to the 2nd line where the source is, but it blows it while I'm looking right now and still names speakeasy Report Spam to: Re: 64.81.88.120 (Administrator of network where email originates) To: abuse@speakeasy.net (Notes) ... now I've cancelled the report, and I'll access the tracker yet again to see if it gets it right; because the parser reparses the item everytime it is accessed. Here is where SC is screwing up Received: from carmen017.9opica.com (HELO coa05.topica.com [4.221.24.168]) by sandblast017.1opica.com (tournamentTV_Wostfix+sws) with SMTP id F0A0EFE1F for ; Sun, 13 Mar 2005 00:29:28 -0200 4.221.24.168 found host 4.221.24.168 = dialup-4.221.24.168.Dial1.Dallas1.Level3.net (cached) dialup-4.221.24.168.Dial1.Dallas1.Level3.net is 4.221.24.168 61.83.201.212 not listed in dnsbl.njabl.org 61.83.201.212 listed in cbl.abuseat.org ( 127.0.0.2 ) Open proxies untrusted as relays 61.83.201.212 discarded as a forgery, using 64.81.88.120 In the topmost part, SC is examining the bogus line. Then, below that, SC is 'thinking' about the line which came above the bogus line. In the 'thinking about' the sourceline, SC recognizes that 61.83.201.212 is a proxy IP, but somehow it jumps all the way back to the top line and names the speakeasy even after it has resolved the misconfiguration problem. Dumb parser. I don't know why it is doing that right now. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Sun Mar 13 05:35:36 2005 From: MikeE at ster.invalid (Mike Easter) Date: Sun Mar 13 08:35:05 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: Mike Easter wrote: > The subject of attachments and uuencoding > is another topic that I'll save for later after discussing the > problem you are asking about. You shouldn't be submitting spam as an attachment or any other way into any of the newsgroups except spamcop.spam Even spamcop.spam isn't as good a way to submit spam as a tracking URL as demonstrated. You [probably] shouldn't be configured to make your attachments uuencoded, unless you are specifically trying to hop over some hurdle I don't know about. That configuration is here: OE/ Tools/ Options/ Send tab - News sending format - Plain text settings button/ - select MIME encoding and None from the menu instead of the other radio button Uuencoding. The problem is, at least in this particular little instance in which there is already a relative no-no of posting spam in the wrong group and putting an attachment into this group, that if someone is trying to 'cope with' your attachment that the 'issue' can't be examined quite as easily. If the original spam had been not uuencoded as an attachment instead of mime, it would have been one decoding step more accessible. It is possible for someone to handle your post 'as is' insecurely if they handle it carelessly. If someone else's OE is configured insecurely and if you post a dangerous .eml attachment and they can't 'see' what is 'inside' your attachment because all they see in the Properties is 'begin 666' and then the encoding, the careless viewer might decide to click open the Solid Financing for the USA!.eml -- and if that eml is a dangerous item somehow, then they have become virus infected from the content or perhaps by being delivered to a bad website. -- Mike Easter kibitzer, not SC admin From TheFatherMind at Dangerous-Minds.NET Sun Mar 13 12:37:43 2005 From: TheFatherMind at Dangerous-Minds.NET (The Father Mind of DM Industries) Date: Sun Mar 13 15:40:04 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: Okay, I totally get what you are saying and have adjusted my settings. On the forum I had registered for it but it apparently required that I check my eMail and autherize my self and I must have missed where it said that. So the bottom line from what I have gottem from all of this is the following... 1. Do not change any thing in the eMail to help the parser. 2. Do not include the spam (use the tracker) and do NOT include eMail as attachments that are not text. 3. I need to fix my zone file on my IP's or change my eMail servers name to match what the zone is currently. My one question I forgot to include earlier is, How do I back out my mistakes. How do I cancel out the submissions including my IP's? Thank you SO much for taking the time to pass all this information to me. I really appreciate it.. ... Merlin "Mike Easter" wrote in message news:d11fgl$rhg$1@news.spamcop.net... > Mike Easter wrote: > > The subject of attachments and uuencoding > > is another topic that I'll save for later after discussing the > > problem you are asking about. > > You shouldn't be submitting spam as an attachment or any other way into > any of the newsgroups except spamcop.spam > > Even spamcop.spam isn't as good a way to submit spam as a tracking URL > as demonstrated. > > You [probably] shouldn't be configured to make your attachments > uuencoded, unless you are specifically trying to hop over some hurdle I > don't know about. That configuration is here: OE/ Tools/ Options/ Send > tab - News sending format - Plain text settings button/ - select MIME > encoding and None from the menu instead of the other radio button > Uuencoding. > > The problem is, at least in this particular little instance in which > there is already a relative no-no of posting spam in the wrong group and > putting an attachment into this group, that if someone is trying to > 'cope with' your attachment that the 'issue' can't be examined quite as > easily. If the original spam had been not uuencoded as an attachment > instead of mime, it would have been one decoding step more accessible. > It is possible for someone to handle your post 'as is' insecurely if > they handle it carelessly. > > If someone else's OE is configured insecurely and if you post a > dangerous .eml attachment and they can't 'see' what is 'inside' your > attachment because all they see in the Properties is 'begin 666' and > then the encoding, the careless viewer might decide to click open the > Solid Financing for the USA!.eml -- and if that eml is a dangerous item > somehow, then they have become virus infected from the content or > perhaps by being delivered to a bad website. > > > -- > Mike Easter > kibitzer, not SC admin > From nobody at devnull.spamcop.net Sun Mar 13 16:45:30 2005 From: nobody at devnull.spamcop.net (WazoO) Date: Sun Mar 13 17:50:32 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: "The Father Mind of DM Industries" wrote in message news:d1289d$81s$1@news.spamcop.net... > > On the forum I had registered for it but it apparently required that I check > my eMail and autherize my self and I must have missed where it said that. Admitting that it's been a long time (and I will go take a look) . but I'm not sure how this could be missed either. . > My one question I forgot to include earlier is, How do I back out my > mistakes. How do I cancel out the submissions including my IP's? The Forum FAQ (which is readable to all) contains an entry; "How to Unsend a Report" .... From TheFatherMind at Dangerous-Minds.NET Sun Mar 13 16:21:27 2005 From: TheFatherMind at Dangerous-Minds.NET (The Father Mind of DM Industries) Date: Sun Mar 13 19:25:03 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: Not sure how I missed that. I went through there. Thank you! "WazoO" wrote in message news:d12fqa$bma$1@news.spamcop.net... > "The Father Mind of DM Industries" wrote > in message news:d1289d$81s$1@news.spamcop.net... > > > > On the forum I had registered for it but it apparently required that I > check > > my eMail and autherize my self and I must have missed where it said that. > > Admitting that it's been a long time (and I will go take a look) . > but I'm not sure how this could be missed either. > . > > My one question I forgot to include earlier is, How do I back out my > > mistakes. How do I cancel out the submissions including my IP's? > > The Forum FAQ (which is readable to all) contains an entry; > "How to Unsend a Report" .... > > From TheFatherMind at Dangerous-Minds.NET Sun Mar 13 21:01:24 2005 From: TheFatherMind at Dangerous-Minds.NET (The Father Mind of DM Industries) Date: Mon Mar 14 00:05:04 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: Okay I fixed the dns resolve on both servers. But it still is not working. See example. http://www.spamcop.net/sc?id=z741906119z23de0e976e15d09dc6f3cec824e26dd5z "Mike Easter" wrote in message news:d11fgl$rhg$1@news.spamcop.net... > Mike Easter wrote: > > The subject of attachments and uuencoding > > is another topic that I'll save for later after discussing the > > problem you are asking about. > > You shouldn't be submitting spam as an attachment or any other way into > any of the newsgroups except spamcop.spam > > Even spamcop.spam isn't as good a way to submit spam as a tracking URL > as demonstrated. > > You [probably] shouldn't be configured to make your attachments > uuencoded, unless you are specifically trying to hop over some hurdle I > don't know about. That configuration is here: OE/ Tools/ Options/ Send > tab - News sending format - Plain text settings