From ric.gates at bigsleep.org Sat Jan 1 02:53:59 2005 From: ric.gates at bigsleep.org (Blammo) Date: Fri Dec 31 21:55:03 2004 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: On 31 Dec 2004 Ellen entered spamcop and left news:cr52e8$fsr$1@news.spamcop.net: > Did I mention that I also pay for a supernews account? Oh > and I don't send outbound mail thru them either. But the wires stay up > and functional about 364+ days of the year -- they do know how to do > wire just not how to do the other stuff :-) > That's funny you mention that because that's one reason I stick with my ISP. I get a Supernews feed that's worth maybe $10 / mo. -- | Ric | From ric.gates at bigsleep.org Sat Jan 1 03:09:37 2005 From: ric.gates at bigsleep.org (Blammo) Date: Fri Dec 31 22:10:02 2004 Subject: [SpamCop-List] Re: Does it really help? References: Message-ID: On 31 Dec 2004 Jeff entered spamcop and left news:cr431o$rav$1@news.spamcop.net: > People do this all the time to me in e-mails, they just > reply and not delete the text off the message they type to me. So I'm > NOT the only one who does this! Tell someone else besides just me. > Plenty of others on AOL and other places online who need to be chewed > out, not just me! I sometimes ask people (nicely) to change their bad habits, like to PLEASE remove all the CC addresses in forwarded messages, or put my address in a BCC so that it's not visiable. Sometimes it seems like a never ending almost futile task. I do have my newsreader set to display quoted text in different colors, and sigs in light gray, so it is much easier (and faster) to read messages when thay are formatted as requested. -- | Ric | From helen at iinet.net.au Sat Jan 1 11:12:56 2005 From: helen at iinet.net.au (Helen) Date: Fri Dec 31 22:15:02 2004 Subject: [SpamCop-List] Re: Spamcop detecting wrong thing? References: Message-ID: Thanks for your reply. I still cant see the boxes hmm. I'm using Mozilla Firefox - are you on Firefox as well? Sorry for not saying "Firefox" in the original post, I didnt think :( Helen "LioNiNoiL_a t_Y a h 0 0_d 0 t_c 0 m" wrote in message news:cr1q4d$ff4$1@news.spamcop.net... > Helen wrote: > >> it says "only tick the boxes you want to report" yet >> I cant see any boxes. Im guessing thats because im >> using Mozilla for web? > > Nope, I use Mozilla and I see the boxes just fine [and leave them ticked > most of the time]. > > -- > "[Spammers] are the mutant spawn of a bizarre reproductive act > involving a telemarketer, Larry Flynt, a tapeworm, and > an executive of the Third Class Mail industry." -- Dave Barry > From helen at iinet.net.au Sat Jan 1 11:14:00 2005 From: helen at iinet.net.au (Helen) Date: Fri Dec 31 22:15:03 2004 Subject: [SpamCop-List] Re: Spamcop detecting wrong thing? References: Message-ID: I did the Mailhosts and I think that's fixed it as I haven't had a misparse since! Thanks for your help Mike and also to Ellen who i've been emailing off list :) Happy New Year everyone. Helen "Mike Easter" wrote in message news:cqvs2f$bf4$1@news.spamcop.net... > Helen wrote: >> Received: from unknown (HELO per-qv1-irony1.iinet.net.au) >> (203.59.2.58) by mail.iinet.net.au with SMTP; 29 Dec 2004 22:04:54 >> -0000 > >> Spamcop keeps trying to report that as a source of the spam! > > Abbreviated Received lines *comment > from unknown (HELO per-qv1-irony1.iinet.net.au) (203.59.2.58) by > mail.iinet.net.au *serves you > from 201008030191.user.veloxzone.com.br (201.8.30.191) by > per-qv1-irony1.iinet.net.au *sourceline > from (abdal.com [66.33.119.168]) by 201008030191.user.veloxzone.com.br > *bogusline > > SC breaks the chain prematurely and calls 203 above because it can't get > from the top line's 'from' field to the 2nd line's 'by' field. > > Unless SC is using a mailhosts configuration, it must be able to > 'correlate' 203.59.2.58 with per-qv1-irony1.iinet.net.au -- which it > can't do because that IP is not the MX for iinet and it isn't 'close > enough' for any of the 3 MXes which are the MX. > > filter.iinet.net.au A (Address) 203.0.178.195 > mx1.iinet.net.au A (Address) 203.59.24.23 > mx2.iinet.net.au A (Address) 203.59.24.15 > >> Is it something im doing wrong here or does spamcop need to know that >> iiNet are using Ironport Systems and Sophos and also Ironport >> Systems and Symantec Brightmail. >> >> Otherwise, I cant always report my spam :( > > One way to fix it is to adopt and configure the mailhosts system. It is > designed to solve those kinds of problems. It makes SC 'smarter' about > interpreting the mailhost/s for the individual who configured for them > > -- > Mike Easter > kibitzer, not SC admin > From ric.gates at bigsleep.org Sat Jan 1 03:31:39 2005 From: ric.gates at bigsleep.org (Blammo) Date: Fri Dec 31 22:35:03 2004 Subject: [SpamCop-List] Re: help Help? HELP! FTP Silliness References: Message-ID: On 31 Dec 2004 Pop entered spamcop and left news:cr4o05$a70$1@news.spamcop.net: > It flashed up a window and a few seconds later showed a > directory of many, many .tar, .tgz, .tga, etc etc etc compressed > files. I knew those weren't on MY machine, so I checked the > modem icon and sure enough, it had downloaded them! I put the > firewall on full block immediately and had one directory's worth > of input, all those compressed files I noted above. There were > four more directories that didn't get a chance to download. > It only downloaded the directory contents, not the files themselves. That is if it really is an FTP connection, like ftp://ftp.cdut.edu.cn, it won't download the files listed there until you click on a file. It probably would be safer to use Ws_Ftp to open FTP URLs rather than IE since IE can be easily fooled. Also Ws_Ftp will show you the connection information. How that got into your Network Places I haven't a clue. I was aware that you can add a site through "Windows File Sharing" or the "FTP Sites" in Office. But otherwise I thought you needed another program to do this (perhaps FTP Explorer or maybe even Samba). You might want to search for your "lmhosts" file and (open in Notepad or Text Viewer) and see if that entry is in there. -- | Ric | From ric.gates at bigsleep.org Sat Jan 1 03:37:27 2005 From: ric.gates at bigsleep.org (Blammo) Date: Fri Dec 31 22:40:03 2004 Subject: [SpamCop-List] Re: Spammers as procrastinators :-) References: Message-ID: On 31 Dec 2004 Larry Kilgallen entered spamcop and left news:i1+X$hgyNJta@eisner.encompasserve.org: > I actually dislike postings to show how clueless spammers are, > so I don't know if it is the holiday spirit or what, but here I > am posting one I received this morning: > > ... you probably have not made a decision on which event to attend ... At least that part is true, for me. 4:23 left to decide. -- | Ric | From ric.gates at bigsleep.org Sat Jan 1 03:59:47 2005 From: ric.gates at bigsleep.org (Blammo) Date: Fri Dec 31 23:00:03 2004 Subject: [SpamCop-List] Re: Spammers as procrastinators :-) References: Message-ID: On 31 Dec 2004 Blammo entered spamcop and left news:Xns95D0C7AA17618blammo@216.154.195.61: > On 31 Dec 2004 Larry Kilgallen entered spamcop and left > news:i1+X$hgyNJta@eisner.encompasserve.org: > >> I actually dislike postings to show how clueless spammers are, >> so I don't know if it is the holiday spirit or what, but here I >> am posting one I received this morning: >> >> ... you probably have not made a decision on which event to attend ... > > At least that part is true, for me. > 4:23 left to decide. > I can still make this one.... Subject: Laurence the party starts at 10 Wonder if I look anything like "Laurence" ;-) -- | Ric | From ric.gates at bigsleep.org Sat Jan 1 04:35:13 2005 From: ric.gates at bigsleep.org (Blammo) Date: Fri Dec 31 23:40:03 2004 Subject: [SpamCop-List] Re: Spammers as procrastinators :-) References: Message-ID: On 31 Dec 2004 Blammo entered spamcop and left news:Xns95D0CB732E0Cblammo@216.154.195.61: > On 31 Dec 2004 Blammo entered spamcop and left > news:Xns95D0C7AA17618blammo@216.154.195.61: > >> On 31 Dec 2004 Larry Kilgallen entered spamcop and left >> news:i1+X$hgyNJta@eisner.encompasserve.org: >> >>> I actually dislike postings to show how clueless spammers are, >>> so I don't know if it is the holiday spirit or what, but here I >>> am posting one I received this morning: >>> >>> ... you probably have not made a decision on which event to attend ... >> >> At least that part is true, for me. >> 4:23 left to decide. >> > > I can still make this one.... > Subject: Laurence the party starts at 10 > Before I head out I'll... Subject: Loose weight fast before the holidays, get Phentermine -- | Ric | From nobody at devnull.spamcop.net Sat Jan 1 00:20:01 2005 From: nobody at devnull.spamcop.net (WazoO) Date: Sat Jan 1 01:20:03 2005 Subject: [SpamCop-List] Re: Spamcop detecting wrong thing? References: Message-ID: "Helen" wrote in message news:cr54hs$h8u$1@news.spamcop.net... > > I still cant see the boxes hmm. > > I'm using Mozilla Firefox - are you on Firefox as well? What are the odds that you have signed up as a "mole" reporter? From ivanleo at gmail.com Sat Jan 1 12:32:17 2005 From: ivanleo at gmail.com (Ivan Leo Puoti) Date: Sat Jan 1 06:35:21 2005 Subject: [SpamCop-List] Re: help Help? HELP! FTP Silliness In-Reply-To: References: Message-ID: FYI that site is hosting what appears to be pirated software, so I've reported it to the copyright owner. Ivan. From TJLWBECGSGWU at spammotel.com Sat Jan 1 14:55:42 2005 From: TJLWBECGSGWU at spammotel.com (Mathew Hendry) Date: Sat Jan 1 10:00:04 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: On Sat, 1 Jan 2005 02:53:59 +0000 (UTC), Blammo wrote: >On 31 Dec 2004 Ellen entered spamcop and left >news:cr52e8$fsr$1@news.spamcop.net: > >> Did I mention that I also pay for a supernews account? Oh >> and I don't send outbound mail thru them either. But the wires stay up >> and functional about 364+ days of the year -- they do know how to do >> wire just not how to do the other stuff :-) > >That's funny you mention that because that's one reason I stick with my >ISP. I get a Supernews feed that's worth maybe $10 / mo. Sounds very much like Blueyonder over here. Near-faultless connectivity - a localised DNS failure a couple of years ago is the only serious fault I can remember, and that lasted only a few hours - but they seem unable to run reliable news and mail services. Their terms and conditions treat these parts of the service as "free extras" so you have no leverage, short of cancelling your account, even if they're down 99% of the time. Dedicated services like SuperNews (I use GigaNews) obviously couldn't get away with that, though I have heard horror stories about some of the cheaper "premium" news providers... -- Mat. From nobody at spamcop.net Sat Jan 1 11:11:30 2005 From: nobody at spamcop.net (Pop) Date: Sat Jan 1 11:15:03 2005 Subject: [SpamCop-List] Re: help Help? HELP! FTP Silliness References: Message-ID: >> How that got into your Network Places I haven't a clue. I was >> aware >> that you can add a site through "Windows File Sharing" or the >> "FTP >> Sites" in Office. But otherwise I thought you needed another >> program >> to do this (perhaps FTP Explorer or maybe even Samba). You >> might >> want to search for your "lmhosts" file and (open in Notepad or >> Text >> Viewer) and see if that entry is in there. >> >> -- >>> Ric Nope, not there nor anywhere else, in fact, other than that one entry. It's an interesting site, actually, but ... the curiousity will live on, I guess. Actually, I learned something; you can add sites like that to the Network Places - didn't know you could do that. Lots of good English lit pieces there though; some of it pretty good stuff. It's apparently a benign site; no cookies, no probes, nothing at all but information. Well, that I could find. I think I'll crawl the site later today and see what pops up, just for grins. Oh well, on to better things. Pop From dogs32 at hotmail.com Sat Jan 1 12:33:07 2005 From: dogs32 at hotmail.com (Jeff) Date: Sat Jan 1 12:35:02 2005 Subject: [SpamCop-List] Re: Does it really help? References: Message-ID: Yeah well you didn't have to FLAME me either. That isn't proper etiquette either. No other Newsgroup makes a big stink about this crap and neither should this one. Its just goody-goody rules that came out of nowhere. Its pathetically stupid and is only more of a hassle. Delete text then reply, delete more text and reply to that question, a big waste of time for me! From David1 at suescornerweb.com Sat Jan 1 12:46:40 2005 From: David1 at suescornerweb.com (David 1) Date: Sat Jan 1 12:50:03 2005 Subject: [SpamCop-List] Re: Does it really help? In-Reply-To: References: Message-ID: Jeff wrote: > Yeah well you didn't have to FLAME me either. That isn't proper etiquette > either. No other Newsgroup makes a big stink about this crap and neither > should this one. > > Its just goody-goody rules that came out of nowhere. Its pathetically > stupid and is only more of a hassle. Delete text then reply, delete more > text and reply to that question, a big waste of time for me! > > I agree with you about the snip rule but most of the others I have been told about I try to follow & after looking things over it does make since on the flow of things Again this is just a newbees opinion They have to read a lot of these & it just makes it easier in general. I'm waiting on Cat to make me a grammar check & send it to me as a virus so that I can't ever turn it off or get rid of it ( just a joke Cat) Ok I'm done for now -- David 1 bad addy spamtrap@suescornerweb.com From MikeE at ster.invalid Sat Jan 1 09:59:25 2005 From: MikeE at ster.invalid (Mike Easter) Date: Sat Jan 1 13:00:05 2005 Subject: [SpamCop-List] Re: Does it really help? References: Message-ID: Jeff wrote: > Yeah well you didn't have to FLAME me either. That isn't proper > etiquette either. No other Newsgroup makes a big stink about this > crap and neither should this one. This is a very gentle and easy going group. There are plenty of flaming groups around, however; you'll need to stay out of those. If you hang out in groups where the posting style ignores the necessity to trim and contextualize, then it doesn't matter, except that it doesn't work very well. There are only a few of those. Even rarer is the group in which topposting or TOFU is preferred, in the corporate email style. If you are participating in groups in which the posting style needs to be trimmed and contextualized then it does matter, because improper posting interferes with the function of the group's conversation for everyone. -- Mike Easter kibitzer, not SC admin From rwmarbleAT at yahooDOT.com Sat Jan 1 17:21:24 2005 From: rwmarbleAT at yahooDOT.com (I'm_a_victim) Date: Sat Jan 1 17:25:06 2005 Subject: [SpamCop-List] How to get trace on virus spam? Message-ID: I am receiving 1 or 2 copies every day from the same ISP. Since this is virus mail how can I get a good trace on the sender so I can complain to the right people? I xxed out what I believe is my personal info. rest is as sent as far as the header. +++++ xxxxx@yahoo.com via xx.xxx.xx.xxx; Sat, 01 Jan 2005 10:55:14 -0800 X-YahooFilteredBulk: xxx .xxx.x..x..x Authentication-Results: mta108.mail.re2.yahoo.com from=sandiego.mine.nu; domainkeys=neutral (no sig) X-Originating-IP: [62.167.86.58] Return-Path: Received: from 62.167.86.58 (HELO xejtb.nu) (62.167.86.58) by mta108.mail.re2.yahoo.com with SMTP; Sat, 01 Jan 2005 10:55:12 -0800 From: webmaster@sandiego.mine.nu Add to Address Book To: mailer@yahoo.com Date: Sat, 01 Jan 2005 18:35:43 GMT Subject: Mail delivery_failed Importance: Normal X-Priority: 3 (Normal) X-MSMail-Priority: Normal Message-ID: <7fb2acba6b.9cdb0@sandiego.mine.nu> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="======5cd6fc.ae4c8dedac0" Content-Transfer-Encoding: 7bit This is a multi-part message in MIME format. Content-Length: 58321 begin 666 abook_add_1.gif M1TE&.#EA$ `0`.9:`-/3TS:--(51R____P98`WX_P)G,S/__F9R.\=;[]LCZ M^>;\\LR9_\SZ^'@OMMW\],?Z^7OP@!W()(KVCPAT!#\\V\9J-O[]O\\<[[^,R"YV7F:YF&[,;Z^\@%I:`80!@H>(AP$3,8:)B(5 1!04!(^"BQ$@12]+E@6@ M!8H13U0N*Q8$/0.L`Z*#A#P2!+0#)0DA#0H"@@(!$JE,#%)63EDLNP!:O@&T M'PM"*#(WN@+*`@<&VB(,##1#'E@0ULO9VC8^#T%'5291Y-@+"S@[#QL<+0TG M5QW7!S4CD" 8D&#*0 A&?OC+H&(@AAP#%<"H0,)?@@10!LQH,C!%D@HZKH%R 6X&" @ (E-2BY<$&9%@`P8\J4&0@`.P`` ` end begin 666 online_u=mailer&m=g&t=0.dat M1TE&.#EA# `,`)'_`/___[^_OW]_`,# P"'Y! $```,`+ `````,``P`0 (E GG"'S7.E# 25C:@AD0)X#KO^G@<:RI,`0`[ ` end begin 666 clip.gif M1TE&.#=A"P`0`)$``/____GUQ@```````"P`````"P`0```"(I2/%LNL_EX0 <;M)UI]6T;P^"W#=V8EARGJ9BU89)4A,G20$`.P`` ` end From rwmarbleAT at yahooDOT.com Sat Jan 1 17:28:38 2005 From: rwmarbleAT at yahooDOT.com (I'm_a_victim) Date: Sat Jan 1 17:30:02 2005 Subject: [SpamCop-List] Blocking address on YAHOO a waste of time Message-ID: A few weeks ago I started spending my time attempting to trace and then block the address of spammers. I currently have thousands of addresses blocked but lately I see that some spam I get is from a blocked address. It appears that YAHOO has a security hole of it's "blocking' is in fact false advertising. I have been reporting this problem on a daily basis to Yahoo but so far they have not been able to successfully block mail from Germany. From Merlyn at Spamcop.net Sat Jan 1 17:32:45 2005 From: Merlyn at Spamcop.net (Merlyn) Date: Sat Jan 1 17:35:02 2005 Subject: [SpamCop-List] Re: Blocking address on YAHOO a waste of time References: Message-ID: "I'm_a_victim" wrote in message news:cr786m$ltt$1@news.spamcop.net... >A few weeks ago I started spending my time attempting to trace and then >block the address of spammers. > I currently have thousands of addresses blocked but lately I see that some > spam I get is from a blocked address. > > It appears that YAHOO has a security hole of it's "blocking' is in fact > false advertising. > > I have been reporting this problem on a daily basis to Yahoo but so far > they have not been able to successfully block mail from Germany. Blocking by addresses does not work. Most email addresses in spam are fake. Blocking by IP is the only way. -- Regards, Merlyn A Spamcop advocate No emails this account is for newsgroups only People demand freedom of speech to make up for the freedom of thought which they avoided From rwmarbleAT at yahooDOT.com Sat Jan 1 17:39:39 2005 From: rwmarbleAT at yahooDOT.com (I'm_a_victim) Date: Sat Jan 1 17:40:02 2005 Subject: [SpamCop-List] Re: Blocking address on YAHOO a waste of time References: Message-ID: Thanks for reply, What I am entering as the address to block is the URL identified in the header. For example in the following spam +++ Thu, 23 Dec 2004 13:36:19 -0800 X-YahooFilteredBulk: 217.235.108.78 Authentication-Results: mta139.mail.sc5.yahoo.com from=zoomorphix.com.au; domainkeys=neutral (no sig) X-Originating-IP: [217.235.108.78] Return-Path: Received: from 217.235.108.78 (HELO cbjlm.au) (217.235.108.78) by mta139.mail.sc5.yahoo.com with SMTP; Thu, 23 Dec 2004 13:36:11 -0800 From: new_account@zoomorphix.com.au Add to Address Book Date: Thu, 23 Dec 2004 18:27:16 UTC Subject: FwD: Registration confirmation Importance: Normal X-Priority: 3 (Normal) X-MSMail-Priority: Normal Message-ID: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="==36da81.e2bedb9aa1ad8a4e9ce7" Content-Transfer-Encoding: 7bit This is a multi-part message in MIME format. Content-Length: 58012 +++ I entered 217.235.108.78 as the address to block. ======================== "Merlyn" wrote in message news:cr78ed$m7i$1@news.spamcop.net... > "I'm_a_victim" wrote in message > news:cr786m$ltt$1@news.spamcop.net... >>A few weeks ago I started spending my time attempting to trace and then >>block the address of spammers. >> I currently have thousands of addresses blocked but lately I see that >> some >> spam I get is from a blocked address. >> >> It appears that YAHOO has a security hole of it's "blocking' is in fact >> false advertising. >> >> I have been reporting this problem on a daily basis to Yahoo but so far >> they have not been able to successfully block mail from Germany. > > > Blocking by addresses does not work. Most email addresses in spam are > fake. > > Blocking by IP is the only way. > > -- > > Regards, > Merlyn > > A Spamcop advocate > No emails this account is for newsgroups only > People demand freedom of speech to make up for the freedom of thought > which > they avoided > > begin 666 abook_add_1.gif M1TE&.#EA$ `0`.9:`-/3TS:--(51R____P98`WX_P)G,S/__F9R.\=;[]LCZ M^>;\\LR9_\SZ^'@OMMW\],?Z^7OP@!W()(KVCPAT!#\\V\9J-O[]O\\<[[^,R"YV7F:YF&[,;Z^\@%I:`80!@H>(AP$3,8:)B(5 1!04!(^"BQ$@12]+E@6@ M!8H13U0N*Q8$/0.L`Z*#A#P2!+0#)0DA#0H"@@(!$JE,#%)63EDLNP!:O@&T M'PM"*#(WN@+*`@<&VB(,##1#'E@0ULO9VC8^#T%'5291Y-@+"S@[#QL<+0TG M5QW7!S4CD" 8D&#*0 A&?OC+H&(@AAP#%<"H0,)?@@10!LQH,C!%D@HZKH%R 6X&" @ (E-2BY<$&9%@`P8\J4&0@`.P`` ` end begin 666 clip.gif M1TE&.#=A"P`0`)$``/____GUQ@```````"P`````"P`0```"(I2/%LNL_EX0 <;M)UI]6T;P^"W#=V8EARGJ9BU89)4A,G20$`.P`` ` end From MikeE at ster.invalid Sat Jan 1 15:10:03 2005 From: MikeE at ster.invalid (Mike Easter) Date: Sat Jan 1 18:10:03 2005 Subject: [SpamCop-List] Re: How to get trace on virus spam? References: Message-ID: I'm_a_victim wrote: > I am receiving 1 or 2 copies every day from the same ISP. Since this > is virus mail how can I get a good trace on the sender so I can > complain to the right people? You can feed it to the online parcer. When you feed just the headers there is no offer to submit a report. If you feed the whole thing, as you might with the yahoo 'forward as attachment' you would obtain the notify address and cancel the reports. Here's what the result of submitting what you pasted here, after 'unbending' the spurious linewraps your newsagent introduced. http://www.spamcop.net/sc?id=z708409973z9281d652fca5bf6013fb4e0a66055ba3z or spamcop.net/sc?id=z708409973z9281d652fca5bf6013fb4e0a66055ba3z If reported today, reports would be sent to: Re: 62.167.86.58 (Administrator of network where email originates) postmaster@sunrise.net abuse@sunrise.net Also and incidentally, the way you are pasting into the newsmessage causes you to be sending the little .gif/s you copied from the page. Don't do that. That is a 'dumb' copy and pasting mechanism that was apparently introduced by XP. My Win98 clipboard doesn't work like that, so I don't have to go thru' gyrations to avoid doing it. Apparently you can't just paste from a clipboard copy directly into your newsreader; you'll have to do it another way when your drag or hi-lite accidentally catches graphics. > begin 666 abook_add_1.gif > M1TE&.#EA$ `0`.9:`-/3TS:--(51 > begin 666 online_u=mailer&m=g&t=0.dat > M1TE&.#EA# > begin 666 clip.gif > M1TE&.#=A"P`0`)$ -- Mike Easter kibitzer, not SC admin From mfkmek820 at yahoo.com Sat Jan 1 15:22:26 2005 From: mfkmek820 at yahoo.com (Fred K) Date: Sat Jan 1 19:25:04 2005 Subject: [SpamCop-List] Re: Blocking address on YAHOO a waste of time References: Message-ID: "I'm_a_victim" wrote in message news:cr78rb$md1$1@news.spamcop.net... > Thanks for reply, > What I am entering as the address to block is the URL identified in the > header. > >That still does not work, because spammers use different infected computers >to forward spam. Spam will come from all different IPs, even if they are >from the same spammer. Blocking on content works about 90% + of the time. >Only accepting email from people in your address book works 100%, but then >you have to check your junk folder for email from sources that you want, >but are not in your allowed list. Fred k From mfkmek820 at yahoo.com Sat Jan 1 15:24:25 2005 From: mfkmek820 at yahoo.com (Fred K) Date: Sat Jan 1 19:25:07 2005 Subject: [SpamCop-List] Re: Blocking address on YAHOO a waste of time References: Message-ID: "I'm_a_victim" wrote in message news:cr786m$ltt$1@news.spamcop.net... >A few weeks ago I started spending my time attempting to trace and then >block the address of spammers. > I currently have thousands of addresses blocked but lately I see that some > spam I get is from a blocked address. > Report each one to Yahoo as spam Fred k From agent01413 at my-deja.com Sun Jan 2 01:06:24 2005 From: agent01413 at my-deja.com (Socks) Date: Sat Jan 1 20:10:02 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: geo_splash_12 wrote in news:cr40ot$ptj$1@news.spamcop.net: > >> For confirmed optin, I have to respond to the confirmation to be >> added to the list. Your description does not sound like confirmed >> optin. That means that spam will be received and spam will be >> reported. > > It is not a confirmed opt-in as you describe. > Then it is not a confirmed opt-in list, they are failing to follow industry best practices, spam will continue to be reported to spamcop, spamcop will continue to report them, and they have no basis for complaining, I should probably add them to my local list to save the bandwidth spent querying spamcop and others. what block are they on? Never mind. I know how to get them permanently added to rangers. From SCNews.5.myspamgobbler at spamgourmet.com Sat Jan 1 17:46:05 2005 From: SCNews.5.myspamgobbler at spamgourmet.com (Spam N Scams Reporter) Date: Sat Jan 1 20:50:02 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 In-Reply-To: References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: Mike Easter wrote: > Mike Easter wrote: > >>It also has a TRUSTe Privacy Seal - and Apple is 'advertising' that at >>their *STUPID* mailing list signup site. >> >>More on that later. > > > ...more on the stupid mailing list signup; never before encountered. > > http://applenews.lists.apple.com/subscribe > > Now tell me that this signup doesn't indicate some kind of cluelessness. > I suppose it would be considered a 'double opt-in' signup, because you > are supposed to enter your address *TWICE* - just to make sure. > I decided to test the signup. There is no double opt-in. From the web signup: Thank You We?re currently processing your subscription request and will shortly send a message confirming the address at which you subscribed. When you receive this message, please save it. It will contain your e-mail address, information about subscribing and unsubscribing to our publications, and web and e-mail addresses you can use if you need to contact us for assistance. Please note that Apple is committed to protecting your privacy. We will use your e-mail address only to send you our publications. We will not give it to any other organization or use it for any other purpose. To see our policy on e-mail privacy, visit: http://www.lists.apple.com/privacy.html You should receive your first issue of your subscription shortly. We hope you enjoy it. ------------------ From email: Subj: Welcome to QuickTime News (quicktime: message 1 of 5) Date: Sat, 1 Jan 2005 17:39:19 -0800 (PST) From: ++myspamgobbler+7b5fc9085f.quicktime_news#applenews.lists.apple.com@spamgourmet.com ---------------------------------------------------------------- Thank you for subscribing to QuickTime News, our free e-mail newsletter. You have subscribed as <.5.myspamgobbler@spamgourmet.com>. Every two weeks, we'll send you a newsletter that will keep you informed about QuickTime and related products and technologies. If you'd like to change either the email address at which you subscribe to QuickTime News or the format in which you receive it, you can do so at: http://www.apple.com/enews/change/ We hope you enjoy QuickTime News, but if you decide you don't wish to receive the newsletter any longer, you can cancel your subscription at any time. You'll find instructions explaining how to do so at the bottom of each issue. The easiest way to unsubscribe is to visit this web site: http://applenews.lists.apple.com/unsubscribe?email=.5.myspamgobbler@spamgourmet.com If, after visiting the website, you still have questions, you can send an email message to: postmaster@applenews.lists.apple.com Please note that Apple is committed to protecting your privacy. We will use your e-mail address only to send you QuickTime News. We will not give it to any other organization or use it for any other purpose. To learn how Apple collects, uses, and safeguards the personal information you provide, visit: http://www.apple.com/legal/privacy Thanks again. And we hope you enjoy QuickTime News. Frank Editor, QuickTime News From tdy at blackhole.invalid Sat Jan 1 18:12:51 2005 From: tdy at blackhole.invalid (N. Miller) Date: Sat Jan 1 21:15:03 2005 Subject: [SpamCop-List] Re: Blocking address on YAHOO a waste of time References: Message-ID: In article , I'm_a_victim says... > Thu, 23 Dec 2004 13:36:19 -0800 > X-YahooFilteredBulk: 217.235.108.78 Was this message not in the Yahoo! Bulk Mail folder? That is as much spam blocking as Yahoo! will give you. -- Norman ~Win dain a lotica, En vai tu ri, Si lo ta ~Fin dein a loluca, En dragu a sei lain ~Vi fa-ru les shutai am, En riga-lint From tdy at blackhole.invalid Sat Jan 1 18:22:21 2005 From: tdy at blackhole.invalid (N. Miller) Date: Sat Jan 1 21:25:03 2005 Subject: [SpamCop-List] Re: Spamcop detecting wrong thing? References: Message-ID: In article , Helen says... > I still cant see the boxes hmm. > I'm using Mozilla Firefox - are you on Firefox as well? Odd. Mozilla Firefox (Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0) works fine for me. -- Norman ~Win dain a lotica, En vai tu ri, Si lo ta ~Fin dein a loluca, En dragu a sei lain ~Vi fa-ru les shutai am, En riga-lint From nobody at devnvll.spamcop.net Sat Jan 1 22:26:10 2005 From: nobody at devnvll.spamcop.net (Heidi) Date: Sat Jan 1 22:30:04 2005 Subject: [SpamCop-List] Re: How to get trace on virus spam? References: Message-ID: "Ivan Leo Puoti" wrote in message news:cr7pdl$vvn$4@news.spamcop.net... > From nobody at devnvll.spamcop.net Sat Jan 1 22:37:11 2005 From: nobody at devnvll.spamcop.net (Heidi) Date: Sat Jan 1 22:40:03 2005 Subject: [SpamCop-List] Re: Blocking address on YAHOO a waste of time References: Message-ID: "I'm_a_victim" wrote in message news:cr7p4p$vem$17@news.spamcop.net... > It seems someone's canceling your posts for you.... Path: news.spamcop.net!not-for-mail From: "I'm_a_victim" Newsgroups: spamcop Subject: Re: Blocking address on YAHOO a waste of time Control: cancel Date: Sun, 2 Jan 2005 03:17:47 +0000 (UTC) Organization: SpamCop Lines: 0 Message-ID: NNTP-Posting-Host: vl654.host66.netvision.net.il X-Trace: news.spamcop.net 1104635867 32214 199.203.54.66 (2 Jan 2005 03:17:47 GMT) X-Complaints-To: news@news.spamcop.net NNTP-Posting-Date: Sun, 2 Jan 2005 03:17:47 +0000 (UTC) Xref: news.spamcop.net control.cancel:4504 From nobody at devnvll.spamcop.net Sat Jan 1 22:52:57 2005 From: nobody at devnvll.spamcop.net (Heidi) Date: Sat Jan 1 22:55:03 2005 Subject: [SpamCop-List] FYI Message-ID: There seems to be a resident troll here now who has taken to canceling other people's posts, both in this group, .help and .social, now posting from NNTP-Posting-Host: vl654.host66.netvision.net.il, but also from NNTP-Posting-Host: adsl-19-177-174.jan.bellsouth.net and several other domains. Hopefully the admins can do something about blocking him. From ric.gates at bigsleep.org Sun Jan 2 04:00:50 2005 From: ric.gates at bigsleep.org (Blammo) Date: Sat Jan 1 23:05:03 2005 Subject: [SpamCop-List] Re: Does it really help? References: Message-ID: On 01 Jan 2005 Jeff entered spamcop and left news:cr6msf$bov$1@news.spamcop.net: > Yeah well you didn't have to FLAME me either. That isn't proper > etiquette either. No other Newsgroup makes a big stink about this > crap and neither should this one. > > Its just goody-goody rules that came out of nowhere. Its pathetically > stupid and is only more of a hassle. Delete text then reply, delete > more text and reply to that question, a big waste of time for me! > > What a selfish attitude. If you have the attitude that you're the only one that matters, than don't expect any help. Why should a newsgroup be any different than any other public place. I suppose you don't have the time to stop at red lights either. -- | Ric | From MikeE at ster.invalid Sat Jan 1 20:04:00 2005 From: MikeE at ster.invalid (Mike Easter) Date: Sat Jan 1 23:05:06 2005 Subject: [SpamCop-List] Re: FYI References: Message-ID: Heidi wrote: > There seems to be a resident troll here now who has taken to > canceling other people's posts, both in this group, .help and > .social, now posting from NNTP-Posting-Host: > vl654.host66.netvision.net.il, 199.203.54.66 rDNS vl654.host66.netvision.net.il can be found on accessible proxy lists, transparent port 80, currently has a visible port 80. -- but, I don't know who that is. Ellen is a adsl bellsouth, but not that one. > adsl-19-177-174.jan.bellsouth.net > Hopefully the admins can do something about blocking him. -- Mike Easter kibitzer, not SC admin From nobody at devnull.spamcop.net Sat Jan 1 22:03:43 2005 From: nobody at devnull.spamcop.net (Cat) Date: Sat Jan 1 23:05:08 2005 Subject: [SpamCop-List] Re: FYI In-Reply-To: References: Message-ID: Heidi wrote: > There seems to be a resident troll here now who has taken to canceling other > people's posts, both in this group, .help and .social, now posting from > NNTP-Posting-Host: vl654.host66.netvision.net.il, but also from > NNTP-Posting-Host: adsl-19-177-174.jan.bellsouth.net and several other > domains. Hopefully the admins can do something about blocking him. Since Heidi is so rudely making false accusations about recent activities in .social, I'm posting her original post over there and my reply to it. For someone who likes to complain quite loudly about .social issues being dragged into the other newsgroups, Heidi is not only being hypocritical by dragging this out here but also for her false accusations toward attempts to do something about the troll since all requests from newsgroup members to the troll's ISP and JT have been ignored. Heidi wrote: > I'm forwarding back to the newsgroup all the messages that the fuckwit is > canceling, just so y'all can see where he's sending them from and send your > abuse reports. :) In case anyone's wondering, you might want to get your facts straight before you falsely accuse someone of being the troll attempting to cancel s/h/its posts. One would think you'd be appreciative of someone making the effort to rid the newsgroup of the troll instead of dishing out false accusations. I sat on this issue for a long time since people have gotten upset about post canceling in the past, but I find it hard to believe that anyone would complain about the troll's posts disappearing from the newsgroup. If you have a problem with a little troll removal, get over it and stop your childish attempt to trash me as the troll. Since you're apparently so ungrateful, I'll just leave the troll's posts alone now and let them sit...especially the anti-Heidi ones since you're such an ungrateful witch. From ric.gates at bigsleep.org Sun Jan 2 04:13:27 2005 From: ric.gates at bigsleep.org (Blammo) Date: Sat Jan 1 23:15:04 2005 Subject: [SpamCop-List] Re: help Help? HELP! FTP Silliness References: Message-ID: On 01 Jan 2005 Pop entered spamcop and left news:cr6i3f$94d$1@news.spamcop.net: > Actually, I learned something; > you can add sites like that to the Network Places - didn't know > you could do that. Are you running XP? Either that's a feature I wasn't aware of, or some other app added that function. -- | Ric | From MikeE at ster.invalid Sat Jan 1 20:18:29 2005 From: MikeE at ster.invalid (Mike Easter) Date: Sat Jan 1 23:20:03 2005 Subject: [SpamCop-List] Re: FYI References: Message-ID: Cat wrote: > people have gotten upset about post canceling in the past, People should only cancel their own posts, unless they are the admin for the newsgroup. Even then, admins of accounts, such as Steve Gielda of cotse have a pretty wide latitude toward the broad spectrum of newsgroup behavior. I realize this isn't the kind of newsgrouping where anonymous remailer boistrousness goes on, but the problem with cancelling posts is that it represents an escalation or newsgroup warfare that is very problematic. I didn't know there was any posting going on that was so problematic that it required administrative intervention. -- Mike Easter kibitzer, not SC admin From nobody at devnull.spamcop.net Sat Jan 1 22:48:00 2005 From: nobody at devnull.spamcop.net (Cat) Date: Sat Jan 1 23:50:03 2005 Subject: [SpamCop-List] Re: FYI In-Reply-To: References: Message-ID: Mike Easter wrote: > Cat wrote: > >>people have gotten upset about post canceling in the past, > > > People should only cancel their own posts, unless they are the admin for > the newsgroup. > > Even then, admins of accounts, such as Steve Gielda of cotse have a > pretty wide latitude toward the broad spectrum of newsgroup behavior. I > realize this isn't the kind of newsgrouping where anonymous remailer > boistrousness goes on, but the problem with cancelling posts is that it > represents an escalation or newsgroup warfare that is very problematic. > > I didn't know there was any posting going on that was so problematic > that it required administrative intervention. This is exactly why I have ignored the troll's posts in the past, but this particular troll infestation and morphing has gone on far too long with complaints just being ignored. Whether or not my canceling the troll's posts was the best thing to do, hanging out in .cancel to post random headers to falsely label them as cancels made by the actual troll is also wrong. Dragging a .social issue over into the main group to annoy everyone who already stays out of .social was also wrong. Heidi has very loudly complained about other people in the past who have posted .social issues over here, yet she's now guilty of the same behavior she usually complains about. Since some people have their panties in a bunch over this, I won't be doing that again, but those people also shouldn't complain about the troll posts in the future then. From agent01413 at my-deja.com Sun Jan 2 05:05:22 2005 From: agent01413 at my-deja.com (Socks) Date: Sun Jan 2 00:10:02 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: Spam N Scams Reporter wrote in news:cr7jos$shi$1@news.spamcop.net: > > I decided to test the signup. There is no double opt-in. > uh - single optin is fine, as long as it is single confirmed optin. From theodorov at spamcop.ru Sun Jan 2 06:33:10 2005 From: theodorov at spamcop.ru (Alexi Theodorov) Date: Sun Jan 2 01:35:04 2005 Subject: [SpamCop-List] Re: Blocking address on YAHOO a waste of time References: Message-ID: "Heidi" wrote: > It seems someone's canceling your posts for you.... It seems someone's canceling your brains for you.... ROFLMAO!!! -- Surveys show that 70-80% of all women are battered. And I'm still eating mine plain! From SCNews.5.myspamgobbler at spamgourmet.com Sat Jan 1 23:04:37 2005 From: SCNews.5.myspamgobbler at spamgourmet.com (Spam N Scams Reporter) Date: Sun Jan 2 02:05:04 2005 Subject: [SpamCop-List] Re: FYI In-Reply-To: References: Message-ID: Cat wrote: > Heidi wrote: > >> There seems to be a resident troll here now who has taken to canceling >> other >> people's posts, both in this group, .help and .social, now posting from >> NNTP-Posting-Host: vl654.host66.netvision.net.il, but also from >> NNTP-Posting-Host: adsl-19-177-174.jan.bellsouth.net and several other >> domains. Hopefully the admins can do something about blocking him. > > > Since Heidi is so rudely making false accusations about recent > activities in .social, I'm posting her original post over there and my > reply to it. For someone who likes to complain quite loudly about > .social issues being dragged into the other newsgroups, Heidi is not > only being hypocritical by dragging this out here but also for her false > accusations toward attempts to do something about the troll since all > requests from newsgroup members to the troll's ISP and JT have been > ignored. > > Heidi wrote: > > > I'm forwarding back to the newsgroup all the messages that the > fuckwit is > > canceling, just so y'all can see where he's sending them from and > send your > > abuse reports. :) > > > > In case anyone's wondering, you might want to get your facts straight > before you falsely accuse someone of being the troll attempting to > cancel s/h/its posts. One would think you'd be appreciative of someone > making the effort to rid the newsgroup of the troll instead of dishing > out false accusations. I sat on this issue for a long time since people > have gotten upset about post canceling in the past, but I find it hard > to believe that anyone would complain about the troll's posts > disappearing from the newsgroup. If you have a problem with a little > troll removal, get over it and stop your childish attempt to trash me as > the troll. Since you're apparently so ungrateful, I'll just leave the > troll's posts alone now and let them sit...especially the anti-Heidi > ones since you're such an ungrateful witch. There have been numerous posts from various sections of spamcop ng that have been canceled by this troll. Many different authors have been canceled. Also, if you look through the messages that are still in the groups, many have been expired prematurely. There are a few different ip addressess that the s/h/it has used both to post from as well as to cancel from. You can see many of the cancels in control.cancel. 