I apologize for the length of this msg. Anyone posting a follow-up, please quote selectively. Here's a strange one. SC offered to send reports, and then either failed to send some of them, or failed to list all that were sent. In particular, reports apparently were not sent to [EMAIL PROTECTED], [EMAIL PROTECTED], and [EMAIL PROTECTED] . Part one that follows shows the way the tracking URL looked before the reports were sent. Part two is what I got after sending. The cpl.net addresses do not appear. Part three shows the tracking URL after the reports were sent. In part three, SC says it sent reports to the cpl.net addresses, although they did not appear in part two. PART ONE: Saved email: This page may be saved for future reference: http://spamcop.net/sc?id=z19151248z8e7d0d6cd7b90ce54d74b1b87e6d347fz Parsing header: Received: from mail.thesun.com.hk [210.176.128.169] () by MailAndNews.com; Mon, 30 Apr 2001 21:30:08 -0400 Possible spammer: 210.176.128.169 [show] "nslookup 169.128.176.210.dialups.mail-abuse.org." (checking ip) not found [show] "nslookup mail.thesun.com.hk" (checking ip) ip = 210.176.128.169 Taking name from IP... [show] "nslookup 210.176.128.169" (getting name) no name [show] "nslookup 169.128.176.210.blackholes.mail-abuse.org." (checking ip) not found [show] "nslookup 169.128.176.210.inputs.orbs.org." (checking ip) ip = 127.0.0.2 blocked by ORBS [show] "nslookup 169.128.176.210.dialups.mail-abuse.org." (checking ip) not found [show] "nslookup 169.128.176.210.inputs.orbs.org." (checking ip) ip = 127.0.0.2 210.176.128.169 is an open relay - saving header for proof. Received line accepted Received: from auNMbZ97C (136-25.dial-up.rdlca.cpl.net [192.216.136.25]) by mail.thesun.com.hk with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id G3QCAB6G; Tue, 1 May 2001 09:26:22 +0800 [show] "nslookup 169.128.176.210.dialups.mail-abuse.org." (checking ip) not found Possible spammer: 192.216.136.25 [show] "nslookup 136-25.dial-up.rdlca.cpl.net" (checking ip) ip = 192.216.136.25 [show] "nslookup 25.136.216.192.blackholes.mail-abuse.org." (checking ip) not found [show] "nslookup 25.136.216.192.inputs.orbs.org." (checking ip) not found Chain test:mail.thesun.com.hk =? mail.thesun.com.hk mail.thesun.com.hk and mail.thesun.com.hk have same hostname - chain verified [show] "nslookup 25.136.216.192.dialups.mail-abuse.org." (checking ip) ip = 127.0.0.3 Reporting of DUL hosts to ORBS disabled for now Received line accepted Right now, this email would be detained by SpamCop filters: blocked by ORBS Tracking message source:192.216.136.25: [show] "nslookup 192.216.136.25" (getting name) 192.216.136.25 = 136-25.dial-up.rdlca.cpl.net [show] "nslookup 136-25.dial-up.rdlca.cpl.net" (checking ip) ip = 192.216.136.25 abuse.net 136-25.dial-up.rdlca.cpl.net = [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] paranoid reverse DNS passes - using [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Statistics: [EMAIL PROTECTED] score:189 [EMAIL PROTECTED] score:189 [EMAIL PROTECTED] score:194 192.216.136.25 score:569 Possible open relay: 210.176.128.169 [show] "nslookup 169.128.176.210.inputs.orbs.org." (checking ip) ip = 127.0.0.2 [show] "nslookup 210.176.128.169" (getting name) no name [show] "dig -x 210.176.128.169 soa" (digging for start of authority) - [EMAIL PROTECTED] No abuse.net record for netplus.com.hk [ omitted some lines regarding http:// links in body of msg ] Finding IP block owner: [refresh/show] Cached whois for 192.216.136.25:[EMAIL PROTECTED] Using shortest default abuse.net entry - abuse.net cpl.net = [EMAIL PROTECTED] abuse.net cpl.net = [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Identical to reporting source:[EMAIL PROTECTED] Identical to reporting source:[EMAIL PROTECTED] Identical to reporting source:[EMAIL PROTECTED] Please make sure this email IS spam: INCREDIBLE!! WE NOW HAVE A SUPER MULTI-LINK WEB SITE OFFERING: View full message Report Spam to: Re:192.216.136.25 (Administrator of network where email originates) To: [EMAIL PROTECTED] (Notes) To: [EMAIL PROTECTED] (Notes) To: [EMAIL PROTECTED] (Notes) Re:192.216.136.25 (Administrator of IP block - statistics only) To: [EMAIL PROTECTED] (Notes) To: [EMAIL PROTECTED] (Notes) To: [EMAIL PROTECTED] (Notes) Re:210.176.128.169 (ORBS open relay automated testing system) To: [EMAIL PROTECTED] (Notes) Re:210.176.128.169 (Administrator of network with open relays) To: [EMAIL PROTECTED] (Notes) Re:http://srd.yahoo.com/srst/36141893/viacreme/2/6... (Administrator of network hosting website referenced in spam) To: [EMAIL PROTECTED] (Notes) Re:http://www.1-800-viacreme-4-womens-desire.com/i... (Administrator of network hosting website referenced in spam) To: [EMAIL PROTECTED] (Notes) Re:http://www.1st-viagra-viacreme-4-impotence.com/(Administrator of network hosting website referenced in spam) To: [EMAIL PROTECTED] (Notes) Re:http://www.2-order-viacreme.com/(Administrator of network hosting website referenced in spam) To: [EMAIL