button/ - select MIME > encoding and None from the menu instead of the other radio button > Uuencoding. > > The problem is, at least in this particular little instance in which > there is already a relative no-no of posting spam in the wrong group and > putting an attachment into this group, that if someone is trying to > 'cope with' your attachment that the 'issue' can't be examined quite as > easily. If the original spam had been not uuencoded as an attachment > instead of mime, it would have been one decoding step more accessible. > It is possible for someone to handle your post 'as is' insecurely if > they handle it carelessly. > > If someone else's OE is configured insecurely and if you post a > dangerous .eml attachment and they can't 'see' what is 'inside' your > attachment because all they see in the Properties is 'begin 666' and > then the encoding, the careless viewer might decide to click open the > Solid Financing for the USA!.eml -- and if that eml is a dangerous item > somehow, then they have become virus infected from the content or > perhaps by being delivered to a bad website. > > > -- > Mike Easter > kibitzer, not SC admin > From MikeE at ster.invalid Mon Mar 14 02:58:54 2005 From: MikeE at ster.invalid (Mike Easter) Date: Mon Mar 14 06:00:26 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: The Father Mind of DM Industries wrote: > Okay I fixed the dns resolve on both servers. Goodjob > But it still is not working. > See example. www.spamcop.net/sc?id=z741906119z23de0e976e15d09dc6f3cec824e26dd5z Yes. The parser is definitely b0rken and providing the wrong source. Thanks for converting to a tracker ;-) You are going to have to transition over to mailhosts to get proper parsing. The advantage of mailhosts is that after configuration the parser becomes familiar with your server's lines, and so the parser is 'spoon fed' the source answer. http://www.spamcop.net/mcgi?action=mhedit&authcode=X4vo9qbIhGGL1Dxx Mailhost configuration Altho' the mailhost logic was constructed to overcome problems with SC tripping during the parse because of not properly recognizing bogus lines, it also solves some other mysterious weaknesses. I can't figure out why SC is getting this wrong. I've messed with some forged lines on the other one I posted the tracker for to see if I could create something in the ballpark that it gets right, but I don't understand yet why it is blowing this. The verbose language shows the 'thinking' is correct right down to the moment/line that it names the wrong source. If you aren't yet configured to see the verbose of the logic, that is selected in the Preferences/ Report Handling Options/ Show Technical Details during reporting section/ check Show technical data "SpamCop can reveal the logic it uses as it finds the right reporting parties for your spam. This can be helpful for advanced users who want to double-check SpamCop's logic, or for new users who want to learn from SpamCop's example." -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Mon Mar 14 08:44:17 2005 From: MikeE at ster.invalid (Mike Easter) Date: Mon Mar 14 11:45:07 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: The Father Mind of DM Industries wrote: > Okay I fixed the dns resolve on both servers. If you have access to the Postfix at 64.81.88.120 rDNS server-03.dmindustries.net -- you need to take the caps out of its name in the 'by' field in this line: Received: from 64.81.88.120 (unknown [221.234.27.33]) by Server-03.DMIndustries.NET (Postfix) with SMTP id 4C36714478; Sun, 13 Mar 2005 17:54:30 -0800 (PST) The helo doesn't matter [here, maybe somewhere] and the 'Received: by' line doesn't matter, but the 'by' field is very important to SC. The rest of the problem is in something improper of the folding of the last bogusline which I haven't figured out yet. Here is both problems straightened out www.spamcop.net/sc?id=z742094018zfd2acfe0d5d74e233e5bc25e27e5187ez compare to yours below > But it still is not working. > See example. > http://www.spamcop.net/sc?id=z741906119z23de0e976e15d09dc6f3cec824e26dd5z -- Mike Easter kibitzer, not SC admin From nospam at dev.null Mon Mar 14 22:07:39 2005 From: nospam at dev.null (Anty Spam) Date: Mon Mar 14 15:10:04 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: "Mike Easter" wrote in message news:d13qmq$vel$1@news.spamcop.net... "...definitely b0rken and ..." I KNOW WHAT YOU! HAVE BEEN READING :-) From MikeE at ster.invalid Mon Mar 14 15:32:23 2005 From: MikeE at ster.invalid (Mike Easter) Date: Mon Mar 14 18:35:03 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: Anty Spam wrote: > "Mike Easter" > "...definitely b0rken and ..." > > I KNOW WHAT YOU! HAVE BEEN READING :-) I didn't know b0rken had a particular source -- just one of those usenet jargonny terms that I don't see discussed anywhere. -- Mike Easter kibitzer, not SC admin From TheFatherMind at Dangerous-Minds.NET Mon Mar 14 18:42:39 2005 From: TheFatherMind at Dangerous-Minds.NET (The Father Mind of DM Industries) Date: Mon Mar 14 21:45:09 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: > If you have access to the Postfix at 64.81.88.120 rDNS > server-03.dmindustries.net -- you need to take the caps out of its name > in the 'by' field in this line: > > Received: from 64.81.88.120 (unknown [221.234.27.33]) by > Server-03.DMIndustries.NET (Postfix) with SMTP id 4C36714478; Sun, 13 > Mar 2005 17:54:30 -0800 (PST) Okay well I believe that is coming from the srever its self. I have bad habit of using Proper lettering when typing out domain names. Yea I am going to work with you on this in every way I can. I have been pondering this. Now let me explain to you some things that will help us resolve this... I have an account on my mail server that I direct all spam to (Not the way it sounds). I have had clients that have had eMail accounts and those mail accounts just receive NOTHING but spam. All day long spam spam spam. Old business accounts of employees of business that I support. So I tunnel all those accounts via alias into one account. That account forwards the spam via a SpamCop supplied script perl script to the quick reporting on SpamCop. Those eMails are never reporting the servers IP (they work). Now, the eMail account in question is my personal account. This is an eMail account on the DMIndustries server (Also Dangerous-Minds.NET) that is being forwarded via the .forward file to an account on TotalSystemControl.com. Also a postfix mail server on a redhat Linux box. I built and admin both servers. I own the DMIndustries.net server and the TotalSystemControl server is owned by a friend. So what ever is happening is happening (I would guess) because of the forwarding or because of something on the totalsystemcontrol server. Or worse case because of Outlook Express... but then other people would be reporting this I am sure. I have changed the settings on both servers all references to the servers are in lower case now. I had a spam come in and it worked as it is supposed to. I will test some more and report back to you as not ALL spam's were having this problem. ... Master Merlin Cul Kirkpatrick "Mike Easter" wrote in message news:d14euc$bgg$1@news.spamcop.net... > The Father Mind of DM Industries wrote: > > Okay I fixed the dns resolve on both servers. > > If you have access to the Postfix at 64.81.88.120 rDNS > server-03.dmindustries.net -- you need to take the caps out of its name > in the 'by' field in this line: > > Received: from 64.81.88.120 (unknown [221.234.27.33]) by > Server-03.DMIndustries.NET (Postfix) with SMTP id 4C36714478; Sun, 13 > Mar 2005 17:54:30 -0800 (PST) > > The helo doesn't matter [here, maybe somewhere] and the 'Received: by' > line doesn't matter, but the 'by' field is very important to SC. > > The rest of the problem is in something improper of the folding of the > last bogusline which I haven't figured out yet. > > Here is both problems straightened out > > www.spamcop.net/sc?id=z742094018zfd2acfe0d5d74e233e5bc25e27e5187ez > > compare to yours below > > > But it still is not working. > > See example. > > > http://www.spamcop.net/sc?id=z741906119z23de0e976e15d09dc6f3cec824e26dd5z > > > -- > Mike Easter > kibitzer, not SC admin > From TheFatherMind at Dangerous-Minds.NET Tue Mar 15 11:40:21 2005 From: TheFatherMind at Dangerous-Minds.NET (The Father Mind of DM Industries) Date: Tue Mar 15 14:40:05 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: I have submitted like 8 spam so far and all of them have worked correctly so far. "Mike Easter" wrote in message news:d14euc$bgg$1@news.spamcop.net... > The Father Mind of DM Industries wrote: > > Okay I fixed the dns resolve on both servers. > > If you have access to the Postfix at 64.81.88.120 rDNS > server-03.dmindustries.net -- you need to take the caps out of its name > in the 'by' field in this line: > > Received: from 64.81.88.120 (unknown [221.234.27.33]) by > Server-03.DMIndustries.NET (Postfix) with SMTP id 4C36714478; Sun, 13 > Mar 2005 17:54:30 -0800 (PST) > > The helo doesn't matter [here, maybe somewhere] and