68.19.177.174 199.203.54.66 63.164.60.12 220.134.241.65 There are quite a few pages of cancels. Wazoo was also complaining of a troll gone crazy in the forums. Most likely is the same. From some.one at else.where Sun Jan 2 07:04:43 2005 From: some.one at else.where (Some One Else) Date: Sun Jan 2 02:05:07 2005 Subject: [SpamCop-List] Re: Blocking address on YAHOO a waste of time References: Message-ID: Alexi Theodorov wrote in message : >> "Heidi" wrote: >> >> It seems someone's canceling your posts for you.... > > It seems someone's canceling your brains for you.... > > ROFLMAO!!! LOL! SPNAK!!! From nobody at xyzzy.claranet.de Sun Jan 2 10:19:06 2005 From: nobody at xyzzy.claranet.de (Frank Ellermann) Date: Sun Jan 2 04:35:07 2005 Subject: [SpamCop-List] Re: FYI References: Message-ID: <41D7BC8A.2C6A@xyzzy.claranet.de> Cat wrote: [Heidi wrote:] >> NNTP-Posting-Host: vl654.host66.netvision.net.il, Yes, numerous dubious [1] 3rd party cancels from this system. >> also NNTP-Posting-Host: adsl-19-177-174.jan.bellsouth.net >> and several other domains. E.g. interbusiness.it and speedup.oxford.networks (or similar), apparently it started Dec 15 2004. > Heidi is so rudely making false accusations Nonsense. See , the criminal also cancelled with from NNTP-Posting-Host: vl654.host66.netvision.net.il > .social issues being dragged into the other newsgroups This is a cancel war. It affects threads here, it's a spammer with zombies in at least three networks. > all requests from newsgroup members to the troll's ISP Which ISP, networks.il, interbusiness.it, speedup.oxford, or what else ? BTW, quite useless, the articles here go through a news2mail gateway to SC's pipermail archive, the mails are also (re)imported by GMaNe to another archive with news, Web, and blog interfaces. Bye, Frank [1] for geeks, the cancels I've seen were "only" dubious. In a technical sense articles with invalid From addresses can be cancelled by anybody (claiming that it's his/her From address). It was certainly no "spam cancel" following the conventions in Rosalind's From nobody at spamcop.net Sun Jan 2 09:38:44 2005 From: nobody at spamcop.net (D€ja vu) Date: Sun Jan 2 04:40:02 2005 Subject: [SpamCop-List] Heidi gets SPNAKED! References: Message-ID: net effect wrote: > so how's it feel to know that several people around the world > are laughin' their phuckin asses off at you right now? > > lol! do you live in the cancel bin? do you sit in the test group > and just wait for posts to "magically" appear? do you always go > for the "obvious" without stopping to think first? > > in other words, DO YOU HAVE NO LIFE AT ALL??? > > BWAHAHAHAHA! st00pid question, we all know the answer to that > one... :-) > > Only one thing left to add... > > SPNAK! > > :-) > Bwahahahha, OWN€D, oink oink, and all that. And oh yeah, Happy New Year. :-) From nobody at xyzzy.claranet.de Sun Jan 2 11:17:15 2005 From: nobody at xyzzy.claranet.de (Frank Ellermann) Date: Sun Jan 2 05:25:22 2005 Subject: [SpamCop-List] Re: FYI References: Message-ID: <41D7CA2B.4C62@xyzzy.claranet.de> Cat wrote: > Whether or not my canceling the troll's posts was the best > thing to do Stop to cancel articles unless you either follow the rules in or you got the license to kill from her majesty Ellen. > she's now guilty of the same behavior she usually complains > about. I don't care about Heidi or spamcop.social, but I care about the reasons why I don't see a (= the first article in this thread) here, still available as: Apparently the spammer cancelled his / her own cancel, that's already phase two. The next phases are hipcrime and preemptive cancels. The last phase could be closing news.spamcop.net :-( > I won't be doing that again Good. An old rule about third party cancels is "you have ONE chance to get it right". > people also shouldn't complain about the troll posts in the > future then. I'll complain about illegal cancels in any way and form I like. Bye, Frank From nobody at devnull.spamcop.net Sun Jan 2 04:28:38 2005 From: nobody at devnull.spamcop.net (Cat) Date: Sun Jan 2 05:30:03 2005 Subject: [SpamCop-List] Re: FYI In-Reply-To: <41D7BC8A.2C6A@xyzzy.claranet.de> References: <41D7BC8A.2C6A@xyzzy.claranet.de> Message-ID: Frank Ellermann wrote: > Cat wrote: > > [Heidi wrote:] > >>>NNTP-Posting-Host: vl654.host66.netvision.net.il, > > > Yes, numerous dubious [1] 3rd party cancels from this system. That one was only after she apparently realized I had seen her posts labeling my newsgroup headers as posts from the troll. >>>also NNTP-Posting-Host: adsl-19-177-174.jan.bellsouth.net >>>and several other domains. This that you quote came from my own headers. You can look at the message source of this post and see that she listed my own and labeled them as cancel attempts by the troll while encouraging people to forward my cancel posts to my ISP's abuse address. > E.g. interbusiness.it and speedup.oxford.networks (or similar), > apparently it started Dec 15 2004. > > >>Heidi is so rudely making false accusations > > > Nonsense. See , the > criminal also cancelled with > from > NNTP-Posting-Host: vl654.host66.netvision.net.il You must have missed the posts in .social where she posted more than a few times listing my cancel headers specifically. Her posts of my headers accusing them of being the troll's posting headers were later canceled without comment or retraction on her part. She only posted the netvision.net.il headers after I called her out on labeling only my cancels as cancels made by the troll. You can also see in the post that Mike Easter quoted that she posted my ISP info from my headers and labeled them as the troll's headers. >>.social issues being dragged into the other newsgroups > > > This is a cancel war. It affects threads here, it's a spammer > with zombies in at least three networks. And now it's also escalated to impersonation of other newsgroup regulars since I've seen at least two posts where the troll forged a SpamCop regular's address in his own posts. >>all requests from newsgroup members to the troll's ISP > > > Which ISP, networks.il, interbusiness.it, speedup.oxford, or > what else ? BTW, quite useless, the articles here go through > a news2mail gateway to SC's pipermail archive, the mails are > also (re)imported by GMaNe to another archive with news, Web, > and blog interfaces. In the posts that have since gone missing, she went through .cancel and only grabbed my cancels and made approximately 16 different posts labeling my headers as the troll's headers encouraging people to report my posts to my ISP as the newsgroup troll. Three of her posts of my headers are still in .social. A direct quote from Heidi from the original post explaining her reasons for posting the headers before the post disappeared: "I'm forwarding back to the newsgroup all the messages that the fuckwit is canceling, just so y'all can see where he's sending them from and send your abuse reports. :)" This was after she posted a bunch of posts singling out my newsgroup headers from .cancel and no one else's until after I caught her posts and pointed out her error. Posting my headers and encouraging people to send abuse complaints to my ISP without any proof to back up her claims crossed a line into abuse and harassment. That's something I don't take lightly. Anyway, it's late, and I'm going to bed. I should have already been asleep by now. From ***** at btconnect.com Sun Jan 2 10:29:23 2005 From: ***** at btconnect.com (Archy) Date: Sun Jan 2 05:30:06 2005 Subject: [SpamCop-List] bounced reply. Message-ID: I am constantly get this bounced message when i send mail to the andrew@XXXX.co.za address. Does this mean btconnect is blocked by the receiving ISP?? This report relates to your message: Subject: SMS688, Message-ID: , To: "Andrew Kilmartin" of Mon, 13 Dec 2004 11:40:02 +0000 Your message was not delivered to: andrew@specialitym.co.za for the following reason: Diagnostic was Unable to transfer, -1 Information MTA 'specialitym.co.za' gives error message host is listed in bl.spamcop.net The Original Message follows: From nobody at xyzzy.claranet.de Sun Jan 2 11:41:42 2005 From: nobody at xyzzy.claranet.de (Frank Ellermann) Date: Sun Jan 2 05:45:02 2005 Subject: [SpamCop-List] Re: FYI References: <41D7BC8A.2C6A@xyzzy.claranet.de> Message-ID: <41D7CFE6.57C3@xyzzy.claranet.de> Cat wrote: > You must have missed the posts in .social True, I only read spamcop (= this group here), routing, and spam. Today I added control.cancel as fourth relevant group. > "I'm forwarding back to the newsgroup all the messages that > the fuckwit is canceling, just so y'all can see where he's > sending them from and send your abuse reports. :)" Reposting articles cancelled by a 3rd party is a "good thing" in theory. It's less convincing here, because any lost stuff is still available in SC's pipermail archive. Bye, Frank From spamcop at oitc.com Sun Jan 2 06:19:50 2005 From: spamcop at oitc.com (spamcop) Date: Sun Jan 2 06:20:02 2005 Subject: [SpamCop-List] Missed url Message-ID: In http://www.spamcop.net/sc?id=z708527094z806bf1a95fef1b42ca37342e3ce91758z From nobody at spamcop.net Sun Jan 2 06:18:08 2005 From: nobody at spamcop.net (Ellen) Date: Sun Jan 2 06:35:02 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: "Frank Ellermann" wrote in message news:41D7CA2B.4C62@xyzzy.claranet.de... > Cat wrote: > > > Whether or not my canceling the troll's posts was the best > > thing to do > > Stop to cancel articles unless you either follow the rules in > or you got the > license to kill from her majesty Ellen. I neither cancel posts nor have I or can I give anyone the license to cancel posts. Ellen From helen at iinet.net.au Sun Jan 2 19:42:25 2005 From: helen at iinet.net.au (Helen) Date: Sun Jan 2 06:45:03 2005 Subject: [SpamCop-List] Re: Spamcop detecting wrong thing? References: Message-ID: Bingo :) I have changed to a mole reporter recently! I didnt think of that - it just says "tick the box" and I couldnt see it :) Thank you Wazo Helen "WazoO" wrote in message news:cr5feg$n0b$1@news.spamcop.net... > "Helen" wrote in message > news:cr54hs$h8u$1@news.spamcop.net... >> >> I still cant see the boxes hmm. >> >> I'm using Mozilla Firefox - are you on Firefox as well? > > What are the odds that you have signed up as a "mole" reporter? > > From helen at iinet.net.au Sun Jan 2 19:43:26 2005 From: helen at iinet.net.au (Helen) Date: Sun Jan 2 06:45:09 2005 Subject: [SpamCop-List] Re: Spamcop detecting wrong thing? References: Message-ID: The reply above your has the answer - ive changed to mole reporting :) Thanks for checking for me Norman. Helen "N. Miller" wrote in message news:MPG.1c40fab794d2047b98978c@news.spamcop.net... > In article , Helen says... > >> I still cant see the boxes hmm. > >> I'm using Mozilla Firefox - are you on Firefox as well? > > Odd. Mozilla Firefox (Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; > rv:1.7.5) > Gecko/20041107 Firefox/1.0) works fine for me. > > -- > Norman > ~Win dain a lotica, En vai tu ri, Si lo ta > ~Fin dein a loluca, En dragu a sei lain > ~Vi fa-ru les shutai am, En riga-lint From nobody at spamcop.net Sun Jan 2 08:46:45 2005 From: nobody at spamcop.net (Pop) Date: Sun Jan 2 08:50:03 2005 Subject: [SpamCop-List] Re: help Help? HELP! FTP Silliness now OT References: Message-ID: Blammo wrote: >> On 01 Jan 2005 Pop entered spamcop and left >> news:cr6i3f$94d$1@news.spamcop.net: >> >>> Actually, I learned something; >>> you can add sites like that to the Network Places - didn't >>> know >>> you could do that. >> >> Are you running XP? Either that's a feature I wasn't aware of, >> or >> some other app added that function. >> >> -- >>> Ric Yes, XP Pro. Dunno about earlier versions, but you can put anything, inter/intra in the Network Places and you'll go there. A surprise to me, but it sort of makes sense! I'll see what I can find out & check back. Pop Pop From TJLWBECGSGWU at spammotel.com Sun Jan 2 14:14:58 2005 From: TJLWBECGSGWU at spammotel.com (Mathew Hendry) Date: Sun Jan 2 09:20:03 2005 Subject: [SpamCop-List] Re: Missed url References: Message-ID: On Sun, 02 Jan 2005 06:19:50 -0500, spamcop wrote: >In http://www.spamcop.net/sc?id=z708527094z806bf1a95fef1b42ca37342e3ce91758z What did it miss? It does seem to be picking up the main phishing page, http://64.23.124.231, which is still active BTW. The rest are hijacked eBay links, not of much interest. I've seen a few weird cases recently where links are missed on the first parse but magically appear if I refresh. That might be what's happened here. -- Mat. From nobody at spamcop.net Sun Jan 2 09:36:30 2005 From: nobody at spamcop.net (Ellen) Date: Sun Jan 2 09:45:03 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: "Mr K. Mean" <47p772ok02@sneakemail.com> wrote in message news:cr8nfk$k8g$1@news.spamcop.net... > > This has gone far beyond an annoying person who we all try to ignore. > Can something be done to address this issue? I've passed the info up the food chain. Thanks Ellen From rwmarbleAT at yahooDOT.com Sun Jan 2 09:55:22 2005 From: rwmarbleAT at yahooDOT.com (I'm_a_victim) Date: Sun Jan 2 10:00:02 2005 Subject: [SpamCop-List] Re: Blocking address on YAHOO a waste of time References: Message-ID: Interesting. According to Yahoo "Incoming mail from addresses on the list will be deleted automatically" "N. Miller" wrote in message news:MPG.1c40f87badf299d898978b@news.spamcop.net... > In article , I'm_a_victim says... > >> Thu, 23 Dec 2004 13:36:19 -0800 >> X-YahooFilteredBulk: 217.235.108.78 > > Was this message not in the Yahoo! Bulk Mail folder? That is as much spam > blocking as Yahoo! will give you. > > -- > Norman > ~Win dain a lotica, En vai tu ri, Si lo ta > ~Fin dein a loluca, En dragu a sei lain > ~Vi fa-ru les shutai am, En riga-lint From nobody at nowhere.invalid Sun Jan 2 16:13:51 2005 From: nobody at nowhere.invalid (Steven Maesslein) Date: Sun Jan 2 10:15:02 2005 Subject: [SpamCop-List] Re: Blocking address on YAHOO a waste of time References: Message-ID: On Sun, 2 Jan 2005 09:55:22 -0500, I'm_a_victim coughed into spamcop and left this in : > Interesting. According to Yahoo "Incoming mail from addresses on the list > will be deleted automatically" Please don't top-post. When they say that, they mean *e-mail* addresses. The list you're supposed to populate is a list of e-mail addresses, not IP addresses. -- Steve BOFH excuse #79: Look, buddy: Windows 3.1 IS A General Protection Fault. From MikeE at ster.invalid Sun Jan 2 07:23:34 2005 From: MikeE at ster.invalid (Mike Easter) Date: Sun Jan 2 10:25:03 2005 Subject: [SpamCop-List] Re: Blocking address on YAHOO a waste of time References: Message-ID: I'm_a_victim wrote: > Interesting. According to Yahoo "Incoming mail from addresses on the > list will be deleted automatically" In gmail and EL, 'addresses' means email addresses, not IP addresses. In gmail it is not possible to add IP addresses to a blocklist. Nor is it possible to do that in EL spamblocker. Also, see http://members.fortunecity.com/nnqweb/nquote.html Quoting Style in Newsgroup Postings Q1: What is "quoting" in newsgroup postings? Q2: How should I use the quoted text and arrange it with my own text? -- Mike Easter kibitzer, not SC admin From rwmarbleAT at yahooDOT.com Sun Jan 2 10:38:36 2005 From: rwmarbleAT at yahooDOT.com (I'm_a_victim) Date: Sun Jan 2 10:40:08 2005 Subject: [SpamCop-List] Re: Blocking address on YAHOO a waste of time References: Message-ID: "Mike Easter" wrote in message news:cr93jk$r2d$1@news.spamcop.net... > I'm_a_victim wrote: >> Interesting. According to Yahoo "Incoming mail from addresses on the >> list will be deleted automatically" > > In gmail and EL, 'addresses' means email addresses, not IP addresses. > > In gmail it is not possible to add IP addresses to a blocklist. Nor is > it possible to do that in EL spamblocker. > > > Also, see http://members.fortunecity.com/nnqweb/nquote.html Quoting > Style in Newsgroup Postings > Q1: What is "quoting" in newsgroup postings? > Q2: How should I use the quoted text and arrange it with my own text? > > -- > Mike Easter > kibitzer, not SC admin > OK Thanks for bit of education. I will then just continue to complain to Yahoo about their in effectual blocking. From TJLWBECGSGWU at spammotel.com Sun Jan 2 16:41:18 2005 From: TJLWBECGSGWU at spammotel.com (Mathew Hendry) Date: Sun Jan 2 11:45:02 2005 Subject: [SpamCop-List] Re: Missed url References: Message-ID: On Sun, 02 Jan 2005 14:14:58 +0000, Mathew Hendry wrote: >I've seen a few weird cases recently where links are missed on the first >parse but magically appear if I refresh. That might be what's happened here. Worse just now with http://www.spamcop.net/sc?id=z708588243zee165d12d5004d4c894c89c78974cd69z Parse, no links found, refresh, no links found, view full message, back, http://www.izbb.com found. -- Mat. From nobody at nowhere.invalid Sun Jan 2 17:50:47 2005 From: nobody at nowhere.invalid (Steven Maesslein) Date: Sun Jan 2 11:55:04 2005 Subject: [SpamCop-List] Re: Blocking address on YAHOO a waste of time References: Message-ID: On Sun, 2 Jan 2005 10:38:36 -0500, I'm_a_victim coughed into spamcop and left this in : > I will then just continue to complain to Yahoo about their in effectual > blocking. You get what you pay for... :) -- Steve At any level of traffic, any delay is intolerable. From ob1dbNOSPAM at spamcop.net Sun Jan 2 13:30:25 2005 From: ob1dbNOSPAM at spamcop.net (David Butler) Date: Sun Jan 2 13:35:02 2005 Subject: [SpamCop-List] hanaro spam to wrong reporting address ?? Message-ID: 222.233.108.95 comes back from Spamcop: Re: 222.233.108.95 (Administrator of network where email originates) To: nospam#hanaro.com@devnull.spamcop.net (Notes) but krnic shows: Org Name : Hanaro Telecom Inc. Service Name : HANANET Org Address : Shindongah Bldg., 43 Taepyeongno2-Ga Jung-Gu [ ISP IP Admin Contact Information ] Name : IP Administrator Phone : +82-2-106-2 Fax : +82-2-6266-6483 E-Mail : ip-adm@hanaro.com [ ISP IP Tech Contact Information ] Name : IP Manager Phone : +82-2-106-2 Fax : +82-2-6266-6483 E-mail : ip-adm@hanaro.com [ ISP Network Abuse Contact Information ] Name : Network Abuse Phone : +82-2-106-2 Fax : +82-2-6266-6483 E-mail : abuse@hanaro.com and that report went through... David From nobody at devnull.spamcop.net Sun Jan 2 13:39:19 2005 From: nobody at devnull.spamcop.net (Sofa King Tyred of Lar Ting) Date: Sun Jan 2 13:40:03 2005 Subject: [SpamCop-List] Re: Strangeness? spam gang(s) has fine tuned look-up delays toavoid SC look up? In-Reply-To: References: Message-ID: Berny wrote: > Me thinks one or more spam gangs along with their hosters have figured out > how to get enough delay to avoid being seen by SC, but not enough to over > try the patience of the vicodin addicts with small penises and erectile > disfunction looking for small bottles to hang in front of their license > plates before they get too many points and lose their drivers license for > going through red lights, and really need a cheaper mortgage from China so > they can pay for everything they've been ordering. LOL! I'm chiming in to say I've theorized the same thing, a while back. The theory about the screen-saver vampire is interesting, too. What's most annoying, is that SpamPal used to block a whole lot more of this crap (based on block lists), and perhaps this tactic is working for the spammers. They're not getting block-listed. I used to have only one or two spams a day that get past the filters. Now I have 10 times that. I first thought it was the latest update of SpamPal, but I re-verified the block lists and I'm pretty sure they're OK. Can SpamCop use an "indirect" service (via proxy) to check for dns lookups, or maybe even record the site then have a batch process to go off and look up "slow" resolves? This is having an effect on spam that gets through. What's most interesting is to see how much positive effect SpamCop can have (when the evil sites get listed), if spammy is truly exploiting a weakness intentionally. From medevul at some.where Sun Jan 2 18:50:26 2005 From: medevul at some.where (MedEvul) Date: Sun Jan 2 13:55:03 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: Ellen wrote: > I've passed the info up the food chain. Thanks Perhaps Heidi should ensure that her own house is in order before she accuses others. :-) From MikeE at ster.invalid Sun Jan 2 11:15:08 2005 From: MikeE at ster.invalid (Mike Easter) Date: Sun Jan 2 14:15:03 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: Mr K. Mean wrote: > I would check this one as one of the main posting locations: > > NNTP-Posting-Host: vl654.host66.netvision.net.il It would be better if people could simply filter or discipline themselves to mentally filter than to expect some administrative management. For Win users, Nfilter ie NewsProxy^1 is a very useful filter and would have no problems with these recent issues. Linux users have their own strategies. That doesn't solve the cancelling problem, but if necessary admin could turn cancelling off. ^1 http://www.nfilter.org/ nfilter : A Client-side Usenet News Filter -- Mike Easter kibitzer, not SC admin From nobody at spamcop.net Sun Jan 2 20:56:15 2005 From: nobody at spamcop.net (D€ja vu) Date: Sun Jan 2 16:00:04 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: MedEvul wrote: > Perhaps Heidi should ensure that her own house is in order > before she accuses others. > > :-) Yeah, she's really gonna be embarrassed when they find out those cancels all came from her own IP. Y is it so? :-) -- cd ./thebomb/ ; ./configure /etc/init.d/mainscreen start chown -R us:us /yourbase/* echo "What" | /usr/bin/festival rm -rf /chance-to-survive/ cd /yourtime/ ; make mv /zig/* ./ From me at privacy.net Sun Jan 2 14:53:09 2005 From: me at privacy.net (Sylvesterthekat) Date: Sun Jan 2 17:55:04 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: "Mike Easter" wrote in message news:cr9h5q$3is$1@news.spamcop.net... > Mr K. Mean wrote: > > I would check this one as one of the main posting locations: > > > > NNTP-Posting-Host: vl654.host66.netvision.net.il > > It would be better if people could simply filter or discipline > themselves to mentally filter than to expect some administrative > management. > > For Win users, Nfilter ie NewsProxy^1 is a very useful filter and would > have no problems with these recent issues. Linux users have their own > strategies. > > That doesn't solve the cancelling problem, but if necessary admin could > turn cancelling off. That sounds like the best idea since I doubt banning the jerk will do any good. We mostly do ignore him, but it's another thing entirely when s/h/it just cancels anything he doesn't like the look of. If anyone wants the clear evidence of where he cancelled one of my posts, I can provide it (not much point posting it here since he'd just cancel it). From kenbrody at spamcop.net Sun Jan 2 11:19:53 2005 From: kenbrody at spamcop.net (Kenneth Brody) Date: Sun Jan 2 18:25:03 2005 Subject: [SpamCop-List] Re: help Help? HELP! FTP Silliness References: Message-ID: <41D81F28.9C51AB2A@spamcop.net> Ivan Leo Puoti wrote: > > FYI that site is hosting what appears to be pirated software, so > I've reported it to the copyright owner. They also have a large collection of O'Reilly books online. Whether they're legal copies or not, I can't say. -- +-------------------------+--------------------+-----------------------------+ | Kenneth J. Brody | www.hvcomputer.com | | | kenbrody/at\spamcop.net | www.fptech.com | #include | +-------------------------+--------------------+-----------------------------+ Don't e-mail me at: From jrstark at barntowire.com Sun Jan 2 18:44:01 2005 From: jrstark at barntowire.com (jrstark) Date: Sun Jan 2 19:45:03 2005 Subject: [SpamCop-List] Yahoo is blacklisted? Message-ID: I am not getting any of my yahoo groups email, this is apparently the reason why: http://www.spamcop.net/w3m?action=blcheck&ip=66.94.237.46 What is going on? From devnull at spamcop.net Sun Jan 2 19:48:37 2005 From: devnull at spamcop.net (Heidi) Date: Sun Jan 2 19:50:03 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: "Mike Easter" wrote in message news:cr9h5q$3is$1@news.spamcop.net... > That doesn't solve the cancelling problem, but if necessary admin could > turn cancelling off. > > ^1 http://www.nfilter.org/ nfilter : A Client-side Usenet News Filter > We don't need filters, anyone remotely competent knows how to killfile, what we need is them to block the troll from canceling posts, and if turning off canceling posts is possible, I would ask that they do it as soon as possible. From Merlyn at Spamcop.net Sun Jan 2 19:49:39 2005 From: Merlyn at Spamcop.net (Merlyn) Date: Sun Jan 2 19:50:08 2005 Subject: [SpamCop-List] Re: Yahoo is blacklisted? References: Message-ID: "jrstark" wrote in message news:cra4ho$f1g$1@news.spamcop.net... >I am not getting any of my yahoo groups email, this is apparently the >reason why: > http://www.spamcop.net/w3m?action=blcheck&ip=66.94.237.46 > > What is going on? Nothing is wrong, too much spam. This is already under discussion here in a few threads. -- Regards, Merlyn A Spamcop advocate No emails this account is for newsgroups only People demand freedom of speech to make up for the freedom of thought which they avoided From wb8tyw at qsl.network Sun Jan 2 20:00:01 2005 From: wb8tyw at qsl.network (John E. Malmberg) Date: Sun Jan 2 20:05:02 2005 Subject: [SpamCop-List] Re: Yahoo is blacklisted? In-Reply-To: References: Message-ID: jrstark wrote: > I am not getting any of my yahoo groups email, this is apparently the > reason why: > http://www.spamcop.net/w3m?action=blcheck&ip=66.94.237.46 > > What is going on? This topic is under discussion in spamcop.help and on the web forum. According to posts by the deputies, Yahoo is allowing spam to be sent to their spamtraps and to spamcop.net members. Looking news.admin.net-abuse.sightings shows 17 spam samples, some of them showing that same spam repeated over again from October to December. I would recommend contacting Yahoo and asking them why they are allowing the spam to be sent. -John wb8tyw@qsl.network Personal Opinion Only From jrstark at barntowire.com Sun Jan 2 19:08:48 2005 From: jrstark at barntowire.com (jrstark) Date: Sun Jan 2 20:10:02 2005 Subject: [SpamCop-List] Re: Yahoo is blacklisted? In-Reply-To: References: Message-ID: Merlyn wrote: > "jrstark" wrote in message > news:cra4ho$f1g$1@news.spamcop.net... > >>I am not getting any of my yahoo groups email, this is apparently the >>reason why: >>http://www.spamcop.net/w3m?action=blcheck&ip=66.94.237.46 >> >>What is going on? > > > Nothing is wrong, too much spam. > > This is already under discussion here in a few threads. > I searched, but just see threads about yahoo email accounts. Where can I find more info? I am not using a yahoo mail account, or complaining about receiving spam. SpamCop is blocking my legitimate emails from yahoo groups, and is sending yahoo bounce notices. From Merlyn at Spamcop.net Sun Jan 2 20:25:23 2005 From: Merlyn at Spamcop.net (Merlyn) Date: Sun Jan 2 20:30:02 2005 Subject: [SpamCop-List] Re: Yahoo is blacklisted? References: Message-ID: "jrstark" wrote in message news:cra607$g7l$1@news.spamcop.net... > Merlyn wrote: > >> "jrstark" wrote in message >> news:cra4ho$f1g$1@news.spamcop.net... >> >>>I am not getting any of my yahoo groups email, this is apparently the >>>reason why: >>>http://www.spamcop.net/w3m?action=blcheck&ip=66.94.237.46 >>> >>>What is going on? >> >> >> Nothing is wrong, too much spam. >> >> This is already under discussion here in a few threads. >> > > I searched, but just see threads about yahoo email accounts. Where can I > find more info? > > I am not using a yahoo mail account, or complaining about receiving spam. > SpamCop is blocking my legitimate emails from yahoo groups, and is sending > yahoo bounce notices. > Spamcop does not block anything. You ISP/Email administrator is doing the blocking. Spamcop is just a list of IP addresses spam has been reported from. -- Regards, Merlyn A Spamcop advocate No emails this account is for newsgroups only People demand freedom of speech to make up for the freedom of thought which they avoided From MikeE at ster.invalid Sun Jan 2 17:54:39 2005 From: MikeE at ster.invalid (Mike Easter) Date: Sun Jan 2 20:55:02 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: Heidi wrote: > We don't need filters, anyone remotely competent knows how to > killfile, Most people are driving a newsagent that has 'primitive' or simplistic rules, like 'block sender' which is fairly inadequate for a morpher. The average morpher would need Nfilter aimed at their IP or provider. This particular one would need to have ongoing headerline adjustments made for whichever proxy s/he happens to be using. Personally I don't have any problem just 'mentally' ignoring what needs to be ignored. Some groups or people have trouble doing that. > what we need is them to block the troll from canceling > posts, and if turning off canceling posts is possible, I would ask > that they do it as soon as possible. The history of the cancelling isn't clear to me. I didn't study it in a timely fashion. By the time you started talking about the cancelling 'problem', a regular was right in the big middle of it. That cancelling should be easily stopped. I don't know which cancelling was retaliatory to which. If everyone, regulars and 'irregulars' alike, would quit cancelling, or rather 'quits' cancelling, or perhaps 'has quit' cancelling, maybe it isn't currently a problem at all. Whoever setup the newsserver wanted there to be cancelling. Maybe it can stay. -- Mike Easter kibitzer, not SC admin From David1 at suescornerweb.com Sun Jan 2 21:10:10 2005 From: David1 at suescornerweb.com (David 1) Date: Sun Jan 2 21:15:03 2005 Subject: [SpamCop-List] Re: FYI In-Reply-To: References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: Heidi wrote: > "Mike Easter" wrote in message > news:cr9h5q$3is$1@news.spamcop.net... > > We don't need filters, anyone remotely competent knows how to killfile, > Excuse me Who ever the hell wrote this, just because I was going to ask in help what killfile is that makes me incompetent, so far the filters are doing fine but if they stop I may have asked what it is because I've been on the web for 10 years but this is my first few months on the ngs. -- David 1 bad addy spamtrap@suescornerweb.com From devnull at spamcop.net Sun Jan 2 21:28:07 2005 From: devnull at spamcop.net (Heidi) Date: Sun Jan 2 21:30:05 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: "Mike Easter" wrote in message news:cra8is$hu8$1@news.spamcop.net... Personally I don't > have any problem just 'mentally' ignoring what needs to be ignored. Nor do I, that's not the problem. > The history of the cancelling isn't clear to me. Easy. The troll started posting from NNTP-Posting-Host: s01060080c8ec971d.vc.shawcable.net, when he became abusive and obnoxious and ignored, he started morphing hysterically, I think there are probably 50 or so incarnations in my killfile. When he got bored with that, he started finding open proxies, NNTP-Posting-Host: c-24-18-161-66.client.comcast.net NNTP-Posting-Host: 220-134-241-65.hinet-ip.hinet.net NNTP-Posting-Host: speedup.oxfordnetworks.net posting vile things he thought would upset people, and started changing his settings in order to cancel posts of the regular posters to call attention to himself. I didn't study it in a > timely fashion. By the time you started talking about the cancelling > 'problem', a regular was right in the big middle of it. That cancelling > should be easily stopped. The "regular" took it upon herself to play cop and cancel his posts when no one authorized her to do so, and if I recall someone was very nearly banned for doing just that a year or so ago. She was doing exactly what the troll was doing, which is all I saw, changing her posting names and ID in order to cancel his posts. Bad idea. I couldn't care less about her, actually. The troll is the problem. > > I don't know which cancelling was retaliatory to which. If everyone, > regulars and 'irregulars' alike, would quit cancelling, or rather > 'quits' cancelling, or perhaps 'has quit' cancelling, maybe it isn't > currently a problem at all. Right, tell the morphing troll to stop canceling posts. That'll work....not. Something else needs to be done about it. From nobody at spamcop.net Sun Jan 2 20:45:11 2005 From: nobody at spamcop.net (RW) Date: Sun Jan 2 21:50:03 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: "David 1" wrote in message news:cra9ic$ic8$1@news.spamcop.net... > Heidi wrote: >> "Mike Easter" wrote in message >> news:cr9h5q$3is$1@news.spamcop.net... > >> We don't need filters, anyone remotely competent knows how to killfile, > Excuse me Who ever the hell wrote this, just because I was going to ask in > help what killfile is that makes me incompetent, so far the filters are > doing fine but if they stop I may have asked what it is because I've been > on the web for 10 years but this is my first few months on the ngs. Killfile is simply a term for assigning a filter to ignore posts from a particular person. It makes your news reader mark the post as read, doesn't download the post, hides it from view, etc., depending on what news reader you are using. Usually the term is used to ignore posts from a particular identity, but you can also filter on subject, thread, date, etc. In Mozilla you make a rule under Tools -> Message Filters. Richard From ric.gates at bigsleep.org Mon Jan 3 02:49:00 2005 From: ric.gates at bigsleep.org (Blammo) Date: Sun Jan 2 21:50:09 2005 Subject: [SpamCop-List] Re: help Help? HELP! FTP Silliness now OT References: Message-ID: On 02 Jan 2005 Pop entered spamcop and left news:cr8u01$nle$1@news.spamcop.net: > Yes, XP Pro. Dunno about earlier versions, but you can put > anything, inter/intra in the Network Places and you'll go there. > A surprise to me, but it sort of makes sense! > Hmm, actually it sounds like a URL shortcut ("favorite"), XP is treating Network Places just like any other folder? Actually that really doesn't make sense, Network Places are computers you are always connected to, an FTP connection will time out. -- | Ric | From nobody at spamcop.net Sun Jan 2 20:50:35 2005 From: nobody at spamcop.net (RW) Date: Sun Jan 2 21:55:03 2005 Subject: [SpamCop-List] Re: hanaro spam to wrong reporting address ?? References: Message-ID: "David Butler" wrote in message news:ob1dbNOSPAM-309C03.13302502012005@news.cesmail.net... > 222.233.108.95 comes back from Spamcop: > > Re: 222.233.108.95 (Administrator of network where email originates) > To: nospam#hanaro.com@devnull.spamcop.net (Notes) > E-mail : abuse@hanaro.com > > and that report went through... We've basically given up on Hanaro. They've written us a few times, we've turned reports back on only to have them continue to bounce reports. abuse@hanaro.com is showing 231,226 bounces as of recently. Richard From MikeE at ster.invalid Sun Jan 2 19:07:05 2005 From: MikeE at ster.invalid (Mike Easter) Date: Sun Jan 2 22:10:02 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: David 1 wrote: > Excuse me Who ever the hell wrote this, just because I was going to > ask in help what killfile is that makes me incompetent, so far the > filters are doing fine but if they stop I may have asked what it is > because I've been on the web for 10 years but this is my first few > months on the ngs. Killfiling or KF/ing or 'plonking' is simply a newsreader [or mailreader] 'tool' which causes a particular poster [or mailer] 's posts to become 'invisible' to you, so that you won't see them and be 'upset' by them -- in case you lack the fortitude or knack or whatever you want to call it to not let such postings 'bother' you. As a general rule, the strategy of remaining silent even when inner 'compelled' to respond, whether you are talking to a friend or a foe, is a useful method of coping with some issues. Personally, when I interact with my dear friends in one-on-ones, I am 'notorious' for speaking frankly with them. I'm much more likely to be silent in a public arena. That is, silent about oneoneone stuff in public -- very much a blabbermouth about everything else. Doesn't opionated mean 'to have an opinion'? Who doesn't? Continuing the extension to responses to trolls and others. It wouldn't be any fun to be a troll if there weren't some kind of reaction or response to one's trollishness. So, when trolls come around, it is best to simply ignore them. It is much harder for them to be completely entertained simply by their own activities. Similarly, when ng interacting with some, if you find yourself having to 'bite your tongue' so much that your tongue is beginning to bleed, then it is time to ignore, if necessary mechanically aided by killfiling, the aggravator. Sometimes the mechanics of the killfile can be useful to 'spot' mechanical things in advance which are nuisances. One could kf all crossposts, all pgp signed messages, or all messages from someone who just gets on your nerves. One might decide to kf a refractory topposter or whatever. And then there is the more complicated issue of social interactions, which involves whether killfiling should be done silently or 'out loud'. That is a much more complicated subject. Most of the time plonking should be done silently. Occasionally some other way. IMO. -- Mike Easter kibitzer, not SC admin From David1 at suescornerweb.com Mon Jan 3 00:21:10 2005 From: David1 at suescornerweb.com (David 1) Date: Mon Jan 3 00:25:13 2005 Subject: [SpamCop-List] Re: FYI In-Reply-To: References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: RW wrote: > "David 1" wrote in message > news:cra9ic$ic8$1@news.spamcop.net... > >>Heidi wrote: >> >>>"Mike Easter" wrote in message >>>news:cr9h5q$3is$1@news.spamcop.net... >> >>>We don't need filters, anyone remotely competent knows how to killfile, > > >>Excuse me Who ever the hell wrote this, just because I was going to ask in >>help what killfile is that makes me incompetent, so far the filters are >>doing fine but if they stop I may have asked what it is because I've been >>on the web for 10 years but this is my first few months on the ngs. > > > Killfile is simply a term for assigning a filter to ignore posts from a > particular person. It makes your news reader mark the post as read, doesn't > download the post, hides it from view, etc., depending