PROTECTED] (Notes) Re:http://www.viacreme.nu/order.htm (Administrator of network hosting website referenced in spam) To: [EMAIL PROTECTED] (Notes) Additional notes (optional - will be the first paragraph of standard report): PART TWO: Saved ORBS info: 210.176.128.169 Spam report id 23706901 sent to: [EMAIL PROTECTED] Spam report id 23706902 sent to: [EMAIL PROTECTED] Spam report id 23706904 sent to: [EMAIL PROTECTED] Spam report id 23706905 sent to: [EMAIL PROTECTED] Spam report id 23706906 sent to: [EMAIL PROTECTED] ============================================================================================= Report another spam? Welcome, [EMAIL PROTECTED] PART THREE: Retrieved email: This page may be saved for future reference: http://spamcop.net/sc?id=z19151248z8e7d0d6cd7b90ce54d74b1b87e6d347fz Received: from mail.thesun.com.hk [210.176.128.169] () by MailAndNews.com; Mon, 30 Apr 2001 21: Received: from auNMbZ97C (136-25.dial-up.rdlca.cpl.net [192.216.136.25]) by mail.thesun.com.hk id G3QCAB6G; Tue, 1 May 2001 09:26:22 +0800 DATE: 30 Apr 01 9:34:23 PM FROM: Message-ID: <8rUWzn1HGnEiAO> SUBJECT: SUPER WEB SITE!!! Parsing header: Received: from mail.thesun.com.hk [210.176.128.169] () by MailAndNews.com; Mon, 30 Apr 2001 21:30:08 -0400 Possible spammer: 210.176.128.169 [show] "nslookup 169.128.176.210.dialups.mail-abuse.org." (checking ip) not found [show] "nslookup mail.thesun.com.hk" (checking ip) ip = 210.176.128.169 Taking name from IP... [show] "nslookup 210.176.128.169" (getting name) no name [show] "nslookup 169.128.176.210.blackholes.mail-abuse.org." (checking ip) not found [show] "nslookup 169.128.176.210.inputs.orbs.org." (checking ip) ip = 127.0.0.2 blocked by ORBS [show] "nslookup 169.128.176.210.dialups.mail-abuse.org." (checking ip) not found [show] "nslookup 169.128.176.210.inputs.orbs.org." (checking ip) ip = 127.0.0.2 210.176.128.169 is an open relay - saving header for proof. Received line accepted Received: from auNMbZ97C (136-25.dial-up.rdlca.cpl.net [192.216.136.25]) by mail.thesun.com.hk with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id G3QCAB6G; Tue, 1 May 2001 09:26:22 +0800 [show] "nslookup 169.128.176.210.dialups.mail-abuse.org." (checking ip) not found Possible spammer: 192.216.136.25 [show] "nslookup 136-25.dial-up.rdlca.cpl.net" (checking ip) ip = 192.216.136.25 [show] "nslookup 25.136.216.192.blackholes.mail-abuse.org." (checking ip) not found [show] "nslookup 25.136.216.192.inputs.orbs.org." (checking ip) not found Chain test:mail.thesun.com.hk =? mail.thesun.com.hk mail.thesun.com.hk and mail.thesun.com.hk have same hostname - chain verified [show] "nslookup 25.136.216.192.dialups.mail-abuse.org." (checking ip) ip = 127.0.0.3 Reporting of DUL hosts to ORBS disabled for now Received line accepted Right now, this email would be detained by SpamCop filters: blocked by ORBS Tracking message source:192.216.136.25: [show] "nslookup 192.216.136.25" (getting name) 192.216.136.25 = 136-25.dial-up.rdlca.cpl.net [show] "nslookup 136-25.dial-up.rdlca.cpl.net" (checking ip) ip = 192.216.136.25 abuse.net 136-25.dial-up.rdlca.cpl.net = [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] paranoid reverse DNS passes - using [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Statistics: [EMAIL PROTECTED] score:190 [EMAIL PROTECTED] score:195 [EMAIL PROTECTED] score:190 192.216.136.25 score:572 Possible open relay: 210.176.128.169 [show] "nslookup 169.128.176.210.inputs.orbs.org." (checking ip) ip = 127.0.0.2 [show] "nslookup 210.176.128.169" (getting name) no name [show] "dig -x 210.176.128.169 soa" (digging for start of authority) - [EMAIL PROTECTED] No abuse.net record for netplus.com.hk Finding IP block owner: [refresh/show] Cached whois for 192.216.136.25:[EMAIL PROTECTED], [EMAIL PROTECTED] Using shortest default abuse.net entry - abuse.net cpl.net = [EMAIL PROTECTED] abuse.net cpl.net = [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Identical to reporting source:[EMAIL PROTECTED] Identical to reporting source:[EMAIL PROTECTED] Identical to reporting source:[EMAIL PROTECTED] Report already sent to: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Would send message source reports to: Re:192.216.136.25 (Administrator of network where email originates) [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] Re:192.216.136.25 (Administrator of IP block - statistics only) [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] Re:210.176.128.169 (ORBS open relay automated testing system) [EMAIL PROTECTED] Re:210.176.128.169 (Administrator of network with open relays) [EMAIL PROTECTED] ============================================================================================= Report another spam? Welcome, [EMAIL PROTECTED] Paste entire spam (headers, blank line, body) - or - single address (one line only): _______________________________________________ SpamCop-Help mailing list [EMAIL PROTECTED] http://news.spamcop.net/mailman/listinfo/spamcop-help