the 'Received: by' > line doesn't matter, but the 'by' field is very important to SC. > > The rest of the problem is in something improper of the folding of the > last bogusline which I haven't figured out yet. > > Here is both problems straightened out > > www.spamcop.net/sc?id=z742094018zfd2acfe0d5d74e233e5bc25e27e5187ez > > compare to yours below > > > But it still is not working. > > See example. > > > http://www.spamcop.net/sc?id=z741906119z23de0e976e15d09dc6f3cec824e26dd5z > > > -- > Mike Easter > kibitzer, not SC admin > From john at home.highertech.net Wed Mar 16 16:50:32 2005 From: john at home.highertech.net (COL/John Aldrich) Date: Wed Mar 16 11:55:05 2005 Subject: [SpamCop-Mail] Problems with "whitelist and release" in held mail Message-ID: From nospam at dev.null Wed Mar 16 23:36:07 2005 From: nospam at dev.null (Anty Spam) Date: Wed Mar 16 16:35:32 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: "Mike Easter" wrote in message news:d156rg$o71$1@news.spamcop.net... > Anty Spam wrote: > > "Mike Easter" > > > "...definitely b0rken and ..." > > > > I KNOW WHAT YOU! HAVE BEEN READING :-) > > I didn't know b0rken had a particular source -- just one of those usenet > jargonny terms that I don't see discussed anywhere. > I know it, just kidding ... Topical though on this ng. Like signatures: " Thank you and have a "Special Blessed Day" " :-) Cheers From jeffg at spamcop.net Wed Mar 16 23:57:34 2005 From: jeffg at spamcop.net (Jeff G.) Date: Thu Mar 17 00:00:03 2005 Subject: [SpamCop-Mail] Re: Problems with "whitelist and release" in held mail References: Message-ID: "COL/John Aldrich" wrote in message news:d19o4o$483$1@news.spamcop.net... > Cat got your tongue? -- Thanks and Best Regards, Jeff G. I have been a SpamCop User/Member/Customer since 1999 and am a Moderator of the new web-based forums (now the primary method for getting help, http://forum.spamcop.net). Please reply via Forum, Group, or List only. From TheFatherMind at Dangerous-Minds.NET Thu Mar 17 02:23:59 2005 From: TheFatherMind at Dangerous-Minds.NET (The Father Mind of DM Industries) Date: Thu Mar 17 05:25:27 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: OMG some guy is blessing people on my thread!!! I am not sure what to do now. "Anty Spam" wrote in message news:d1a8nu$fh8$1@news.spamcop.net... > > "Mike Easter" wrote in message > news:d156rg$o71$1@news.spamcop.net... > > Anty Spam wrote: > > > "Mike Easter" > > > > > "...definitely b0rken and ..." > > > > > > I KNOW WHAT YOU! HAVE BEEN READING :-) > > > > I didn't know b0rken had a particular source -- just one of those usenet > > jargonny terms that I don't see discussed anywhere. > > > > I know it, just kidding ... > > Topical though on this ng. Like signatures: " Thank you and have a "Special > Blessed Day" " :-) > > Cheers > > > From TheFatherMind at Dangerous-Minds.NET Thu Mar 17 02:29:21 2005 From: TheFatherMind at Dangerous-Minds.NET (The Father Mind of DM Industries) Date: Thu Mar 17 05:30:03 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: No No we are not through this yet. I managed to forward about 10+ before another one showed up. http://www.spamcop.net/sc?id=z742897644ze824e48550385cd9de71b82dfacb0d87z Tell me what I did wrong here please. :) I looked at it and I am not sure. "Mike Easter" wrote in message news:d14euc$bgg$1@news.spamcop.net... > The Father Mind of DM Industries wrote: > > Okay I fixed the dns resolve on both servers. > > If you have access to the Postfix at 64.81.88.120 rDNS > server-03.dmindustries.net -- you need to take the caps out of its name > in the 'by' field in this line: > > Received: from 64.81.88.120 (unknown [221.234.27.33]) by > Server-03.DMIndustries.NET (Postfix) with SMTP id 4C36714478; Sun, 13 > Mar 2005 17:54:30 -0800 (PST) > > The helo doesn't matter [here, maybe somewhere] and the 'Received: by' > line doesn't matter, but the 'by' field is very important to SC. > > The rest of the problem is in something improper of the folding of the > last bogusline which I haven't figured out yet. > > Here is both problems straightened out > > www.spamcop.net/sc?id=z742094018zfd2acfe0d5d74e233e5bc25e27e5187ez > > compare to yours below > > > But it still is not working. > > See example. > > > http://www.spamcop.net/sc?id=z741906119z23de0e976e15d09dc6f3cec824e26dd5z > > > -- > Mike Easter > kibitzer, not SC admin > From MikeE at ster.invalid Thu Mar 17 04:34:26 2005 From: MikeE at ster.invalid (Mike Easter) Date: Thu Mar 17 07:35:23 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: The Father Mind of DM Industries wrote: > No No we are not through this yet. > I managed to forward about 10+ before another one showed up. www.spamcop.net/sc?id=z742897644ze824e48550385cd9de71b82dfacb0d87z > > Tell me what I did wrong here please. :) > I looked at it and I am not sure. There's nothing you are doing wrong. The parser is screwing up. It is accepting a line and then tripping and jumping 'backwards' and upwards past the line it has already accepted. Abbreviated Received lines *comment from server-03.dmindustries.net (server-03.dmindustries.net [64.81.88.120]) by babcomm.totalsystemcontrol.com *serves recipient from 201-26-32-157.dsl.telesp.net.br (201-26-32-157.dsl.telesp.net.br [201.26.32.157]) by server-03.dmindustries.net *sourceline from ms-smtp-05.texas.rr.com ([24.93.47.44]) by mx3.charta2N.ca *bogusline from cpe-065-188-010-077.sc.rr.com ([81.243.148.86]) by sc004pub.verizon.net ([206.46.170.180]) *bogusline If we 'number' the lines above 1-4 top to bottom, the parse proceeds downward from 1 to 2, 2 to 3, etc. as a chain from above 'from' to below 'by'. The verbose of the parse 'mixes up' the process which it is describing; that is, it starts talking about the parsing of the next line down before it has completely digested the veracity of the line above. That is normal procedure. What is going wrong here is after SC accepts line 1 and works on line 2, SC accepts line 2 and starts working on line 3. In this case described below in more detail which I've annotated , it accepts line 2 and starts working on line 3. While it is working on line 3, it inexplicably 'goes back' and decides to say something is a forgery [which is always useless information, totally non-informative] and apparently 'unaccepts' line 2, which I don't understand. Parsing header: Received: from server-03.dmindustries.net (server-03.dmindustries.net [64.81.88.120]) by babcomm.totalsystemcontrol.com (Postfix) with ESMTP id 7F59B147C7 for ; Wed, 16 Mar 2005 15:16:33 -0800 (PST) 64.81.88.120 found host 64.81.88.120 = server-03.dmindustries.net (cached) server-03.dmindustries.net is 64.81.88.120 Possible spammer: 64.81.88.120 64.81.88.120 is an MX for server-03.dmindustries.net 64.81.88.120 is mx Received line accepted Received: by server-03.dmindustries.net (Postfix) id 253151448A; Wed, 16 Mar 2005 15:36:51 -0800 (PST) no from Ignored Received: from 201-26-32-157.dsl.telesp.net.br (201-26-32-157.dsl.telesp.net.br [201.26.32.157]) by server-03.dmindustries.net (Postfix) with SMTP id 500211445B for ; Wed, 16 Mar 2005 15:36:35 -0800 (PST) 201.26.32.157 found host 201.26.32.157 = 201-26-32-157.dsl.telesp.net.br. (cached) 201-26-32-157.dsl.telesp.net.br. is 201.26.32.157 64.81.88.120 not listed in dnsbl.njabl.org 64.81.88.120 not listed in cbl.abuseat.org 64.81.88.120 not listed in dnsbl.sorbs.net 64.81.88.120 is not an MX for babcomm.totalsystemcontrol.com 64.81.88.120 is an MX for server-03.dmindustries.net Possible spammer: 201.26.32.157 201.26.32.157 is not an MX for 201-26-32-157.dsl.telesp.net.br host 201-26-32-157.dsl.telesp.net.br (checking ip) = 201.26.32.157 host server-03.dmindustries.net (checking ip) = 64.81.88.120 64.81.88.120 not listed in dnsbl.njabl.org 64.81.88.120 not listed in cbl.abuseat.org 64.81.88.120 not listed in dnsbl.sorbs.net Chain test:server-03.dmindustries.net =? server-03.dmindustries.net server-03.dmindustries.net and server-03.dmindustries.net have same hostname - chain verified Possible relay: 64.81.88.120 64.81.88.120 not listed in relays.ordb.org. 64.81.88.120 has already been sent to relay testers Received line accepted Received: from ms-smtp-05.texas.rr.com ([24.93.47.44]) by mx3.charta2N.ca (iPlanet Messaging Server 5.2 Patch 2 (built Jul 14 2004)) with ESMTP id <0IDG46CZDI38VK@mx3.eastlink.ca> for x (ORCPT x); Wed, 16 Mar 2005 15:23:52 -0800 24.93.47.44 found host 24.93.47.44 = ms-smtp-05.texas.rr.com (cached) ms-smtp-05.texas.rr.com is 24.93.47.44 201.26.32.157 not listed in dnsbl.njabl.org 201.26.32.157 not listed in cbl.abuseat.org 201.26.32.157 not listed in dnsbl.sorbs.net 201.26.32.157 is not an MX for server-03.dmindustries.net 201.26.32.157 is not an MX for 201-26-32-157.dsl.telesp.net.br. 201.26.32.157 is not an MX for mx3.charta2N.ca 201.26.32.157 is not an MX for server-03.dmindustries.net 201.26.32.157 not listed in dnsbl.njabl.org Possible spammer: 24.93.47.44 host mx3.charta2N.ca (checking ip) ip not found ; mx3.charta2N.ca discarded as fake. 24.93.47.44 is not an MX for mx3.charta2N.ca 201.26.32.157 is not an MX for mx3.charta2N.ca Looks like a forgery 201.26.32.157 discarded as a forgery, using 64.81.88.120 Tracking message source: 64.81.88.120: I've been discussing this in a different thread in a different newsgroup over in spamcop. A previous tracker you posted which parsed incorrectly was parsing correctly and we discussed that improvement over there. The business about the caps problem appeared to be corrected by the parser algorithm, besides the fact that you eliminated it. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Thu Mar 17 04:43:47 2005 From: MikeE at ster.invalid (Mike Easter) Date: Thu Mar 17 07:45:05 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: Mike Easter wrote: > The Father Mind of DM Industries wrote: >> No No we are not through this yet. >> I managed to forward about 10+ before another one showed up. > www.spamcop.net/sc?id=z742897644ze824e48550385cd9de71b82dfacb0d87z >> >> Tell me what I did wrong here please. :) >> I looked at it and I am not sure. > > There's nothing you are doing wrong. However, I predict that you would get a correct result if you were to correctly configure yourself to use the mailhosts mod. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Thu Mar 17 19:39:42 2005 From: MikeE at ster.invalid (Mike Easter) Date: Thu Mar 17 22:40:04 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: Mike Easter wrote: > The Father Mind of DM Industries wrote: >> No No we are not through this yet. >> I managed to forward about 10+ before another one showed up. > www.spamcop.net/sc?id=z742897644ze824e48550385cd9de71b82dfacb0d87z > The parser is screwing up. It is accepting a line and then tripping > and jumping 'backwards' and upwards past the line it has already > accepted. > 201.26.32.157 is not an MX for mx3.charta2N.ca > > relationship or rather the non-relationship between 201.26.32.157 and > mx3.charta2N.ca in the 'by' field and breaking the chain between line > 2 and line 3 and deciding that 201.26.32.157 is, in fact the > spamsource, but NO.... SC makes a crazy decision....> > > Looks like a forgery > 201.26.32.157 discarded as a forgery, using 64.81.88.120 > Tracking message source: 64.81.88.120: > > make any sense to me, and gives the wrong result> The parser is getting this right now, I'm beginning to think that SC isn't 'competent' to name an IP as a source unless it is listed in a proxy db or something.: I hate to paste all of this verbose logic, but it is different from before: Received: from 201-26-32-157.dsl.telesp.net.br (201-26-32-157.dsl.telesp.net.br [201.26.32.157]) by server-03.dmindustries.net (Postfix) with SMTP id 500211445B for ; Wed, 16 Mar 2005 15:36:35 -0800 (PST) 201.26.32.157 found host 201.26.32.157 (getting name) = 201-26-32-157.dsl.telesp.net.br. 201-26-32-157.dsl.telesp.net.br is 201.26.32.157 64.81.88.120 not listed in dnsbl.njabl.org 64.81.88.120 not listed in cbl.abuseat.org 64.81.88.120 not listed in dnsbl.sorbs.net 64.81.88.120 is not an MX for babcomm.totalsystemcontrol.com 64.81.88.120 is an MX for server-03.dmindustries.net Possible spammer: 201.26.32.157 201.26.32.157 is not an MX for 201-26-32-157.dsl.telesp.net.br host 201-26-32-157.dsl.telesp.net.br (checking ip) = 201.26.32.157 host server-03.dmindustries.net (checking ip) = 64.81.88.120 64.81.88.120 not listed in dnsbl.njabl.org 64.81.88.120 not listed in cbl.abuseat.org 64.81.88.120 not listed in dnsbl.sorbs.net Chain test:server-03.dmindustries.net =? server-03.dmindustries.net server-03.dmindustries.net and server-03.dmindustries.net have same hostname - chain verified Possible relay: 64.81.88.120 64.81.88.120 not listed in relays.ordb.org. 64.81.88.120 has already been sent to relay testers Received line accepted Received: from ms-smtp-05.texas.rr.com ([24.93.47.44]) by mx3.charta2N.ca (iPlanet Messaging Server 5.2 Patch 2 (built Jul 14 2004)) with ESMTP id <0IDG46CZDI38VK@mx3.eastlink.ca> for x (ORCPT x); Wed, 16 Mar 2005 15:23:52 -0800 24.93.47.44 found host 24.93.47.44 = ms-smtp-05.texas.rr.com (cached) ms-smtp-05.texas.rr.com is 24.93.47.44 201.26.32.157 not listed in dnsbl.njabl.org 201.26.32.157 listed in cbl.abuseat.org ( 127.0.0.2 ) Open proxies untrusted as relays Tracking message source: 201.26.32.157: So, if all parses were to behave like this one, we would say that SC can't accurately name an IP as a source without jumping backwards for some alleged 'forgery' if the IP isn't listed in one of the proxy db/s. If the parser has 'degenerated' to that level of incompetency unless there's a mailhost configuration, that would be very sad. And I'm over in nanae trying to defend it. -- Mike Easter kibitzer, not SC admin From TheFatherMind at Dangerous-Minds.NET Thu Mar 17 19:40:26 2005 From: TheFatherMind at Dangerous-Minds.NET (The Father Mind of DM Industries) Date: Thu Mar 17 22:40:08 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: Okay, again I am going to make myself look foolish here. What is the mailhosts mod? If you previously mentioned this to me (And it sounds very familiar so either you did or I saw it mentioned some where) I am sorry for making you repeat your self. ... Master Merlin Cul Krikpatrick "Mike Easter" wrote in message news:d1btvb$dcg$1@news.spamcop.net... > Mike Easter wrote: > > The Father Mind of DM Industries wrote: > >> No No we are not through this yet. > >> I managed to forward about 10+ before another one showed up. > > www.spamcop.net/sc?id=z742897644ze824e48550385cd9de71b82dfacb0d87z > >> > >> Tell me what I did wrong here please. :) > >> I looked at it and I am not sure. > > > > There's nothing you are doing wrong. > > However, I predict that you would get a correct result if you were to > correctly configure yourself to use the mailhosts mod. > > -- > Mike Easter > kibitzer, not SC admin > From TheFatherMind at Dangerous-Minds.NET Thu Mar 17 19:44:48 2005 From: TheFatherMind at Dangerous-Minds.NET (The Father Mind of DM Industries) Date: Thu Mar 17 22:45:03 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: 201.26.32.157 discarded as a forgery, using 64.81.88.120 Tracking message source: 64.81.88.120: yea I saw this line and when I was reviewing the tech details (what I understood of it) made no sense. Okay so now that we have more or less established there is a problem with the parser, what now? "Mike Easter" wrote in message news:d1btdq$d1h$1@news.spamcop.net... > The Father Mind of DM Industries wrote: > > No No we are not through this yet. > > I managed to forward about 10+ before another one showed up. > www.spamcop.net/sc?id=z742897644ze824e48550385cd9de71b82dfacb0d87z > > > > Tell me what I did wrong here please. :) > > I looked at it and I am not sure. > > There's nothing you are doing wrong. > > The parser is screwing up. It is accepting a line and then tripping and > jumping 'backwards' and upwards past the line it has already accepted. > > Abbreviated Received lines *comment > from server-03.dmindustries.net (server-03.dmindustries.net > [64.81.88.120]) by babcomm.totalsystemcontrol.com *serves recipient > from 201-26-32-157.dsl.telesp.net.br (201-26-32-157.dsl.telesp.net.br > [201.26.32.157]) by server-03.dmindustries.net *sourceline > from ms-smtp-05.texas.rr.com ([24.93.47.44]) by mx3.charta2N.ca > *bogusline > from cpe-065-188-010-077.sc.rr.com ([81.243.148.86]) by > sc004pub.verizon.net ([206.46.170.180]) *bogusline > > If we 'number' the lines above 1-4 top to bottom, the parse proceeds > downward from 1 to 2, 2 to 3, etc. as a chain from above 'from' to below > 'by'. The verbose of the parse 'mixes up' the process which it is > describing; that is, it starts talking about the parsing of the next > line down before it has completely digested the veracity of the line > above. That is normal procedure. > > What is going wrong here is after SC accepts line 1 and works on line 2, > SC accepts line 2 and starts working on line 3. In this case described > below in more detail which I've annotated , it accepts > line 2 and starts working on line 3. While it is working on line 3, it > inexplicably 'goes back' and decides to say something is a forgery > [which is always useless information, totally non-informative] and > apparently 'unaccepts' line 2, which I don't understand. > > > Parsing header: > > Received: from server-03.dmindustries.net (server-03.dmindustries.net > [64.81.88.120]) by babcomm.totalsystemcontrol.com (Postfix) with ESMTP > id 7F59B147C7 for ; Wed, 16 Mar 2005 15:16:33 -0800 (PST) > 64.81.88.120 found > host 64.81.88.120 = server-03.dmindustries.net (cached) > server-03.dmindustries.net is 64.81.88.120 > Possible spammer: 64.81.88.120 > 64.81.88.120 is an MX for server-03.dmindustries.net > 64.81.88.120 is mx > Received line accepted > > a spamsource until the chain goes further back> > > Received: by server-03.dmindustries.net (Postfix) id 253151448A; Wed, > 16 Mar 2005 15:36:51 -0800 (PST) > no from > > Ignored > > > > Received: from 201-26-32-157.dsl.telesp.net.br > (201-26-32-157.dsl.telesp.net.br [201.26.32.157]) by > server-03.dmindustries.net (Postfix) with SMTP id 500211445B for ; > Wed, 16 Mar 2005 15:36:35 -0800 (PST) > 201.26.32.157 found > host 201.26.32.157 = 201-26-32-157.dsl.telesp.net.br. (cached) > 201-26-32-157.dsl.telesp.net.br. is 201.26.32.157 > 64.81.88.120 not listed in dnsbl.njabl.org > 64.81.88.120 not listed in cbl.abuseat.org > 64.81.88.120 not listed in dnsbl.sorbs.net > 64.81.88.120 is not an MX for babcomm.totalsystemcontrol.com > 64.81.88.120 is an MX for server-03.dmindustries.net > Possible spammer: 201.26.32.157 > 201.26.32.157 is not an MX for 201-26-32-157.dsl.telesp.net.br > host 201-26-32-157.dsl.telesp.net.br (checking ip) = 201.26.32.157 > host server-03.dmindustries.net (checking ip) = 64.81.88.120 > 64.81.88.120 not listed in dnsbl.njabl.org > 64.81.88.120 not listed in cbl.abuseat.org > 64.81.88.120 not listed in dnsbl.sorbs.net > Chain test:server-03.dmindustries.net =? server-03.dmindustries.net > server-03.dmindustries.net and server-03.dmindustries.net have same > hostname - chain verified > Possible relay: 64.81.88.120 > 64.81.88.120 not listed in relays.ordb.org. > 64.81.88.120 has already been sent to relay testers > Received line accepted > > spamsource; now 201.26.32.157 is the spamsource until the chain goes > further back; next we are working on the 3rd line> > > Received: from ms-smtp-05.texas.rr.com ([24.93.47.44]) by > mx3.charta2N.ca (iPlanet Messaging Server 5.2 Patch 2 (built Jul 14 > 2004)) with ESMTP id <0IDG46CZDI38VK@mx3.eastlink.ca> for x (ORCPT x); > Wed, 16 Mar 2005 15:23:52 -0800 > 24.93.47.44 found > host 24.93.47.44 = ms-smtp-05.texas.rr.com (cached) > ms-smtp-05.texas.rr.com is 24.93.47.44 > 201.26.32.157 not listed in dnsbl.njabl.org > 201.26.32.157 not listed in cbl.abuseat.org > 201.26.32.157 not listed in dnsbl.sorbs.net > 201.26.32.157 is not an MX for server-03.dmindustries.net > 201.26.32.157 is not an MX for 201-26-32-157.dsl.telesp.net.br. > 201.26.32.157 is not an MX for mx3.charta2N.ca > 201.26.32.157 is not an MX for server-03.dmindustries.net > 201.26.32.157 not listed in dnsbl.njabl.org > Possible spammer: 24.93.47.44 > host mx3.charta2N.ca (checking ip) ip not found ; mx3.charta2N.ca > discarded as fake. > 24.93.47.44 is not an MX for mx3.charta2N.ca > 201.26.32.157 is not an MX for mx3.charta2N.ca > > relationship or rather the non-relationship between 201.26.32.157 and > mx3.charta2N.ca in the 'by' field and breaking the chain between line 2 > and line 3 and deciding that 201.26.32.157 is, in fact the spamsource, > but NO.... SC makes a crazy decision....> > > Looks like a forgery > 201.26.32.157 discarded as a forgery, using 64.81.88.120 > Tracking message source: 64.81.88.120: > > make any sense to me, and gives the wrong result> > > I've been discussing this in a different thread in a different newsgroup > over in spamcop. > > A previous tracker you posted which parsed incorrectly was parsing > correctly and we discussed that improvement over there. The business > about the caps problem appeared to be corrected by the parser algorithm, > besides the fact that you eliminated it. > > -- > Mike Easter > kibitzer, not SC admin > From TheFatherMind at Dangerous-Minds.NET Thu Mar 17 19:50:35 2005 From: TheFatherMind at Dangerous-Minds.NET (The Father Mind of DM Industries) Date: Thu Mar 17 22:50:04 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: cbl.abuseat.org is on my list of filters. So that IP would have had to be added to it recently and this would explain why the logic changed. Otherwise cbl.abuseat.org should have stopped the spam from getting through. "Mike Easter" wrote in message news:d1dif4$g04$1@news.spamcop.net... > Mike Easter wrote: > > The Father Mind of DM Industries wrote: > >> No No we are not through this yet. > >> I managed to forward about 10+ before another one showed up. > > www.spamcop.net/sc?id=z742897644ze824e48550385cd9de71b82dfacb0d87z > > > The parser is screwing up. It is accepting a line and then tripping > > and jumping 'backwards' and upwards past the line it has already > > accepted. > > > 201.26.32.157 is not an MX for mx3.charta2N.ca > > > > > relationship or rather the non-relationship between 201.26.32.157 and > > mx3.charta2N.ca in the 'by' field and breaking the chain between line > > 2 and line 3 and deciding that 201.26.32.157 is, in fact the > > spamsource, but NO.... SC makes a crazy decision....> > > > > Looks like a forgery > > 201.26.32.157 discarded as a forgery, using 64.81.88.120 > > Tracking message source: 64.81.88.120: > > > > > make any sense to me, and gives the wrong result> > > The parser is getting this right now, I'm beginning to think that SC > isn't 'competent' to name an IP as a source unless it is listed in a > proxy db or something.: > > I hate to paste all of this verbose logic, but it is different from > before: > > > Received: from 201-26-32-157.dsl.telesp.net.br > (201-26-32-157.dsl.telesp.net.br [201.26.32.157]) by > server-03.dmindustries.net (Postfix) with SMTP id 500211445B for ; > Wed, 16 Mar 2005 15:36:35 -0800 (PST) > 201.26.32.157 found > host 201.26.32.157 (getting name) = 201-26-32-157.dsl.telesp.net.br. > 201-26-32-157.dsl.telesp.net.br is 201.26.32.157 > 64.81.88.120 not listed in dnsbl.njabl.org > 64.81.88.120 not listed in cbl.abuseat.org > 64.81.88.120 not listed in dnsbl.sorbs.net > 64.81.88.120 is not an MX for babcomm.totalsystemcontrol.com > 64.81.88.120 is an MX for server-03.dmindustries.net > Possible spammer: 201.26.32.157 > 201.26.32.157 is not an MX for 201-26-32-157.dsl.telesp.net.br > host 201-26-32-157.dsl.telesp.net.br (checking ip) = 201.26.32.157 > host server-03.dmindustries.net (checking ip) = 64.81.88.120 > 64.81.88.120 not listed in dnsbl.njabl.org > 64.81.88.120 not listed in cbl.abuseat.org > 64.81.88.120 not listed in dnsbl.sorbs.net > Chain test:server-03.dmindustries.net =? server-03.dmindustries.net > server-03.dmindustries.net and server-03.dmindustries.net have same > hostname - chain verified > Possible relay: 64.81.88.120 > 64.81.88.120 not listed in relays.ordb.org. > 64.81.88.120 has already been sent to relay testers > Received line accepted > > shows that SC is going to start considering the 'from' 201.26.32.157 as > the spamsource. It wants to finish thinking about the previous 1st line > which it accepted which temporarily made 64.81.88.120 the source, > because it matters if that IP is a proxy or something. Then it goes on > to decide that it is going to accept this 2nd line -- which means that > 64.81.88.120 isn't the source anymore. Now, 201.26.32.157 has become > the new source and SC is going to check the next line [and think about > 201 some more]> > > Received: from ms-smtp-05.texas.rr.com ([24.93.47.44]) by > mx3.charta2N.ca (iPlanet Messaging Server 5.2 Patch 2 (built Jul 14 > 2004)) with ESMTP id <0IDG46CZDI38VK@mx3.eastlink.ca> for x (ORCPT x); > Wed, 16 Mar 2005 15:23:52 -0800 > 24.93.47.44 found > host 24.93.47.44 = ms-smtp-05.texas.rr.com (cached) > ms-smtp-05.texas.rr.com is 24.93.47.44 > 201.26.32.157 not listed in dnsbl.njabl.org > 201.26.32.157 listed in cbl.abuseat.org ( 127.0.0.2 ) > Open proxies untrusted as relays > > think about the new apparent source 201.26.32.157 from the preceding > section and that's when it discovers that 201 is listed in the cbl. > That does it. That breaks the chain. It isn't going to chain from a > proxy to any kind of 'by' field, no matter if there's some kind of good > forgery in there.> > > Tracking message source: 201.26.32.157: > > > > So, if all parses were to behave like this one, we would say that SC > can't accurately name an IP as a source without jumping backwards for > some alleged 'forgery' if the IP isn't listed in one of the proxy db/s. > If the parser has 'degenerated' to that level of incompetency unless > there's a mailhost configuration, that would be very sad. And I'm over > in nanae trying to defend it. > > > -- > Mike Easter > kibitzer, not SC admin > From nobody at devnull.spamcop.net Thu Mar 17 21:50:18 2005 From: nobody at devnull.spamcop.net (WazoO) Date: Thu Mar 17 22:55:27 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: "The Father Mind of DM Industries" wrote in message news:d1dii7$g0n$1@news.spamcop.net... > Okay, again I am going to make myself look foolish here. What is the > mailhosts mod? If you previously mentioned this to me (And it sounds very > familiar so either you did or I saw it mentioned some where) I am sorry for > making you repeat your self. Configuring your account by identifying your MailHosts ..?? Button seen on your logged-into www.spamcop.net page Found under the FAQ from the Help button on the same page. Alternative to this is the Forum FAQ (which includes even more stuff) at http://forum.spamcop.net/forums/index.php From TheFatherMind at Dangerous-Minds.NET Thu Mar 17 20:07:34 2005 From: TheFatherMind at Dangerous-Minds.NET (The Father Mind of DM Industries) Date: Thu Mar 17 23:10:07 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: Okay I added the Mailhosts (I must be blind for missing that) And now it seems to be processing better. I can see where the "system" should be