on what news reader > you are using. Usually the term is used to ignore posts from a particular > identity, but you can also filter on subject, thread, date, etc. > > In Mozilla you make a rule under Tools -> Message Filters. > > Richard > > thankyou, so it's what I'm already doing -- David 1 bad addy spamtrap@suescornerweb.com From David1 at suescornerweb.com Mon Jan 3 00:23:37 2005 From: David1 at suescornerweb.com (David 1) Date: Mon Jan 3 00:25:20 2005 Subject: [SpamCop-List] Re: FYI In-Reply-To: References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: Mike Easter wrote: > David 1 wrote: > >>Excuse me Who ever the hell wrote this, just because I was going to >>ask in help what killfile is that makes me incompetent, so far the >>filters are doing fine but if they stop I may have asked what it is >>because I've been on the web for 10 years but this is my first few >>months on the ngs. > > > Killfiling or KF/ing or 'plonking' is simply a newsreader [or > mailreader] 'tool' which causes a particular poster [or mailer] 's posts > to become 'invisible' to you, so that you won't see them and be 'upset' > by them -- in case you lack the fortitude or knack or whatever you want > to call it to not let such postings 'bother' you. > > As a general rule, the strategy of remaining silent even when inner > 'compelled' to respond, whether you are talking to a friend or a foe, is > a useful method of coping with some issues. Personally, when I interact > with my dear friends in one-on-ones, I am 'notorious' for speaking > frankly with them. I'm much more likely to be silent in a public arena. > That is, silent about oneoneone stuff in public -- very much a > blabbermouth about everything else. Doesn't opionated mean 'to have an > opinion'? Who doesn't? > > Continuing the extension to responses to trolls and others. It wouldn't > be any fun to be a troll if there weren't some kind of reaction or > response to one's trollishness. > > So, when trolls come around, it is best to simply ignore them. It is > much harder for them to be completely entertained simply by their own > activities. Similarly, when ng interacting with some, if you find > yourself having to 'bite your tongue' so much that your tongue is > beginning to bleed, then it is time to ignore, if necessary mechanically > aided by killfiling, the aggravator. > > Sometimes the mechanics of the killfile can be useful to 'spot' > mechanical things in advance which are nuisances. One could kf all > crossposts, all pgp signed messages, or all messages from someone who > just gets on your nerves. One might decide to kf a refractory topposter > or whatever. > > And then there is the more complicated issue of social interactions, > which involves whether killfiling should be done silently or 'out loud'. > That is a much more complicated subject. Most of the time plonking > should be done silently. Occasionally some other way. IMO. > > > Do I have this right or not Killfilling = Filtering -- David 1 bad addy spamtrap@suescornerweb.com From spamtrap at mrsmith.com Mon Jan 3 02:08:02 2005 From: spamtrap at mrsmith.com (Mr. Smith) Date: Mon Jan 3 02:10:18 2005 Subject: [SpamCop-List] Re: empty spam References: Message-ID: "Rob" wrote in message news:cr4na6$9n2$1@news.spamcop.net... > > "Mr. Smith" wrote in message > news:cr4g01$3qc$1@news.spamcop.net... >> I have received the same spam 3 ~ 4 per week, as posted in spamcop.spam >> under the heading "empty spam" >> >> The originating IP changes each time. The nonsense text changes each >> time. >> The subject header always starts with $.S.T.O.R- >> >> There is nothing advertised and no links other than MSN search. >> >> It is sent to multpile yahoo addresses. What would be the purpose of >> this? >> Is it to check email addresses (i.e. verify which ones do not bounce)? >> >> >> > > Have you viewed the source? Is there invisible HTML and/or Java there? > > Rob nothing, just plain text. You can see a copy over at spamcop.spam. not just this crop either, I have noticed in the past that I sometimes get spam with nothing in it, similar to this one From spamtrap at mrsmith.com Mon Jan 3 02:19:47 2005 From: spamtrap at mrsmith.com (Mr. Smith) Date: Mon Jan 3 02:20:03 2005 Subject: [SpamCop-List] Re: empty spam References: Message-ID: "Mike Easter" wrote in message news:cr4nec$9vj$1@news.spamcop.net... > Mr. Smith wrote: >> I have received the same spam 3 ~ 4 per week, as posted in >> spamcop.spam under the heading "empty spam" > > Generally speaking, spammer mindreading is not a worthwhile endeavor; > but we can go along with the idea of doing some analysis because some > people are actually interested in messing around with something more > thoroughly, and also because it is quite common for a more in-depth > evaluation of an issue to bring out something worth knowing which wasn't > expected. But, we have to be able to get all the depth possible. > > There's a better way to talk about this than you posting the one item > you did into .spam. You can never describe something adequately which > you could alternatively demonstrate the 'real thing' by using the > tracking URL. That is 'sort of a' real thing in .spam, but it is only > one and it is bent by the process you used to put it there. hmmm... a Babelfish translation from which language? I would guess either Lithuanian or some other Baltic country, right? From nobody at spamcop.net Mon Jan 3 00:10:20 2005 From: nobody at spamcop.net (RandallW) Date: Mon Jan 3 03:15:11 2005 Subject: [SpamCop-List] Re: Blocking address on YAHOO a waste of time References: Message-ID: "I'm_a_victim" wrote in message news:cr94hq$rhu$1@news.spamcop.net... > > > > I will then just continue to complain to Yahoo about their in effectual > blocking. > Do you have SpamGuard activated? From MikeE at ster.invalid Mon Jan 3 02:09:23 2005 From: MikeE at ster.invalid (Mike Easter) Date: Mon Jan 3 05:11:06 2005 Subject: [SpamCop-List] Re: empty spam References: Message-ID: Mr. Smith wrote: > "Mike Easter" >> There's a better way to talk about this than you posting the one item >> you did into .spam. > hmmm... a Babelfish translation from which language? I would guess > either Lithuanian or some other Baltic country, right? How about this? You. Post some trackers, not spam. -- Mike Easter kibitzer, not SC admin From porpoise1954 at yahoo.co.uk Mon Jan 3 10:06:38 2005 From: porpoise1954 at yahoo.co.uk (Porpoise) Date: Mon Jan 3 05:20:10 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: "Mr K. Mean" <47p772ok02@sneakemail.com> wrote in message news:crapdm$sop$1@news.spamcop.net... > Mike Easter wrote: >> >> Killfiling or KF/ing or 'plonking' is simply a newsreader [or >> mailreader] 'tool' which causes a particular poster [or mailer] 's posts >> to become 'invisible' to you, so that you won't see them and be 'upset' >> by them -- in case you lack the fortitude or knack or whatever you want >> to call it to not let such postings 'bother' you. > > This is well and fine, but not useful in this case. There are a few > trolls in social who I have killfiled who I have no problems with anymore > because I don't see them. With this particular psycho troll, however, > killfiles are not the answer. When somebody morphs their identity > probably around 50 times, to date, in order to avoid being killfiled, > resorts to posting from compromised trojaned open proxies to further avoid > being killfiled and then starts to randomly canceling other people's > messages, this is not something that can be solved by a simple killfile, > or even a pretty sophisticated one. > I think you missed Mike's point there..... The best Killfile is the brain - i.e. just ignore what bothers you rather than feeding the trolls. From porpoise1954 at yahoo.co.uk Mon Jan 3 10:12:11 2005 From: porpoise1954 at yahoo.co.uk (Porpoise) Date: Mon Jan 3 05:25:04 2005 Subject: [SpamCop-List] Re: help Help? HELP! FTP Silliness now OT References: Message-ID: "Blammo" wrote in message news:Xns95D2BF74359Dblammo@216.154.195.61... > On 02 Jan 2005 Pop entered spamcop and left > news:cr8u01$nle$1@news.spamcop.net: > > Hmm, actually it sounds like a URL shortcut ("favorite"), XP is treating > Network Places just like any other folder? Actually that really doesn't > make sense, Network Places are computers you are always connected to, an > FTP connection will time out. That's not strictly true..... You don't need to be *always* connected to them (laptops for example are not always connected to the network). You can set whether you want XP to "remember" Network Connections. It does it in a similar way to the way it mounts network drives - except instead of a drive it's a computer. An FTP connection timing out (whilst not in use) is not a problem IME, it will re-connect as soon as you want to do something. From ric.gates at bigsleep.org Mon Jan 3 10:42:48 2005 From: ric.gates at bigsleep.org (Blammo) Date: Mon Jan 3 05:45:03 2005 Subject: [SpamCop-List] Re: help Help? HELP! FTP Silliness now OT References: Message-ID: On 03 Jan 2005 Porpoise entered spamcop and left news:crb6f1$4f6$1@news.spamcop.net: > An FTP connection timing out (whilst not in use) is not a problem IME, > it will re-connect as soon as you want to do something. > FTP is for file transfer, it is strictly NOT a network connection and it makes no sense being there. It also sounds like it fired up IE when opened, which is nothing like any other network connection. The question of how it got there in the first place is an obvious security concern, especially since network connections are supposed to be in a diferent "security zone". -- | Ric From billk at no.spam Mon Jan 3 02:51:31 2005 From: billk at no.spam (Bill K.) Date: Mon Jan 3 05:55:03 2005 Subject: [SpamCop-List] Identity Compromised? Message-ID: How many of you have received spam which address you by your full name, which you have never given out publicly over the Internet? What's also disconcerting is that is that in the places where such information was entered, such as online product registration forms for new purchases, other information, such as street address and other sensitive personal and private information were also entered. What do you figure is likely happening here? Do you suppose some of the companies, whose sites this personal information was entered, have some corrupt workers within extracting information from their database to use for their own unscrupulous purposes? What to do in these situations? Thanks. -Bill From billk at no.spam Mon Jan 3 02:58:35 2005 From: billk at no.spam (Bill K.) Date: Mon Jan 3 06:00:03 2005 Subject: [SpamCop-List] Identity Compromised? Message-ID: Spam in question at news://news.spamcop.net/crb7di$51f$1@news.spamcop.net How many of you have received spam which address you by your full name, which you have never given out publicly over the Internet? What's also disconcerting is that is that in the places where such information was entered, such as online product registration forms for new purchases, other information, such as street address and other sensitive personal and private information were also entered. What do you figure is likely happening here? Do you suppose some of the companies, whose sites this personal information was entered, have some corrupt workers within extracting information from their database to use for their own unscrupulous purposes? What to do in these situations? Thanks. -Bill From porpoise1954 at yahoo.co.uk Mon Jan 3 11:08:48 2005 From: porpoise1954 at yahoo.co.uk (Porpoise) Date: Mon Jan 3 06:25:03 2005 Subject: [SpamCop-List] Re: help Help? HELP! FTP Silliness now OT References: Message-ID: "Blammo" wrote in message news:Xns95D31BA528A0Bblammo@216.154.195.61... > On 03 Jan 2005 Porpoise entered spamcop and left > news:crb6f1$4f6$1@news.spamcop.net: > >> An FTP connection timing out (whilst not in use) is not a problem IME, >> it will re-connect as soon as you want to do something. >> > > FTP is for file transfer, it is strictly NOT a network connection Well, strictly speaking it is... it's a WAN (wide area NETWORK) connection > and it > makes no sense being there. It does to WinXP > It also sounds like it fired up IE when opened, > which is nothing like any other network connection. Ermmm.... ALL directories use IE for browsing in XP (remember the DJ actions against M$ for making it a part of the OS?) albeit the UI presented might differ slightly > The question of how it got there in the first place is an obvious security > concern, especially since network connections are supposed to be in a > diferent "security zone". Not relevant here. If you start up a connection to a LAN machine and a connection to a WAN machine, you'll find their "security zones" *are* different. The fact that there's a shortcut to them in the same folder is neither here-nor-there. From porpoise1954 at yahoo.co.uk Mon Jan 3 11:34:30 2005 From: porpoise1954 at yahoo.co.uk (Porpoise) Date: Mon Jan 3 06:50:02 2005 Subject: [SpamCop-List] Re: Identity Compromised? References: Message-ID: "Bill K." wrote in message news:crb81f$5dk$1@news.spamcop.net... > How many of you have received spam which address you by your full name, > which you have never given out publicly over the Internet? > > What's also disconcerting is that is that in the places where such > information was entered, such as online product registration forms for new > purchases, other information, such as street address and other sensitive > personal and private information were also entered. > > What do you figure is likely happening here? ? > Do you suppose some of the companies, whose sites this personal > information was entered, have some corrupt workers within extracting > information from their database to use for their own unscrupulous > purposes? > > What to do in these situations? > > Thanks. > > -Bill From porpoise1954 at yahoo.co.uk Mon Jan 3 11:40:10 2005 From: porpoise1954 at yahoo.co.uk (Porpoise) Date: Mon Jan 3 06:55:03 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: "Mr K. Mean" <47p772ok02@sneakemail.com> wrote in message news:crb9dn$69t$1@news.spamcop.net... > Porpoise wrote: > >>> >> I think you missed Mike's point there..... The best Killfile is the >> brain - i.e. just ignore what bothers you rather than feeding the trolls. > > It doesn't bother me. I can scan the list of new headers and mark the > ones I know are the trolls read before I read anything. I never see them. > But how exactly does the brain help when messages disappear. Ahh... Well...... you see....... then you don't even have to scan for them..... ;-) From 79ytka802 at sneakemail.com Mon Jan 3 12:47:46 2005 From: 79ytka802 at sneakemail.com (Aviatrix) Date: Mon Jan 3 07:50:03 2005 Subject: [SpamCop-List] Re: Yahoo is blacklisted? In-Reply-To: References: Message-ID: John E. Malmberg wrote: > This topic is under discussion in spamcop.help and on the web forum. > > According to posts by the deputies, Yahoo is allowing spam to be sent to > their spamtraps and to spamcop.net members. > > Looking news.admin.net-abuse.sightings shows 17 spam samples, some of > them showing that same spam repeated over again from October to December. > > I would recommend contacting Yahoo and asking them why they are allowing > the spam to be sent. I think the problem is that Yahoogroups mailing lists are not under Yahoo's direct control. Anybody can set up a Yahoogroups mailing list. The vast majority of Yahoogroups mailing lists are genuine multi-way discussion lists, but every now and again the facility gets abused by spammers who set up mailing lists to send spam. Another problem is that some genuine mailing lists are not properly looked after. I have received spam through Yahoogroups mailing lists that I am subscribed to. It's up to each list administrator/moderator to ensure their lists are kept free from spam (which they can do by making sure it's "members only" and that all new subscription requests are properly vetted). Unfortunately some mailing list administrators are failing in their duty of care here. From nobody at spamcop.net Mon Jan 3 07:54:57 2005 From: nobody at spamcop.net (Miss Betsy) Date: Mon Jan 3 07:55:04 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: > Do I have this right or not > Killfilling = Filtering IIUC, yes. it is also the same as Since there are various ways of doing it, basically it means that you no longer are reading posts by that person (even if you don't do any mechanical filtering). If the 'not reading' is because of a person's attitude, then to tell hir is the final 'insult' or attempt to get the person to 'behave' If it is because you are just not interested, or don't particularly respect hir knowledge or thought processes, then generally people don't make it public. There are a few posters that I rarely look at, some that I only read the thread if Mike Easter has answered and only read his answer, and whole threads that I ignore if I am not interested in the subject. However, I do not mechanically filter anyone. Miss Betsy From TMHRVMFWREVN at spammotel.com Mon Jan 3 12:37:45 2005 From: TMHRVMFWREVN at spammotel.com (Rob) Date: Mon Jan 3 07:55:08 2005 Subject: [SpamCop-List] Re: Blocking address on YAHOO a waste of time References: Message-ID: "Fred K" wrote in message news:cr7f02$pn0$1@news.spamcop.net... > > "I'm_a_victim" wrote in message > news:cr786m$ltt$1@news.spamcop.net... > >A few weeks ago I started spending my time attempting to trace and then > >block the address of spammers. > > I currently have thousands of addresses blocked but lately I see that some > > spam I get is from a blocked address. > > > Report each one to Yahoo as spam > > Fred k > > Then sit back for a few weeks until you get a thank you note from Yahoo telling you that they take spam very seriously and will look into it :-) From me at privacy.net Mon Jan 3 07:40:58 2005 From: me at privacy.net (Frog Prince) Date: Mon Jan 3 08:00:04 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: "Porpoise" | > | > This is well and fine, but not useful in this case. There are a few | > trolls in social who I have killfiled who I have no problems with anymore | > because I don't see them. With this particular psycho troll, however, | > killfiles are not the answer. When somebody morphs their identity | > probably around 50 times, to date, in order to avoid being killfiled, | > resorts to posting from compromised trojaned open proxies to further avoid | > being killfiled and then starts to randomly canceling other people's | > messages, this is not something that can be solved by a simple killfile, | > or even a pretty sophisticated one. | > | | I think you missed Mike's point there..... The best Killfile is the brain - | i.e. just ignore what bothers you rather than feeding the trolls. Isn't that much like the mantra JHD (just hit delete) as a responce to spam? From nobody at spamcop.net Mon Jan 3 08:01:53 2005 From: nobody at spamcop.net (Miss Betsy) Date: Mon Jan 3 08:00:11 2005 Subject: [SpamCop-List] Re: Yahoo is blacklisted? References: Message-ID: "jrstark" wrote in message news:cra607$g7l$1@news.spamcop.net... > I am not using a yahoo mail account, or complaining about receiving > spam. SpamCop is blocking my legitimate emails from yahoo groups, and > is sending yahoo bounce notices. The yahoo servers are on the blocklist because of yahoo policies that allow spammers to actually send spam through them. The only way to keep receiving legitimate yahoo groups is to 'whitelist' them if you have that capability (you need to contact your ISP who is bouncing the email from the spamming yahoo servers who is the one who is using the spamcop blocklist). Or better yet, get your yahoo group administrator to complain to yahoo to stop allowing unmoderated groups (or whatever it is that the spammers exploit) to use the same servers as the groups who use the recommended methods to prevent spammers so that their groups always receive their messages. The only way that spam can be controlled is from the sending end and it is the sender's responsibility to use responsible servers. Miss Betsy > From notgiven at nodomain.net Mon Jan 3 08:13:39 2005 From: notgiven at nodomain.net (C. S.) Date: Mon Jan 3 08:15:03 2005 Subject: [SpamCop-List] Re: Identity Compromised? References: Message-ID: Sometime around Mon, 03 Jan 2005 02:51:31 -0800, "Bill K." deemed it necessary to offer: > How many of you have received spam which address you by your full name, > which you have never given out publicly over the Internet? I have never received such a pitch, though I have received spew targeted to the geographic region indicated by my Yahoo! address profile. If you have said information stored in any fashion on your system, I'd suggest using a full battery of scans with ad/spy/malware and antivirus detectors. Failing that, I'm one of those geeky types who would just go ahead and do a low-level format and re-install of my OS and other software, since I archive everything I want to keep for easy retrieval. > What's also disconcerting is that is that in the places where such > information was entered, such as online product registration forms for > new purchases, other information, such as street address and other > sensitive personal and private information were also entered. Likely encoded into the URL, as a tracker, though that may be too simple an explanation. > What do you figure is likely happening here? Do you suppose some of the > companies, whose sites this personal information was entered, have some > corrupt workers within extracting information from their database to use > for their own unscrupulous purposes? > > What to do in these situations? If the standard actions for such a situation prove fruitless, I'd consider contacting law-enforcement about identity theft possibly *in-progress*. The *in-progress* aspect might get them off their duffs to actually investigate, rather than telling you "So sorry, but..." > Thanks. > > -Bill From nobody at spamcop.net Mon Jan 3 08:17:27 2005 From: nobody at spamcop.net (Miss Betsy) Date: Mon Jan 3 08:15:07 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: "Frog Prince" wrote in message news:crbfi1$a42$1@news.spamcop.net... > | I think you missed Mike's point there..... The best Killfile is the > brain - > | i.e. just ignore what bothers you rather than feeding the trolls. > > Isn't that much like the mantra JHD (just hit delete) as a responce to spam? And JHD is a reasonable response until the incoming gets to be overwhelming to deal with. FMO, trolls will go away if the first time they post, someone posts a 'Do Not Feed the Trolls' sign and noone contributes anything more to the thread. The 'sign' is necessary for newcomers to understand about trolls. Sometimes, however, some members of the ng do not consider the person a troll and continue to respond. Then, they can be asked to take the discussion elsewhere if it is not on topic for the newsgroup (i.e. when spamcop.help was the only place to get help, a discussion of anti-spam tactics would not be appropriate). You know all this, but I am stating for those who don't know. The basic point is that ignoring (either by JHD or blocking) works, but it has to be a community effort. Anyone who responds keeps the spam or the troll going because even one response is worth its while. Miss Betsy From porpoise1954 at yahoo.co.uk Mon Jan 3 13:13:06 2005 From: porpoise1954 at yahoo.co.uk (Porpoise) Date: Mon Jan 3 08:25:02 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: "Frog Prince" wrote in message news:crbfi1$a42$1@news.spamcop.net... > > "Porpoise" >> | > | I think you missed Mike's point there..... The best Killfile is the > brain - > | i.e. just ignore what bothers you rather than feeding the trolls. > > Isn't that much like the mantra JHD (just hit delete) as a responce to > spam? > > Not quite the same - spammers just keep spamming indiscriminately and use your bandwidth. Trolls get bored and go away when no-one plays with them. And you don't need to download their NG postings. From Kilgallen at SpamCop.net Mon Jan 3 07:43:22 2005 From: Kilgallen at SpamCop.net (Larry Kilgallen) Date: Mon Jan 3 08:45:03 2005 Subject: [SpamCop-List] Re: Yahoo is blacklisted? References: Message-ID: In article , Aviatrix <79ytka802@sneakemail.com> writes: > I think the problem is that Yahoogroups mailing lists are not under > Yahoo's direct control. No, any problem would be that Yahoo is not _exercising_ the control they have over what is sent from their IP addressess. From nobody at spamcop.net Mon Jan 3 08:30:39 2005 From: nobody at spamcop.net (RW) Date: Mon Jan 3 09:35:03 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: "Miss Betsy" wrote in message news:crbgfo$anp$1@news.spamcop.net... > The basic point is that ignoring (either by JHD or blocking) works, > but it has to be a community effort. Anyone who responds keeps the > spam or the troll going because even one response is worth its > while. JHD would work for spam too if _everyone_ did it. Because there are a few (0.1%) that respond, it makes it profitable for spammers so they keep on going. Increase the volume and that 0.1% becomes a larger number. Don't feed the troll works if there is 100% compliance. JHD would work if there was 100% compliance! Richard From usenet1 at DE.LETE.THISljvideo.com Mon Jan 3 15:31:27 2005 From: usenet1 at DE.LETE.THISljvideo.com (Larry J.) Date: Mon Jan 3 10:35:02 2005 Subject: [SpamCop-List] Re: Identity Compromised? References: Message-ID: Waiving the right to remain silent, C. S. said: > If the standard actions for such a situation prove fruitless, > I'd consider contacting law-enforcement about identity theft > possibly *in-progress*. The *in-progress* aspect might get > them off their duffs to actually investigate, rather than > telling you "So sorry, but..." That's more likely to get you laughed at. There are actual identity thefts to investigate, rather than to waste time as suggested. -- Larry J. - Remove spamtrap in ALLCAPS to e-mail "Lord, are we worthy of the task that lies before us, or are we just jerking off..?" From nospam at nospam.org Mon Jan 3 17:02:08 2005 From: nospam at nospam.org (geo_splash_12) Date: Mon Jan 3 11:05:04 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 In-Reply-To: References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: Larry Kilgallen wrote: > So ? Some of those Itunes newsletter transmissions are spam ! No they are not, I call it ignorance since we perfectly well know that the mentioned IP is an itunes distribution node. Despite all discussions here on spamcop's list policy i've not seen any reasonable argument on what some hope to achieve by listing this IP. It doesn't change or improve the situation, it is probably regarded as plain old fashioned annoyance that discredits the spamcop system. Everyone can subscribe or unsubscribe from the Apple newslist system, but what we seem to be disagreeing on is the way this is implemented. Maybe some hope to achieve that Apple changes its newslist system, I don't see any evidence of this, it is the classical dilemma of bringing Mohammed to the Mountain. Ejo -- And your Chinese exchange student asks: what does it mean "I'm busy". Location 51 57'N 4 28'E From mfkmek820 at yahoo.com Mon Jan 3 08:16:30 2005 From: mfkmek820 at yahoo.com (Fred K) Date: Mon Jan 3 12:20:03 2005 Subject: [SpamCop-List] Re: Blocking address on YAHOO a waste of time References: Message-ID: "Rob" wrote in message news:crbf7k$9lt$1@news.spamcop.net... > > Then sit back for a few weeks until you get a thank you note from Yahoo > telling you that they take spam very seriously and will look into it :-) I don't believe in doing nothing. It may or maynot be helpful to click on the spam button. It is easy to do. I could be wrong, but declaring a message as spam in the yahoo inbox, trains your discrete spam engine. Fred k From tmcgraw at spamcop.net Mon Jan 3 09:30:01 2005 From: tmcgraw at spamcop.net (Tim McGraw) Date: Mon Jan 3 12:35:02 2005 Subject: [SpamCop-List] Re: Yahoo is blacklisted? In-Reply-To: References: Message-ID: jrstark wrote: > I am not getting any of my yahoo groups email, this is apparently the > reason why: > http://www.spamcop.net/w3m?action=blcheck&ip=66.94.237.46 Last time I parsed a Yahoo! Groups message - which was yesterday - sc correctly finds the original sender's IP, because Yahoo! Groups adds the original headers from the original sender to its own. From tdy at blackhole.invalid Mon Jan 3 09:42:18 2005 From: tdy at blackhole.invalid (N. Miller) Date: Mon Jan 3 12:45:04 2005 Subject: [SpamCop-List] Re: Yahoo is blacklisted? References: Message-ID: In article , jrstark says... > SpamCop is blocking my legitimate emails from yahoo groups, and > is sending yahoo bounce notices. No, SC is not blocking squat. Partial headers from a YG message that I received; I.e, it was not "blocked": > Received: from spooler by aosake.net (Mercury/32 v4.01b); 1 Jan 2005 11:10:05 -0800 > X-Envelope-To: > Return-path: > Received: from n1a.bulk.scd.yahoo.com (66.94.237.35) by aosake.net (Mercury/32 v4.01b) ID MG000001; > 1 Jan 2005 11:10:00 -0800 > X-Blocked: Blocked by 'SpamCop' > Received: from [66.218.66.58] by n1.bulk.scd.yahoo.com with NNFMP; 01 Jan 2005 18:36:09 -0000 > Received: from [66.218.66.31] by mailer7.bulk.scd.yahoo.com with NNFMP; 01 Jan 2005 18:36:09 -0000 > X-Yahoo-Newman-Property: groups-email > X-Sender: The header line "X-Blocked: Blocked by 'SpamCop'" is a tag added by my mail server. The sources in the SCBL are not rejected by my mail server. -- Norman ~Win dain a lotica, En vai tu ri, Si lo ta ~Fin dein a loluca, En dragu a sei lain ~Vi fa-ru les shutai am, En riga-lint From tdy at blackhole.invalid Mon Jan 3 09:58:47 2005 From: tdy at blackhole.invalid (N. Miller) Date: Mon Jan 3 13:00:02 2005 Subject: [SpamCop-List] Re: Blocking address on YAHOO a waste of time References: Message-ID: In article , I'm_a_victim says... > OK Thanks for bit of education. > I will then just continue to complain to Yahoo about their in effectual > blocking. The " X-YahooFilteredBulk:" header line is added by Yahoo! to indicate suspected spam. If Yahoo!'s "SpamGuard" is active, all email with that header line is place in the Bulk Mail folder. In my experience, SpamGuard is pretty effective. I have my own pet peeve about SpamGuard; but it has nothing to do with the effectiveness of SpamGuard at identifying spam. -- Norman ~Win dain a lotica, En vai tu ri, Si lo ta ~Fin dein a loluca, En dragu a sei lain ~Vi fa-ru les shutai am, En riga-lint From tdy at blackhole.invalid Mon Jan 3 10:01:47 2005 From: tdy at blackhole.invalid (N. Miller) Date: Mon Jan 3 13:05:03 2005 Subject: [SpamCop-List] Re: Blocking address on YAHOO a waste of time References: Message-ID: In article , Rob says... > Then sit back for a few weeks until you get a thank you note from Yahoo > telling you that they take spam very seriously and will look into it :-) He is referring to the "Spam" button that appears with the message in the Yahoo! Inbox. Every message in the Yahoo! Inbox has this "Spam" button which is used to report spam in the Inbox. It does not generate a notify to the source, as SpamCop does; it is just used to train the Yahoo! SpamGuard filters. No "thank you" notice is ever sent; but there is an instant "thank you" notice immediately after clicking on the button. -- Norman ~Win dain a lotica, En vai tu ri, Si lo ta ~Fin dein a loluca, En dragu a sei lain ~Vi fa-ru les shutai am, En riga-lint From blitzen at utvinternet.com Mon Jan 3 18:22:51 2005 From: blitzen at utvinternet.com (Blitzen) Date: Mon Jan 3 13:25:05 2005 Subject: [SpamCop-List] Why are you blocking Yahoo Groups ??? Message-ID: This is idiotic, my iolfree.ie addy is hardbouncing yahoo groups AND any attempt at reactivation of the addy with the following message: *** Remote host said: 550 Blocked - see http://www.spamcop.net/bl.shtml?66.94.237.47 [RCPT_TO] *** This really doesn't serve any useful purpose. G From dfm2a3l0t2 at spymac.com Mon Jan 3 13:32:07 2005 From: dfm2a3l0t2 at spymac.com (D.F. Manno) Date: Mon Jan 3 13:35:04 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: In article , geo_splash_12 wrote: > I call it ignorance since we perfectly well know that > the mentioned IP is an itunes distribution node. Despite all discussions > here on spamcop's list policy i've not seen any reasonable argument on > what some hope to achieve by listing this IP. It doesn't change or > improve the situation, it is probably regarded as plain old fashioned > annoyance that discredits the spamcop system. The ignorance is yours. You do not see because you do not want to see. The goal is to keep spam out of inboxes. The blacklist works towards that goal in one of two ways: 1) by encouraging the source to tighten its procedures so that it is not used to send spam, or 2) by keeping spam out of inboxes directly by keeping all mail originating from the source out of inboxes. Who the source is is irrelevant. If it spams or facilitates spamming, it gets listed. It can't be any simpler. -- D.F. Manno dfm2a3l0t2@spymac.com "The work goes on, the cause endures, the hope still lives and the dream will never die." From tmcgraw at spamcop.net Mon Jan 3 10:52:49 2005 From: tmcgraw at spamcop.net (Tim McGraw) Date: Mon Jan 3 13:55:04 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? In-Reply-To: References: Message-ID: Blitzen wrote: > This is idiotic, my iolfree.ie addy is hardbouncing yahoo groups AND any > attempt at reactivation of the addy with the following message: > > *** > Remote host said: 550 Blocked - see > http://www.spamcop.net/bl.shtml?66.94.237.47 [RCPT_TO] > *** > > This really doesn't serve any useful purpose. Yes it does. It keeps spam out of my inbox. This IP is a source of spam. http://groups-beta.google.com/group/news.admin.net-abuse.sightings/search?q=66.94.237.47&start=0&scoring=d From blitzen at utvinternet.com Mon Jan 3 19:08:21 2005 From: blitzen at utvinternet.com (Blitzen) Date: Mon Jan 3 14:10:03 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? References: Message-ID: Well all I can say is: "bully for you Tim" Because it sure as heck isn't keeping SPAM out of MY inbox (for the addy, for which the SPAMcop filters are being used, which is INUNDATED), it is just keeping me, a disabled person, out of touch with my friends! G >> >> This really doesn't serve any useful purpose. > > Yes it does. It keeps spam out of my inbox. > > This IP is a source of spam. > > http://groups-beta.google.com/group/news.admin.net-abuse.sightings/search?q=66.94.237.47&start=0&scoring=d > From Merlyn at Spamcop.net Mon Jan 3 14:16:38 2005 From: Merlyn at Spamcop.net (Merlyn) Date: Mon Jan 3 14:20:07 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? References: Message-ID: "Blitzen" wrote in message news:crc2i5$m81$1@news.spamcop.net... > This is idiotic, my iolfree.ie addy is hardbouncing yahoo groups AND any > attempt at reactivation of the addy with the following message: > > *** > Remote host said: 550 Blocked - see > http://www.spamcop.net/bl.shtml?66.94.237.47 [RCPT_TO] > *** > > This really doesn't serve any useful purpose. > This is also being discussed elsewhere in the .help group. Yes, it serves a very useful purpose for the people that use the list to keep spam out of their inboxes. I think you would agree with me that everyone is tired of receiving mortgage quotes, penis enlargement, breast enhancement, weight loss, nude 40 year old teenage sluts, Viagra, vacation, lottery, prescription drug, business opportunities, genealogical, university degrees, gambling, get rich quick, MLM, pyramid schemes, Web Cams, Russian brides, work from home, stock scams, pirated software and everything else that is force fed into our inboxes. The spammers are the only ones to blame. -- Regards, Merlyn A Spamcop advocate No emails this account is for newsgroups only People demand freedom of speech to make up for the freedom of thought which they avoided From blitzen at utvinternet.com Mon Jan 3 19:20:48 2005 From: blitzen at utvinternet.com (Blitzen) Date: Mon Jan 3 14:25:03 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? References: Message-ID: Merlyn, Reality is that ALL the mails you mention KEEP ON COMING in SPITE of my ISP using SPAMCOP. And to add insult to injury I cannot stay in touch with my friends, so, I respectfully suggest PERHAPS SPAMcop isn't really working? G > > This is also being discussed elsewhere in the .help group. > > Yes, it serves a very useful purpose for the people that use the list to > keep spam out of their inboxes. > > I think you would agree with me that everyone is tired of receiving > mortgage quotes, penis enlargement, breast enhancement, weight loss, nude > 40 year old teenage sluts, Viagra, vacation, lottery, prescription drug, > business opportunities, genealogical, university degrees, gambling, get > rich quick, MLM, pyramid schemes, Web Cams, Russian brides, work from > home, stock scams, pirated software and everything else that is force fed > into our inboxes. > > The spammers are the only ones to blame. > > -- > > Regards, > Merlyn > > A Spamcop advocate > No emails this account is for newsgroups only > People demand freedom of speech to make up for the freedom of thought > which they avoided > From Merlyn at Spamcop.net Mon Jan 3 14:35:58 2005 From: Merlyn at Spamcop.net (Merlyn) Date: Mon Jan 3 14:40:02 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? References: Message-ID: "Blitzen" wrote in message news:crc5ut$opv$1@news.spamcop.net... > Merlyn, > > Reality is that ALL the mails you mention KEEP ON COMING in SPITE of my > ISP using SPAMCOP. > > And to add insult to injury I cannot stay in touch with my friends, so, I > respectfully suggest PERHAPS SPAMcop isn't really working? > > G > Please do not top post. Spamcop works great but in conjunction with other lists. We block almost 99% of the spam we receive and everyone gets all their email. There is no reason to blame Spamcop because your ISP's spam filtering is ineffective. -- Regards, Merlyn A Spamcop advocate No emails this account is for newsgroups only People demand freedom of speech to make up for the freedom of thought which they avoided From notabene at spamcop.net Mon Jan 3 20:48:22 2005 From: notabene at spamcop.net (Nico Bartels) Date: Mon Jan 3 14:50:03 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? References: Message-ID: <5e4293ad56dba5fc126ff2f493f8b453@nbartels.net> On Mon, 3 Jan 2005 19:20:48 -0000, Blitzen wrote: >And to add insult to injury I cannot stay in touch with my friends, so, I >respectfully suggest PERHAPS SPAMcop isn't really working? No. it means your whitelist isn't working! When it is that important to you, don't use the blocklist or ask your mail provider not to use the list for your mail.. Don't blame SpamCop. It is nothing more than a list of IP's who sent SPAM. For a lot of people it is a good blocklist for filtering out spam. If you do not think it is a good list, then do not use it! Ciao! |\ | | \|ico -- Wie wil er nog een 1000 MB Gmail account? Mail me op nbartels@gmail.com From nobody at nowhere.invalid Mon Jan 3 21:20:47 2005 From: nobody at nowhere.invalid (Steven Maesslein) Date: Mon Jan 3 15:25:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: On Mon, 03 Jan 2005 17:02:08 +0100, geo_splash_12 coughed into spamcop and left this in : >> So ? Some of those Itunes newsletter transmissions are spam ! > > No they are not Yes they are. Remember, spam is a question of consent, not content. If I didn't consent to receiving Apple's spew then it's spam for me, while it's not spam for my next door neighbour who *did* sign up. -- Steve "Here, Outlook Express, run this program!" "Okay, stranger." From MikeE at ster.invalid Mon Jan 3 13:17:06 2005 From: MikeE at ster.invalid (Mike Easter) Date: Mon Jan 3 16:20:04 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? References: Message-ID: Blitzen wrote: > This is idiotic, my iolfree.ie addy is hardbouncing yahoo groups AND > any attempt at reactivation of the addy with the following message: Every provider has to develop a strategy for counteracting spam. My EarthLink provider gives me 3 choices which includes no spam filtering, which is the one I have chosen. My other email provider Gmail puts all of the spam into a spam folder. In neither of those cases do I lose any goodmail which might be identified as spam. I consider the loss of goodmail, especially when it is dev/null/ed or 'dropped on the floor' to be a very very bad spam filtering strategy. Rejecting mail at the smtp transaction is a very healthy form of spam filtering or rejecting, because it notifies the proper sender of the mail that the transaction failed and why it failed. > *** > Remote host said: 550 Blocked - see > http://www.spamcop.net/bl.shtml?66.94.237.47 [RCPT_TO] > *** > > This really doesn't serve any useful purpose. That serves an excellent purpose of both rejecting an item whose IP address is on a blocklist and notifying the sender that the mail was rejected and why. Presumably you would like to discuss why your wanted mail's sending IP is on a blocklist. -- Mike Easter kibitzer, not SC admin From nobody at spamcop.net Tue Jan 4 10:18:47 2005 From: nobody at spamcop.net (Anony Mouse) Date: Mon Jan 3 16:20:08 2005 Subject: [SpamCop-List] Sash Message-ID: <41D9B6B7.5020504@spamcop.net> Does anyone know the identity of the spammer that uses /sash/ in spamvertised URL's. This spammer has been a regular in my inbox for many years. Is it Ralsky? From MikeE at ster.invalid Mon Jan 3 13:24:52 2005 From: MikeE at ster.invalid (Mike Easter) Date: Mon Jan 3 16:25:04 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? References: Message-ID: Blitzen wrote: > Because it sure as heck isn't keeping SPAM out of MY inbox (for the > addy, for which the SPAMcop filters are being used, which is > INUNDATED), it is just keeping me, a disabled person, out of touch > with my friends! Your frustration is misdirected. SpamCop is a parsing and reporting service. It is also the maintainer of the spamcop blocklist of reported spamsources. It also provides a mail filtering/tagging and reporting service. If you were a client of the spamcop tagging and reporting service, your yahoo mail wouldn't have been bounced. It might have been tagged as likely spam unless you had whitelisted it, in which case, it wouldn't have been tagged at all. If I were a subscriber to yahoo groups, my personal client side spam filter, SpamPal, would not have tagged my yahoo mail as spam even tho' I'm using spamcop's blocklist as part of its filtering strategy, because I would have whitelisted yahoo groups. If I had forgotten to whitelist yahoo groups I wouldn't have lost the yahoo mail because my spampal filter simply tags, it isn't deleted or otherwise lost. If your provider doesn't provide you with sufficient options for managing your mail, such as whitelisting or turning off spamfiltering, it isn't appropriate for you to be directing your frustration at the fact that a spamming IP is blocklisted by a blocklist which is designed to list spamsource IPs. Yahoo groups is a spamsource IP. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Mon Jan 3 13:29:28 2005 From: MikeE at ster.invalid (Mike Easter) Date: Mon Jan 3 16:30:02 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? References: Message-ID: Blitzen wrote: > Reality is that ALL the mails you mention KEEP ON COMING in SPITE of > my ISP using SPAMCOP. A provider has to have a comprehensive and effective spam strategy which is also satisfactory to its clients. Apparently iolfree.ie isn't providing optimal spamfiltering for you. I would be very unhappy if I couldn't turn off my spam filtering. I was also very frustrated when I discovered that a friend of mine's provider was dropping my mail to her on the floor, filtering nonspam goodmail without bouncing it, and without even notifying her that they were spamfiltering in any way; much less telling her /how/ they were spam filtering. I consider that to be a very bad spam strategy. It is also difficult to investigate; which your bounced item was not. > And to add insult to injury I cannot stay in touch with my friends, > so, I respectfully suggest PERHAPS SPAMcop isn't really working? You might want to get another email provider to supplement your current one. Have you considered gmail? They don't throw away or bounce any spam at all. -- Mike Easter kibitzer, not SC admin From nobody at spamcop.net Tue Jan 4 10:55:19 2005 From: nobody at spamcop.net (Anony Mouse) Date: Mon Jan 3 17:00:03 2005 Subject: [SpamCop-List] Re: Sash References: <41D9B6B7.5020504@spamcop.net> Message-ID: <41D9BF47.4080409@spamcop.net> Anony Mouse wrote: > Does anyone know the identity of the spammer that uses /sash/ in > spamvertised URL's. > > This spammer has been a regular in my inbox for many years. > > Is it Ralsky? > I think I answered my own question with a bit of google research... Mike Van Essen / Global Web Promotions An old URL... http://www.easy-herbal.biz/sash/vprx/ whois easy-herbal.biz Domain Name: EASY-HERBAL.BIZ Domain ID: D5243383-BIZ Sponsoring Registrar: ABACUS AMERICA, INC. D/B/A NAMES4EVER.COM Sponsoring Registrar IANA ID: 52 Domain Status: ok Registrant ID: CPMPY Registrant Name: John Kovalesky Registrant Address1: P.O. Box 567 Registrant City: Pradomar Registrant State/Province: N/A Registrant Postal Code: 7892 Registrant Country: Colombia Registrant Country Code: CO Registrant Phone Number: +1.57535380691 Registrant Email: herbalpills@hotmail.com Name Server: NS2.PHATDNS.US Name Server: NS1.PHATDNS.US phatdns.us is listed on spamhaus... http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK2960 I guess the best place to send spam with /sash/ in the spamvertised URL would be my contact at the ACA in Australia. Anyone up with the play regarding the charges that where laid against Van Essen and Atkinson by the US authorities? I seem to recall reading that the charges may have been withdrawn. From wb8tyw at qsl.network Mon Jan 3 17:10:47 2005 From: wb8tyw at qsl.network (John E. Malmberg) Date: Mon Jan 3 17:15:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 In-Reply-To: References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: geo_splash_12 wrote: > Larry Kilgallen wrote: > >> So ? Some of those Itunes newsletter transmissions are spam ! > > Everyone can subscribe or unsubscribe from the Apple newslist system, My primary e-mail provider's terms of service prohibit me from unsubscribing from what I did not subscribe to. A spam-trap will also not unsubscribe. Why are you not complaining to Apple that they are not confirming subscriptions, and thus allowing people to use their servers to abuse others? As soon as they convert their system to a closed loop system, the problem will be solved. Currently 17.254.6.27 is not listed by spamcop.net -John wb8tyw@qsl.network Personal Opinion Only From Merlyn at Spamcop.net Mon Jan 3 17:13:37 2005 From: Merlyn at Spamcop.net (Merlyn) Date: Mon Jan 3 17:15:09 2005 Subject: [SpamCop-List] Re: Sash References: <41D9B6B7.5020504@spamcop.net> <41D9BF47.4080409@spamcop.net> Message-ID: "Anony Mouse" wrote in message news:41D9BF47.4080409@spamcop.net... > Anony Mouse wrote: >> Does anyone know the identity of the spammer that uses /sash/ in >> spamvertised URL's. >> >> This spammer has been a regular in my inbox for many years. >> >> Is it Ralsky? >> > I think I answered my own question with a bit of google research... > > Mike Van Essen / Global Web Promotions > > An old URL... > > http://www.easy-herbal.biz/sash/vprx/ > > whois easy-herbal.biz > Domain Name: EASY-HERBAL.BIZ > Domain ID: D5243383-BIZ [snipped] > Anyone up with the play regarding the charges that where laid against Van > Essen and Atkinson by the US authorities? > > I seem to recall reading that the charges may have been withdrawn. > http://www.google.com/search?hl=en&q=Van+Essen+and+Atkinson+spam :-) -- Regards, Merlyn A Spamcop advocate No emails this account is for newsgroups only People demand freedom of speech to make up for the freedom of thought which they avoided From nobody at nowhere.invalid Mon Jan 3 23:15:34 2005 From: nobody at nowhere.invalid (Steven Maesslein) Date: Mon Jan 3 17:20:03 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? References: Message-ID: On Mon, 3 Jan 2005 13:17:06 -0800, Mike Easter coughed into spamcop and left this in : > Presumably you would like to discuss why your wanted mail's sending IP > is on a blocklist. It doesn't look like it. It looks more like the OP would rather throw a hissy fit and hope that the spam sewer gets delisted through that course of action. -- Steve Notice spotted in a field: THE FARMER ALLOWS WALKERS TO CROSS THE FIELD FOR FREE, BUT THE BULL CHARGES From nobody at nowhere.invalid Mon Jan 3 23:17:48 2005 From: nobody at nowhere.invalid (Steven Maesslein) Date: Mon Jan 3 17:20:05 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: On Mon, 03 Jan 2005 17:02:08 +0100, geo_splash_12 coughed into spamcop and left this in : > Everyone can subscribe or unsubscribe from the Apple newslist system, Let me correct that so that things get put into perspective: "Everyone can subscribe or unsubscribe *ANYONE ELSE* to or from the Apple newslist system" -- Steve Good judgment comes from bad experience, and a lot of that comes from bad judgment. From nobody at xyzzy.claranet.de Mon Jan 3 23:24:51 2005 From: nobody at xyzzy.claranet.de (Frank Ellermann) Date: Mon Jan 3 17:30:02 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: <41D9C633.6CD6@xyzzy.claranet.de> Frog Prince wrote: >| I think you missed Mike's point there..... The best Killfile >| is the brain - i.e. just ignore what bothers you rather than >| feeding the trolls. > Isn't that much like the mantra JHD (just hit delete) as a > responce to spam? Yes. If it is spam (defined by too many posts of essentially the same article) you could do something about it, but here it is difficult, because at least one SpamCop admin doesn't like complaints about articles in SC newsgroups. Maybe Ellen finds a solution for this problem, and that could be to appoint Cat as admin with the right to cancel articles. Or to block the compromised netvision.il etc. systems. Bye, Frank From nobody at spamcop.net Mon Jan 3 17:36:33 2005 From: nobody at spamcop.net (indigo) Date: Mon Jan 3 17:40:03 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: Mike Easter wrote: > For Win users, Nfilter ie NewsProxy^1 is a very useful filter and > would have no problems with these recent issues. Linux users have > their own strategies. > > That doesn't solve the cancelling problem, but if necessary admin > could turn cancelling off. > It won't run on XP, I tried. From devnull at spamcop.net Mon Jan 3 17:39:26 2005 From: devnull at spamcop.net (Heidi) Date: Mon Jan 3 17:45:04 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> <41D9C633.6CD6@xyzzy.claranet.de> Message-ID: "Frank Ellermann" wrote in message news:41D9C633.6CD6@xyzzy.claranet.de... > Maybe Ellen finds a solution for this problem, and that could > be to appoint Cat as admin with the right to cancel articles. > Or to block the compromised netvision.il etc. systems. Uh no thanks to that idea, JT's handled it just fine. From nobody at spamcop.net Mon Jan 3 17:42:05 2005 From: nobody at spamcop.net (indigo) Date: Mon Jan 3 17:45:11 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> <41D9C633.6CD6@xyzzy.claranet.de> Message-ID: Frank Ellermann wrote: > Maybe Ellen finds a solution for this problem, and that could > be to appoint Cat as admin with the right to cancel articles. Uh, let's not and say we did, M'kay? No one should be canceling posts that are not their own. From nobody at spamcop.net Mon Jan 3 17:44:42 2005 From: nobody at spamcop.net (indigo) Date: Mon Jan 3 17:45:17 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> <41D9C633.6CD6@xyzzy.claranet.de> Message-ID: Heidi wrote: > "Frank Ellermann" wrote in message > news:41D9C633.6CD6@xyzzy.claranet.de... > > > Maybe Ellen finds a solution for this problem, and that could > > be to appoint Cat as admin with the right to cancel articles. > > Or to block the compromised netvision.il etc. systems. > > Uh no thanks to that idea, JT's handled it just fine. Spill! Inquiring minds want to know! From nobody at spamcop.net Tue Jan 4 11:49:01 2005 From: nobody at spamcop.net (Anony Mouse) Date: Mon Jan 3 17:50:02 2005 Subject: [SpamCop-List] Re: Sash References: <41D9B6B7.5020504@spamcop.net> <41D9BF47.4080409@spamcop.net> Message-ID: <41D9CBDD.6020406@spamcop.net> Merlyn wrote: > "Anony Mouse" wrote in message > news:41D9BF47.4080409@spamcop.net... > >>Anony Mouse wrote: >> >>I seem to recall reading that the charges may have been withdrawn. >> > > > http://www.google.com/search?hl=en&q=Van+Essen+and+Atkinson+spam > > :-) > Hmmm not much help finding the info I am looking for... The reason Van Essen is to the forefront again is because I am being spammed again with the same old stuff as I used to get when I started tracking down Van Essen over three years ago. It appears from spamhaus records that he has started up again. I also have new evidence related to the means by which Ven Essen sends his garbage. I have no doubt now that Van Essen is a member of the Send-safe gang run by Ruslan Ibragimov. From porpoise1954 at yahoo.co.uk Mon Jan 3 22:52:49 2005 From: porpoise1954 at yahoo.co.uk (Porpoise) Date: Mon Jan 3 18:05:03 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? References: Message-ID: "Merlyn" wrote in message news:crc5mn$oi6$1@news.spamcop.net... > > I think you would agree with me that everyone is tired of receiving > mortgage quotes, penis enlargement, breast enhancement, weight loss, nude > 40 year old teenage sluts, Viagra, vacation, lottery, prescription drug, > business opportunities, genealogical, university degrees, gambling, get > rich quick, MLM, pyramid schemes, Web Cams, Russian brides, work from > home, stock scams, pirated software and everything else that is force fed > into our inboxes. > > The spammers are the only ones to blame. > > -- > > Regards, > Merlyn Hey! Who said we're all tired of receiving nude 40 year old teenage sluts? ;-) From nobody at spamcop.net Mon Jan 3 18:20:21 2005 From: nobody at spamcop.net (Miss Betsy) Date: Mon Jan 3 18:25:07 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: "RW" wrote in message news:crbkub$ddl$1@news.spamcop.net... > "Miss Betsy" wrote in message > news:crbgfo$anp$1@news.spamcop.net... > > > The basic point is that ignoring (either by JHD or blocking) works, > > but it has to be a community effort. Anyone who responds keeps the > > spam or the troll going because even one response is worth its > > while. > > JHD would work for spam too if _everyone_ did it. Because there are a few > (0.1%) that respond, it makes it profitable for spammers so they keep on > going. Increase the volume and that 0.1% becomes a larger number. > > Don't feed the troll works if there is 100% compliance. JHD would work if > there was 100% compliance! Usually after a while, there is 100% compliance for not feeding the troll or at least it used to work on spamcop.help and in spamcop main ng. Miss Betsy From e.schrama_NOSPAM at NOSPAM_hccnet.nl Tue Jan 4 00:33:57 2005 From: e.schrama_NOSPAM at NOSPAM_hccnet.nl (geo_splash_12) Date: Mon Jan 3 18:35:06 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 In-Reply-To: References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: Steven Maesslein wrote: > On Mon, 03 Jan 2005 17:02:08 +0100, geo_splash_12 coughed into spamcop > and left this in : > > >>Everyone can subscribe or unsubscribe from the Apple newslist system, > > > Let me correct that so that things get put into perspective: > > "Everyone can subscribe or unsubscribe *ANYONE ELSE* to or from the > Apple newslist system" > So, how often does this happen? You can subscribe somebody else but it will be noted directly since they receive a confirmation and the recipient can correct it. Merely an annoyance if it happens, but no more. Was it abuse?, was it an error?, you simply can't tell. If you really want to get rid of Apple's newsletters then use *THEIR WEB SITE*. This is a better solution than blocking their mail server distributing the newsletters. Blocking their news servers also affects others, and in particular those who can't influence their ISPs that reserve the right to block spam on basis of spamcop. If it happens a few times you discredit spamcop, what a waste! I think you have a legal point about spewing applesauce around the world [sic] if you can prove that unsubscribing from Apple's newslists is unsuccessful. Nobody has demonstrated this so far, thus you have no case. Also nobody has demonstrated so far that Apple sells your e-mail address. If you have this evidence then it would also provide you with information to sue the spammer under US law including laws in many other countries. The whole discussion here is whether somebody is guilty until proven innocent or innocent until proven guilty. I opt for the latter, we don't live under Klingon legislation, and we shouldn't waste our effort on a problem which can be dealt with in a more efficient way. Anyone who reports certain types of spam to spamcop should IMHO simply receive a short feedback with the advice to use the Apple web site to unsubscribe from their digests. Also spamtraps shouldn't report this type of spam which is in reality is no spam. This is the core of the problem, how do you define spam? There is no clear definition and this whole discussion proves it. My $0.02, Ejo From me at privacy.net Mon Jan 3 15:50:24 2005 From: me at privacy.net (Sylvesterthekat) Date: Mon Jan 3 18:55:02 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: "Porpoise" wrote in message news:crbbk2$7kr$1@news.spamcop.net... > Ahh... Well...... you see....... then you don't even have to scan for > them..... ;-) If it was only his posts that were going missing, nobody would have cared a damn. From nobody at spamcop.net Mon Jan 3 18:56:03 2005 From: nobody at spamcop.net (Miss Betsy) Date: Mon Jan 3 19:00:02 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: "geo_splash_12" wrote in message news:crckp5$43n$1@news.spamcop.net... > The whole discussion here is whether somebody is guilty until proven > innocent or innocent until proven guilty. I opt for the latter, we don't > live under Klingon legislation, and we shouldn't waste our effort on a > problem which can be dealt with in a more efficient way. > > Anyone who reports certain types of spam to spamcop should IMHO simply > receive a short feedback with the advice to use the Apple web site to > unsubscribe from their digests. Also spamtraps shouldn't report this > type of spam which is in reality is no spam. This is the core of the > problem, how do you define spam? There is no clear definition and this > whole discussion proves it. > > My $0.02, The basic definition is 'unsolicited' and spamtraps 'prove' it is unsolicited because they are /never/ used. Also, AFAIK, confirmation emails are not reportable. If Apple doesn't want to be listed, then their mailing list needs to be confirmed subscription which they can then demonstrate to spamcop that the report was in error. The only way to stop spam is to stop it at the source which means that those who run mailing lists have to be responsible, competent managers of mailing lists. And that is easily demonstrated by the numbers of people who report their mailings as spam and where the list owners cannot demonstrate that the report is in error. On a personal note, I do not ever unsubscribe from something that I have not subscribed to. Miss Betsy From MikeE at ster.invalid Mon Jan 3 16:04:01 2005 From: MikeE at ster.invalid (Mike Easter) Date: Mon Jan 3 19:05:02 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: geo_splash_12 wrote: > So, how often does this happen? You can subscribe somebody else but it > will be noted directly since they receive a confirmation and the > recipient can correct it. I'm having a hard time understanding why you don't get it. Where 'it' is what is going on wrong with Apple's newsletter. If you subscribe to Itunes and then you start getting Itunes and then you want to unsub, then you go unsub. That's fine. If someone bogus subscribes me to Itunes and I start getting Itunes newsletters along with the confirmation that is telling me that I can go unsubscribe if I don't want it anymore -- then that is spam just like it is spam whenever I get any other kind of spam that tells me I can unsub if I want to. Now, it just so happens that I am one of those people who would handle a straightup mainsleaze spam differently than a 'regular' spam that invites me to unsub -- but just because I am willing to send my abuse notifies to various people including Apple's unsub address, if there is one. If a spam requires me to go visit a website to unsub, I'm not going to do that no matter who it is. > If you really want to get rid of Apple's newsletters then use *THEIR > WEB SITE*. That is only appropriate for those who have subscribed; not those who haven't. > This is a better solution than blocking their mail server > distributing the newsletters. Blocking their news servers also affects > others, and in particular those who can't influence their ISPs that > reserve the right to block spam on basis of spamcop. If it happens a > few times you discredit spamcop, what a waste! It is Apple's fault their spams get listed as spamsources, not spamcop's. > I think you have a legal point about spewing applesauce around the > world [sic] if you can prove that unsubscribing from Apple's > newslists is unsuccessful. This isn't about unsubbing from unsolicited commercial email. The only people who should be unsubbing is the subs. > Nobody has demonstrated this so far, thus > you have no case. That's not what we're talking about. > Also nobody has demonstrated so far that Apple > sells your e-mail address. That's not what we're talking about either. We are only talking about one thing. We are talking about people getting newsletters from Apple who never subscribed. We are also talking about spamtraps getting newsletters from Apple who never subscribed. We are also talking about it being a proven fact that Apple sends out unsolicited commercial emails to people who have never confirmed to Apple that they want to receive them. The business of there being a subscribe webform which requires that an email address be entered two times is only considered an affirmed subscription by something stupid like Bonded Sender, who is in the business of making mailer's pay to get their Bonded Sender stamp on mail. In the case of Apple, they chose to be TrustE/d rather than bonded sender. > Anyone who reports certain types of spam to spamcop should IMHO simply > receive a short feedback with the advice to use the Apple web site to > unsubscribe from their digests. That is the stupidest most ridiculous idea I've heard all day. > Also spamtraps shouldn't report this > type of spam which is in reality is no spam. A spamtrap which never subscribed shouldn't be allowed to report the spam it receives. Why is that? Because /you/ want to get your Itunes mail and you want everyone else to get their Itunes mail, and it doesn't matter if all kinds of other people who never subscribed to their Itunes mail should also get it. Don't you understand? Just because some mailing list has subscribers doesn't mean that the mailing list can mail to everyone in the world and expect all of those everyone's to go unsub. That is absurd. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Mon Jan 3 16:14:50 2005 From: MikeE at ster.invalid (Mike Easter) Date: Mon Jan 3 19:15:05 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: Mike Easter wrote: > geo_splash_12 wrote: >> Anyone who reports certain types of spam to spamcop should IMHO >> simply receive a short feedback with the advice to use the Apple web >> site to unsubscribe from their digests. > > That is the stupidest most ridiculous idea I've heard all day. That sounds a little harsh. Let me wrap a little context or clarification around it. If a spamcop reporter subscribed to Itunes, and then they made a mistake and reported their newsletter as spam, then they would be candidates for disciplinary action by a deputy who was informed of that. Further, it would be /wrong/ of that reporter to be reporting that Itunes newsletter as spam. Instead, they should be going to the website to unsubscribe, just like they agreed to in the first place. However, if a person receives an unsolicited commercial email to which they have not subscribed, it is not up to Ejo, who likes Apple and who wants to receive Itunes in his mail and who subscribed to Itunes, to decide that the spamcop reporter shouldn't be reporting that unsolicited commercial email, but instead should be clicking on the spammer's weblink to go unsubscribe. That is ridiculous. I don't see why it shouldn't also be called a stupid idea. -- Mike Easter kibitzer, not SC admin From ric.gates at bigsleep.org Tue Jan 4 01:22:53 2005 From: ric.gates at bigsleep.org (Blammo) Date: Mon Jan 3 20:25:03 2005 Subject: [SpamCop-List] Re: help Help? HELP! FTP Silliness now OT References: Message-ID: On 03 Jan 2005 Porpoise entered spamcop and left news:crb9p7$6kq$1@news.spamcop.net: > Ermmm.... ALL directories use IE for browsing in XP (remember the DJ > actions against M$ for making it a part of the OS?) albeit the UI > presented might differ slightly > An Internet Shortcut opens the default application for that protocal. You can argue about it all you want but FTP is nothing like file sharing. You could argue that HTTP is just like browsing your harddrive, that don't make it so, and IE doesn't handle them the same way, the browser isn't used for that, the explorer shell is. You can use FTP over your local network, that don't make FTP the same as file sharing. You can even file share with an FTP site but it doesn't use FTP to do that. -- | Ric | From rg at nospam.please Mon Jan 3 20:23:47 2005 From: rg at nospam.please (rg) Date: Mon Jan 3 20:25:20 2005 Subject: [SpamCop-List] DNS blocking for companionground.com? Message-ID: I just posted a spam that has links to companionground.com. Spamcop reported it could not resolve the address, so I substituted the actual IP address in one case so the spam report would go out. Q: Does this mean the DNS provider is in cahoots with the spammer, blocking Spamcop access? Here's the Whois info: Registration Service Provided By: NameCheap.com Contact: support@NameCheap.com Visit: http://www.namecheap.com/ Domain name: companionground.com Registrant Contact: HomeViz Vadim Gablian (admin@chillblow.com) +1.5555555555 Fax: +1.5555555555 34 Vualia Diesel, GH 324533 JM Administrative Contact: HomeViz Vadim Gablian (admin@chillblow.com) +1.5555555555 Fax: +1.5555555555 34 Vualia Diesel, GH 324533 JM Technical Contact: HomeViz Vadim Gablian (admin@chillblow.com) +1.5555555555 Fax: +1.5555555555 34 Vualia Diesel, GH 324533 JM Billing Contact: HomeViz Vadim Gablian (admin@chillblow.com) +1.5555555555 Fax: +1.5555555555 34 Vualia Diesel, GH 324533 JM Status: Active Name Servers: NS1.97MARANGA97.BIZ NS2.97MARANGA97.BIZ Creation date: 02 Jan 2005 18:46:55 Expiration date: 02 Jan 2006 18:46:55 From nobody at spamcop.net Mon Jan 3 20:46:55 2005 From: nobody at spamcop.net (Ellen) Date: Mon Jan 3 20:55:02 2005 Subject: [SpamCop-List] Re: DNS blocking for companionground.com? References: Message-ID: "rg" wrote in message news:crcr72$8ne$1@news.spamcop.net... > I just posted a spam that has links to companionground.com. Spamcop reported > it could not resolve the address, so I substituted the actual IP address in > one case so the spam report would go out. > I really hope that you are not saying that you modified the spam to force the system to send a report that it would not have sent ? That is against the SC TOS/AUP. Ellen SpamCop From MikeE at ster.invalid Mon Jan 3 18:13:15 2005 From: MikeE at ster.invalid (Mike Easter) Date: Mon Jan 3 21:15:03 2005 Subject: [SpamCop-List] Re: DNS blocking for companionground.com? References: Message-ID: rg wrote: > I just posted a spam that has links to companionground.com. Spamcop > reported it could not resolve the address, so I substituted the > actual IP address in one case so the spam report would go out. If I'm understanding you correctly, you aren't supposed to do that. What I'm hearing is that you submitted a spam to the parser, you weren't satisfied with the reporting results of the parse, so you 'modified' ie changed the original spam into a different spam which would provide the result you desired for the reporting addies. In a situation in which a spamcop parse does not provide the desired [by you] reporting address, you have two options depending upon whether you are a free or paid reporter. If you are a free reporter, you have no alternative spamcop reporting related options. You /can/ use spamcop to help you determine a notifying addy, and then use that notifying addy for a manual notify, generated by yourself, not a spamcop notify. If you are a paid reporter, you have the 'right' to add an additional reporting address to the notify. Notice that that is quite a different thing than modifying the original spam, ie 'forging' a 'make-believe' spam. Forging a make believe spam so as to 'enable' SC to report the body link is against the rules. That is a 'material change' which causes SC to find a link, in this case resolve a link rather than 'find', that it wouldn't have otherwise found/resolved. > Q: Does this mean the DNS provider is in cahoots with the spammer, > blocking Spamcop access? SC cannot resolve companionground.com Parsing input: companionground.com Cannot resolve companionground.com No valid email addresses found, sorry! If that domainname is in a spam, that is, if you have provided a tracker instead of not providing a tracker, then we could see more information about why the above result is given. My dns gives a result as 202.102.230.36 - but that may be cached. It is more appropriate to go to the root servers and come back down to the domainname dns. If I go to dns stuff, I see poor performance from the nameservers ns1 & ns2 97maranga97.biz It is not unusual for such a situation to result in SC inability to resolve. > Here's the Whois info: > > Registration Service Provided By: NameCheap.com That is the wrong kind of information. SC isn't interested in the domainname registration. It is interested in the resolution of the domainname to an IP address; after it obtains that IP address then it uses the appropriate RiR for the notify. In this case, the IP is 202.102.230.36 and SC's notifies for that IP would be Reporting addresses: abuse@chinanet.cn.net abuse@cnc-noc.net If you were paid reporter, you could add that to the notify. If you were free reporter, you would have to make that notify manually. Such a notify wouldn't be very productive, because that IP is on the SBL, spamhaus blocklist, which indicates that the provider is unresponsive to notifies. > Name Servers: > NS1.97MARANGA97.BIZ > NS2.97MARANGA97.BIZ -- Mike Easter kibitzer, not SC admin From mfkmek820 at yahoo.com Mon Jan 3 18:07:29 2005 From: mfkmek820 at yahoo.com (Fred K) Date: Mon Jan 3 22:10:04 2005 Subject: [SpamCop-List] Re: DNS blocking for companionground.com? References: Message-ID: "Mike Easter" wrote in message news:crcu1j$akq$1@news.spamcop.net... > rg wrote: >> I just posted a spam that has links to companionground.com. Spamcop >> reported it could not resolve the address, so I substituted the >> actual IP address in one case so the spam report would go out. Mike You again gave a refreshingly accurate account and dissection of the original post. Thank you for your professionalism. I learn more and more from almost every post you make. Thanks again Fred k From rg at nospam.please Mon Jan 3 23:25:08 2005 From: rg at nospam.please (rg) Date: Mon Jan 3 23:30:03 2005 Subject: [SpamCop-List] Re: DNS blocking for companionground.com? References: Message-ID: Aren't you interested in the fact that they may have come up with a new way to block spamcop by making your DNS server fail when analyzing their spam message? They have sabotaged an important part of your analysis stream. I did one substitution by replacing one machine name with the resolved IP, since Spamcop could not to that. It does not alter the structure, functionality, or intent of the spam. It only makes it possible for Spamcop to continue in spite of this spammer's sabotage. "Mike Easter" wrote in message news:crcu1j$akq$1@news.spamcop.net... > rg wrote: > > I just posted a spam that has links to companionground.com. Spamcop > > reported it could not resolve the address, so I substituted the > > actual IP address in one case so the spam report would go out. > > If I'm understanding you correctly, you aren't supposed to do that. > > What I'm hearing is that you submitted a spam to the parser, you weren't > satisfied with the reporting results of the parse, so you 'modified' ie > changed the original spam into a different spam which would provide the > result you desired for the reporting addies. > > In a situation in which a spamcop parse does not provide the desired [by > you] reporting address, you have two options depending upon whether you > are a free or paid reporter. > > If you are a free reporter, you have no alternative spamcop reporting > related options. You /can/ use spamcop to help you determine a > notifying addy, and then use that notifying addy for a manual notify, > generated by yourself, not a spamcop notify. > > If you are a paid reporter, you have the 'right' to add an additional > reporting address to the notify. Notice that that is quite a different > thing than modifying the original spam, ie 'forging' a 'make-believe' > spam. Forging a make believe spam so as to 'enable' SC to report the > body link is against the rules. That is a 'material change' which > causes SC to find a link, in this case resolve a link rather than > 'find', that it wouldn't have otherwise found/resolved. > > > Q: Does this mean the DNS provider is in cahoots with the spammer, > > blocking Spamcop access? > > SC cannot resolve companionground.com > > Parsing input: companionground.com > Cannot resolve companionground.com > No valid email addresses found, sorry! > > If that domainname is in a spam, that is, if you have provided a tracker > instead of not providing a tracker, then we could see more information > about why the above result is given. > > My dns gives a result as 202.102.230.36 - but that may be cached. It > is more appropriate to go to the root servers and come back down to the > domainname dns. > > If I go to dns stuff, I see poor performance from the nameservers ns1 & > ns2 97maranga97.biz > > It is not unusual for such a situation to result in SC inability to > resolve. > > > Here's the Whois info: > > > > Registration Service Provided By: NameCheap.com > > That is the wrong kind of information. > > SC isn't interested in the domainname registration. It is interested in > the resolution of the domainname to an IP address; after it obtains > that IP address then it uses the appropriate RiR for the notify. > > In this case, the IP is 202.102.230.36 > > and SC's notifies for that IP would be > > Reporting addresses: > abuse@chinanet.cn.net > abuse@cnc-noc.net > > If you were paid reporter, you could add that to the notify. If you > were free reporter, you would have to make that notify manually. > > Such a notify wouldn't be very productive, because that IP is on the > SBL, spamhaus blocklist, which indicates that the provider is > unresponsive to notifies. > > > Name Servers: > > NS1.97MARANGA97.BIZ > > NS2.97MARANGA97.BIZ > > -- > Mike Easter > kibitzer, not SC admin > From notspam at alias.hotpop.com Mon Jan 3 21:27:42 2005 From: notspam at alias.hotpop.com (JV) Date: Mon Jan 3 23:30:11 2005 Subject: [SpamCop-List] Update Message-ID: Anything really interesting going on? I've been busy outside this venue for quite some time. :-) From notspam at alias.hotpop.com Mon Jan 3 21:39:13 2005 From: notspam at alias.hotpop.com (JV) Date: Mon Jan 3 23:40:03 2005 Subject: [SpamCop-List] 7 weeks, SOS Message-ID: 7 weeks I have spent on a problem that really began 10 years ago. We have little or no proactive security. Will we ever get that? Moving again to another such... From agent01413 at my-deja.com Tue Jan 4 04:43:26 2005 From: agent01413 at my-deja.com (Socks) Date: Mon Jan 3 23:45:03 2005 Subject: [SpamCop-List] Re: Yahoo is blacklisted? References: Message-ID: jrstark wrote in news:cra607$g7l$1@news.spamcop.net: > Merlyn wrote: > >> "jrstark" wrote in message >> news:cra4ho$f1g$1@news.spamcop.net... >> >>>I am not getting any of my yahoo groups email, this is apparently the >>>reason why: >>>http://www.spamcop.net/w3m?action=blcheck&ip=66.94.237.46 >>> >>>What is going on? >> >> >> Nothing is wrong, too much spam. >> >> This is already under discussion here in a few threads. >> > > I searched, but just see threads about yahoo email accounts. Where > can I find more info? > > I am not using a yahoo mail account, or complaining about receiving > spam. SpamCop is blocking my legitimate emails from yahoo groups, and > is sending yahoo bounce notices. > Is spamcop sending them, or is your ISP sending them? You didn't post an example so it is hard to say for sure. It is possible to add someone to a yahoo group without their consent, leading to spam complaints. I know, because I run some yahoo groups and know how to get past their confirmation requirement. The spamcop report says that mail is being delivered to spamcop spamtrap addresses. That suggests to me that someone running a group list did exactly that, and the listing is legitimate. Since Yahoo refuses spamcop reports, according to the query page for 66.94.237.46 I am not too surprised that they let the spammer keep spamming, the reports keep piling up, and the listing to continue. Your ISP can whitelist yahoo groups so that spamcop and the other dnsbls don't get checked. I did that on one domain that I am responsible for. Asking your ISP to whitelist yahoo seems reasonable. Of course, that means that spam coming through those servers will get delivered, so it would also be reasonable for your ISP to say no. There is some irony at play here. barntowire is hosted on theplanet. theplanet blocking spammers is like george bush criticizing someone for poor grammar. Bear in mind that you have other options. You can view your list traffic in the yahoo group archive. You can also configure yourself to get a daily digest of messages. Faced with the same problem you have with my politechbot traffic, I set myself to digest and got that traffic through a different, unlisted IPA. I think it is reasonably likely, given its volume, that yahoo has a separate server dedicated to digest traffic. From Kilgallen at SpamCop.net Mon Jan 3 22:45:01 2005 From: Kilgallen at SpamCop.net (Larry Kilgallen) Date: Mon Jan 3 23:50:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: In article , geo_splash_12 writes: > Larry Kilgallen wrote: > > >> So ? Some of those Itunes newsletter transmissions are spam ! > > No they are not, I call it ignorance since we perfectly well know that > the mentioned IP is an itunes distribution node. If they were sent to someone who did not ask for them, they are spam. > Everyone can subscribe or unsubscribe from the Apple newslist system, Or be subscribed by their enemies. > but what we seem to be disagreeing on is the way this is