hsc message board > Help reporting spam

hsc message board > Main > hsc Software Support

Eddie

Apr 13 2008, 11:30 PM

Hi Jeff,
I usually get errors while reporting spam, unless I uncheck the "Report Spamvertized URLs" box
The only exceptions seem to be Lycos, Yahoo, and Geocities. But at least 90% I'm getting errors.

So I have to uncheck the "Report Spamvertized URLs" box and my reports get sent, but only to spamreport@cox.net

My reports are already going to spamreport@cox.net even before I open my email program or Purify, since I report them via Cox's webmail.
What should I do so that Purify sends the reports to the different abuse addresses on a regular basis?

Thanks for your help.

Jeff Hendrickson

Apr 14 2008, 05:16 PM

Your complaints SHOULD NOT all be going to your ISP. If they are, then something is wrong.

They should be going to the ISP of the source of the message.

Sometimes, the reference URI doesn't have email addresses to report abuse.

Eddie

Apr 14 2008, 06:34 PM

QUOTE (Jeff Hendrickson @ Apr 14 2008, 10:16 AM)

Hi Jeff.
Each report is going to spamreport@cox.net and from time to time to additional addresses, but always to spamreport@cox.net

Could this be related to this thread?
http://www.hendricom.com/forums/index.php?...ic=2112&hl=

Jeff Hendrickson

Apr 14 2008, 06:57 PM

Can you please send me the complete SMTP header of a message that ONLY goes to cox.net?

Eddie

Apr 15 2008, 12:51 AM

Interestingly enough, my ISP will not allow me to send the email since it's identified as spam

Here it is:

Return-Path: <mbqlct@altavista.com>
Received: from eastrmimpi05.cox.net ([68.1.16.123])
by eastrmmtai109.cox.net
(InterMail vM.7.08.02.01 201-2186-121-102-20070209) with ESMTP
id <20080415002916.OKVX23840.eastrmmtai109.cox.net@eastrmimpi05.cox.net>;
Mon, 14 Apr 2008 20:29:16 -0400
Received: from barracuda.alfredstate.edu ([89.183.2.210])
by eastrmimpi05.cox.net with IMP
id DcR71Z01b4Xs0Np01cUyuu; Mon, 14 Apr 2008 20:29:24 -0400
From: "HealthStore" <mbqlct@altavista.com>
To: <afflyer1964@cox.net>
Subject: Pain killers, diabetes, ED and more at great prices
Date: Mon, 14 Apr 2008 16:41:01 -0700
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_008F_01C89E55.16FF7BB0"
Message-Id: <20080415002916.OKVX23840.eastrmmtai109.cox.net@eastrmimpi05.cox.net>

This is a multi-part message in MIME format.

------=_NextPart_000_008F_01C89E55.16FF7BB0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

afflyer1964

B

------=_NextPart_000_008F_01C89E55.16FF7BB0
Content-Type: text/html;;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<html>

<head>
<meta http-equiv=3D"Content-Language" content=3D"en-us">
<meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3Dwindows-1252">
<title>Pain killers, diabetes, ED and more at great prices</title>
</head>

<body>

<a target=3D"_blank" href=3D"http://www.pibenaie.com">
<img border=3D"0" src=3D"http://urlcut.com/1pvlj" width=3D"649" =
height=3D"95"></a> 
 
NO PRESCRlPT1ONS REQUIRED
Get Everything You Need In One Place
<a href=3D"http://www.buniopoeli.com">
Today's Special For Men Wanting a =
Larger Unit
Click Here</a>
<a href=3D"http://www.pibenaie.com">Pain =
Relief</a> 
C e l e b r e x, T r a m a d o l  =
etc 
 
<a href=3D"http://www.pibenaie.com">Men's Health</a> 
V i a g r a, C i a l i s  etc 
 
<a href=3D"http://www.pibenaie.com">Women's Health</a> 
F o s a m a x, S a r a f e m  etc 
 
<a href=3D"http://www.pibenaie.com">Weight Loss</a> 
L i p o t h i n, Z i m u l t i  =
etc 
 
<a href=3D"http://www.pibenaie.com">Sleep Aids</a> 
M e l a t o n i n, E l a v i l  =
etc
All filled and shipped from our P =
h arm in
Canada. Great Savings and no trips to your GP
 
<a href=3D"http://n.pibenaie.com/r.php">
<img border=3D"0" src=3D"http://unsgif.notlong.com" width=3D"416" =
height=3D"28"></a>

</body>

</html>
------=_NextPart_000_008F_01C89E55.16FF7BB0--

Eddie

Apr 15 2008, 04:17 AM

Another one:

Return-Path: <dmonopoly@chimu.com>
Received: from eastrmimpi03.cox.net ([68.1.16.121])
by eastrmmtai107.cox.net
(InterMail vM.7.08.02.01 201-2186-121-102-20070209) with ESMTP
id <20080415035932.EAXY28800.eastrmmtai107.cox.net@eastrmimpi03.cox.net>;
Mon, 14 Apr 2008 23:59:32 -0400
Received: from nbrooneyn.lowtherhall.vic.edu.au ([58.105.225.6])
by eastrmimpi03.cox.net with IMP
id Dfze1Z00a08uRWa01fzfY7; Mon, 14 Apr 2008 23:59:41 -0400
Received: from 171.184.149.193 (HELO localhost.localdomain) (100.186.193.163)
by 150.172.167.176 with SMTP; Tue, 15 Apr 2008 13:58:51 -1000
Date: Tue, 15 Apr 2008 13:58:51 -1000
Message-Id: <2IX950EJXVWDA379@chimu.com>
X-Mailer: MIME::Lite 3.01 (F2.72; A1.62; B3.01; Q3.01)
X-Header-CompanyDBUserName: hpccm
X-Header-MasterId: 508504
X-Header-Versions: Hewlett-Packard.7t0bn7nd7.fk@us.newsgram.hp.com
X-FID: 01E59DBC-7677-33AF-B7E6-99CDEA80DCB3
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
To: <address removed@cox.net>,
<address removed@cox.net>,
<address removed@cox.net>,
<address removed@cox.net>
From: "Alexandra Carlson" <dmonopoly@chimu.com>
Subject: *Le\/|tr@ Pr0fe$$i0na_3.82

At present you can get medical goods sitting at home

Best-selling medications

Big variety

The lowest cost you have ever seen

http://heardwhole.com

Jeff Hendrickson

Apr 15 2008, 10:22 AM

Thanks for the samples Eddie.

Purify is selective about which protocols that it will look at when tracing an email.

You've pointed out one that it does not, and probably should. This will be in the next release, which will be out very soon.

Eddie

Apr 15 2008, 11:33 AM

Thanks Jeff

Eddie

Apr 17 2008, 05:44 PM

This one gave me an error, both with a without Spamvertized URLs:

Return-Path: <dsuarezbg@mediafutures.org>
Received: from fed1rmimpi05.cox.net ([70.169.32.74])
by fed1rmmtai106.cox.net
(InterMail vM.7.08.02.01 201-2186-121-102-20070209) with ESMTP
id <20080417173151.QTZW1249.fed1rmmtai106.cox.net@fed1rmimpi05.cox.net>;
Thu, 17 Apr 2008 13:31:51 -0400
Received: from puysn ([190.56.248.121])
by fed1rmimpi05.cox.net with IMP
id EhXG1Z01i2dtfcW05hXtss; Thu, 17 Apr 2008 13:31:56 -0400
Date: Thu, 17 Apr 2008 10:43:39 -0700
X-Sender: <dsuarezbg@mediafutures.org>
To: <Removed Name@cox.net>
Bcc: <Removed Name@cox.net>, <Removed Name@cox.net>, <Removed Name@cox.net>, <Removed Name@cox.net>, <Removed Name@cox.net>, <Removed Name@cox.net>, <Removed Name@cox.net>, <Removed Name@cox.net>
Reply-To: "Dominique Suarez" <dsuarezbg@mediafutures.org>
In-Reply-To: <721401c89bb4$40b5fc1a$519faf60@034o0l1>
From: "Dominique Suarez" <dsuarezbg@mediafutures.org>
Subject: Does your PenisSize ruin your life? Our product will stop that.. hxx caoso xkyoq
Message-ID: <1208454219.8215@mediafutures.org>
Sender: <dsuarezbg@mediafutures.org>
Content-Type: text/plain;
charset="iso-8859-2"
Content-Transfer-Encoding: 8bit

** 100% Working PenisEnlargement herbal pill is here **
- Discreet packaging so others wont know what's inside the parcel
- Shipping to ALL countries
- The best formula available on market currently

click below link to find out more about this NEW product

http://pmdh.xstheupper.com

Eddie

Apr 17 2008, 06:58 PM

Another one with the same situation as the previous one:

Return-Path: <alden_shaffer_te@unimstores.com>
Received: from eastrmimpi05.cox.net ([68.1.16.123])
by eastrmmtai113.cox.net
(InterMail vM.7.08.02.01 201-2186-121-102-20070209) with ESMTP
id <20080417180618.BYIG16795.eastrmmtai113.cox.net@eastrmimpi05.cox.net>;
Thu, 17 Apr 2008 14:06:18 -0400
Received: from fovzrg ([201.15.76.223])
by eastrmimpi05.cox.net with IMP
id Ei2G1Z0084p3zz501i68No; Thu, 17 Apr 2008 14:06:20 -0400
From: "Alden Shaffer" <alden_shaffer_te@unimstores.com>
Date: Thu, 17 Apr 2008 11:17:34 -0700
Sender: <alden_shaffer_te@unimstores.com>
Message-ID: <1208456254.8490@unimstores.com>
To: <Removed Name@cox.net>
Bcc: <Removed Name@cox.net>, <Removed Name@cox.net>, <Removed Name@cox.net>, <Removed Name@cox.net>, <Removed Name@cox.net>, <Removed Name@cox.net>, <Removed Name@cox.net>, <Removed Name@cox.net>
X-Sender: <alden_shaffer_te@unimstores.com>
In-Reply-To: <e1f001c89e4f$01a4429d$6197d32b@90ipek2>
Subject: f Huge Saving For Pills >>> Buy ViagraPill, Cialix, Phentrimine, Levitr, SQMA, Tramadol cyapt nwr ru5d12dy
Content-Type: text/plain;
charset="iso-8859-2"
Content-Transfer-Encoding: 8bit

.. Over 200 A-Z medications to choose from ..

We give you FreeViagraPills (Free you 12 pills with any order)

. ViagraPill
. Cialix Pills
. PenisGrowth Pack
. SQMA
. Phentrimine
. Levitr
. Tramadol
. FemaleViagra
. & 400 more meds to choose from

Claim your Free 12 ViagraPills here with us

http://kqhk.xstheupper.com

Jeff Hendrickson

Apr 17 2008, 07:11 PM

Thanks for this Eddie. I'm unable to reproduce this here.

The domain traced, with reporting addresses.
What is the error that you are getting? Have you run this with logging on? What log entries are present for this error?

BTW, is your email tracing outside of the Cox domain now?

Eddie

Apr 17 2008, 09:59 PM

QUOTE (Jeff Hendrickson @ Apr 17 2008, 12:11 PM)

I just turned logging on.

"DNS lookup IP address = 70.169.32.70
Using cached DNS answer 70.169.32.70 = fed1rmimpi03.cox.net
DNS result = cox.net
Warning, no domain extension for 70
Rule #1 passes.
Rule #2 passes, line count 1.
DNS lookup IP address = 200.127.125.29
Using cached DNS answer 200.127.125.29 = 200-127-125-29.static.cab.prima.net.ar
DNS result = prima.net.ar
Warning, no domain extension for 29
Rule #1 passes.
Rule #2 passes, line count 2.
Rule #4, accepting 70.169.32.70.
Rule #6, accepting cox.net.
Rule #8, accepting 200.127.125.29.
Rule #11, accepting prima.net.ar.
DNS lookup IP address = 70.169.32.70
Using cached DNS answer 70.169.32.70 = fed1rmimpi03.cox.net
DNS result = cox.net
Warning, no domain extension for 70
Rule #1 passes.
Rule #2 passes, line count 1.
DNS lookup IP address = 200.127.125.29
Using cached DNS answer 200.127.125.29 = 200-127-125-29.static.cab.prima.net.ar
DNS result = prima.net.ar
Warning, no domain extension for 29
Rule #1 passes.
Rule #2 passes, line count 2.
GetResponse(), error 552 5.2.0 Em3D1Z00F1dXAAG03m3Er8 This message was undeliverable. This message has been found to be a potential spam message, and has therefore been blocked. Please visit http://coxagainstspam.cox.net for more information.

GetResponse(), error 552 5.2.0 Em3D1Z00F1dXAAG03m3Er8 This message was undeliverable. This message has been found to be a potential spam message, and has therefore been blocked. Please visit http://coxagainstspam.cox.net for more information."

It seems that my ISP (Cox) is actually preventing the report from being sent. Am I interpreting this correctly?
One solution would be to forward the email to unblock.requests@cox.net but that would be too time consuming. I would rather just delete these emails.

QUOTE (Jeff Hendrickson @ Apr 17 2008, 12:11 PM)

BTW, is your email tracing outside of the Cox domain now?

Excuse my lack of understanding, but how do I check that?

Jeff Hendrickson

Apr 17 2008, 10:32 PM

Holy moly, it does look like Cox is blocking these messages!

You know, you have access to a purify.cc account as a Purify user. You could use it to send your abuse complaints. Your purify.cc account will also allow you to use port 25 OR 26 on its SMTP server. Just shoot me an email, and I'll get you fixed up with this if you like...

Your log answered my question about the trace, looks great!

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.