able to process the header with out knowing the hosts. But if you have the feature there to improve the system, why not rely on it to resolve those 3% foul-ups? ... Master Merlin Cul Kirkpatrick "The Father Mind of DM Industries" wrote in message news:d1bm5b$9b4$1@news.spamcop.net... > No No we are not through this yet. > I managed to forward about 10+ before another one showed up. > http://www.spamcop.net/sc?id=z742897644ze824e48550385cd9de71b82dfacb0d87z > > Tell me what I did wrong here please. :) > I looked at it and I am not sure. > > "Mike Easter" wrote in message > news:d14euc$bgg$1@news.spamcop.net... > > The Father Mind of DM Industries wrote: > > > Okay I fixed the dns resolve on both servers. > > > > If you have access to the Postfix at 64.81.88.120 rDNS > > server-03.dmindustries.net -- you need to take the caps out of its name > > in the 'by' field in this line: > > > > Received: from 64.81.88.120 (unknown [221.234.27.33]) by > > Server-03.DMIndustries.NET (Postfix) with SMTP id 4C36714478; Sun, 13 > > Mar 2005 17:54:30 -0800 (PST) > > > > The helo doesn't matter [here, maybe somewhere] and the 'Received: by' > > line doesn't matter, but the 'by' field is very important to SC. > > > > The rest of the problem is in something improper of the folding of the > > last bogusline which I haven't figured out yet. > > > > Here is both problems straightened out > > > > www.spamcop.net/sc?id=z742094018zfd2acfe0d5d74e233e5bc25e27e5187ez > > > > compare to yours below > > > > > But it still is not working. > > > See example. > > > > > http://www.spamcop.net/sc?id=z741906119z23de0e976e15d09dc6f3cec824e26dd5z > > > > > > -- > > Mike Easter > > kibitzer, not SC admin > > > From TheFatherMind at Dangerous-Minds.NET Thu Mar 17 20:09:44 2005 From: TheFatherMind at Dangerous-Minds.NET (The Father Mind of DM Industries) Date: Thu Mar 17 23:10:10 2005 Subject: [SpamCop-Mail] Re: Problems with "whitelist and release" in held mail References: Message-ID: No No... I know this trick. He used an invisible font. You have to hold a flame up to your monitor to see it. .. Master Merlin Cul Kirkpatrick "Jeff G." wrote in message news:d1b2nv$ucv$1@news.spamcop.net... > "COL/John Aldrich" wrote in message > news:d19o4o$483$1@news.spamcop.net... > > > > Cat got your tongue? > > -- > Thanks and Best Regards, Jeff G. > I have been a SpamCop User/Member/Customer since 1999 and am a > Moderator of the new web-based forums (now the primary method for > getting help, http://forum.spamcop.net). Please reply via Forum, Group, > or List only. > From MikeE at ster.invalid Thu Mar 17 20:32:14 2005 From: MikeE at ster.invalid (Mike Easter) Date: Thu Mar 17 23:35:22 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: The Father Mind of DM Industries wrote: > Okay so now that we have more or > less established there is a problem with the parser, what now? It now appears to be fixed. Sometimes I think that when we are discussing what is wrong with the parser, Julian is lurking in the ng and tweaking code down there in the dungeon or wherever he does that stuff. It appears that the parser is all better. I just forged an item to test an item very similar to the one we were discussing which parses correctly now, except that the .br IP I made up /isn't/ listed in the CBL, and SC now gets it right anyway. http://www.spamcop.net/sc?id=z743280656z9b76c1afbc70fc2bed3634ca9d8acdc4z So, now when SC sez 'looks like a forgery' - it makes sense. The 'forgery' is comparing the 'from' IP with the domainname of the 'by' field -- which doesn't 'compute' - so the 'by' must be 'forged'. Here's the pertinent section. And, SC doesn't 'jump backwards' and 'unaccept' something which it had already accepted earlier Received: from 201-26-32-156.dsl.telesp.net.br (201-26-32-156.dsl.telesp.net.br [201.26.32.156]) by server-03.dmindustries.net (Postfix) with SMTP id 500211445B for ; Wed, 16 Mar 2005 15:36:35 -0800 (PST) 201.26.32.156 found host 201.26.32.156 (getting name) = 201-26-32-156.dsl.telesp.net.br. 201-26-32-156.dsl.telesp.net.br is 201.26.32.156 64.81.88.120 not listed in dnsbl.njabl.org 64.81.88.120 not listed in cbl.abuseat.org 64.81.88.120 not listed in dnsbl.sorbs.net 64.81.88.120 is not an MX for babcomm.totalsystemcontrol.com 64.81.88.120 is an MX for server-03.dmindustries.net Possible spammer: 201.26.32.156 201.26.32.156 is not an MX for 201-26-32-156.dsl.telesp.net.br host 201-26-32-156.dsl.telesp.net.br (checking ip) = 201.26.32.156 host server-03.dmindustries.net (checking ip) = 64.81.88.120 64.81.88.120 not listed in dnsbl.njabl.org 64.81.88.120 not listed in cbl.abuseat.org 64.81.88.120 not listed in dnsbl.sorbs.net Chain test:server-03.dmindustries.net =? server-03.dmindustries.net server-03.dmindustries.net and server-03.dmindustries.net have same hostname - chain verified Possible relay: 64.81.88.120 64.81.88.120 not listed in relays.ordb.org. 64.81.88.120 has already been sent to relay testers Received line accepted Received: from ms-smtp-05.texas.rr.com ([24.93.47.44]) by mx3.charta2N.ca (iPlanet Messaging Server 5.2 Patch 2 (built Jul 14 2004)) with ESMTP id <0IDG46CZDI38VK@mx3.eastlink.ca> for x (ORCPT x); Wed, 16 Mar 2005 15:23:52 -0800 24.93.47.44 found host 24.93.47.44 = ms-smtp-05.texas.rr.com (cached) ms-smtp-05.texas.rr.com is 24.93.47.44 201.26.32.156 not listed in dnsbl.njabl.org 201.26.32.156 not listed in cbl.abuseat.org 201.26.32.156 not listed in dnsbl.sorbs.net 201.26.32.156 is not an MX for server-03.dmindustries.net 201.26.32.156 is not an MX for 201-26-32-156.dsl.telesp.net.br 201.26.32.156 is not an MX for mx3.charta2N.ca 201.26.32.156 is not an MX for server-03.dmindustries.net 201.26.32.156 not listed in dnsbl.njabl.org Possible spammer: 24.93.47.44 host mx3.charta2N.ca (checking ip) ip not found ; mx3.charta2N.ca discarded as fake. 24.93.47.44 is not an MX for mx3.charta2N.ca 201.26.32.156 is not an MX for mx3.charta2N.ca -- Mike Easter kibitzer, not SC admin From TheFatherMind at Dangerous-Minds.NET Thu Mar 17 20:50:29 2005 From: TheFatherMind at Dangerous-Minds.NET (The Father Mind of DM Industries) Date: Thu Mar 17 23:50:04 2005 Subject: [SpamCop-Mail] Re: Reporting My own IP? References: Message-ID: I am sure it helped that I added my servers to the Mailhosts lists area. Thank you for your assistance on this. We have lots of resources and good minds. If you ever need any thing please feel free to drop in and ask for it or visit. Best place to find us is on our private IRC server in the #Public channel on DMIndustries.net or use the cgi chat on http://Chat.Dangerous-Minds.NET Now, I am going to write what I will be calling a local RBL that will build a local list of IP's to exclude from eMail via spam collecting addresses. I hope that this will help cut down the spam even more. .. Master Merlin Cul Kirkpatrick "Mike Easter" wrote in message news:d1dlhj$iki$1@news.spamcop.net... > The Father Mind of DM Industries wrote: > > Okay so now that we have more or > > less established there is a problem with the parser, what now? > > It now appears to be fixed. > > Sometimes I think that when we are discussing what is wrong with the > parser, Julian is lurking in the ng and tweaking code down there in the > dungeon or wherever he does that stuff. > > It appears that the parser is all better. I just forged an item to test > an item very similar to the one we were discussing which parses > correctly now, except that the .br IP I made up /isn't/ listed in the > CBL, and SC now gets it right anyway. > > http://www.spamcop.net/sc?id=z743280656z9b76c1afbc70fc2bed3634ca9d8acdc4z > > So, now when SC sez 'looks like a forgery' - it makes sense. The > 'forgery' is comparing the 'from' IP with the domainname of the 'by' > field -- which doesn't 'compute' - so the 'by' must be 'forged'. Here's > the pertinent section. And, SC doesn't 'jump backwards' and 'unaccept' > something which it had already accepted earlier > > > Received: from 201-26-32-156.dsl.telesp.net.br > (201-26-32-156.dsl.telesp.net.br [201.26.32.156]) by > server-03.dmindustries.net (Postfix) with SMTP id 500211445B for ; > Wed, 16 Mar 2005 15:36:35 -0800 (PST) > 201.26.32.156 found > host 201.26.32.156 (getting name) = 201-26-32-156.dsl.telesp.net.br. > 201-26-32-156.dsl.telesp.net.br is 201.26.32.156 > 64.81.88.120 not listed in dnsbl.njabl.org > 64.81.88.120 not listed in cbl.abuseat.org > 64.81.88.120 not listed in dnsbl.sorbs.net > 64.81.88.120 is not an MX for babcomm.totalsystemcontrol.com > 64.81.88.120 is an MX for server-03.dmindustries.net > Possible spammer: 201.26.32.156 > 201.26.32.156 is not an MX for 201-26-32-156.dsl.telesp.net.br > host 201-26-32-156.dsl.telesp.net.br (checking ip) = 201.26.32.156 > host server-03.dmindustries.net (checking ip) = 64.81.88.120 > 64.81.88.120 not listed in dnsbl.njabl.org > 64.81.88.120 not listed in cbl.abuseat.org > 64.81.88.120 not listed in dnsbl.sorbs.net > Chain test:server-03.dmindustries.net =? server-03.dmindustries.net > server-03.dmindustries.net and server-03.dmindustries.net have same > hostname - chain verified > Possible relay: 64.81.88.120 > 64.81.88.120 not listed in relays.ordb.org. > 64.81.88.120 has already been sent to relay testers > Received line accepted > > now the new potential source is 201> > > Received: from ms-smtp-05.texas.rr.com ([24.93.47.44]) by > mx3.charta2N.ca (iPlanet Messaging Server 5.2 Patch 2 (built Jul 14 > 2004)) with ESMTP id <0IDG46CZDI38VK@mx3.eastlink.ca> for x (ORCPT x); > Wed, 16 Mar 2005 15:23:52 -0800 > 24.93.47.44 found > host 24.93.47.44 = ms-smtp-05.texas.rr.com (cached) > ms-smtp-05.texas.rr.com is 24.93.47.44 > 201.26.32.156 not listed in dnsbl.njabl.org > 201.26.32.156 not listed in cbl.abuseat.org > 201.26.32.156 not listed in dnsbl.sorbs.net > 201.26.32.156 is not an MX for server-03.dmindustries.net > 201.26.32.156 is not an MX for 201-26-32-156.dsl.telesp.net.br > 201.26.32.156 is not an MX for mx3.charta2N.ca > 201.26.32.156 is not an MX for server-03.dmindustries.net > 201.26.32.156 not listed in dnsbl.njabl.org > Possible spammer: 24.93.47.44 > host mx3.charta2N.ca (checking ip) ip not found ; mx3.charta2N.ca > discarded as fake. > 24.93.47.44 is not an MX for mx3.charta2N.ca > 201.26.32.156 is not an MX for mx3.charta2N.ca > > 'from' to its respective 'by' -- and so it breaks the chain. It also > isn't listed in any proxy db/s, but that doesn't matter, SC figgered it > out anyway. > > Looks like a forgery > Tracking message source: 201.26.32.156: > > crazy before> > > > > -- > Mike Easter > kibitzer, not SC admin > From TheFatherMind at Dangerous-Minds.NET Sat Mar 19 01:24:14 2005 From: TheFatherMind at Dangerous-Minds.NET (The Father Mind of DM Industries) Date: Sat Mar 19 04:25:05 2005 Subject: [SpamCop-Mail] reporter.pl Message-ID: I am using reporter.pl to bounce my mail to spamcop from a spam only account. This was working just fine.. perfect even, until I upgraded from postfix v2.0.18 to 2.2.1-1.rh9 Now it seems when ever the reporter.pl bounces mail it never makes it to spamcop but instead bounces around in a strange way in my mail queue and then vanishes. This seems to be the only thing wrong with the mailserver. Mar 19 01:25:24 Server-03 postfix/local[19039]: EADF514480: to=, relay=local, delay=3, status=sent (delivered to command: /home/spam/bin/reporter.pl) Mar 19 01:25:24 Server-03 postfix/qmgr[15723]: EADF514480: removed And then in Webmin I see it in the queue bouncing around and vanishing with the from or to box empty. Has any one seen any thing like this on their system? -- Thank You... .. Master Merlin Cul Kirkpatrick From shorn at spamcop.net Sat Mar 19 15:30:14 2005 From: shorn at spamcop.net (Ascleptius) Date: Sat Mar 19 16:35:39 2005 Subject: [SpamCop-Mail] Any pine users out there. Message-ID: Hi: Sorry for the cross posting but I deparately need help. When I try to launch the Pine Email client I keep getting the error message "[Error: "Invalid folder name" Can't fetch remote configuration]". Needless to say, I cannot access my spamcop account via IMAP. I tried the Pine newsgroup but the Pine people told me to ask someone at spamcop. I'm showing my pinere file so another Pine user might be able to tell me what I'm doning wrong, and tell me how to fix it. If anyone can tell me what I need to do to fix it, I would deeply apprecaite it. TIA Ascleptius -----------------pinerc file-------------------------------------------- # Updated by Pine(tm) 4.00, copyright 1989-1998 University of Washington. # # Pine configuration file -- customize as needed. # # This file sets the configuration options used by Pine and PC-Pine. If you # are using Pine on a Unix system, there may be a system-wide configuration # file which sets the defaults for these variables. There are comments in # this file to explain each variable, but if you have questions about # specific settings see the section on configuration options in the Pine # notes. On Unix, run pine -conf to see how system defaults have been set. # For variables that accept multiple values, list elements are separated # by commas. A line beginning with a space or tab is considered to be a # continuation of the previous line. For a variable to be unset its value # must be blank. To set a variable to the empty string its value should # be "". You can override system defaults by setting a variable to the # empty string. Switch variables are set to either "yes" or "no", and # default to "no". # Lines beginning with "#" are comments, and ignored by Pine. #Example: user-id=xyz123 user-id=shorn@spamcop.net #Example: personal-name=My Name personal-name=Steven Horn #Example: user-domain=u.washington.edu user-domain=imap.spamcop.net #Example: smtp-server=smtp.foobar.edu smtp-server=mail.mailcircuit.com/user-id=kcom #Example: nntp-server=news.foobar.edu nntp-server=news.alt.net/user=sjsm #Example: inbox-path={imapserver.foobar.edu}inbox inbox-path={imap.spamcop.net/user=shorn@spamcop.net/tls/novalidate-cert}INBOX #Example: incoming-folders= "WIDGETS" {imapserver.foobar.edu}widgets, # "CompMailPine" {imapserver.foobar.edu}{news.foobar.edu/nntp}#news.comp.mail.pine #Note: the second example requires a recent version of the UW IMAP server, which is acting as a news proxy in this case incoming-folders= #Example: folder-collections=MAIN {imapserver.foobar.edu}mail/[*], PROJECTS {imapserver.foobar.edu}projects/[*] folder-collections={imap.spamcop.net/user=shorn@spamcop.net/tls/novalidate-cert}INBOX.[] #You can leave the following group of variables blank; Pine will pick default names news-collections= default-fcc= postponed-folder= read-message-folder= signature-file= #Example: address-book=MYBOOK {imapserver.foobar.edu}addrbook #Note: this example identifies a Pine addressbook being stored on your IMAP server address-book= feature-list=delete-skips-deleted, use-current-dir, enable-mail-check-cue, auto-open-next-unread, enable-incoming-folders, news-read-in-newsrc-order, news-post-without-validation, select-without-confirm, news-approximates-new-status, compose-maps-delete-key-to-ctrl-d, enable-mouse-in-xterm, enable-aggregate-command-set, enable-bounce-cmd, enable-flag-cmd, enable-full-header-cmd, enable-jump-shortcut, enable-suspend, enable-tab-completion, enable-unix-pipe-cmd, quit-without-confirm, enable-alternate-editor-cmd, single-column-folder-list, enable-8bit-nntp-posting, enable-8bit-esmtp-negotiation, enable-verbose-smtp-posting, compose-cut-from-cursor, auto-zoom-after-select, auto-unzoom-after-apply, print-offers-custom-cmd-prompt, print-formfeed-between-messages, auto-move-read-msgs, enable-dot-files, enable-dot-folders, tab-visits-next-new-message-only, use-subshell-for-suspend, enable-newmail-in-xterm-icon, expanded-view-of-distribution-lists, save-will-not-delete, compose-posts-in-background, enable-background-sending, enable-goto-in-file-browser, no-print-index-enabled, enable-delivery-status-notification, enable-search-and-replace, enable-arrow-navigation, expunge-without-confirm, enable-msg-view-urls, enable-msg-view-web-hostnames, enable-exit-via-lessthan-command, enable-partial-match-lists, enable-fast-recent-test, add-ldap-result-to-addrbook initial-keystroke-list=i default-composer-hdrs=To, Cc, Bcc, Subject customized-hdrs=Reply-To:, Organization: Not Much But I Keep Trying saved-msg-name-rule=by-recipient fcc-name-rule= sort-key= character-set=ISO-8859-1 editor= image-viewer= use-only-domain-name=No printer= personal-print-command= last-time-prune-questioned=98.6 last-version-used=4.00 addrbook-sort-rule=dont-sort global-address-book= mail-directory= normal-foreground-color=black normal-background-color=cyan reverse-foreground-color=white reverse-background-color=blue font-size=12 # Full path and name of NEWSRC file newsrc-path= # Extension used for local folder names (".MTX" by default). folder-extension="" # Name and size of font. font-name="Fixedsys" font-style="" # Name and size of printer font. print-font-name="Lucida Console" print-font-size="10" print-font-style="" # Window position in the format: CxR+X+Y # Where C and R are the window size in characters and X and Y are the # screen position of the top left corner of the window. window-position=80x32+185+4b # Over-rides default path for saved-msg folder, e.g. =saved-messages (using first # folder collection dir) or ={host2}saved-mail or ="" (to suppress saving). # Default: saved-messages (Unix) or SAVEMAIL.MTX (PC) in default folder collection. default-saved-msg-folder= # This names the path to an alternative sendmail program which is # usually "/usr/lib/sendmail". It must support sendmail's "-bs" option. sendmail-path= # Specifies the program invoked by ^T in the Composer. (For Unix Pine) speller=ispell # Path and filename of news configation's active file. # The default is typically "/usr/lib/news/active". news-active-file-path= # Directory containing system's news data. # The default is typically "/usr/spool/news" news-spool-directory= # A list of alternate addresses the user is known by alt-addresses=xyz@u.foobar.edu, abc@cs.foobar.edu # The number of lines of overlap when scrolling through message text viewer-overlap=2 # The approximate