implemented. No, _you_ are the only one here who thinks that closed loop confirmation is not a requirement. > Maybe some hope to achieve that Apple changes its newslist system, I > don't see any evidence of this, it is the classical dilemma of bringing > Mohammed to the Mountain. No, it is a classic example of big business misusing a public resource and squandering their goodwill. From agent01413 at my-deja.com Tue Jan 4 04:49:02 2005 From: agent01413 at my-deja.com (Socks) Date: Mon Jan 3 23:50:08 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? References: Message-ID: "Blitzen" wrote in news:crc2i5$m81$1 @news.spamcop.net: > This is idiotic, my iolfree.ie addy is hardbouncing yahoo groups AND any > attempt at reactivation of the addy with the following message: > > *** > Remote host said: 550 Blocked - see > http://www.spamcop.net/bl.shtml?66.94.237.47 [RCPT_TO] > *** > > This really doesn't serve any useful purpose. > > G yes it does. it stops the spam that is being sent through yahoo groups, including spam sent to spamcop trap addresses. as a paying spamcop client, I expect spamcop to list IPAs that spam is coming from. In this case, the sending IPA happens to belong to Yahoo Groups. If Yahoo Groups wants to get its act together and stop the spamming, then the problem will be resolved. if this forces yahoo groups to stop the spam, then it serves a purpose. Meanwhile, set your address so that mail isn't delivered, and read the messages in the group archive. http://groups.yahoo.com/group/xxxxxxxxxx/messages Replace xxxxxxxxxx with your group name. From Kilgallen at SpamCop.net Mon Jan 3 22:50:28 2005 From: Kilgallen at SpamCop.net (Larry Kilgallen) Date: Mon Jan 3 23:55:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> In article , geo_splash_12 writes: > Steven Maesslein wrote: >> On Mon, 03 Jan 2005 17:02:08 +0100, geo_splash_12 coughed into spamcop >> and left this in : >> >> >>>Everyone can subscribe or unsubscribe from the Apple newslist system, >> >> >> Let me correct that so that things get put into perspective: >> >> "Everyone can subscribe or unsubscribe *ANYONE ELSE* to or from the >> Apple newslist system" >> > > So, how often does this happen? Often enough that their IP address gets boycotted, annoying those who _did_ subscribe and have to come to this newsgroup for an education. > You can subscribe somebody else but it > will be noted directly since they receive a confirmation and the > recipient can correct it. That approach does not scale. Those who realize it does not scale will never unsubscribe from something to which they did not subscribe. > Merely an annoyance if it happens, but no > more. And if you are forge-subscribed to 2529 different newsletters will you still feel that way. > Was it abuse?, was it an error?, you simply can't tell. We can tell. Apple does not require closed loop confirmation, so they are abusing the internet. > If you really want to get rid of Apple's newsletters then use *THEIR > WEB SITE*. This is a better solution than blocking their mail server > distributing the newsletters. No, that would not have brought you here for an education. > Blocking their news servers also affects > others, and in particular those who can't influence their ISPs that > reserve the right to block spam on basis of spamcop. If you are their customer, you can affect Apple. > If it happens a few > times you discredit spamcop, what a waste! No, Apple is the one discredited. From agent01413 at my-deja.com Tue Jan 4 04:50:32 2005 From: agent01413 at my-deja.com (Socks) Date: Mon Jan 3 23:55:09 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? References: Message-ID: "Blitzen" wrote in news:crc5ut$opv$1@news.spamcop.net: > Merlyn, > > Reality is that ALL the mails you mention KEEP ON COMING in SPITE of > my ISP using SPAMCOP. > Not from that IPA. If it did, why are you complaining. > And to add insult to injury I cannot stay in touch with my friends, > so, I respectfully suggest PERHAPS SPAMcop isn't really working? > your friends are refusing traffic from you? From agent01413 at my-deja.com Tue Jan 4 04:51:56 2005 From: agent01413 at my-deja.com (Socks) Date: Mon Jan 3 23:55:15 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? References: Message-ID: Steven Maesslein wrote in news:slrnctjh06.lu0.nobody@127.0.0.1: > On Mon, 3 Jan 2005 13:17:06 -0800, Mike Easter coughed into spamcop and > left this in : > >> Presumably you would like to discuss why your wanted mail's sending IP >> is on a blocklist. > > It doesn't look like it. It looks more like the OP would rather throw a > hissy fit and hope that the spam sewer gets delisted through that course > of action. > why he doesnt just go to the archive directory for that list and read the missing messages escapes me. It isn't rocket science. From Kilgallen at SpamCop.net Mon Jan 3 22:53:57 2005 From: Kilgallen at SpamCop.net (Larry Kilgallen) Date: Mon Jan 3 23:55:20 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? References: Message-ID: <0YPwLWzL8zvR@eisner.encompasserve.org> In article , "Blitzen" writes: > This is idiotic, my iolfree.ie addy is hardbouncing yahoo groups AND any > attempt at reactivation of the addy with the following message: > > *** > Remote host said: 550 Blocked - see > http://www.spamcop.net/bl.shtml?66.94.237.47 [RCPT_TO] > *** > > This really doesn't serve any useful purpose. It protects me from the _DAILY_ spam I get from Yahoo Groups. From Kilgallen at SpamCop.net Mon Jan 3 22:54:54 2005 From: Kilgallen at SpamCop.net (Larry Kilgallen) Date: Mon Jan 3 23:55:23 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? References: Message-ID: In article , "Blitzen" writes: > Well all I can say is: > > "bully for you Tim" > > Because it sure as heck isn't keeping SPAM out of MY inbox (for the addy, > for which the SPAMcop filters are being used, which is INUNDATED), it is > just keeping me, a disabled person, out of touch with my friends! I recognize your disability, but top-posting can be cured. >>> This really doesn't serve any useful purpose. >> >> Yes it does. It keeps spam out of my inbox. >> >> This IP is a source of spam. >> >> http://groups-beta.google.com/group/news.admin.net-abuse.sightings/search?q=66.94.237.47&start=0&scoring=d From agent01413 at my-deja.com Tue Jan 4 05:05:17 2005 From: agent01413 at my-deja.com (Socks) Date: Tue Jan 4 00:10:02 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: geo_splash_12 wrote in news:crbqa4$gfq$1 @news.spamcop.net: >> So ? Some of those Itunes newsletter transmissions are spam ! > > No they are not, I call it ignorance since we perfectly well know that > the mentioned IP is an itunes distribution node. Despite all discussions > here on spamcop's list policy i've not seen any reasonable argument on > what some hope to achieve by listing this IP. It doesn't change or > improve the situation, it is probably regarded as plain old fashioned > annoyance that discredits the spamcop system. nope. itunes can choose to implement a confirmation system, or it can choose to continue its merry way accepting addresses without confirmation. However, I'll take your word for it that itunes runs a confirmation based system. I happen to know a spamtrap address for another dnsbl. It is configured to trigger listing on the second message from a given IPA to the address. That permits a confirmation to arrive and be ignored without triggering listing. If a second message from the same IPA to the same address arrives within a certain amount of time, then obviously deleting the confirmation message unanswered failed to keep the address from being added to the list. That shouldn't pose a problem for itunes, because you claim that they confirm subscriptions. Any objections if I test your proposition? From SCNews.5.myspamgobbler at spamgourmet.com Mon Jan 3 21:20:21 2005 From: SCNews.5.myspamgobbler at spamgourmet.com (Spam N Scams Reporter) Date: Tue Jan 4 00:25:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 In-Reply-To: References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: Socks wrote: > geo_splash_12 wrote in news:crbqa4$gfq$1 > @news.spamcop.net: > > >>>So ? Some of those Itunes newsletter transmissions are spam ! >> >>No they are not, I call it ignorance since we perfectly well know that >>the mentioned IP is an itunes distribution node. Despite all discussions >>here on spamcop's list policy i've not seen any reasonable argument on >>what some hope to achieve by listing this IP. It doesn't change or >>improve the situation, it is probably regarded as plain old fashioned >>annoyance that discredits the spamcop system. > > > nope. itunes can choose to implement a confirmation system, or it can > choose to continue its merry way accepting addresses without confirmation. > > However, I'll take your word for it that itunes runs a confirmation based > system. I happen to know a spamtrap address for another dnsbl. It is > configured to trigger listing on the second message from a given IPA to the > address. That permits a confirmation to arrive and be ignored without > triggering listing. If a second message from the same IPA to the same > address arrives within a certain amount of time, then obviously deleting > the confirmation message unanswered failed to keep the address from being > added to the list. That shouldn't pose a problem for itunes, because you > claim that they confirm subscriptions. Any objections if I test your > proposition? > Save yourself the trouble. I already tested it - See my post above. Apple failed. Brian From David1 at suescornerweb.com Tue Jan 4 02:23:28 2005 From: David1 at suescornerweb.com (David 1) Date: Tue Jan 4 02:25:04 2005 Subject: [SpamCop-List] Re: FYI In-Reply-To: References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: Miss Betsy wrote: > "Frog Prince" wrote in message > news:crbfi1$a42$1@news.spamcop.net... > > >>| I think you missed Mike's point there..... The best Killfile is > > the > >>brain - snip > You know all this, but I am stating for those who don't know. snip > > Miss Betsy > > > & you just keep doing that for folks like me -- David 1 bad addy spamtrap@suescornerweb.com From David1 at suescornerweb.com Tue Jan 4 02:58:30 2005 From: David1 at suescornerweb.com (David 1) Date: Tue Jan 4 03:00:02 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? In-Reply-To: References: Message-ID: Socks wrote: > "Blitzen" wrote in news:crc2i5$m81$1 > @news.spamcop.net: > > >>This is idiotic, my iolfree.ie addy is hardbouncing yahoo groups AND any >>attempt at reactivation of the addy with the following message: >> >>*** >>Remote host said: 550 Blocked - see >>http://www.spamcop.net/bl.shtml?66.94.237.47 [RCPT_TO] >>*** >> >>This really doesn't serve any useful purpose. >> >>G > > > yes it does. it stops the spam that is being sent through yahoo groups, > including spam sent to spamcop trap addresses. as a paying spamcop client, > I expect spamcop to list IPAs that spam is coming from. In this case, the > sending IPA happens to belong to Yahoo Groups. If Yahoo Groups wants to > get its act together and stop the spamming, then the problem will be > resolved. > > if this forces yahoo groups to stop the spam, then it serves a purpose. > > Meanwhile, set your address so that mail isn't delivered, and read the > messages in the group archive. > > http://groups.yahoo.com/group/xxxxxxxxxx/messages Replace xxxxxxxxxx with > your group name. well on most of the groups that I run that wont work as far as no mail because yahoo took the space from groups to give to the mail section they don't keep the attachments any more ing the archive & all my groups are mostly attachments -- David 1 bad addy spamtrap@suescornerweb.com From MikeE at ster.invalid Tue Jan 4 00:52:58 2005 From: MikeE at ster.invalid (Mike Easter) Date: Tue Jan 4 03:55:13 2005 Subject: [SpamCop-List] Re: DNS blocking for companionground.com? References: Message-ID: rg wrote: > Aren't you interested in the fact that they may have come up with a > new way to block spamcop by making your DNS server fail when > analyzing their spam message? They have sabotaged an important part > of your analysis stream. Yes, spamcop admin and also just regular citizens like me are interested in the fact that some domains are not resolvable by spamcop's resolver. But, only a little. But/and, you should also realize that the 'business' of spamcop notifying the provider for a spamvertised site is not an important business. It is only useful to those providers who want to hear about it; and being identified as a spamvertiser has no 'consequences' in the same way that being identified as a spamsource has the consequence of affecting the spamcop blocklist. > I did one substitution by replacing one machine name with the > resolved IP, since Spamcop could not to that. It does not alter the > structure, functionality, or intent of the spam. It only makes it > possible for Spamcop to continue in spite of this spammer's sabotage. What Ellen is, and also less importantly I am, trying to help you understand is that you are not /allowed/ to help out in that way. When you sign up with SC, you agree^1 to play by the rules, and there is a rule^2 against that. There are many many many structures which 'we' who look at spamcop parses find to interfere with the result of a parse, some more problematic than others. And some of those structures are important and need to be remedied, especially the ones in the headers. So, the situation is that you can talk about the problem with the result of a parse here, which should be done by posting a tracker^3 not just describing the problem. There is one more problem which is about housekeeping, and that is that you need to structure your quotes^4 in such a way that you have trimmed and contextualized them, not topposted. That way we can have a conversation. ^1 http://www.spamcop.net/anonsignup.shtml If I break these rules, SpamCop will immediately and permanently revoke my access to SpamCop. http://www.spamcop.net/fom-serve/cache/143.html What if I break the rule(s)? ^2 http://www.spamcop.net/fom-serve/cache/283.html Do not make any material changes to spam before submitting or parsing which may cause SpamCop to find a link, address or URL it normally would not, by design, find. ^3 A tracker is a tracking URL to be found at the top of a parse in this context: "Here is your TRACKING URL - it may be saved for future reference:" and looks like this: http://www.spamcop.net/sc?id=code# - where code# is z + 9 decimal digits + z + 32 hexadecimal digits + z and that tracker can be used to examine both the parse result and the original spam ^4 http://members.fortunecity.com/nnqweb/nquote.html Quoting Style in Newsgroup Postings Q1: What is "quoting" in newsgroup postings? Q2: How should I use the quoted text and arrange it with my own text? -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Tue Jan 4 02:04:06 2005 From: MikeE at ster.invalid (Mike Easter) Date: Tue Jan 4 05:06:02 2005 Subject: [SpamCop-List] Re: DNS blocking for companionground.com? References: Message-ID: rg wrote: > I just posted a spam that has links to companionground.com. Spamcop > reported it could not resolve the address, so I substituted the > actual IP address in one case so the spam report would go out. Let's talk about attacking this problem differently than altering spam which is fed to spamcop. > Q: Does this mean the DNS provider is in cahoots with the spammer, > blocking Spamcop access? Here's the dnsreport story on how bad companionground.com looks http://www.dnsreport.com/tools/dnsreport.ch?domain=companionground.com companion has 3 nameservers, 2 'regular' and 1 stealth. Of those only one regular is answering; and the quality of the 'answering' is terrible as is seen by the dns timing score of F, which shows all of the timing out and not answering and/but eventually giving a report. > Here's the Whois info: > > Registration Service Provided By: NameCheap.com This is another route of attack on the domainname, because the registration is full of bogus information. > Registrant Contact: > Administrative Contact: > Technical Contact: > Billing Contact: > HomeViz > Vadim Gablian (admin@chillblow.com) > +1.5555555555 > Fax: +1.5555555555 > 34 Vualia > Diesel, GH 324533 > JM > Creation date: 02 Jan 2005 18:46:55 dns chillblow.com No DNS for this address (host doesn't exist) All of that bogus business should be reported at internic There is no email addy, no telno, no valid snail addy. To report incomplete or inaccurate Registrar Whois data, please visit the new Whois Data Problem Report System. http://wdprs.internic.net/ All accredited registrars have agreed with ICANN to obtain contact information from registrants, to provide it publicly by a Whois service, and to investigate and correct any reported inaccuracies in contact information for domain names registered through them. Reports submitted through this facility will be forwarded to the appropriate registrar for handling, and the progress of your report will be tracked. So, the point of this is that the spamcop report isn't useful for 'dealing with' the spamvertiser, who has a brandnew domainname. The better approach is to attack the domainname registration, which you do yourself. Changing spam to get spamcop to notify the unresponsive .cn providers will get you in trouble at spamcop and do no good whatsoever. Finding the vulnerability of the bogus domainname information and reporting it to internic and enom [enom is the registrar, namecheap is a registration service] is a better strategy. Domain Name: COMPANIONGROUND.COM Registrar: ENOM, INC. whois -h whois.enom.com companionground.com ... Registration Service Provided By: NameCheap.com -- Mike Easter kibitzer, not SC admin From nobody at nowhere.invalid Tue Jan 4 11:23:31 2005 From: nobody at nowhere.invalid (Steven Maesslein) Date: Tue Jan 4 05:25:04 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: On Tue, 04 Jan 2005 00:33:57 +0100, geo_splash_12 coughed into spamcop and left this in : > So, how often does [forge subscribing] happen? More often than you seem to think. Spammers are sick in the brain (ObQuirk noted). When disgruntled enough about snti-spammers' efforts working, they take the time to forge subscribe people to hundreds of unconfirmed lists. Literally. > You can subscribe somebody else but it will be noted directly since > they receive a confirmation and the recipient can correct it. For one thing, the damage is already done if the forge subscribee receives the confirmation message. Furthermore, if JHD doesn't scale, unsubbing has even less chance of scaling since it takes more time. Then there are principles: I do not unsubscribe from something I didn't subscribe to in the first place. > Merely an annoyance if it happens, but no more. Getting forge-subscribed to hundreds of unconfirmed mailing lists overnight is more than a mere annoyance. > Was it abuse?, was it an error?, you simply can't tell. I agree here. However, it has the potential to be abuse, and it can be prevented by the list operator doing hir job correctly in the first place. > If you really want to get rid of Apple's newsletters then use *THEIR > WEB SITE*. Huh? How is using their website going to get rid of ther spewletter? > This is a better solution than blocking their mail server distributing > the newsletters. Not for the victims of their abuse, it isn't. All it does, IIUC what you're on about, is stop Apple sending *me* their crap. It doesn't stop them from sending it to *all* those who didn't request it. > Blocking their news servers also affects others, and in particular > those who can't influence their ISPs that reserve the right to block > spam on basis of spamcop. If it happens a few times you discredit > spamcop, what a waste! I assume you mean their mail server, not their news server. That's the whole point. Those that *do* want Apple's spewletter but aren't receiving it are going to ask what's going on. To which Apple is going to respond that some list subscribers have been reporting the spew as spam. In reaction to that, those who ask what's going on are going to be split into 2 groups: those who (like you) seem impervious to clue and think that SpamCop are a bunch of meddling a-holes disrupting Apple's operations, and those who (unlike you) can be educated and will realise that the spew is being reported as spam because it *is* spam. > I think you have a legal point about spewing applesauce around the world Who said anything about the law? > [sic] if you can prove that unsubscribing from Apple's newslists is > unsuccessful. Nobody has demonstrated this so far, thus you have no > case. Nor do you, because this isn't about the ability or not to unsubscribe. People shouldn't have been forge subscribed in the first place. > Also nobody has demonstrated so far that Apple sells your e-mail > address. Irrelevant. This is about Apple confirming subscriptions, not about what Apple does with the e-mail addresses once they're on the list. > If you have this evidence then it would also provide you with > information to sue the spammer under US law including laws in many > other countries. Nobody's even been looking for this evidence because it has nothing to do with the problem at hand. > The whole discussion here is whether somebody is guilty until proven > innocent or innocent until proven guilty. I opt for the latter, we don't > live under Klingon legislation, and we shouldn't waste our effort on a > problem which can be dealt with in a more efficient way. Efficient for whom? Also, as I already said, this has nothing to do with the law. All the law is able to do is define what is legal spam and what is illegal spam. It does not define what is and what is not spam. So what if Apple isn't in breach of the U-CAN-SPAM act? All that means is that they're sending legal spam. It's still spam, though. > Anyone who reports certain types of spam to spamcop should IMHO simply > receive a short feedback with the advice to use the Apple web site to > unsubscribe from their digests. Anyone who uses SC to report spam is *not* going to attempt to unsubscribe from something they didn't unsubscribe to in the first place. They know better than that. Even if Apple is totally above-board in that area, they will suffer from the reputation of other, sleazier outfits that don't honour unsubscriptions and that sell off e-mail addresses that unsub as "live". If Apple wants to prove that they're trustworthy with unsubscription requests, they'll have to prove that they're trustworthy with subscription requests too. So far they've succeeded in proving precisely the opposite. > Also spamtraps shouldn't report this type of spam which is in reality > is no spam. This is the core of the problem, how do you define spam? > There is no clear definition and this whole discussion proves it. Much of what hits the SC spam traps is reviewed by humans. If it's clear that what hit the spam trap is a request for confirmation then the hit will *not* contribute to the DNSBL. If what hits the trap is the newsletter that was sent to an unconfirmed address then it *is* spam and *should* contribute to the DNSBL. -- Steve "A reputation for releasing inferior software will make it more difficult for a software vendor to induce customers to pay for new products or new versions of existing products." -- Microsoft From David1 at suescornerweb.com Tue Jan 4 05:23:35 2005 From: David1 at suescornerweb.com (David 1) Date: Tue Jan 4 05:30:02 2005 Subject: [SpamCop-List] Re: DNS blocking for companionground.com? In-Reply-To: References: Message-ID: Mike Easter wrote: > rg wrote: > >>Aren't you interested in the fact that they may have come up with a >>new way to block spamcop by making your DNS server fail when >>analyzing their spam message? They have sabotaged an important part >>of your analysis stream. > > > Yes, spamcop admin and also just regular citizens like me are interested > in the fact that some domains are not resolvable by spamcop's resolver. > But, only a little. > > But/and, you should also realize that the 'business' of spamcop > notifying the provider for a spamvertised site is not an important > business. It is only useful to those providers who want to hear about > it; and being identified as a spamvertiser has no 'consequences' in the > same way that being identified as a spamsource has the consequence of > affecting the spamcop blocklist. > > >>I did one substitution by replacing one machine name with the >>resolved IP, since Spamcop could not to that. It does not alter the >>structure, functionality, or intent of the spam. It only makes it >>possible for Spamcop to continue in spite of this spammer's sabotage. > > > What Ellen is, and also less importantly I am, trying to help you > understand is that you are not /allowed/ to help out in that way. When > you sign up with SC, you agree^1 to play by the rules, and there is a > rule^2 against that. > > There are many many many structures which 'we' who look at spamcop > parses find to interfere with the result of a parse, some more > problematic than others. And some of those structures are important and > need to be remedied, especially the ones in the headers. > > So, the situation is that you can talk about the problem with the result > of a parse here, which should be done by posting a tracker^3 not just > describing the problem. > > > There is one more problem which is about housekeeping, and that is that > you need to structure your quotes^4 in such a way that you have trimmed > and contextualized them, not topposted. That way we can have a > conversation. > > > ^1 http://www.spamcop.net/anonsignup.shtml If I break these rules, > SpamCop will immediately and permanently revoke my access to SpamCop. > http://www.spamcop.net/fom-serve/cache/143.html What if I break the > rule(s)? > > ^2 http://www.spamcop.net/fom-serve/cache/283.html Do not make any > material changes to spam before submitting or parsing which may cause > SpamCop to find a link, address or URL it normally would not, by design, > find. > > ^3 A tracker is a tracking URL to be found at the top of a parse in this > context: "Here is your TRACKING URL - it may be saved for future > reference:" and looks like this: http://www.spamcop.net/sc?id=code# - > where code# is z + 9 decimal digits + z + 32 hexadecimal digits + z and > that tracker can be used to examine both the parse result and the > original spam > > ^4 http://members.fortunecity.com/nnqweb/nquote.html Quoting Style in > Newsgroup Postings > Q1: What is "quoting" in newsgroup postings? > Q2: How should I use the quoted text and arrange it with my own text? > > > 1. no I'm not snipping this time 2. thanks for hopefully allowing me to jump in here 3. so does that mean on a message with no body I'm breaking the rules buy adding "no body adding for parser" to the email so that the parser will do it's thing for me. -- David 1 bad addy spamtrap@suescornerweb.com From MikeE at ster.invalid Tue Jan 4 02:39:50 2005 From: MikeE at ster.invalid (Mike Easter) Date: Tue Jan 4 05:40:03 2005 Subject: [SpamCop-List] Re: DNS blocking for companionground.com? References: Message-ID: David 1 wrote: > 1. no I'm not snipping this time 2. thanks for hopefully allowing me > to jump in here > 3. so does that mean on a message with no body I'm breaking the rules > buy adding "no body adding for parser" to the email so that the parser > will do it's thing for me. We think not. That is 'we' tinw think that it is OK to put that 'explanatory' information into the body. There are also some citizen folks here who don't think you /should/ do that - that is, they don't believe they should if a deputy doesn't say so, and a deputy isn't going to say so. The problem with the 'interpretation' of the rules about material changes is that fundamentally the rules are not going to get 'expanded' in terms of leniency in the newsgroup discussions. That is, a deputy is not going to come along here and make an allowance for something in the newsgroup that isn't allowed in the written rules.. The only thing you will ever see in the newsgroups about the rules is a deputy saying 'such and such will be enforced'. You will not see a deputy saying 'such and such will not be enforced' as a material change. That is, the deputy doesn't want to be in the position of changing the rules which are written as they are written. The rules about the rules is that they are the rules unless they are changed *in the rules*. They aren't going to be 'loosened up' in the newsgroup. At least that's how I'm reading/ guessing at/ the interpretation of the deputies position on the deputies position on the rules and their discussions in the newsgroups. -- Mike Easter kibitzer, not SC admin From agent01413 at my-deja.com Tue Jan 4 12:12:03 2005 From: agent01413 at my-deja.com (Socks) Date: Tue Jan 4 07:15:11 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? References: Message-ID: David 1 wrote in news:crdid6$n6o$1@news.spamcop.net: >> Meanwhile, set your address so that mail isn't delivered, and read >> the messages in the group archive. >> >> http://groups.yahoo.com/group/xxxxxxxxxx/messages Replace xxxxxxxxxx >> with your group name. > > well on most of the groups that I run that wont work as far as no mail > because yahoo took the space from groups to give to the mail section > they don't keep the attachments any more ing the archive & all my > groups are mostly attachments > then you have a badly designed group. that isnt spamcop's fault. Your files shouldn't be sent as attachments. Your files should be stored in your files section, with an email auto generated advising people when a new file has been uploaded. From nobody at spamcop.net Tue Jan 4 05:48:03 2005 From: nobody at spamcop.net (Ellen) Date: Tue Jan 4 07:15:26 2005 Subject: [SpamCop-List] Re: DNS blocking for companionground.com? References: Message-ID: "rg" wrote in message news:crd5r9$f43$1@news.spamcop.net... > Aren't you interested in the fact that they may have come up with a new way > to block spamcop by making your DNS server fail when analyzing their spam > message? They have sabotaged an important part of your analysis stream. > > I did one substitution by replacing one machine name with the resolved IP, > since Spamcop could not to that. It does not alter the structure, > functionality, or intent of the spam. It only makes it possible for Spamcop > to continue in spite of this spammer's sabotage. > You are confusing two things -- the first is that, for some reason, the parser was not able to resolve some url. We don't know the exact url because you haven't provided it. Not knowing the exact url we don't know why the parser wasn't able to resolve it. The second thing is that you forced the parser to issue a report by modifying the spam. And that is absolutely against the SC TOS/AUP. It is irrelevant as to why you did this just as it is irrelevant as to whether you did it correctly or not. Ellen SpamCop From agent01413 at my-deja.com Tue Jan 4 12:15:18 2005 From: agent01413 at my-deja.com (Socks) Date: Tue Jan 4 07:20:02 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: Spam N Scams Reporter wrote in news:crd92p$hte$1@news.spamcop.net: > Socks wrote: >> geo_splash_12 wrote in news:crbqa4$gfq$1 >> @news.spamcop.net: >> >> >>>>So ? Some of those Itunes newsletter transmissions are spam ! >>> >>>No they are not, I call it ignorance since we perfectly well know >>>that the mentioned IP is an itunes distribution node. Despite all >>>discussions here on spamcop's list policy i've not seen any >>>reasonable argument on what some hope to achieve by listing this IP. >>>It doesn't change or improve the situation, it is probably regarded >>>as plain old fashioned annoyance that discredits the spamcop system. >> >> >> nope. itunes can choose to implement a confirmation system, or it >> can choose to continue its merry way accepting addresses without >> confirmation. >> >> However, I'll take your word for it that itunes runs a confirmation >> based system. I happen to know a spamtrap address for another dnsbl. >> It is configured to trigger listing on the second message from a >> given IPA to the address. That permits a confirmation to arrive and >> be ignored without triggering listing. If a second message from the >> same IPA to the same address arrives within a certain amount of time, >> then obviously deleting the confirmation message unanswered failed to >> keep the address from being added to the list. That shouldn't pose a >> problem for itunes, because you claim that they confirm >> subscriptions. Any objections if I test your proposition? >> > > Save yourself the trouble. I already tested it - See my post above. > Apple failed. > > Brian > Then why does the OP keep insisting that this listing is anyone's fault but Apple's, or that anyone but Apple is discredited foir failure to have a workable business plan? That's sort of like someone who sees no problem with driving drunk thinking that it is the fault of everyone else for not assuming that he's going to run stop signs, drive on sidewalks, and otherwise endanger his neighborhood, and then getting mad when the judge takes away his driver's license and throws him in the slammer. From nospam at nospam.org Tue Jan 4 13:53:39 2005 From: nospam at nospam.org (geo_splash_12) Date: Tue Jan 4 07:55:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 In-Reply-To: References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: Socks wrote: > Then why does the OP keep insisting that this listing is anyone's fault > but Apple's, or that anyone but Apple is discredited foir failure to > have a workable business plan? Because I think spamcop's approach is wrong and inefficient in this case. The main reason is that there are better solutions than blocking Apple's newsserver, the easiest is to simply unsubscribe from their mail list if you don't like their digests. All attemps to educate Apple don't seem to work, unfortunately, so I would take the path with the least resistance. I call it a workable business plan. > That's sort of like someone who sees no problem with driving drunk > thinking that it is the fault of everyone else for not assuming that > he's going to run stop signs, drive on sidewalks, and otherwise endanger > his neighborhood, and then getting mad when the judge takes away his > driver's license and throws him in the slammer. Sure, try another analogy that makes sense. Ejo -- And your Chinese exchange student asks: what does it mean "I'm busy". Location 51 57'N 4 28'E From nobody at spamcop.net Tue Jan 4 08:08:25 2005 From: nobody at spamcop.net (Miss Betsy) Date: Tue Jan 4 08:10:03 2005 Subject: [SpamCop-List] Re: FYI References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: "David 1" wrote in message news:crdgau$log$1@news.spamcop.net... > & you just keep doing that for folks like me The character of this news group has changed since I first came here. At that time the accepted method of getting rid of 'trolls' was to harass them - which I always thought was not productive. However, it was very distracting in .help and there were two or three who started the 'Do Not Feed the Troll' with a link to what a troll was for newcomers and it worked in chasing the troll out of .help. The only problem is that some people label as 'troll' anyone with a different opinion. A 'troll' is not arguing a different perspective, but posts with the intent of starting a fight and generally disintegrates quickly into an exchange of personalities - sometimes the exchange can be hilarious, actually. But it is annoying to those who simply want to know what to do about spam. For those who mechanically killfile, the troll will sometimes change his user name so that they can't miss it. Then it gets more technical (like the cancelling of posts) until TPTB (the powers that be) are called upon to do something. Usually the troll makes the mistake that TPTB can't ignore. (Like spammers, they aren't really very smart) Miss Betsy From tdy at blackhole.invalid Tue Jan 4 05:33:27 2005 From: tdy at blackhole.invalid (N. Miller) Date: Tue Jan 4 08:35:03 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? References: Message-ID: In article , Blitzen says... > Well all I can say is: > "bully for you Tim" > Because it sure as heck isn't keeping SPAM out of MY inbox (for the addy, > for which the SPAMcop filters are being used, which is INUNDATED), it is > just keeping me, a disabled person, out of touch with my friends! The SCBL is not keeping me from receiving any email from YahooGroups. The following message was received just fine (partial headers): > Received: from spooler by aosake.net (Mercury/32 v4.01b); 1 Jan 2005 11:10:05 -0800 > X-Envelope-To: <..?..