number of seconds between checks for new mail mail-check-interval=180 # This is a list of formats for address books. Each entry in the list is made # up of space-delimited tokens telling which fields are displayed and in # which order. See help text addressbook-formats=NICKNAME FULLNAME(24) COMMENT # This gives a format for displaying the index. It is made # up of space-delimited tokens telling which fields are displayed and in # which order. See help text #index-format=FULLSTATUS MSGNO DATE FROMORTO(33%) SIZE SUBJECT(67%) index-format= # This variable takes a list of programs that message text is piped into # after MIME decoding, prior to display. #display-filters=_LEADING("-----BEGIN PGP")_ /usr/local/bin/pgp-decrypt -p _DATAFILE_ -s -m _RESULTFILE_ _PREPENDKEY_ display-filters= # This defines a program that message text is piped into before MIME # encoding, prior to sending sending-filters= # The number of seconds to sleep after writing a status message status-message-delay=0 # Specifies the column of the screen where the composer should wrap. composer-wrap-column= # Specifies the string to insert when replying to message. reply-indent-string= # Which category default print command is in personal-print-category=3 # List of context and folder pairs, delimited by a space, to be offered for # pruning each month. For example: {host1}mail/[] mumble pruned-folders= # List of folder pairs; the first indicates a folder to archive, and the # second indicates the folder read messages in the first should # be moved to. #Example: incoming-archive-folders=DOOM doom-arch, # PINE-INFO pine-info-arch, incoming-archive-folders= # emulator's into Pine's composer. # Note: _FILE_ will be replaced with the temporary file used in the uplaod. upload-command= # Path and filename of the program used to download text via your terminal # emulator from Pine's export and save commands. # Note: _FILE_ will be replaced with the temporary file used in the downlaod. download-command= # When viewing messages, include this list of headers viewer-hdrs=date, from, reply-to, to, cc, newsgroups, resent-from, resent-to, organization, subject # Sets the default folder and collectionoffered at the Goto Command's prompt. goto-default-rule=first-collection-with-inbox-default # This names the root of the tree to which the user is restricted when reading # and writing folders and files. For example, on Unix ~/work confines the # user to the subtree beginning with their work subdirectory. # (Note: this alone is not sufficient for preventing access. You will also # need to restrict shell access and so on, see Pine Technical Notes.) # Default: not set (so no restriction) operating-dir= # Text sent to terminal emulator prior to invoking the program defined by # the upload-command variable. # Note: _FILE_ will be replaced with the temporary file used in the upload. upload-command-prefix= # Text sent to terminal emulator prior to invoking the program defined by # the download-command variable. # Note: _FILE_ will be replaced with the temporary file used in the downlaod. download-command-prefix= # Sets the search path for the mailcap cofiguration file. # NOTE: colon delimited under UNIX, semi-colon delimited under DOS/Windows. mailcap-search-path= # Sets the search path for the mimetypes cofiguration file. # NOTE: colon delimited under UNIX, semi-colon delimited under DOS/Windows. mimetype-search-path= # Sets the time in seconds that Pine will attempt to open a network # connection. The default is 30, the minimum is 5, and the maximum is# system defined (typically 75). tcp-open-timeout=5 # Sets the time in seconds that Pine will attempt to open a UNIX remote # shell connection. The default is 15, min is 5, and max is unlimited. # Zero disables rsh altogether. rsh-open-timeout=5 # Number of lines from top and bottom of screen where single # line scrolling occurs. scroll-margin=5 # Specifies the string to use when sending a message with no to or cc. empty-header-message= # Sets the version number Pine will use as a threshold for offering # its new version message on startup. new-version-threshold= # Program to open Internet URLS (e.g. http or ftp references). # PC-Pine 4.00 and later will use your default web browser web-browser= # Sets message which cursor begins on. Choices: first-unseen, first-recent, # first, last. Default: "first-unseen". incoming-startup-rule=first-recent # Set by Pine; contains data for caching remote address books. remote-abook-metafile= # LDAP servers for looking up addresses. #Example: ldap-servers=ldap.four11.com "/base=/impl=0/type=/srch=/time=/size=/cust=", people.u.washington.edu "/base=o=University of Washington,c=US/impl=1/rhs=0/type=/srch=/time=/size=/cust=/nick=" ldap-servers= # How many extra copies of remote address book should be kept. Default: 3 remote-abook-history= # List of programs to open Internet URLs (e.g. http or ftp references). url-viewers= # Sets the name of the command used to open a UNIX remote shell connection. # The default is tyically /usr/ucb/rsh. rsh-path= # Sets the format of the command used to open a UNIX remote # shell connection. The default is "%s %s -l %s exec /etc/r%sd" # NOTE: the 4 (four) "%s" entries MUST exist in the provided command # where the first is for the command's path, the second is for the # host to connnect to, the third is for the user to connect as, and the # fourth is for the connection method (typically "imap") rsh-command= # List of mail drivers to disable. See technical notes. disable-these-drivers= # If no user input for this many hours, Pine will exit if in an idle loop # waiting for a new command. If set to zero (the default), then there will # be no timeout. user-input-timeout= From wb8tyw at qsl.network Sat Mar 19 17:10:29 2005 From: wb8tyw at qsl.network (John E. Malmberg) Date: Sat Mar 19 17:15:40 2005 Subject: [SpamCop-Mail] Re: Any pine users out there. In-Reply-To: References: Message-ID: Ascleptius wrote: > Hi: > > Sorry for the cross posting but I deparately need help. When I try to > launch the Pine Email client I keep getting the error message "[Error: > "Invalid folder name" Can't fetch remote configuration]". Needless to > say, I cannot access my spamcop account via IMAP. I tried the Pine > newsgroup but the Pine people told me to ask someone at spamcop. I'm > showing my pinere file so another Pine user might be able to tell me > what I'm doning wrong, and tell me how to fix it. If anyone can tell me > what I need to do to fix it, I would deeply apprecaite it. TIA I have set followups to the spamcop.mail group as that is the group that is most likely to be able to tell you what settings are needed on your e-mail client. Generally when a person cross posts, followups should be set to one of the groups so that there will not be thread fragments all over the place. The person that maintains the spamcop.net mail server has stated that they are only monitoring the web forum, so that is where you will most likely get help what settings are needed. The majority of your pine.rc file is obvious not relavent to solving the problem. Once you get confirmed on the correct settings for connecting to the spamcop.net mail server if you still need help the pine newsgroup may be able to help you. -John wb8tyw@qsl.network Personal Opinion Only From TheFatherMind at Dangerous-Minds.NET Tue Mar 29 11:15:01 2005 From: TheFatherMind at Dangerous-Minds.NET (The Father Mind of DM Industries) Date: Tue Mar 29 14:15:05 2005 Subject: [SpamCop-Mail] Re: reporter.pl References: Message-ID: Well as it turns out this upgrade I did on the mail server affected more then just that reporter script. It also killed eMail from a lot of my php services and my chat server. I was getting errors where it was not receiving the destination line. I downgraded postfix. I did find a lot of reports of this same problem in google. But most of them did not even realize where the problem was coming from. And the ones that did had no idea how to fix it. I suppose I just need to wait for the next stable release of postfix and try that. ... Master Merlin Cul Kirkpatrick "The Father Mind of DM Industries" wrote in message news:d1gr23$mut$1@news.spamcop.net... > I am using reporter.pl to bounce my mail to spamcop from a spam only > account. > This was working just fine.. perfect even, until I upgraded from postfix > v2.0.18 to 2.2.1-1.rh9 > Now it seems when ever the reporter.pl bounces mail it never makes it to > spamcop but instead bounces around in a strange way in my mail queue and > then vanishes. This seems to be the only thing wrong with the mailserver. > > Mar 19 01:25:24 Server-03 postfix/local[19039]: EADF514480: to= DMIndustries.NET>, relay=local, delay=3, status=sent (delivered to command: > /home/spam/bin/reporter.pl) > Mar 19 01:25:24 Server-03 postfix/qmgr[15723]: EADF514480: removed > > And then in Webmin I see it in the queue bouncing around and vanishing with > the from or to box empty. > Has any one seen any thing like this on their system? > > > -- > Thank You... > .. Master Merlin Cul Kirkpatrick >