@ypgr.aosake.net> > Return-path: > Received: from n1a.bulk.scd.yahoo.com (66.94.237.35) by aosake.net (Mercury/32 v4.01b) ID MG000001; > 1 Jan 2005 11:10:00 -0800 > X-Blocked: Blocked by 'SpamCop' > Received: from [66.218.66.58] by n1.bulk.scd.yahoo.com with NNFMP; 01 Jan 2005 18:36:09 -0000 > Received: from [66.218.66.31] by mailer7.bulk.scd.yahoo.com with NNFMP; 01 Jan 2005 18:36:09 -0000 > X-Yahoo-Newman-Property: groups-email > X-Sender:... > ... > ... > X-eGroups-Remote-IP: 66.94.237.47 > From: > ... > ... > X-AC-Weight: [####] (Whitelisted) -9999 > X-CC-Diagnostic: The reason you are getting hard bounces is because your email provider is blocking based on the SCBL, not tagging. Any spam I get from a Yahoo Groups IP address will be scored by my MTA, and the score will accumulate to a specified threshold. Cross that threshold and the message gets a different "X-Weight" line: > X-UC-Weight: [## ] 123 > X-CC-Diagnostic: RIPE (2), Level 3 (2), Header "X-YahooFilteredBulk" Exists (49), > Body has "cum" (20), Body contains " cumshot" (50) > X-Text-Classification: spam Complain to your email provider. -- Norman ~Win dain a lotica, En vai tu ri, Si lo ta ~Fin dein a loluca, En dragu a sei lain ~Vi fa-ru les shutai am, En riga-lint From tdy at blackhole.invalid Tue Jan 4 05:43:07 2005 From: tdy at blackhole.invalid (N. Miller) Date: Tue Jan 4 08:45:03 2005 Subject: [SpamCop-List] Re: DNS blocking for companionground.com? References: Message-ID: In article , rg says... > I did one substitution by replacing one machine name with the resolved IP, > since Spamcop could not to that. It does not alter the structure... Yes, it did alter the structure. > ...functionality, or intent of the spam. If your local P.D. could do that, and did that in a manner that got you convicted, would that be appropriate? > It only makes it possible for Spamcop to continue in spite of > this spammer's sabotage. There are alternative methods to send a notify to that spam site hosting company; if you would pay attention to Mike, and follow his instructions. -- Norman ~Win dain a lotica, En vai tu ri, Si lo ta ~Fin dein a loluca, En dragu a sei lain ~Vi fa-ru les shutai am, En riga-lint From nobody at spamcop.net Tue Jan 4 09:32:29 2005 From: nobody at spamcop.net (Miss Betsy) Date: Tue Jan 4 09:30:02 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: "geo_splash_12" wrote in message news:cre3km$18e$1@news.spamcop.net... > Socks wrote: > > > Then why does the OP keep insisting that this listing is anyone's fault > > but Apple's, or that anyone but Apple is discredited foir failure to > > have a workable business plan? > > Because I think spamcop's approach is wrong and inefficient in this > case. The main reason is that there are better solutions than blocking > Apple's newsserver, the easiest is to simply unsubscribe from their mail > list if you don't like their digests. All attemps to educate Apple don't > seem to work, unfortunately, so I would take the path with the least > resistance. I call it a workable business plan. I haven't read the beginning of this thread. IMHO, taking the path of least resistance is not helping the problem of spam - especially when it is a large company. It would be better to simply JHD than to unsubscribe from something that you didn't subscribe to. OTOH, how you get on their list is important to me. IMHO, if you were a customer, and they added you, then I do think it is more effective to badger customer service and whoever else you can think of, to stop this practice. (Again, do NOT use the unsubscribe. I think that you have forgotten the statistics of the amount of unsolicited email one could get if that were the 'norm' - it would make email virtually unusable). Miss Betsy From rg at nospam.please Tue Jan 4 09:59:40 2005 From: rg at nospam.please (rg) Date: Tue Jan 4 10:00:03 2005 Subject: [SpamCop-List] Re: DNS blocking for companionground.com? References: Message-ID: Thank you! Instead of turning the victim of SPAM into a criminal, you have actually addressed the deeper problem, SPAM. "Mike Easter" wrote in message news:crdpkd$rb0$1@news.spamcop.net... > rg wrote: > > I just posted a spam that has links to companionground.com. Spamcop > > reported it could not resolve the address, so I substituted the > > actual IP address in one case so the spam report would go out. > > Let's talk about attacking this problem differently than altering spam > which is fed to spamcop. > > > Q: Does this mean the DNS provider is in cahoots with the spammer, > > blocking Spamcop access? > > Here's the dnsreport story on how bad companionground.com looks > http://www.dnsreport.com/tools/dnsreport.ch?domain=companionground.com > > companion has 3 nameservers, 2 'regular' and 1 stealth. Of those only > one regular is answering; and the quality of the 'answering' is > terrible as is seen by the dns timing score of F, which shows all of the > timing out and not answering and/but eventually giving a report. > > > Here's the Whois info: > > > > Registration Service Provided By: NameCheap.com > > This is another route of attack on the domainname, because the > registration is full of bogus information. > > > Registrant Contact: > > Administrative Contact: > > Technical Contact: > > Billing Contact: > > HomeViz > > Vadim Gablian (admin@chillblow.com) > > +1.5555555555 > > Fax: +1.5555555555 > > 34 Vualia > > Diesel, GH 324533 > > JM > > > Creation date: 02 Jan 2005 18:46:55 > > dns chillblow.com > No DNS for this address > (host doesn't exist) > > All of that bogus business should be reported at internic There is no > email addy, no telno, no valid snail addy. > > > To report incomplete or inaccurate Registrar Whois data, please visit > the new Whois Data Problem Report System. http://wdprs.internic.net/ > > > All accredited registrars have agreed with ICANN to obtain contact > information from registrants, to provide it publicly by a Whois service, > and to investigate and correct any reported inaccuracies in contact > information for domain names registered through them. > > Reports submitted through this facility will be forwarded to the > appropriate registrar for handling, and the progress of your report will > be tracked. > > > So, the point of this is that the spamcop report isn't useful for > 'dealing with' the spamvertiser, who has a brandnew domainname. The > better approach is to attack the domainname registration, which you do > yourself. > > Changing spam to get spamcop to notify the unresponsive .cn providers > will get you in trouble at spamcop and do no good whatsoever. > > Finding the vulnerability of the bogus domainname information and > reporting it to internic and enom [enom is the registrar, namecheap is a > registration service] is a better strategy. > > Domain Name: COMPANIONGROUND.COM > Registrar: ENOM, INC. > > whois -h whois.enom.com companionground.com ... > Registration Service Provided By: NameCheap.com > > -- > Mike Easter > kibitzer, not SC admin > From sache at grignon.inra.fr Tue Jan 4 16:11:31 2005 From: sache at grignon.inra.fr (Ivan Sache) Date: Tue Jan 4 10:10:03 2005 Subject: [SpamCop-List] Massage in a bottle? Message-ID: <41DAB223.EC8BC@grignon.inra.fr> Hello, My first 419 scam of the year was one of the most exciting ever received :-) > MY NAME IS leila Nza Young personal assistance and legal addviser to Mrs Lucy > Bongo Odemba the president of Gabon and the doughter of Denies Bassu NGASSU > OG GONGO. As far as I remember, the president of Gabon is Mr Omar Bongo. I guess Lucy's father must "be" President Denis Sassou N'Guesso, of Congo. I am skipping the rest of the scam and going directly to the end: > this massage was translated from franch to engligh. Anyway, it originated from Spain, where the money has been transfered by "deplomatic correa" I promised Lucy not to disclose her "top screat" massaging and linguistical skills, so you will not know the end of the story. Sorry, but business is business and that must be ethukal. I am still wondering how suckers can still be fooled by such pathetic attempts. Regards -- Ivan Sache From nobody at spamcop.net Tue Jan 4 09:52:27 2005 From: nobody at spamcop.net (Ellen) Date: Tue Jan 4 10:20:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: "geo_splash_12" wrote in message news:cre3km$18e$1@news.spamcop.net... > > Because I think spamcop's approach is wrong and inefficient in this > case. The main reason is that there are better solutions than blocking > Apple's newsserver, the easiest is to simply unsubscribe from their mail > list if you don't like their digests. All attemps to educate Apple don't > seem to work, unfortunately, so I would take the path with the least > resistance. I call it a workable business plan. Ok let me see if I understand this. There is no reason to special case itunes, other than you have decided that for some reason they are "special", so given that, what you are saying is that people should just try to unsub from all the spam they receive and hope that it works and that their mailboxes will not overflow with spam? And that blocking is wrong. Following your logic, if educating some mailer doesn't work, then people should just unsub. Educating the pills spammers doesn't work so people should unsub. Educating the spammer who sends "buy this medal" "buy these playing cards" doesn't work so everyone should just unsubscribe. Educating the pills/mtg/body parts/traffic camera/porn spammers doesn't work so people should just unsub. I am trying to decide if you are just trolling this group for some reason or if you seriously believe that there are people sending mail to email addresses that never asked for it, who should be exempted from being reported and listed because you think they should be. Ellen From porpoise1954 at yahoo.co.uk Tue Jan 4 15:19:18 2005 From: porpoise1954 at yahoo.co.uk (Porpoise) Date: Tue Jan 4 10:35:02 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: "geo_splash_12" wrote in message news:crckp5$43n$1@news.spamcop.net... > > Anyone who reports certain types of spam to spamcop should IMHO simply > receive a short feedback with the advice to use the Apple web site to > unsubscribe from their digests. Also spamtraps shouldn't report this type > of spam which is in reality is no spam. This is the core of the problem, > how do you define spam? There is no clear definition and this whole > discussion proves it. If I receive bulk email that I haven't subscribed to it is spam - full stop. I don't intend unsubscribing from something I didn't subscribe to in the first place. The "definition" of spam is unsolicited bulk email - with the emphasis on UNSOLICTED - i.e. IT WASN'T REQUESTED! That is why spamtraps capture spam - because the spamtrap address didn't request it - therefore, it IS spam. A spamtrap doesn't subscribe to anything. But aside from all that, SC just produces the BL, what your mailprovider chooses to do with it and how they use it has nothing whatsoever to do with SC so you'd be better off venting your frustration with them. From nospam at nospam.org Tue Jan 4 16:41:06 2005 From: nospam at nospam.org (geo_splash_12) Date: Tue Jan 4 10:45:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 In-Reply-To: References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: Ellen wrote: > "geo_splash_12" wrote in message > news:cre3km$18e$1@news.spamcop.net... > >>Because I think spamcop's approach is wrong and inefficient in this >>case. The main reason is that there are better solutions than blocking >>Apple's newsserver, the easiest is to simply unsubscribe from their mail >>list if you don't like their digests. All attemps to educate Apple don't >>seem to work, unfortunately, so I would take the path with the least >>resistance. I call it a workable business plan. > > > Ok let me see if I understand this. There is no reason to special case > itunes, other than you have decided that for some reason they are "special", > so given that, what you are saying is that people should just try to unsub > from all the spam they receive and hope that it works and that their > mailboxes will not overflow with spam? And that blocking is wrong. No, that is not what I'm saying here. Oftentimes blocking is ok, especially for the average pill seller. Sometimes it is wrong. News digest from Apple, matlab, HP and others are for me a different catagory. There is really a difference between black and white. > > Following your logic, if educating some mailer doesn't work, then people > should just unsub. Educating the pills spammers doesn't work so people > should unsub. Educating the spammer who sends "buy this medal" "buy these > playing cards" doesn't work so everyone should just unsubscribe. Educating > the pills/mtg/body parts/traffic camera/porn spammers doesn't work so people > should just unsub. I can not take this very seriously because Apple is somebody else than the average spammer. That's why I treat them differently. > I am trying to decide if you are just trolling this group for some reason or > if you seriously believe that there are people sending mail to email > addresses that never asked for it, who should be exempted from being > reported and listed because you think they should be. I'm just trying to explain that blocking isn't (in this case even wasn't) the right decision, but everybody seems to be too trigger happy to look at the other solution that I mentioned. But I'll shut up on this issue if it makes you more happy. Ejo -- And your Chinese exchange student asks: what does it mean "I'm busy". Location 51 57'N 4 28'E From nobody at spamcop.net Tue Jan 4 11:21:05 2005 From: nobody at spamcop.net (Ellen) Date: Tue Jan 4 11:40:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: "geo_splash_12" wrote in message news:credem$85h$1@news.spamcop.net... > Ellen wrote: > No, that is not what I'm saying here. Oftentimes blocking is ok, > especially for the average pill seller. Sometimes it is wrong. News > digest from Apple, matlab, HP and others are for me a different > catagory. There is really a difference between black and white. The operative words in what you said are "for me" You can personally choose to deal with your inbound mail in any manner you choose. You can choose to unsubscribe from mail you never asked for because you like the sending company, because you are in a good mood, because you think it might actually work. The rest of the people in this world who are receiving mail that they never asked for also have the same right to deal with their mail as they choose and specifically they have the right to report unsolicited mail as spam. People have the right to publish a list of IPs that have been reported as spamming and any company/ISP/individual can choose to use that list to determine whether or not to accept mail from those IPs. Your decisions as to *your* mail only apply to *you*; they do not apply to anyone else's mailbox. And no there is no difference between apple sending email to people who never asked for and anyone else sending email to people who never asked for it other than the fact that you recognize their name and you don't recognize wztuyeioshs.iamapillspammer.com > > I can not take this very seriously because Apple is somebody else than > the average spammer. That's why I treat them differently. Do you realize the slippery slope you are on? How about if sends you unsolicted mail. What do you plan to do then? At what point do you decide if something is spam? Only if it is pills? Only if you never heard of them? Only if they don't make computer equipment? How about if sends you spam clearly from his IPs? Believe it or not there actually are some people who want his spams. What then? But yes you are right, apple is someone other than the pills spammer -- they advertize on the super bowl and have brick and mortar stores. So that means that any company with a big advertising budget and real stores can send you unsolicited mail? > I'm just trying to explain that blocking isn't (in this case even > wasn't) the right decision, but everybody seems to be too trigger happy > to look at the other solution that I mentioned. There is no other solution. If you expect people to unsub from apple spam then by extension you expect them to unsub from all spam because there is *no* point at which a line can be drawn. > But I'll shut up on this issue if it makes you more happy. No you don't have to shut up because I have posted everything I have to say about this subject. The groups are for people to express opinions about spam and ask questions - an answer them of course. I think we are in violent agreement that we disagree. I rarely get involved in these kinds of discussions and I will go back to my usual non-involvement now. Ellen From Paul.Sawyer.does.not.want.spam at unh.BAD.EXAMPLE.edu Tue Jan 4 17:12:44 2005 From: Paul.Sawyer.does.not.want.spam at unh.BAD.EXAMPLE.edu (Paul Sawyer) Date: Tue Jan 4 12:15:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: geo_splash_12 wrote in news:credem$85h$1@news.spamcop.net: > No, that is not what I'm saying here. Oftentimes blocking is ok, > especially for the average pill seller. Sometimes it is wrong. News > digest from Apple, matlab, HP and others are for me a different > catagory. There is really a difference between black and white. > [...] > I can not take this very seriously because Apple is somebody else than > the average spammer. That's why I treat them differently. Then the guy driving a Pinto should be stopped for speeding, but not the guy in the Cadillac? > I'm just trying to explain that blocking isn't (in this case even > wasn't) the right decision, but everybody seems to be too trigger > happy to look at the other solution that I mentioned. SpamCop does not block anyone. If there was blockage, it would have been the decision of your ISP and/or mail provider. -- From agent01413 at my-deja.com Tue Jan 4 18:00:39 2005 From: agent01413 at my-deja.com (Socks) Date: Tue Jan 4 13:05:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: geo_splash_12 wrote in news:cre3km$18e$1@news.spamcop.net: > Socks wrote: > >> Then why does the OP keep insisting that this listing is anyone's >> fault but Apple's, or that anyone but Apple is discredited foir >> failure to have a workable business plan? > > Because I think spamcop's approach is wrong and inefficient in this > case. The main reason is that there are better solutions than blocking > Apple's newsserver, the easiest is to simply unsubscribe from their > mail list if you don't like their digests. All attemps to educate > Apple don't seem to work, unfortunately, so I would take the path with > the least resistance. I call it a workable business plan. > Except in the case of the person who never subscribed to the Apple list. I assume you got your first computer this christmas, so I will try to keep this simple. When you follow a spammer's unsubscribe instructions, you are telling the spammer three things: 1) You have a valid email address 2) You believe what people tell you in email 3) You read all the way to the bottom of the spam to find how to unsub put those three things together, and you tell the spammer a fourth thing: 4) You are an incredibly gullible twit. Security and anti-spam experts for years have been telling people to never, ever confirm your email address for spammers by following unsub instructions. Most of the time they are bogus. Sometimes, they are actually harmful, passing you trojans and other malware instead of unsubbing you. The objective of the spamcop system is to identify for its members and users the origination point of unsolicited bulk email. There is no doubt whatsoever that people are getting itunes mail who never subscribed to get it (if that is not the case, let Apple file an appeal and prove their confirmation process worked). Since Apple is clue resistent, Apple gets listed. Since Apple is sending UBE, the listing is valid. Since your own ISP has not responded favorably to your requests to whitelist Apple (otherwise, why are you posting?) it appears that Spamcop's customers agree with the decision. For the people using Spamcop, that is the path of least resistence. Not only that, but it is the only path that Spamcop can follow that wouldn't qualify as consumer fraud. Spamcop publishes its criteria for listing spammers. Apple meets those criteria. If Spamcop failed to list Apple, then Spamcop would be defrauding its own customers. Well before your recent decision to join the Internet, there was an organization called MAPS. At its time, it was one of the most heavily used and widely respected dnsbls in existence. Then it started ignoring nominations of spammers, even when the spammers met their listing criteria. At the same time, a couple of spammers sued them, and got delisted because MAPS didn't have the funds for protracted legal battles. Because MAPS failed to follow its published policies, MAPS is now a shadow of its former self. The percentage of its former customers who are still using it is probably now in the single digits. That is the path that you are arguing spamcop should take. The day it does is the day that a competitor will come along and implement the same thing, and walk away with spamcop's customer base. The fact that the itunes newsserver and their mail server are on the same IPA, according to your post above, is another example of idiocy on their part. However, this is the first I heard that anyone was using spamcop to block traffic from the news port 117. I didn't even know that it was feasible, though I suppose it wouldn't be that hard to write some code. Why they'd bother though is something that escapes me. NEVER RESPOND TO UNSUB INSTRUCTIONS WHEN YOU DIDNT SUBSCRIBE TO THE LIST. Tattoo that on your arm somewhere. Otherwise, you will find yourself innundated in spam and unable to use your computer for useful communication. From nobody at spamcop.net Tue Jan 4 10:02:11 2005 From: nobody at spamcop.net (RandallW) Date: Tue Jan 4 13:05:13 2005 Subject: [SpamCop-List] where's the spamvertised item? Message-ID: Here's the text of spam I received today: ----------------------------------------------- Hello, I have transfered to you 470$, check your e-gold balance and send to Alex 100$, I have promised him transfer today.. Good luck, Andrew ) From agent01413 at my-deja.com Tue Jan 4 18:07:16 2005 From: agent01413 at my-deja.com (Socks) Date: Tue Jan 4 13:10:04 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: "geo_splash_12" wrote in message news:crckp5$43n$1@news.spamcop.net... > > Anyone who reports certain types of spam to spamcop should IMHO > simply receive a short feedback with the advice to use the Apple web > site to unsubscribe from their digests. Also spamtraps shouldn't > report this type of spam which is in reality is no spam. This is the > core of the problem, how do you define spam? There is no clear > definition and this whole discussion proves it. Spam is unsolicited bulk email spamtraps cant solicit email, so this is unsolicited it's obviously sent in bulk it's email That makes this spam. Your ISP agrees. Otherwise, they would have honored your request that Apple be whitelisted. From PossumTrot at dont.spam.me Tue Jan 4 08:54:23 2005 From: PossumTrot at dont.spam.me (Possum Trot) Date: Tue Jan 4 13:15:03 2005 Subject: [SpamCop-List] Spamford Wallace says "I give up ( temporarily}!" Message-ID: 'Spam King' Agrees to Stop Invading Computers Until FTC Lawsuit Is Resolved 1/04/05 3:59PM GMT Under an agreement with the Federal Trade Commission, a man known as the "Spam King" will stop infecting computers with advertising programs until a federal lawsuit against him is resolved. Stanford Wallace and his companies, SmartBot.net Inc. of Richboro, Pa., and Seismic Entertainment Productions Inc. of Rochester, N.Y., are required by the agreement to send online ads only to people who visit their Web sites. http://tinyurl.com/57kc5 From redball at mindspring.com Tue Jan 4 12:17:50 2005 From: redball at mindspring.com (Trish Roberts-Miller) Date: Tue Jan 4 13:17:58 2005 Subject: [SpamCop-List] Why Spam/scam works In-Reply-To: <200501041045.1cLQS05F33Nl3pK0@gideon.mail.atl.earthlink.net> References: <200501041045.1cLQS05F33Nl3pK0@gideon.mail.atl.earthlink.net> Message-ID: <41DADDCE.4020506@mindspring.com> spamcop-list-request@news.spamcop.net wrote: Ivan Sache got an offer for a massage translated from franch, and wonders why people fall for such pathetic attempts. Apparently, mis-spellings sometimes add to the credibility of scammers, as they make the target think s/he is smarter than the scammer. For more about scams, this is what I give students: http://www.cwrl.utexas.edu/~robertsmiller/suckered.html -- Trish Roberts-Miller redball@mindspring.com "I shall try to correct errors when shown to be errors; and I shall adopt new views so fast as they shall appear to be true views." (Abraham Lincoln, 1862) http://www.cwrl.utexas.edu/~robertsmiller/homepage.html From nobody at spamcop.net Tue Jan 4 13:45:38 2005 From: nobody at spamcop.net (Pop) Date: Tue Jan 4 13:50:12 2005 Subject: [SpamCop-List] Manual Reporting Page Message-ID: Is there any way to get rid of that old email reference that comes up above the box to paste spam into? I am getting real tired of having to be scolded that it's 60 days old, then 61, then 62, and so on. It looks like it's being resubmitted every time I log in, the way the age keeps changing on it. And I can find no way to delete it, so ... looks like the right glitch could have me reportin ga spam over and over and ... just by going to the manual submission page. Yes, I also use fwd as attach; that's totally separate. Could I have caused that to happen? It's also a pain because I have to scroll down SEVERAL pages to get TO the paste-box - the Skip to Reports doesn't do anything on that page. IF it can't be rermoved, how about at least putting it UNDER the paste box? Anyplace so it's out of the danged way! TIA, Pop From mfkmek820 at yahoo.com Tue Jan 4 11:00:54 2005 From: mfkmek820 at yahoo.com (Fred K) Date: Tue Jan 4 15:05:04 2005 Subject: [SpamCop-List] Re: empty spam References: Message-ID: "Mike Easter" wrote in message news:crb5ie$3tq$1@news.spamcop.net... > You. Post some trackers, not spam. I also receive empty spam. Unless I missed it not even Mike has come up with a plausible explanation. Given this condition there may only be conjecture or educated guesses possible. The sample posted in .spam looks like a dumb spammer can't get his spam to work right, because it only show junk text that spammers think will fool spamfilters. HA 1. I also get that type from time to time. 2. I am now getting spam where the link cannot be found by dns server(s), or whois etc, leaving me to believe that they are dead in the water and the spammers haven't updated their spam, or I am being targeted with nonexistent spamvertizes for revenge. 3. My blank spams are truly blank, no jibberish text, no html nuthin but empty. I get one a day, with from name a variation of FFWGMYDYKSAQK. http://www.spamcop.net/sc?id=z709372959zeb30615c5930c46b45b91f29634a3b32z Fred k From MikeE at ster.invalid Tue Jan 4 12:40:44 2005 From: MikeE at ster.invalid (Mike Easter) Date: Tue Jan 4 15:40:03 2005 Subject: [SpamCop-List] Re: empty spam References: Message-ID: Fred K wrote: > I also receive empty spam. Unless I missed it not even Mike has come > up with a plausible explanation. I think there are different reasons/causes/guesses, depending on the 'clues'. > Given this condition there may only > be conjecture or educated guesses possible. The sample posted in > .spam looks like a dumb spammer can't get his spam to work right, > because it only show junk text that spammers think will fool > spamfilters. HA I think the example you posted is an 'incomplete' spam. Since it comes from a proxy^1, and besides the body it was also missing the following header elements, To, Date, Subject, MsgID; that means that it originally was an smtp transaction with only a From and the necessary envelope elements and the recipient smtp service provided the Date and MsgID. So, my guess is that that one was 'interrupted' during the proxy injection. ^1 port 30744 socks 4&5, http connect evidence > 3. My blank spams are truly blank, no jibberish text, no html nuthin > but empty. I get one a day, with from name a variation of > FFWGMYDYKSAQK. www.spamcop.net/sc?id=z709372959zeb30615c5930c46b45b91f29634a3b32z -- Mike Easter kibitzer, not SC admin From asterix at no_where.net Tue Jan 4 22:24:32 2005 From: asterix at no_where.net (Asterix) Date: Tue Jan 4 16:25:04 2005 Subject: [SpamCop-List] Re: 7 weeks, SOS References: Message-ID: <1gpvxvt.1oi6u54uh9gp1N%asterix@no_where.net> JV wrote: > 7 weeks I have spent on a problem that really began 10 years ago. We > have little or no proactive security. Will we ever get that? It's not clear what you are referring to, but your headers indicate that you are using Microsoft Windows. Could be the heart of the problem. If you keep doing that, I guess the answer is "no". :-) > Moving again to another such... such what ? OS ? No - I'm not going to direct you to the "switch" campaign. I'll let you find it yourself -- I recommend Macs to my friends, and Intel machines to those whom I don't mind billing by the hour From dfm2a3l0t2 at spymac.com Tue Jan 4 16:39:05 2005 From: dfm2a3l0t2 at spymac.com (D.F. Manno) Date: Tue Jan 4 16:40:03 2005 Subject: [SpamCop-List] Re: Massage in a bottle? References: <41DAB223.EC8BC@grignon.inra.fr> Message-ID: In article <41DAB223.EC8BC@grignon.inra.fr>, Ivan Sache wrote: > I am still wondering how suckers can still be fooled by such pathetic > attempts. I'm still wondering why people buy drugs from outfits that can't spell the drug names correctly. -- D.F. Manno dfm2a3l0t2@spymac.com "The work goes on, the cause endures, the hope still lives and the dream will never die." From borgholio at storymind.com Tue Jan 4 13:53:59 2005 From: borgholio at storymind.com (Borgholio) Date: Tue Jan 4 16:55:03 2005 Subject: [SpamCop-List] Re: Massage in a bottle? In-Reply-To: References: <41DAB223.EC8BC@grignon.inra.fr> Message-ID: D.F. Manno wrote: > In article <41DAB223.EC8BC@grignon.inra.fr>, > Ivan Sache wrote: > > >>I am still wondering how suckers can still be fooled by such pathetic >>attempts. > > > I'm still wondering why people buy drugs from outfits that can't spell > the drug names correctly. Some people are just plain stupid? From nobody at nowhere.invalid Tue Jan 4 22:57:48 2005 From: nobody at nowhere.invalid (Steven Maesslein) Date: Tue Jan 4 17:00:02 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: On Tue, 4 Jan 2005 09:32:29 -0500, Miss Betsy coughed into spamcop and left this in : > (Again, do NOT use the unsubscribe. I think that you have forgotten > the statistics of the amount of unsolicited email one could get if > that were the 'norm' - it would make email virtually unusable). It already is. However, you're right about the "do not unsubscribe" bit. I have an array of spamtraps snagging roughly 150 spams a day on average. All they ever did since they were created was "unsubscribe" from spam lists. -- Steve Before you criticize someone, you should walk a mile in their shoes. That way, when you criticize them, you're a mile away and you have their shoes. From tmcgraw at spamcop.net Tue Jan 4 14:31:28 2005 From: tmcgraw at spamcop.net (Tim McGraw) Date: Tue Jan 4 17:35:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 In-Reply-To: References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: geo_splash_12 wrote: > Socks wrote: > >> Then why does the OP keep insisting that this listing is anyone's >> fault but Apple's, or that anyone but Apple is discredited foir >> failure to have a workable business plan? > > Because I think spamcop's approach is wrong and inefficient in this > case. The main reason is that there are better solutions than blocking > Apple's newsserver, the easiest is to simply unsubscribe from their mail > list if you don't like their digests. All attemps to educate Apple don't > seem to work, unfortunately, so I would take the path with the least > resistance. I call it a workable business plan. ...and I call it compromising integrity, making "special" exceptions. >> That's sort of like someone who sees no problem with driving drunk >> thinking that it is the fault of everyone else for not assuming that >> he's going to run stop signs, drive on sidewalks, and otherwise >> endanger his neighborhood, and then getting mad when the judge takes >> away his driver's license and throws him in the slammer. > > Sure, try another analogy that makes sense. My inbox, my rules. Your belief does not make it "not spam" once it hits that boundary. From nobody at spamcop.net Tue Jan 4 17:47:54 2005 From: nobody at spamcop.net (Miss Betsy) Date: Tue Jan 4 17:45:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: > I'm just trying to explain that blocking isn't (in this case even > wasn't) the right decision, but everybody seems to be too trigger happy > to look at the other solution that I mentioned. > > But I'll shut up on this issue if it makes you more happy. I have answered your posts twice and you have ignored me. But I am going to try again. Unsubscribing is not a solution. Trying to get a legitimate, brick and mortar, merchant to contribute to the community by not setting themselves above the normal industry standards can be attempted in more ways than blocking. However, there is no way that one can draw the line on what constitutes spam except by the criterion of 'unsolicited' I always add 'unwanted' because there are some unsolicited emails that are wanted and that depends on one's preferences and is entirely up to the receiver on how to handle. For blocklists, the criteria have to be defined (for instance, spamcop does not allow the reporting of viruses or bounces). For other blocklists, there are other criteria. Apple apparently is sending unsolicited, unwanted email to enough people (and spamtraps) that consider their emails spam that they have gotten blocked. You can unsubscribe if you want to, but it is not a recommended solution, not even by the FTC. If you want to continue discussing the point, try answering some of the arguments on why unsolicited email even by companies who are offering a decent product is not good. If you can't answer them, then admit that you prefer an unreasonable personal opinion. Miss Betsy From TMHRVMFWREVN at spammotel.com Tue Jan 4 22:42:44 2005 From: TMHRVMFWREVN at spammotel.com (Rob) Date: Tue Jan 4 17:50:03 2005 Subject: [SpamCop-List] Re: Massage in a bottle? References: <41DAB223.EC8BC@grignon.inra.fr> Message-ID: "D.F. Manno" wrote in message news:dfm2a3l0t2-7B8B2A.16390404012005@news.cesmail.net... > > I'm still wondering why people buy drugs from outfits that can't spell > the drug names correctly. > -- Well pharmacists get prescriptions from doctors with illegible writing so I presume it runs in the profession, Rob From MikeE at ster.invalid Tue Jan 4 15:04:41 2005 From: MikeE at ster.invalid (Mike Easter) Date: Tue Jan 4 18:05:18 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: I think I'll play around a little bit being the Devil Ejo's advocate [not actually advocate, let's say theorist] for purposes of philosophical discussion. It might be worth 'arguing about' to consider this hypothetical model. Suppose that all spam could be put into two classes... - that which is full of bogosity with abused proxies/relays or whatever with bogus From and who uses removes to scrape responsive addies and make new/more lists. It is also offensive, scammish, or otherwise undesirable. - that which is straightup, ie the From = the source, no bogosity or proxy/relay abuse, and who uses removes to listwash. It is also wholesome, useful, or otherwise appealing. Suppose also that all spam recipients could be put into two classes - rabid antispammers who don't believe in listwashing, who would never profit /either/ of the above spammers, not just the bogus abusers, and who would like to leave anyone who ever sent an unsolicited or unconfirmed subscription email on some kind of blocklist forever or nearly so - just hit deleters, who would like to look at /some/ spam, and who wish that removes would really work, because they would like to keep receiving the spams that they like, just not the ones they don't. Their optimal spamfilter would eliminate those which offend them, they would just delete the ones which don't offend and would report none. Don't forget that this is just theoretical, but it is also imaginable. Or at least perhaps discussable. So, one argument is that if you could distinguish the two classes of spammers, and you were the latter type of recipient, that you should successfully remove from those lists you don't want. If you were the former type of recipient, then you would like to list all of those who manage lists suboptimally, as well as all of the offensive spammers. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Tue Jan 4 15:28:22 2005 From: MikeE at ster.invalid (Mike Easter) Date: Tue Jan 4 18:30:02 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: Mike Easter wrote: > Suppose that all spam could be put into two classes... > - that which is full of bogosity > - that which is straightup, > Suppose also that all spam recipients could be put into two classes > > - rabid antispammers > - just hit deleters, > So, one argument is that if you could distinguish the two classes of > spammers, and you were the latter type of recipient, Naturally, I'm a person who believes that there is no black and white, but just one big grayzone which merges indistinguishably from one extreme to the other. In the case of the 'masses' out there which is some shades of gray, variable grayshades, the average shade is much more like the JHD than like the rabid anti-. When anti-/s get together and commiserate about how it ought to be, they are not only a minority, but they are also going up against important interests; legislative, DMA, and mainsleaze commercial and political, who want email marketing to have a great deal of latitude, because it is a very valuable medium. Healthy email marketing is good. The vast majority of spam is very bad. The current average shade of gray of spam is very black. -- Mike Easter kibitzer, not SC admin From SCNews.5.myspamgobbler at spamgourmet.com Tue Jan 4 15:41:04 2005 From: SCNews.5.myspamgobbler at spamgourmet.com (Spam N Scams Reporter) Date: Tue Jan 4 18:45:08 2005 Subject: [SpamCop-List] Re: Massage in a bottle? In-Reply-To: References: <41DAB223.EC8BC@grignon.inra.fr> Message-ID: D.F. Manno wrote: > In article <41DAB223.EC8BC@grignon.inra.fr>, > Ivan Sache wrote: > > >>I am still wondering how suckers can still be fooled by such pathetic >>attempts. > > > I'm still wondering why people buy drugs from outfits that can't spell > the drug names correctly. Maybe the people that buy them don't know how to spell them either? From SCNews.5.myspamgobbler at spamgourmet.com Tue Jan 4 15:44:37 2005 From: SCNews.5.myspamgobbler at spamgourmet.com (Spam N Scams Reporter) Date: Tue Jan 4 18:45:14 2005 Subject: [SpamCop-List] Re: where's the spamvertised item? In-Reply-To: References: Message-ID: RandallW wrote: > Here's the text of spam I received today: > > ----------------------------------------------- > > Hello, > I have transfered to you 470$, check your e-gold balance and send to Alex > 100$, I have promised him transfer today.. > Good luck, Andrew ) > > I would imagine that some people might possibly reply, wondering what this was about, and thereby confirm their email address. Were the headers forged? From David1 at suescornerweb.com Tue Jan 4 19:22:47 2005 From: David1 at suescornerweb.com (David 1) Date: Tue Jan 4 19:25:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 In-Reply-To: References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: Ellen wrote: > "geo_splash_12" wrote in message > news:cre3km$18e$1@news.spamcop.net... > snip > I am trying to decide if you are just trolling this group for some reason or > if you seriously believe that there are people sending mail to email > addresses that never asked for it, who should be exempted from being > reported and listed because you think they should be. > > Ellen > > I second the troll sign if that how it works & if that was Ellen's intention was to put one up I do second it if I've been here long enough to have that prividledge -- David 1 bad addy spamtrap@suescornerweb.com From David1 at suescornerweb.com Tue Jan 4 19:35:53 2005 From: David1 at suescornerweb.com (David 1) Date: Tue Jan 4 19:40:03 2005 Subject: [SpamCop-List] Re: FYI In-Reply-To: References: <41D7CA2B.4C62@xyzzy.claranet.de> Message-ID: Miss Betsy wrote: > "David 1" wrote in message > news:crdgau$log$1@news.spamcop.net... > > >>& you just keep doing that for folks like me > > > The character of this news group has changed since I first came > here. At that time the accepted method of getting rid of 'trolls' > was to harass them - which I always thought was not productive. > However, it was very distracting in .help and there were two or > three who started the 'Do Not Feed the Troll' with a link to what a > troll was for newcomers and it worked in chasing the troll out of > ..help. > > The only problem is that some people label as 'troll' anyone with a > different opinion. A 'troll' is not arguing a different > perspective, but posts with the intent of starting a fight and > generally disintegrates quickly into an exchange of personalities - > sometimes the exchange can be hilarious, actually. But it is > annoying to those who simply want to know what to do about spam. > > For those who mechanically killfile, the troll will sometimes > change his user name so that they can't miss it. Then it gets more > technical (like the cancelling of posts) until TPTB (the powers > that be) are called upon to do something. Usually the troll makes > the mistake that TPTB can't ignore. (Like spammers, they aren't > really very smart) > > Miss Betsy > > > & I thank you -- David 1 bad addy spamtrap@suescornerweb.com From David1 at suescornerweb.com Tue Jan 4 19:45:50 2005 From: David1 at suescornerweb.com (David 1) Date: Tue Jan 4 19:50:03 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? In-Reply-To: References: Message-ID: Socks wrote: > David 1 wrote in > news:crdid6$n6o$1@news.spamcop.net: > > > > >>>Meanwhile, set your address so that mail isn't delivered, and read >>>the messages in the group archive. >>> >>>http://groups.yahoo.com/group/xxxxxxxxxx/messages Replace xxxxxxxxxx >>>with your group name. >> >>well on most of the groups that I run that wont work as far as no mail >>because yahoo took the space from groups to give to the mail section >>they don't keep the attachments any more ing the archive & all my >>groups are mostly attachments >> > > > then you have a badly designed group. that isnt spamcop's fault. > > Your files shouldn't be sent as attachments. Your files should be stored in > your files section, with an email auto generated advising people when a new > file has been uploaded. > EXCUSE me ! My group was designed Under the impression that 4 years after I started my groups that yahoo wasn't going to stop keeping attachments in the archive (In case your not aware of it yahoo did use to keep the attachments in the archive & I don't think it was that long ago that they stopped) & when they did do that only give us 14 days to retrieve & download those attachments, yeah right 3K messages I'm gong to get that done. I have since moved my groups to my own servers so that nobody could ever do that to me again. Had a started a group today I never would have considered a yahoo group -- David 1 bad addy spamtrap@suescornerweb.com From ric.gates at bigsleep.org Wed Jan 5 01:26:46 2005 From: ric.gates at bigsleep.org (Blammo) Date: Tue Jan 4 20:30:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: On 04 Jan 2005 Ellen entered spamcop and left news:cregm0$a8n$1@news.spamcop.net: > > > "geo_splash_12" wrote in message > news:credem$85h$1@news.spamcop.net... > >> I'm just trying to explain that blocking isn't (in this case even >> wasn't) the right decision, but everybody seems to be too trigger >> happy to look at the other solution that I mentioned. > > There is no other solution. If you expect people to unsub from apple > spam then by extension you expect them to unsub from all spam because > there is *no* point at which a line can be drawn. > >> But I'll shut up on this issue if it makes you more happy. > > No you don't have to shut up because I have posted everything I have > to say about this subject. The groups are for people to express > opinions about spam and ask questions - an answer them of course. I > think we are in violent agreement that we disagree. I rarely get > involved in these kinds of discussions and I will go back to my usual > non-involvement now. > I think we are straying off the path a little here. The original discussion was about a spamtrap listing, which actually I think you answered. The purpose of a spamtrap is to trap those that scrape addresses off web pages, so the real question is whether iTunes is scraping addresses, or if someone is entering bogus addresses - which in my opinion, isn't what spamtraps are meant to trap. It may be that iTunes sends eMail to those who didn't subscribe because of bogus subscriptions, but I don't think that applies to this listing. Now if you could show that iTunes indeed does scrape pages for eMails, which you could determine by analysing log files, then this would be a valid spamtrap listing. Not trying to justify iTunes or their subscription methods, just trying to draw a line between black and white. -- | Ric | From MikeE at ster.invalid Tue Jan 4 17:52:39 2005 From: MikeE at ster.invalid (Mike Easter) Date: Tue Jan 4 20:55:02 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: Blammo wrote: > web pages, so the real question is whether iTunes is scraping > addresses, or if someone is entering bogus addresses I think there are more possibilities than that. First, the bad list management crew at iTunes may be buying some kind of lists. Second, Ellen sez that SC has all kinds of spamtraps. Ellen wrote: > "Mike Easter" >> What is the ideal spamtrap? A spamtrap which has a common username >> attached to a common domainname so as to maximize the 'catching' of >> dictionary spammings? A spamtrap which has a unique, randomly >> generated username *planted* in some place where it is likely to be >> scraped? Some addy which was generated in some kind of 'humanish' >> manner, not randomized, but not common, but planted in scraping >> territory? Something else? > > All of the above and more. I think it is likely that Apple turns over their list management to some kind of 3rd party who gets their list from $deity knows where, and as a result it is a dirty list. I don't believe that Apple is 'personally' running bots around scraping web addies. -- Mike Easter kibitzer, not SC admin From notspam at alias.hotpop.com Tue Jan 4 19:06:30 2005 From: notspam at alias.hotpop.com (JV) Date: Tue Jan 4 21:10:03 2005 Subject: [SpamCop-List] Re: 7 weeks, SOS In-Reply-To: <1gpvxvt.1oi6u54uh9gp1N%asterix@no_where.net> References: <1gpvxvt.1oi6u54uh9gp1N%asterix@no_where.net> Message-ID: Asterix wrote: > JV wrote: > > >>7 weeks I have spent on a problem that really began 10 years ago. We >>have little or no proactive security. Will we ever get that? > > > It's not clear what you are referring to, but your headers indicate that > you are using Microsoft Windows. Could be the heart of the problem. > If you keep doing that, I guess the answer is "no". :-) > > >>Moving again to another such... > > > such what ? OS ? > No - I'm not going to direct you to the "switch" campaign. > I'll let you find it yourself > I know the "switch campaign" very well. I've worked on Apples and Mac's from day one, production programming in 6502 and up. Duh. Since the vast majority of machines in the world are Micro$oft, most of the problems are there as well. Another duh. I'm mutli-OS literate. UNIX as well. ;-) Do you the operating system AUX? I do. It's Apple UNIX and has been in use on Apple servers for a long time. Think about it. From ric.gates at bigsleep.org Wed Jan 5 02:10:13 2005 From: ric.gates at bigsleep.org (Blammo) Date: Tue Jan 4 21:15:03 2005 Subject: [SpamCop-List] Re: 7 weeks, SOS References: <1gpvxvt.1oi6u54uh9gp1N%asterix@no_where.net> Message-ID: On 04 Jan 2005 Asterix entered spamcop and left news:1gpvxvt.1oi6u54uh9gp1N%asterix@no_where.net: > JV wrote: > >> 7 weeks I have spent on a problem that really began 10 years ago. We >> have little or no proactive security. Will we ever get that? > > It's not clear what you are referring to, but your headers indicate that > you are using Microsoft Windows. Could be the heart of the problem. > If you keep doing that, I guess the answer is "no". :-) > Well, I don't know, but at least it (appears to be) the latest version of Mozilla, and not the latest OS. -- | Ric | From ric.gates at bigsleep.org Wed Jan 5 02:39:54 2005 From: ric.gates at bigsleep.org (Blammo) Date: Tue Jan 4 21:40:02 2005 Subject: [SpamCop-List] Re: Manual Reporting Page References: Message-ID: On 04 Jan 2005 Pop entered spamcop and left news:creo89$f8l$1@news.spamcop.net: > Is there any way to get rid of that old email reference that > comes up above the box to paste spam into? > Have you tried logging into Spamcop, clicking the "Report Spam" button then clicking "Remove all unreported spam"? Another possibility is that you are using a bookmark/ Favorite that is actually a link to that particular report, instead of just www.spamcop.net. -- | Ric | From agent01413 at my-deja.com Wed Jan 5 03:04:44 2005 From: agent01413 at my-deja.com (Socks) Date: Tue Jan 4 22:05:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: "Mike Easter" wrote in news:crf7bv$pf1$1 @news.spamcop.net: > So, one argument is that if you could distinguish the two classes of > spammers, and you were the latter type of recipient, that you should > successfully remove from those lists you don't want. The problem of course is deciding which spammer is a liar all the time, and which spammer is a liar only some of the time. The spammer who is a liar all the time is the one that you don't want to confirm your address with. The spammer who is a liar some of the time is the one who signed a contract with his ISP not to spam, but then configures his system as Apple has done to permit it to be used to send spam. Knowing how often and under what circumstances Apple is dishonest, and when it isn't dishonest, is a rhetorical exercise of minimal value. If you do it for Apple, you have to do it for Richter, and Reinhertsen, and all the other covicted felons in the spam business. It's easier and less risky to assume that demonstrated dishonesty in some matters means that the person or organization is not to be trusted in any matters. Guessing safely wrong poses less danger to me, and to my systems, than making the wrong guess in the unsafe direction. If Apple wants us to trust them, they can start by demonstrating that their ISP has reason to trust them, and convert to a confirmed optin system. Until then, blocking 17/8 with IPTABLES seems the safe course. From agent01413 at my-deja.com Wed Jan 5 03:10:31 2005 From: agent01413 at my-deja.com (Socks) Date: Tue Jan 4 22:15:05 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: "Mike Easter" wrote in news:crfh6t$ft$1 @news.spamcop.net: > Blammo wrote: >> web pages, so the real question is whether iTunes is scraping >> addresses, or if someone is entering bogus addresses > > I think there are more possibilities than that. > > First, the bad list management crew at iTunes may be buying some kind of > lists. > > Second, Ellen sez that SC has all kinds of spamtraps. > Could the problem be an honest typo? I have a dot org domain. People frequently send email to my primary valid address using dot com for my domain. If that address were a spamtrap, I could see the possibility. And yes, I have seen people get the tld of their own address wrong. My mother annoyingly does it all the time. From ric.gates at bigsleep.org Wed Jan 5 03:13:32 2005 From: ric.gates at bigsleep.org (Blammo) Date: Tue Jan 4 22:15:15 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: On 04 Jan 2005 Mike Easter entered spamcop and left news:crfh6t$ft$1@news.spamcop.net: > Blammo wrote: >> web pages, so the real question is whether iTunes is scraping >> addresses, or if someone is entering bogus addresses > > I think there are more possibilities than that. > > First, the bad list management crew at iTunes may be buying some kind of > lists. > > Second, Ellen sez that SC has all kinds of spamtraps. > > Ellen wrote: >> "Mike Easter" >>> What is the ideal spamtrap? A spamtrap which has a common username >>> attached to a common domainname so as to maximize the 'catching' of >>> dictionary spammings? A spamtrap which has a unique, randomly >>> generated username *planted* in some place where it is likely to be >>> scraped? Some addy which was generated in some kind of 'humanish' >>> manner, not randomized, but not common, but planted in scraping >>> territory? Something else? >> >> All of the above and more. > > I think it is likely that Apple turns over their list management to some > kind of 3rd party who gets their list from $deity knows where, and as a > result it is a dirty list. > > I don't believe that Apple is 'personally' running bots around scraping > web addies. > I did forget about that post. But still, unconfirmed opt-in and spamtrap don't really relate, that is Poisoning as opposed to Spamming. Spamtraps are supposed to be "invisible" and noone would knowingly send eMail to one, certainly not Apple. I don't know for sure, but I don't think that Apple is intentionally spamming in this case, but was actually poisoned with an address noone should have. Whether this was from a bad (poisoned) list or manual intervention (bogus subscription) I wouldn't know. I guess what I am trying to point out here is that an automated system (spamtrap) is meant to trap an automated system (spider) and manual intervention (poisoning) defeats the system, because noone is "supposed" to know that address. I could go on about similar things that are against the rules, but we could get away with them by lying because we don't like some company's practice. But hopefully Spamcop considers the messages sent to the traps, as Ellen indicated they do, and the listing is justified. -- | Ric | From agent01413 at my-deja.com Wed Jan 5 03:14:31 2005 From: agent01413 at my-deja.com (Socks) Date: Tue Jan 4 22:15:20 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? References: Message-ID: David 1 wrote in news:crfdce$thg$1 @news.spamcop.net: > Had a started a group today I > never would have considered a yahoo group > > however, you're looking for a solution to your current problem, not to a hypothetical what-if. you can still post your attachments in your 20M files section and have your subscribers download from there. From ob1db at spamcop.net Tue Jan 4 22:49:07 2005 From: ob1db at spamcop.net (David Butler) Date: Tue Jan 4 22:50:03 2005 Subject: [SpamCop-List] Re: hanaro spam to wrong reporting address ?? References: Message-ID: "RW" wrote in message news:crabtn$kc9$1@news.spamcop.net... > "David Butler" wrote in message > news:ob1dbNOSPAM-309C03.13302502012005@news.cesmail.net... > > 222.233.108.95 comes back from Spamcop: > > > > Re: 222.233.108.95 (Administrator of network where email originates) > > To: nospam#hanaro.com@devnull.spamcop.net (Notes) > > > E-mail : abuse@hanaro.com > > > > and that report went through... > > We've basically given up on Hanaro. They've written us a few times, we've > turned reports back on only to have them continue to bounce reports. > abuse@hanaro.com is showing 231,226 bounces as of recently. > Hmm, appeared mine did not bounce but who knows... From David1 at suescornerweb.com Tue Jan 4 22:51:02 2005 From: David1 at suescornerweb.com (David 1) Date: Tue Jan 4 22:55:03 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? In-Reply-To: References: Message-ID: Socks wrote: > David 1 wrote in news:crfdce$thg$1 > @news.spamcop.net: > > >> Had a started a group today I >>never would have considered a yahoo group >> >> > > > however, you're looking for a solution to your current problem, not to a > hypothetical what-if. you can still post your attachments in your 20M files > section and have your subscribers download from there. Yeah & have to put up with Yahoo crashing or stop responding, the extra work it takes to upload the files seperatly from the emails, the pick or joke not being carried over with the replies so that all know what's being talked about OHHHH & lets NOT forget about the ad on every page Plus the ad that added in as a so called waiting to load page, NO I don't think I'm going to put my subscribers through that & didn't I moved, but a group I moderate on a daily basis has decided what is right for him so I'm stuck on yahoo for the time being. Which now that you brought this up is another reason for yahoo to do this besides needing the space on the servers for the mail increase it gave everyone at the cost of the groups losing their message attachments ( & they did because what good is the archive if it just stores a message saying attachment removed for the picture group that I'm part time moderator of)They can now have folks telling other folks just to use the file section (20M when msg base use to be 100M) & sit through everything I described above. -- David 1 bad addy spamtrap@suescornerweb.com From ob1db at spamcop.net Tue Jan 4 22:52:28 2005 From: ob1db at spamcop.net (David Butler) Date: Tue Jan 4 22:55:11 2005 Subject: [SpamCop-List] cimvai.489ficd.com fails to parse Message-ID: spamcop sez: Parsing input: cimvai.489ficd.com No recent reports, no history available Cannot resolve cimvai.489ficd.com but openrbl.org yields: Address: 202.102.230.36 resolved to cimvai.489ficd.com AS: 202.102.192.0/18 AS4134 Data Communications Bureau Beijing Net 202.102.224-255 CHINANET-HA @ns.chinanet.cn.net inetnum: 202.102.224.0 - 202.102.255.255 netname: CNCGROUP-HA country: CN descr: CNCGROUP Henan province network admin-c: CH455-AP tech-c: LZ33-AP status: ALLOCATED PORTABLE changed: abuse@cnc-noc.net odd, since the IP DOES parse! Parsing input: 202.102.230.36 host 202.102.230.36 (getting name) no name host 202.102.230.36 = zz.163.ppp (old cache) No recent reports, no history available Routing details for 202.102.230.36 [refresh/show] Cached whois for 202.102.230.36 : antispam@public.zz.ha.cn abuse@cnc-noc.net Using abuse net on abuse@cnc-noc.net abuse net cnc-noc.net = abuse@cnc-noc.net, postmaster@cnc-noc.net Using best contacts abuse@chinanet.cn.net abuse@cnc-noc.net postmaster@cnc-noc.net From ric.gates at bigsleep.org Wed Jan 5 04:02:42 2005 From: ric.gates at bigsleep.org (Blammo) Date: Tue Jan 4 23:05:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: On 04 Jan 2005 Socks entered spamcop and left news:Xns95D4CD1FF8424agent01413MYDEJACOM@216.154.195.61: > And yes, I have seen people get the tld of their own address wrong. My > mother annoyingly does it all the time. > Ha! I just did that the other day, but with my URL, not my eMail address. That is something to consider. -- | Ric | From Kilgallen at SpamCop.net Tue Jan 4 22:37:58 2005 From: Kilgallen at SpamCop.net (Larry Kilgallen) Date: Tue Jan 4 23:40:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> In article , geo_splash_12 writes: > No, that is not what I'm saying here. Oftentimes blocking is ok, > especially for the average pill seller. Sometimes it is wrong. News > digest from Apple, matlab, HP and others are for me a different > catagory. There is really a difference between black and white. Spam is spam. Spam is about conSent, not conTent !!! > I can not take this very seriously because Apple is somebody else than > the average spammer. That's why I treat them differently. They are not average in that they _certainly_ should know better. From Kilgallen at SpamCop.net Tue Jan 4 22:42:39 2005 From: Kilgallen at SpamCop.net (Larry Kilgallen) Date: Tue Jan 4 23:45:04 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> In article , Socks writes: > Could the problem be an honest typo? I have a dot org domain. People > frequently send email to my primary valid address using dot com for my > domain. If that address were a spamtrap, I could see the possibility. Ellen reported that the spamtrap was being hit with newsletters, not with confirmation requests. _Nobody_ has claimed that Apple is using confirmed opt-in for these newsletters. Case closed. From Kilgallen at SpamCop.net Tue Jan 4 22:44:16 2005 From: Kilgallen at SpamCop.net (Larry Kilgallen) Date: Tue Jan 4 23:45:11 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> In article , Blammo writes: > I did forget about that post. But still, unconfirmed opt-in and spamtrap > don't really relate, that is Poisoning as opposed to Spamming. Spamtraps > are supposed to be "invisible" and noone would knowingly send eMail to one, > certainly not Apple. > I don't know for sure, but I don't think that Apple is intentionally > spamming in this case, but was actually poisoned with an address noone > should have. Whether this was from a bad (poisoned) list or manual > intervention (bogus subscription) I wouldn't know. But it really does not matter. The root problem is their failure to use confirmed opt-in. From nobody at devnull.spamcop.net Tue Jan 4 22:50:21 2005 From: nobody at devnull.spamcop.net (WazoO) Date: Tue Jan 4 23:55:02 2005 Subject: [SpamCop-List] Re: cimvai.489ficd.com fails to parse References: Message-ID: "David Butler" wrote in message news:crfo9o$5lp$1@news.spamcop.net... > spamcop sez: > > Parsing input: cimvai.489ficd.com > No recent reports, no history available > > Cannot resolve cimvai.489ficd.com > > but openrbl.org yields: > > Address: 202.102.230.36 resolved to cimvai.489ficd.com Google here, google Forum, Google everywhere on that IP From nobody at devnull.spamcop.net Tue Jan 4 22:53:02 2005 From: nobody at devnull.spamcop.net (WazoO) Date: Tue Jan 4 23:55:10 2005 Subject: [SpamCop-List] Re: hanaro spam to wrong reporting address ?? References: Message-ID: "David Butler" wrote in message news:crfo3m$5hm$1@news.spamcop.net... > "RW" wrote in message > news:crabtn$kc9$1@news.spamcop.net... > > "David Butler" wrote in message > > news:ob1dbNOSPAM-309C03.13302502012005@news.cesmail.net... > > > 222.233.108.95 comes back from Spamcop: > > > > > > Re: 222.233.108.95 (Administrator of network where email originates) > > > To: nospam#hanaro.com@devnull.spamcop.net (Notes) > > > > > E-mail : abuse@hanaro.com > > > > > > and that report went through... > > > > We've basically given up on Hanaro. They've written us a few times, we've > > turned reports back on only to have them continue to bounce reports. > > abuse@hanaro.com is showing 231,226 bounces as of recently. > > Hmm, appeared mine did not bounce but who knows... "everybody" else seems to know ... look up the word "filter" .. apply it to an e-mail application ... hint yet again - your address probably isn't the same as the parsing/report engine From ric.gates at bigsleep.org Wed Jan 5 05:35:26 2005 From: ric.gates at bigsleep.org (Blammo) Date: Wed Jan 5 00:40:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> <6xc62Sv2LM5v@eisner.encompasserve.org> Message-ID: On 04 Jan 2005 Larry Kilgallen entered spamcop and left news:6xc62Sv2LM5v@eisner.encompasserve.org: > In article , Blammo > writes: > >> I did forget about that post. But still, unconfirmed opt-in and >> spamtrap don't really relate, that is Poisoning as opposed to >> Spamming. Spamtraps are supposed to be "invisible" and noone would >> knowingly send eMail to one, certainly not Apple. >> I don't know for sure, but I don't think that Apple is intentionally >> spamming in this case, but was actually poisoned with an address >> noone should have. Whether this was from a bad (poisoned) list or >> manual intervention (bogus subscription) I wouldn't know. > > But it really does not matter. The root problem is their failure to > use confirmed opt-in. > This may matter for spam you receive (and I, for that matter), but this is not what spam traps are for. Unconfirmed opt-in is not the problem, lyers and spam are the problem. If I opt-in to something, it really doesn't matter whether they confirm or not, but that I want it, and I am not supposed to report it simply because they didn't confirm. However a spamtrap can't opt-in, confirm or opt-out and isn't suppose to "exist". If Apple is lying (or buying bad lists) then they are spammers. If they are being abused then they are adding to the problem, though it's really hard to compair 1 or so a month to 10 a day (for the same thing). I just don't buy into the theory that you are evil if you don't follow all the rules, I'm more concerned with the "evil" that's filling my inbox. Now if I got something from Apple I just might consider it spam because I never gave them my address, confirm or unconfirm don't really matter (a spammer could send me 1000 confirms a day), but a spamcop spamtrap is a very likely target for abuse in order to discredit. So it does matter, unless you don't care if your system breaks down. It obviously matters to those that are complaining. For some reason your replies are disjointed? Off the thread... or perhaps the thread is getting too long for Xnews? -- | Ric | From nobody at nowhere.not Wed Jan 5 07:27:35 2005 From: nobody at nowhere.not (Robert Blair) Date: Wed Jan 5 02:30:05 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: On Tue, 4 Jan 2005 23:28:22 UTC, "Mike Easter" wrote: > When anti-/s get together and commiserate about how it ought to be, they > are not only a minority, but they are also going up against important > interests; legislative, DMA, and mainsleaze commercial and political, > who want email marketing to have a great deal of latitude, because it is > a very valuable medium. The problem with mainsleaze commercial is if all companies start to spam which most want to do it would be the end of email. I don't remember the exact numbers but it was like if 1% of the companies spamed you and you unsubscribed you would be receiving about 500 spam a day forever. How many hours would it take you to unsubscribe 500 times? This is the reason that I don't see much gray area, it is spam (black) or it is not spam (white). -- Robert Blair From salvisberg at spamcop.net Wed Jan 5 11:46:29 2005 From: salvisberg at spamcop.net (Hans Salvisberg) Date: Wed Jan 5 05:40:02 2005 Subject: [SpamCop-List] Deputies: "This message looks like a bounce, will not report." Message-ID: I keep getting misdirected bounces (virus and spam reports) in response to forged sender addresses. According to http://www.spamcop.net/fom-serve/cache/14.html we are now allowed to send spam reports for these: vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv Messages which may be reported: There are several types of responses to forged email that SpamCop has in the past prohibited. However, these messages have become a big enough problem that we now allow them to be reported as the spam that they technically are. Examples of messages in this category: Misdirected bounces Misdirected virus notifications Misdirected vacation emails Misdirected challenges from challenge/response spam filtering systems" ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ I tried to do just that http://mailsc.spamcop.net/sc?id=z709571796zecbd3136b27ecf44e967e58f3056cc97z but SC says: This message looks like a bounce, will not report. Do not report bounces as spam! Message is old [<----- not true, but that's another issue] Nothing to do. Deputies: I'm sure you don't want us to massage the headers to get around SC's bounce detection, so please update SC to allow submitting the bounces. Thanks! Hans P.S. This bouncer even says that it detected the Sober.I worm, which is known for spoofing the sender address, but it still sends the bounce to the spoofed address! P.P.S. My domain has an SPF record, which has helped tremendously in discouraging Spammers from abusing it, but the "AntiVirus Checkers" apparently don't care... From sdnsdbaq8734632623 at yahoo.com Wed Jan 5 10:39:44 2005 From: sdnsdbaq8734632623 at yahoo.com (Biwah) Date: Wed Jan 5 05:40:15 2005 Subject: [SpamCop-List] "Spam King" linked to earlier bankruptcy Message-ID: http://www.cnn.com/2005/TECH/internet/01/04/spyware.ap/index.html (full article) ......U.S. District Judge Joseph DiClerico issued a temporary restraining order against Wallace in October to prevent him from sending ads. Hearings on that order planned for this week were canceled because the agreement made them unnecessary. Wallace has said he is being persecuted because of his past involvement in junk Internet mailings. He headed a company called Cyber Promotions in the 1990s that sent as many as 30 million junk e-mails daily to consumers, earning him the nicknames "Spam King" and "Spamford." He left the company after lawsuits from America Online and CompuServe. Wallace moved to Las Vegas last summer. He recently shut down a nightclub he ran in Rochester and placed Seismic Entertainment, the company that ran it, in bankruptcy.****** From nobody at spamcop.net Wed Jan 5 06:09:39 2005 From: nobody at spamcop.net (Miss Betsy) Date: Wed Jan 5 06:10:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: "David 1" wrote in message news:crfc12$sen$1@news.spamcop.net... > Ellen wrote: > > "geo_splash_12" wrote in message > > news:cre3km$18e$1@news.spamcop.net... > > > snip > > I am trying to decide if you are just trolling this group for some reason or > > if you seriously believe that there are people sending mail to email > > addresses that never asked for it, who should be exempted from being > > reported and listed because you think they should be. > > > > Ellen > > > > > > I second the troll sign if that how it works & if that was Ellen's > intention was to put one up I do second it if I've been here long enough > to have that prividledge Since s/he isn't willing to do anything but reiterate hir arguments, if s/he isn't a full blown troll, s/he isn't worth the time to answer. Miss Betsy From sache at grignon.inra.fr Wed Jan 5 12:55:39 2005 From: sache at grignon.inra.fr (Ivan Sache) Date: Wed Jan 5 06:55:08 2005 Subject: [SpamCop-List] Another spammer's appropriate name Message-ID: <41DBD5BC.6E1DEC5F@grignon.inra.fr> Hi, Hanaro kindly forwarded me a spam "sent" by: > From: Sebastian Cul "Cul" being "ass" in French, I find this name particularly appropriate. Sebastian might be a relative of barrister S*ithole, involved in a 419 scam last year. Sebastian want me to but this: "My tablets is an advanced fat-binding appurtenance which withdraws fat from a nourishment we consume! Invented with the powerful fat-holding fast filament, the blend of natural constituents..." He probably tested his tablets himself, and they withdrew neurons from his brain (provided he got one). By the way, congratulations to Trish Roberts-Miller for her excellent "Ways to get suckered". It is worth being linked from every anti-spam resource website. -- Ivan Sache From Kilgallen at SpamCop.net Wed Jan 5 06:19:59 2005 From: Kilgallen at SpamCop.net (Larry Kilgallen) Date: Wed Jan 5 07:25:06 2005 Subject: [SpamCop-List] Reporting misdirect automaton responses now allowed ! References: Message-ID: In article , Hans Salvisberg writes: > I keep getting misdirected bounces (virus and spam reports) in response > to forged sender addresses. According to > > http://www.spamcop.net/fom-serve/cache/14.html > > we are now allowed to send spam reports for these: > > vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv > Messages which may be reported: > > There are several types of responses to forged email that SpamCop has in > the past prohibited. However, these messages have become a big enough > problem that we now allow them to be reported as the spam that they > technically are. > > Examples of messages in this category: > > Misdirected bounces > Misdirected virus notifications > Misdirected vacation emails > Misdirected challenges from challenge/response spam filtering systems" > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Whooo ! Thanks for the notice about the change of policy. I did not see that posted here, nor on the spam reporting (copy and paste) page. From gospamming at yourdomain.invalid Wed Jan 5 12:51:36 2005 From: gospamming at yourdomain.invalid (D.Diaz) Date: Wed Jan 5 07:55:02 2005 Subject: [SpamCop-List] Re: Reporting misdirect automaton responses now allowed ! References: Message-ID: Kilgallen@SpamCop.net (Larry Kilgallen) wrote in news:rvQ4giJQfjX$@eisner.encompasserve.org: > Whooo ! Thanks for the notice about the change of policy. > > I did not see that posted here, nor on the spam reporting (copy and > paste) page. > Interesting. I wonder when this change did happen... -- Daniel Diaz SpamCop User From MikeE at ster.invalid Wed Jan 5 05:10:22 2005 From: MikeE at ster.invalid (Mike Easter) Date: Wed Jan 5 08:10:10 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: Robert Blair wrote: > "Mike Easter" > The problem with mainsleaze commercial is if all companies start to > spam which most want to do it would be the end of email. I don't > remember the exact numbers but it was like if 1% of the companies > spamed you and you unsubscribed you would be receiving about 500 spam > a day forever. I agree that Apple and all the rest of the mainsleaze who would like for everyone to optout shouldn't get a 'pass'. > This is the reason that I don't see much gray area, it is spam > (black) or it is not spam (white). However, I treat bad mailing list spam differently than I treat proxy abuse bogus spam, and now I'm speaking just as an 'average' spamcop reporter; where the average SC reporter typically reports munged. The SC reporting system is 'designed' to munge against listwashing. So, in the hypothetical example of my somehow starting to receive an unsolicited Itunes newsletter, which I haven't, and the Itunes output IP getting itself listed in the SC blocklist for hitting spamtraps, which it has, and then the/my Itunes newsletter getting itself named as spam by my SpamPal filter, which it would because SP uses the SCbl, and then my SC reporting of the Itunes spam ie bad mailing list. That reporting is an example of something in which I would take note of several 'issues'. First, Apple is not going to lose its services because of getting reported to its provider. The notify address for 17.254.6.27 rDNS chatbox-smtp-out11.apple.com is abuse@apple.com but in the case of some mainsleaze straightup spam their mail is handled by a different mailing entity. Neither Apple nor a different mailing entity is going to terminate Apple's account. Second, I don't disagree that Apple should be spanked for bad mailing list management by getting itself listed in how many ever blocklists and getting its mailings interfered with to how many ever tens of thousands of people who want the mailing list; but remember, that 'we' tinw are also 'spanking' all of those people who want the mailing list at the same time. Third, this is an example of the type of thing that I also submit a 'remove' in addition to my notifies for abuse. That is, I 'invite' or facilitate being listwashed. I don't want to be receiving the Itunes newsletter. It would be better for me, better for Apple, and better for all of the people who do want to receive the newsletter if Apple would remove me from their mailing list. However, I refuse to go visit a website to request to be removed from a list I never subscribed. That doesn't mean that I think everyone should use removes for all of their spam. It means that I must think that some spam is different than other spam. That doesn't mean that I think the DMA should get its way and that everyone should have to remove themselves from all of the possible mailing lists in the world forever. However, that /is/ the current legislative position on the matter. That is, it is legal for Apple to be doing what it is doing. Not only is it legal, but Apple's actions are consistent with the closest thing we currently have to 'approved' mail, in this case Apple is a TrustE mailer. It isn't following the mailing list guidelines I recommend, but it /is/ following the mailing list guidelines which Bonded Sender requires. You and I and everyone here agree that Apple's mailing list management is not good enough, and as a result of that they are getting themselves sometimes blocklisted and that is interfering with the distribution of the mailing list 'episodically' - since currently the IP in question is no longer listed. Fortunately for Apple, the SC blocklist is dynamic. But, I still say it is more complicated than black and white and that there is spam and there is spam. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Wed Jan 5 05:24:52 2005 From: MikeE at ster.invalid (Mike Easter) Date: Wed Jan 5 08:25:02 2005 Subject: [SpamCop-List] Re: Deputies: "This message looks like a bounce, will not report." References: Message-ID: Hans Salvisberg wrote: > I keep getting misdirected bounces (virus and spam reports) in > response to forged sender addresses. According to > > http://www.spamcop.net/fom-serve/cache/14.html > > we are now allowed to send spam reports for these: Well, I'll be dingdong. I didn't know that had been changed. I think that should be flagged on some front page somewhere or pointed to in news, which also doesn't have it. Currently the latest news is Nov 9, but that #14 faq page doesn't have a Last Modified date on it. That is a very interesting change. It allows virus reporting, virus bounce reporting, spam bounce reporting, as well as challenge reporting which it always has. When coupled with the feature of allowing the listed to remove themselves, that makes for some very interesting dynamics. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Wed Jan 5 05:27:03 2005 From: MikeE at ster.invalid (Mike Easter) Date: Wed Jan 5 08:30:03 2005 Subject: [SpamCop-List] Re: Another spammer's appropriate name References: <41DBD5BC.6E1DEC5F@grignon.inra.fr> Message-ID: Ivan Sache wrote: > By the way, congratulations to Trish Roberts-Miller for her excellent > "Ways to get suckered". It is worth being linked from every anti-spam > resource website. Yes, that's a link worth saving. I did. Along with drilling around all over her site. -- Mike Easter kibitzer, not SC admin From bjtexas at hotmale.com Wed Jan 5 07:27:11 2005 From: bjtexas at hotmale.com (BJ) Date: Wed Jan 5 08:30:10 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? References: Message-ID: David 1 wrote: || Socks wrote: ||| David 1 wrote in news:crfdce$thg$1 ||| @news.spamcop.net: ||| ||| |||| Had a started a group today I |||| never would have considered a yahoo group |||| |||| ||| ||| ||| however, you're looking for a solution to your current ||| problem, not to a hypothetical what-if. you can still post ||| your attachments in your 20M files section and have your ||| subscribers download from there. || || Yeah & have to put up with Yahoo crashing or stop responding, || the extra work it takes to upload the files seperatly from || the emails, the pick or joke not being carried over with the || replies so that all know what's || being talked about OHHHH & lets NOT forget about the ad on || every page || Plus the ad that added in as a so called waiting to load || page, NO I || don't think I'm going to put my subscribers through that & || didn't I || moved, but a group I moderate on a daily basis has decided || what is right for him so I'm stuck on yahoo for the time || being. Which now that you brought this up is another reason || for yahoo to do this besides needing || the space on the servers for the mail increase it gave || everyone at the || cost of the groups losing their message attachments ( & they || did because what good is the archive if it just stores a || message saying attachment removed for the picture group that || I'm part time moderator of)They can || now have folks telling other folks just to use the file || section (20M || when msg base use to be 100M) & sit through everything I || described above. || Sounds like your problem is with Yahoo. Go complain about it there. BJ From crappy.trappy at ntlworld.com Wed Jan 5 13:35:22 2005 From: crappy.trappy at ntlworld.com (Tim) Date: Wed Jan 5 08:40:02 2005 Subject: [SpamCop-List] Re: Another spammer's appropriate name In-Reply-To: References: <41DBD5BC.6E1DEC5F@grignon.inra.fr> Message-ID: Mike Easter wrote: > > Yes, that's a link worth saving. I did. Along with drilling around all > over her site. > Where may I find this link please? From Kilgallen at SpamCop.net Wed Jan 5 07:39:30 2005 From: Kilgallen at SpamCop.net (Larry Kilgallen) Date: Wed Jan 5 08:40:09 2005 Subject: [SpamCop-List] Re: Reporting misdirect automaton responses now allowed ! References: Message-ID: In article , "Mike Easter" writes: > Hans Salvisberg wrote: >> I keep getting misdirected bounces (virus and spam reports) in >> response to forged sender addresses. According to >> >> http://www.spamcop.net/fom-serve/cache/14.html >> >> we are now allowed to send spam reports for these: > > Well, I'll be dingdong. I didn't know that had been changed. I think > that should be flagged on some front page somewhere or pointed to in > news, which also doesn't have it. Currently the latest news is Nov 9, > but that #14 faq page doesn't have a Last Modified date on it. > > That is a very interesting change. It allows virus reporting, virus > bounce reporting, spam bounce reporting, as well as challenge reporting > which it always has. As I read it, challenge reporting is limited to _misdirected_ challenges. As I read it, the page does _not_ allow virus reporting, only virus _notification_ reporting, and at that only _misdirected_ virus notification reporting. (Of course here on my VMSmail account, all virus notifications are misdirected :-) From salvisberg at spamcop.net Wed Jan 5 14:54:28 2005 From: salvisberg at spamcop.net (Hans Salvisberg) Date: Wed Jan 5 08:45:03 2005 Subject: [SpamCop-List] Re: Deputies: "This message looks like a bounce, will not report." In-Reply-To: References: Message-ID: Mike Easter wrote: > Well, I'll be dingdong. I didn't know that had been changed. I'll mark this as the day when I was able to tell you something you didn't already know. :-) Now, if we could actually use the new liberties, it would definitely be worth a news item... Hans From MikeE at ster.invalid Wed Jan 5 05:47:58 2005 From: MikeE at ster.invalid (Mike Easter) Date: Wed Jan 5 08:50:03 2005 Subject: [SpamCop-List] Re: Another spammer's appropriate name References: <41DBD5BC.6E1DEC5F@grignon.inra.fr> Message-ID: Tim wrote: > Mike Easter wrote: >> >> Yes, that's a link worth saving. I did. Along with drilling around >> all over her site. >> > > Where may I find this link please? Trish Roberts-Miller wrote: > Ivan Sache got an offer for a massage translated from franch, and > wonders why people fall for such pathetic attempts. Apparently, > mis-spellings sometimes add to the credibility of scammers, as they > make the target think s/he is smarter than the scammer. > > For more about scams, this is what I give students: > > http://www.cwrl.utexas.edu/~robertsmiller/suckered.html -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Wed Jan 5 05:56:05 2005 From: MikeE at ster.invalid (Mike Easter) Date: Wed Jan 5 08:55:03 2005 Subject: [SpamCop-List] Re: Reporting misdirect automaton responses now allowed ! References: Message-ID: Larry Kilgallen wrote: > "Mike Easter" >> That is a very interesting change. It allows virus reporting, virus >> bounce reporting, spam bounce reporting, as well as challenge >> reporting which it always has. > > As I read it, challenge reporting is limited to _misdirected_ > challenges. Yes. I didn't mean that you could report being challenged on a mail you sent the challenger. I think the bigger problem for C/Rs is that they are challenging all of those spams and it is going to the forged Froms. It was the forged From reporter I was thinking of when I said that, not /all/ challenges. > As I read it, the page does _not_ allow virus reporting, only > virus _notification_ reporting, and at that only _misdirected_ > virus notification reporting. (Of course here on my VMSmail account, > all virus notifications are misdirected :-) What it sez down underneath is: Viruses -- Viruses are another form of spam and may be reported to SpamCop as such. and /then/ it 'commercially' goes on to say Viruses may also be used to trigger Ironport's Virus Outbreak Filters http://www.ironport.com/products/c60_virus_outbreak_filters.html which appears to me to be some kind of Ironport advertisement on the SC faq page. That seems a little 'much' -- unless I'm misinterpreting something. -- Mike Easter kibitzer, not SC admin From nobody at devnull.spamcop.net Wed Jan 5 07:57:06 2005 From: nobody at devnull.spamcop.net (WazoO) Date: Wed Jan 5 09:00:04 2005 Subject: [SpamCop-List] Re: Reporting misdirect automaton responses now allowed ! References: Message-ID: "D.Diaz" wrote in message news:Xns95D58CFD5E781xnddmxn@216.154.195.61... > Kilgallen@SpamCop.net (Larry Kilgallen) wrote in > news:rvQ4giJQfjX$@eisner.encompasserve.org: > > > Whooo ! Thanks for the notice about the change of policy. > > > > I did not see that posted here, nor on the spam reporting (copy and > > paste) page. > > Interesting. I wonder when this change did happen... As far as I'm concerned, it wasn't there last month when I was building my own Table of Contents so as to compare the FAQ with the web-based Forum version to make sure I had every- thing addressed "over there" ... From tdy at blackhole.invalid Wed Jan 5 06:00:48 2005 From: tdy at blackhole.invalid (N. Miller) Date: Wed Jan 5 09:05:05 2005 Subject: [SpamCop-List] Re: Deputies: "This message looks like a bounce, will not report." References: Message-ID: In article , Mike Easter says... > That is a very interesting change. It allows virus reporting, virus > bounce reporting, spam bounce reporting, as well as challenge reporting > which it always has. Note that the adjectival verb "misdirected" is placed before each category you mentioned. Note also, in the case of viruses, that it is not viruses, themselves, which can be reported, but misdirected notification of viral infections. Presumably, the reporter needs to discern between notifications, bounces, and challenges which were properly sent to the correct email address, and their misdirected counterparts. -- Norman ~Win dain a lotica, En vai tu ri, Si lo ta ~Fin dein a loluca, En dragu a sei lain ~Vi fa-ru les shutai am, En riga-lint From MikeE at ster.invalid Wed Jan 5 06:05:44 2005 From: MikeE at ster.invalid (Mike Easter) Date: Wed Jan 5 09:05:13 2005 Subject: [SpamCop-List] Re: Reporting misdirect automaton responses now allowed ! References: Message-ID: WazoO wrote: > As far as I'm concerned, it wasn't there last month when I was > building my own Table of Contents so as to compare the FAQ > with the web-based Forum version to make sure I had every- > thing addressed "over there" ... 'They' tint should let this stamp contain a Last Modified line on all the faq pages: HTTP/1.1 200 OK Server: Apache/1.3.29 (Unix) mod_perl/1.28 Content-Type: text/html; charset=iso-8859-1 Content-Length: 6605 Date: Wed, 05 Jan 2005 14:02:39 GMT Connection: close -- Mike Easter kibitzer, not SC admin From cbminfo at toast.net Wed Jan 5 09:22:15 2005 From: cbminfo at toast.net (ken) Date: Wed Jan 5 09:25:18 2005 Subject: [SpamCop-List] @devnull Message-ID: I don't use spamcop that often much anymore. It was useful in teaching me how to trace the sender for using Sam spade. They've changed format, and the sent doesn't look like it's gone anywhere.. previous used to say sent to: xxxx@thisplace.net xxxx@thisotherplace.com xxxx@ebay.com etc... Now all I see is a single line to devnull. or doublespeak for trashcan. From MikeE at ster.invalid Wed Jan 5 06:33:07 2005 From: MikeE at ster.invalid (Mike Easter) Date: Wed Jan 5 09:35:04 2005 Subject: [SpamCop-List] Re: Deputies: "This message looks like a bounce, will not report." References: Message-ID: N. Miller wrote: > Mike Easter says... > >> That is a very interesting change. It allows virus reporting, virus >> bounce reporting, spam bounce reporting, as well as challenge >> reporting which it always has. > > Note that the adjectival verb "misdirected" is placed before each > category you mentioned. Yes, but.... First, the virus reporting itself has a separate par which allows virus reporting per se Second, these days *all* virus notifications are misdirected, because no current viruses are being propagated with the infected user's addy in the From. That is, if you get a virus notification, you can be assured that it wasn't you who sent the virus you are being notified about. Third, yes; I meant the challenge for a mail you didn't send, namely a spam [or virus] with your addy in the From. > Note also, in the case of viruses, that it is > not viruses, themselves, which can be reported, but misdirected > notification of viral infections. I'll cite again what some seem to be missing under the list of misdirected issues: Viruses -- Viruses are another form of spam and may be reported to SpamCop as such. > Presumably, the reporter needs to > discern between notifications, bounces, and challenges which were > properly sent to the correct email address, and their misdirected > counterparts. Well; personally I completely agree that the reporter needs to be so discerning. But, while being discerning, I'm saying that it appears to me that I can report virus receipts as spam, I can report misdirected challenges for spam and virms, and I can report virm and spam bounces, all of which are going to be misdirected. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Wed Jan 5 06:38:49 2005 From: MikeE at ster.invalid (Mike Easter) Date: Wed Jan 5 09:40:02 2005 Subject: [SpamCop-List] Re: @devnull References: Message-ID: ken wrote: > I don't use spamcop that often much anymore. It was useful in > teaching me how to trace the sender for using Sam spade. > > They've changed format, and the sent doesn't look like it's gone > anywhere.. > > previous used to say > sent to: > > xxxx@thisplace.net > xxxx@thisotherplace.com > xxxx@ebay.com > etc... > Now all I see is a single line to devnull. or doublespeak for > trashcan. I'm going to try to manufacture a question out of that. My analysis of your statements is that you are 'asking why' ie questioningly observing that sometimes spamcop's reports are to be directed to a devnull address. There is a faq on that subject http://www.spamcop.net/fom-serve/cache/253.html -- Reports sent to SpamCop addresses -- "An example of the internal address used is abuse#isp.net@devnull.spamcop.net " You should go read the faq rather than my pasting its contents in here. -- Mike Easter kibitzer, not SC admin From salvisberg at spamcop.net Wed Jan 5 15:48:11 2005 From: salvisberg at spamcop.net (Hans Salvisberg) Date: Wed Jan 5 09:40:10 2005 Subject: [SpamCop-List] Reporting virms may not be such a great idea... In-Reply-To: References: Message-ID: <41DBFE2B.6080105@spamcop.net> Mike Easter wrote: > What it sez down underneath is: > > Viruses -- Viruses are another form of spam and may be reported to > SpamCop as such. I'm not sure that's a good idea. A lot of virm sources are dynamically assigned IPs, and blacklisting them only causes problems for the next guy who innocently gets assigned the blacklisted IP. Responsible ISPs may act on the /reports/ and try to find and notify the client that had the reported IP at the time when the virm was sent, but the /blacklistings/ typically hurt the wrong guy. I have an ADLS connection that is reset every 24 hours (to force me to pay more to get a static IP if I want to run servers), and the days where I find myself (or other innocent people) blacklisted are becoming more common. Hans From MikeE at ster.invalid Wed Jan 5 06:49:56 2005 From: MikeE at ster.invalid (Mike Easter) Date: Wed Jan 5 09:50:03 2005 Subject: [SpamCop-List] Re: Reporting virms may not be such a great idea... References: <41DBFE2B.6080105@spamcop.net> Message-ID: Hans Salvisberg wrote: > Mike Easter wrote: >> Viruses -- Viruses are another form of spam and may be reported to >> SpamCop as such. > > I'm not sure that's a good idea. A lot of virm sources are dynamically > assigned IPs, and blacklisting them only causes problems for the next > guy who innocently gets assigned the blacklisted IP. We've been playing tug-of-war around here for a long time imagining there being a 'virus cop' - and considering what all would be wrong and right with reporting viruses. Many of us felt that it could/should be a separate kind of source list; that being a spamsource should be different than being a virus source. Others argue that virus propagations are unsolicited and should be considered sufficiently similar to spam to be tarred with the same brush. Your consideration of dynamic virus propagators is similar to the condition of a dynamic spam propagator, ie the abused proxy/trojan. Too bad for the unfortunate inheritor of the abused or infected IP's address. > Responsible ISPs may act on the /reports/ and try to find and notify > the client that had the reported IP at the time when the virm was > sent, but the /blacklistings/ typically hurt the wrong guy. I understand the problem; but I'm inclined to be more glad to see the heat get turned up to put pressure on the providers who are allowing infected propagators just like abused proxy/trojans. > I have an ADLS connection that is reset every 24 hours (to force me to > pay more to get a static IP if I want to run servers), and the days > where I find myself (or other innocent people) blacklisted are > becoming more common. Yep. That is definitely a problem. That would make you want to highly motivate your provider to be doing good security so that you won't catch a dirty IP. Fortunately my cable IP, which is also reassigned frequently, is 'traditionally' or inherently or something very 'dynamicaly static' in that it 'sticks to me' for many many months at a time. That is it is 'always' reassigned to be the same IP. Except in the unusual condition in which it isn't. -- Mike Easter kibitzer, not SC admin From salvisberg at spamcop.net Wed Jan 5 16:41:15 2005 From: salvisberg at spamcop.net (Hans Salvisberg) Date: Wed Jan 5 10:35:04 2005 Subject: [SpamCop-List] Re: Reporting virms may not be such a great idea... In-Reply-To: References: <41DBFE2B.6080105@spamcop.net> Message-ID: Mike Easter wrote: > We've been playing tug-of-war around here for a long time imagining > there being a 'virus cop' - and considering what all would be wrong and > right with reporting viruses. Thank you for the most informative summary! >>I have an ADLS connection that is reset every 24 hours (to force me to >>pay more to get a static IP if I want to run servers), and the days >>where I find myself (or other innocent people) blacklisted are >>becoming more common. > > Yep. That is definitely a problem. That would make you want to highly > motivate your provider to be doing good security so that you won't catch > a dirty IP. Gee, I must admit I haven't thought of complaining to my ISP about dirty IPs yet -- great idea! They may get tired and end up giving me a static one... ;-) I doubt we'll be able to attain critical mass to get the ISPs at large to police their users, though. More likely, we'll end up growing our whitelists to the point where we start wishing we had a super-blacklist to overrule whitelists. OTOH, the ISPs could certainly do more. My ISP (by far the largest one in Switzerland) asks for an additional monthly fee to install a virus filter on your account. They should offer a discount instead! So maybe reporting virms is a step in the right direction after all. Hans From nobody at xyzzy.claranet.de Wed Jan 5 17:23:42 2005 From: nobody at xyzzy.claranet.de (Frank Ellermann) Date: Wed Jan 5 11:25:03 2005 Subject: [SpamCop-List] Re: Deputies: "This message looks like a bounce, will not report." References: Message-ID: <41DC148E.3EEE@xyzzy.claranet.de> Hans Salvisberg wrote: > According to > http://www.spamcop.net/fom-serve/cache/14.html > we are now allowed to send spam reports for these Tnx for info. The most important change in SC's AUP for years and I missed it. Bye, Frank > P.P.S. My domain has an SPF record, which has helped > tremendously in discouraging Spammers from abusing it, > but the "AntiVirus Checkers" apparently don't care... Some of them are stupid. Or Symantec, that's worse. From amenex at amenex.com Wed Jan 5 11:36:28 2005 From: amenex at amenex.com (George Langford, Sc.D.) Date: Wed Jan 5 11:37:07 2005 Subject: [SpamCop-List] Re: Is InfoUSA [not] a spammer ? Message-ID: <200501051636.j05GaSQ27696@email1.voicenet.com> In the past few months, I've gotten about a dozen spams like this one: http://www.spamcop.net/sc?id=z709647315zc4df68b4aa56522b16cee286df54c75dz and this one: http://www.spamcop.net/sc?id=z700456943ze3c1ec7766d3d0829677b7d5e7c405ebz Yet SpamCop doesn't list InfoUSA.com: http://us.openrbl.org/ip/199/125/12/10.htm But Google "thinks" otherwise, when searched on ["(402) 593-4500" +abuse] where the telephone number is in InfoUSA's WhoIs domain contact information. The reports have all gone to abuse@gblx.net, whose ASN is 3549. Potaroo (http://bgp.potaroo.net/cgi-bin/as-report?as=AS3549&view=4637 says the upstream adjacencies for AS3549 are: > AS3549 GBLX Global Crossing Ltd. > Adjacency: 507 Upstream: 4 Downstream: 503 > Upstream Adjacent AS list > AS1239 SPRN Sprint > AS4637 REACH Reach Network Border AS > AS21599 NETDIRECT S.A. > AS701 UU UUNET Technologies, Inc. Is it worthwhile to report InfoUSA to any of these IP's ? The spams all have come directly into my SpamCop Inbox without intervention. amenex From mfkmek820 at yahoo.com Wed Jan 5 08:01:08 2005 From: mfkmek820 at yahoo.com (Fred K) Date: Wed Jan 5 12:05:06 2005 Subject: [SpamCop-List] Re: Deputies: "This message looks like a bounce, will not report." References: Message-ID: "Mike Easter" wrote in message news:crgtom$u11$1@news.spamcop.net... > Second, these days *all* virus notifications are misdirected, because no > current viruses are being propagated with the infected user's addy in > the From. That is, if you get a virus notification, you can be assured > that it wasn't you who sent the virus you are being notified about. Mike But the originating IP is still the source of the virm and not the From, right? Fred k From MikeE at ster.invalid Wed Jan 5 09:24:07 2005 From: MikeE at ster.invalid (Mike Easter) Date: Wed Jan 5 12:25:03 2005 Subject: [SpamCop-List] Re: Is InfoUSA [not] a spammer ? References: Message-ID: George Langford, Sc.D. wrote: > In the past few months, I've gotten about a dozen spams like this one: spamcop.net/sc?id=z709647315zc4df68b4aa56522b16cee286df54c75dz > and this one: spamcop.net/sc?id=z700456943ze3c1ec7766d3d0829677b7d5e7c405ebz Those are both straightup spams sourced at 206.165.247.238 & .235 rDNS raven.pondmail.com and skunk.pondmail.com OrgName: Global Crossing NetRange: 206.165.0.0 - 206.165.255.255 abuse@gblx.net which are spamvertising salesleads.infousa.com DNS 206.165.247.220 same abuse@gblx.net > Yet SpamCop doesn't list InfoUSA.com: > http://us.openrbl.org/ip/199/125/12/10.htm SC lists spamsources. The spamsource is not SC bl/d. That/those IP/s is/are also not blocklisted in spews or spamhaus or other lists suggesting unresponsiveness 'of record'. > The reports have all gone to abuse@gblx.net, whose ASN is 3549. I agree with your analysis of the ASN, and I also agree with SC's notifies. >> Upstream Adjacent AS list >> AS1239 SPRN Sprint >> AS4637 REACH Reach Network Border AS >> AS21599 NETDIRECT S.A. >> AS701 UU UUNET Technologies, Inc. I agree with your method of evaluating the upstreams. > Is it worthwhile to report InfoUSA to any of these IP's ? The spams > all have come directly into my SpamCop Inbox without intervention. IMO, you are justified in notifying the upstreams if your personal experience with notifying the provider for the source and the spamvertised site is met with unresponsiveness. The basis for your notification is the unresponsiveness of gblx, not the spam. In this case you aren't able to 'reinforce' your case to the upstreams with information about listings in spews or spamhaus, because the source and spamvertiser are not so listed. -- Mike Easter kibitzer, not SC admin From MikeE at ster.invalid Wed Jan 5 09:28:05 2005 From: MikeE at ster.invalid (Mike Easter) Date: Wed Jan 5 12:30:02 2005 Subject: [SpamCop-List] Re: Deputies: "This message looks like a bounce, will not report." References: Message-ID: Fred K wrote: > "Mike Easter" >> Second, these days *all* virus notifications are misdirected, >> because no current viruses are being propagated with the infected >> user's addy in the From. That is, if you get a virus notification, >> you can be assured that it wasn't you who sent the virus you are >> being notified about. > > Mike > But the originating IP is still the source of the virm and not the > From, right? Correct. The sequence is now.... - a foolish user/IP gets infected - the infected becomes a propagator and spews virms with your From addy - a foolish server receives the propagation and generates a newmail to you notifying you of the propagation - now with the #14 change, you report the foolish server source of the notify or - a foolish user/IP gets infected - the infected becomes a propagator and spews virms at you - now with the #14 change, you report the foolish user/IP [not the From] -- Mike Easter kibitzer, not SC admin From munged at nomorespamithurts.com Wed Jan 5 17:30:06 2005 From: munged at nomorespamithurts.com (KD) Date: Wed Jan 5 12:35:02 2005 Subject: [SpamCop-List] DMA opt out - is it worth it ? Message-ID: Hi all, Whilst looking through our intranet site at work I noticed a link to dmaconsumers dot org as a way of opting out of emails from companies that use the the DMA preference list. Does anybody know if this is used by any of the usual spammers though I suspect that this is very unlikely ? Has anyone used this and reduced their spamload ? I'm up to 150 spams a day so any measures that may reduce this may be worth a shot. S'pose I could change my email address but it's a bigger exercise than I've really got the spare time for at the moment. Cheers, Keith From cnwykab02 at sneakemail.com Wed Jan 5 18:43:49 2005 From: cnwykab02 at sneakemail.com (Warre) Date: Wed Jan 5 12:45:02 2005 Subject: [SpamCop-List] Re: DMA opt out - is it worth it ? In-Reply-To: References: Message-ID: KD wrote: > Hi all, > Whilst looking through our intranet site at work I noticed a link to > dmaconsumers dot org as a way of opting out of emails from companies that > use the the DMA preference list. Does anybody know if this is used by any > of the usual spammers though I suspect that this is very unlikely ? Has > anyone used this and reduced their spamload ? I'm up to 150 spams a day so > any measures that may reduce this may be worth a shot. S'pose I could > change my email address but it's a bigger exercise than I've really got the > spare time for at the moment. > > Cheers, > Keith > > If the DMA simply passes the list on to whoever asks for it, without hashing the addresses for example, then i would expect many spammers to actually start sending spams to everyone on the list. Spammers usually don't honor opt-out requests, so they probably won't actively look for addresses to unsubscribe, either. You could start using sneakemail ( http://www.sneakemail.com ) for any legitimate sites that automatically process your email address; it keeps your address safe from spam and makes it a lot easier to change your address. From mfkmek820 at yahoo.com Wed Jan 5 08:45:36 2005 From: mfkmek820 at yahoo.com (Fred K) Date: Wed Jan 5 12:50:04 2005 Subject: [SpamCop-List] Re: Deputies: "This message looks like a bounce, will not report." References: Message-ID: "Mike Easter" wrote in message news:crh80p$56v$1@news.spamcop.net... > The sequence is now.... > - a foolish user/IP gets infected > - the infected becomes a propagator and spews virms at you > - now with the #14 change, you report the foolish user/IP [not the > From] I have my AV set to automatically fix/delete viruses. It attaches a text file with the deleted virus name to the message. I would think forwarding the message with the actual virus attached is not a good thing. But I seriously doubt much change in my case. I have been receiving the old "Microwonderfuldamnsoft patch" and reporting it myself for months, with no fix. But I will start reporting anyway. BTW, I also strongly agree with the earlier remark that a change in rules etc., especially a biggy like this should be flagged for SC users. Fred k From Merlyn at Spamcop.net Wed Jan 5 12:47:04 2005 From: Merlyn at Spamcop.net (Merlyn) Date: Wed Jan 5 12:50:12 2005 Subject: [SpamCop-List] Re: DMA opt out - is it worth it ? References: Message-ID: "KD" wrote in message news:crh86r$5dv$1@news.spamcop.net... > Hi all, > Whilst looking through our intranet site at work I noticed a link to > dmaconsumers dot org as a way of opting out of emails from companies that > use the the DMA preference list. Does anybody know if this is used by any > of the usual spammers though I suspect that this is very unlikely ? Has > anyone used this and reduced their spamload ? I'm up to 150 spams a day > so any measures that may reduce this may be worth a shot. S'pose I could > change my email address but it's a bigger exercise than I've really got > the spare time for at the moment. > See: http://www.spamhaus.org/removelists.html IMHO the DMA list is the same. According to the DMA they believe in opt-out! -- Regards, Merlyn A Spamcop advocate No emails this account is for newsgroups only People demand freedom of speech to make up for the freedom of thought which they avoided From nobody at spamcop.net Wed Jan 5 12:57:15 2005 From: nobody at spamcop.net (Miss Betsy) Date: Wed Jan 5 12:55:02 2005 Subject: [SpamCop-List] Re: DMA opt out - is it worth it ? References: Message-ID: No and neither is the doubleclick opt out. Miss Betsy From Kilgallen at SpamCop.net Wed Jan 5 12:01:57 2005 From: Kilgallen at SpamCop.net (Larry Kilgallen) Date: Wed Jan 5 13:05:02 2005 Subject: [SpamCop-List] Re: Reporting misdirect automaton responses now allowed ! References: Message-ID: <0XHv4VxCUc6E@eisner.encompasserve.org> In article , "Mike Easter" writes: > What it sez down underneath is: > > Viruses -- Viruses are another form of spam and may be reported to > SpamCop as such. Hot Diggity ! Thanks for correcting my sloppy reading ! From nobody at spamcop.net Wed Jan 5 13:07:38 2005 From: nobody at spamcop.net (Miss Betsy) Date: Wed Jan 5 13:05:08 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: "Mike Easter" wrote in message news:crgoti$q03$1@news.spamcop.net... > Robert Blair wrote: > > However, I treat bad mailing list spam differently than I treat proxy > abuse bogus spam, and now I'm speaking just as an 'average' spamcop > reporter; where the average SC reporter typically reports munged. The > SC reporting system is 'designed' to munge against listwashing. > > So, in the hypothetical example of my somehow starting to receive an > unsolicited Itunes newsletter, which I haven't, and the Itunes output IP > getting itself listed in the SC blocklist for hitting spamtraps, which > it has, and then the/my Itunes newsletter getting itself named as spam > by my SpamPal filter, which it would because SP uses the SCbl, and then > my SC reporting of the Itunes spam ie bad mailing list. > > That reporting is an example of something in which I would take note of > several 'issues'. > > First, Apple is not going to lose its services because of getting > reported to its provider. The notify address for 17.254.6.27 rDNS > chatbox-smtp-out11.apple.com is abuse@apple.com but in the case of > some mainsleaze straightup spam their mail is handled by a different > mailing entity. Neither Apple nor a different mailing entity is going > to terminate Apple's account. > > Second, I don't disagree that Apple should be spanked for bad mailing > list management by getting itself listed in how many ever blocklists and > getting its mailings interfered with to how many ever tens of thousands > of people who want the mailing list; but remember, that 'we' tinw are > also 'spanking' all of those people who want the mailing list at the > same time. If people are not aware that there are responsible emailers and irresponsible emailers, then nothing is going to happen about spam. Let the people who want to receive the newsletter complain about not getting *to Apple* because of *Apple's* bad policies. - just as they should complain to yahoo when they don't get their group emails. Or there are enough ISPs who don't use blocklists left that they can find one that allows them to get all the spam they want - legitimate and otherwise. The only way to conquer spam is to have black and white definitions. However, just as spamcop does not consider bounces and viruses as spam, IMHO, spamcop reporters should not be allowed to report as spam anything from a site they have had a prior relationship with. IMHO, it is more effective to complain or to use the unsubscribe (if it is a busy day) than to report to spamcop. Miss Betsy From Kilgallen at SpamCop.net Wed Jan 5 12:07:03 2005 From: Kilgallen at SpamCop.net (Larry Kilgallen) Date: Wed Jan 5 13:10:04 2005 Subject: [SpamCop-List] Re: Reporting virms may not be such a great idea... References: <41DBFE2B.6080105@spamcop.net> Message-ID: In article <41DBFE2B.6080105@spamcop.net>, Hans Salvisberg writes: > Mike Easter wrote: >> What it sez down underneath is: >> >> Viruses -- Viruses are another form of spam and may be reported to >> SpamCop as such. > > I'm not sure that's a good idea. A lot of virm sources are dynamically > assigned IPs, and blacklisting them only causes problems for the next > guy who innocently gets assigned the blacklisted IP. The reports go to the entity doing the assigning, who can take action against whoever had the IP address at the time. > Responsible ISPs may act on the /reports/ and try to find and notify the > client that had the reported IP at the time when the virm was sent, but > the /blacklistings/ typically hurt the wrong guy. SpamCop DNSbl listings typically do not happen until after the provider has been notified. > I have an ADLS connection that is reset every 24 hours (to force me to > pay more to get a static IP if I want to run servers), and the days > where I find myself (or other innocent people) blacklisted are becoming > more common. If it really gives you a different address (my cable provider gives me the same one repeatedly, even though it is not static), you can make the point to your provider that they should catch outgoing abuse. From tmcgraw at spamcop.net Wed Jan 5 10:25:36 2005 From: tmcgraw at spamcop.net (Tim McGraw) Date: Wed Jan 5 13:30:03 2005 Subject: [SpamCop-List] [media] Microsoft's Anti-Spyware Beta To Debut Thursday Message-ID: Microsoft will roll out the first beta of its anti-spyware software Thursday, Jan. 6, according to a leaked internal memo published by the Neowin Web site. ... Some analysts have theorized that Microsoft's acquisition of Giant, and its release of anti-spyware software, was driven by increased interest in browsers that compete with its Internet Explorer. http://www.internetweek.com/allStories/showArticle.jhtml?articleID=56900528 From not at home.today Wed Jan 5 19:25:31 2005 From: not at home.today (Ant) Date: Wed Jan 5 14:30:03 2005 Subject: [SpamCop-List] Re: Deputies: "This message looks like a bounce, will not report." References: Message-ID: "Fred K" wrote: [snip] > I also strongly agree with the earlier remark that a change in rules > etc., especially a biggy like this should be flagged for SC users. Yes, I'll be interested to hear why it hasn't been announced. Makes me wonder about the communication in this organization, when even the deputies don't appear to know about it. From TMHRVMFWREVN at spammotel.com Wed Jan 5 19:31:58 2005 From: TMHRVMFWREVN at spammotel.com (Rob) Date: Wed Jan 5 14:40:03 2005 Subject: [SpamCop-List] Re: [media] Microsoft's Anti-Spyware Beta To Debut Thursday References: Message-ID: "Tim McGraw" wrote in message news:crhbf1$857$1@news.spamcop.net... > Microsoft will roll out the first beta of its anti-spyware software > Thursday, Jan. 6, according to a leaked internal memo published by the > Neowin Web site. > Am I reading that right? Glad MS don't work for MI5 :-)) From Kilgallen at SpamCop.net Wed Jan 5 13:53:41 2005 From: Kilgallen at SpamCop.net (Larry Kilgallen) Date: Wed Jan 5 14:55:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> In article , "Miss Betsy" writes: > definitions. However, just as spamcop does not consider bounces > and viruses as spam, That just changed, as discussed in other topics. From e.schrama_NOSPAM at NOSPAM_hccnet.nl Wed Jan 5 20:55:48 2005 From: e.schrama_NOSPAM at NOSPAM_hccnet.nl (geo_splash_12) Date: Wed Jan 5 15:00:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 In-Reply-To: References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: Miss Betsy wrote: > > >>I'm just trying to explain that blocking isn't (in this case even >>wasn't) the right decision, but everybody seems to be too trigger > > happy > >>to look at the other solution that I mentioned. >> >>But I'll shut up on this issue if it makes you more happy. > > > I have answered your posts twice and you have ignored me. But I am > going to try again. Sorry Betsy, I don't have the time to answer every post under this thread in this group, bear with me. > Unsubscribing is not a solution. It depends on the reputation of the sender, oftentimes you're right, sometimes you're not. There is a difference between black and white, often called gray. > Trying to get a legitimate, brick and mortar, merchant to > contribute to the community by not setting themselves above the > normal industry standards can be attempted in more ways than > blocking. So, is there an industry standard? Where is it? Who believes it? > However, there is no way that one can draw the line on what > constitutes spam except by the criterion of 'unsolicited' I always > add 'unwanted' because there are some unsolicited emails that are > wanted and that depends on one's preferences and is entirely up to > the receiver on how to handle. For blocklists, the criteria have > to be defined (for instance, spamcop does not allow the reporting > of viruses or bounces). For other blocklists, there are other > criteria. Maybe the blocklist criteria are not always adequate. I provided an alternative, if you're interested then read on. > Apple apparently is sending unsolicited, unwanted email to enough > people (and spamtraps) that consider their emails spam that they > have gotten blocked. So how often does it happen compared to the valid number of subscribers? Why is that not a criterion? > You can unsubscribe if you want to, but it is not a recommended > solution, not even by the FTC. Blah, sure, we will not respond to the joe in the field bla bla enhancers, I really got beyond this point. But thanks for reminding me anyway. Unsubscribing from a valid newslist means that your problem would be solved for now. > If you want to continue discussing the point, try answering some of > the arguments on why unsolicited email even by companies who are > offering a decent product is not good. If you can't answer them, > then admit that you prefer an unreasonable personal opinion. Ok, read on, miss Betsy and others. Or don't if you don't want to hear about a new mechanism to reduce false positives generated by the spamcop block list. Point is that there is a difference between black and white. I noticed that both sorbs and spamcop have a lousy performance in detecting the validity of common newsletters read by many subscribers. I've seen it with Apple newslists (actually IP 17.254.6.26 is currently listed and it is also wrong), Matlab digests, divx newsletters, and comsol digests. The list goes on and on. Apparently I must conclude that it is very difficult for a RBL to distinguish between good and bad. Since valid newsletters are distributed in large numbers I think that they are sensitive to being blocked. We have heard about all possibly reasons why this is the case, spamtraps, obnoxious reporters, etc etc. To an outsider it simply means that the false positives rating of a blocklist goes up. (this is bad, I want the 0.1% false positives rating to go down to 0.00001% or less) It may be that these newslists are poluted. Too bad, because of the reputation of the organization behind the newslist I advise recipients to unsubscribe if they don't want to receive the newsletter. I'm aware of the uglyness of this idea. For reputed newslists there is however no danger UNTIL the contrary is proven. Innocent until proven guilty is a perfectly legal concept. So what I'm trying to advocate is that we can do better than plain old fashioned blocking. (It is the party line here, I know, and if you like it then stop reading here) I've provided a fairly simple concept on how you can fix the valid newslist blocking problem. Question is now whether this is some weird idea that is never going to work, or, whether the idea could be implemented in some procedure from which we could benefit. The only thing you need to do is to write a separate filter that tells whether a particular e-mail is a valid digest is coming from a known IP range. No open proxies should be inbetween you and this IP, and to recognize the validity of the newslist you need to know some fingerprint of that newslist. Is this an easy task, NO, certainly not. The problem may seem like, you can never ever bla bla bla, solve this problem. It is like answering, how do you make a fruit cordial, answer 1: add fruit, sugar and water in a bowl and mix, answer 2: be nice to me. If new ideas are to much for you then please also stop reading here. But, if you knew the right fingerprint (yes, a content question and not a consent question) of a particular digest (like, Itunes newsletter bla bla bla) and if you know that it was sent from a particular ip range (like 17.254.6.[0-255] which belongs to Apple), plus some other conditions, then you know that we are dealing with a valid newsletter rather than a pill enhancer. It could be tested at the very moment that somebody submits spam to spamcop or when it enters through a spamtrap in the system. In either case the decision should be. Do not allow this information to be blocked or at least return a different code in the DNS lookup like, probably it is a newsletter that was accidentically reported. So, who has the guts to write implement this procedure? Ejo From Kilgallen at SpamCop.net Wed Jan 5 13:57:43 2005 From: Kilgallen at SpamCop.net (Larry Kilgallen) Date: Wed Jan 5 15:00:13 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> In article , Kilgallen@SpamCop.net (Larry Kilgallen) writes: > In article , "Miss Betsy" writes: > >> definitions. However, just as spamcop does not consider bounces >> and viruses as spam, > > That just changed, as discussed in other topics. http://mailsc.spamcop.net/fom-serve/cache/14.html in particular. From Kilgallen at SpamCop.net Wed Jan 5 14:05:48 2005 From: Kilgallen at SpamCop.net (Larry Kilgallen) Date: Wed Jan 5 15:10:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> In article , geo_splash_12 writes: > Miss Betsy wrote: >> Unsubscribing is not a solution. > > It depends on the reputation of the sender, oftentimes you're right, > sometimes you're not. There is a difference between black and white, > often called gray. Around here, the reputation of Apple in particular has descended to "totally clueless". >> Trying to get a legitimate, brick and mortar, merchant to >> contribute to the community by not setting themselves above the >> normal industry standards can be attempted in more ways than >> blocking. > > So, is there an industry standard? Where is it? Who believes it? http://www.cluelessmailers.org/info/listmanagement.html I believe it. >> Apple apparently is sending unsolicited, unwanted email to enough >> people (and spamtraps) that consider their emails spam that they >> have gotten blocked. > > So how often does it happen compared to the valid number of subscribers? > Why is that not a criterion? That is immaterial to the total amount of email received by a victim. Why should one victim care that _other_ people in the world actually want what is delivered to them as spam. > Point is that there is a difference between black and white. I noticed > that both sorbs and spamcop have a lousy performance in detecting the > validity of common newsletters read by many subscribers. I've seen it > with Apple newslists (actually IP 17.254.6.26 is currently listed and it > is also wrong), Matlab digests, divx newsletters, and comsol digests. We have already determined that Apple mishandles their mailing list. What about the others ? > The list goes on and on. Apparently I must conclude that it is very > difficult for a RBL to distinguish between good and bad. All spam is bad. The only case where a DNSbl (RBL is a trademarked term) mishandles their listing is if they consider something spam that is not. > Since valid newsletters are distributed in large numbers I think that > they are sensitive to being blocked. We have heard about all possibly > reasons why this is the case, spamtraps, obnoxious reporters, etc etc. Then we heard the guaranteed and verified reason for the Apple case -- their failure to use confirmed opt-in results in sending to spamtraps. > The only thing you need to do is to write a separate filter that tells > whether a particular e-mail is a valid digest is coming from a known IP > range. That says nothing about whether the mailing is spam. Spam is about conSent, not conTent. When will you get that through your head ? From gezgin at spamcop.net Wed Jan 5 22:06:45 2005 From: gezgin at spamcop.net (Gezgin) Date: Wed Jan 5 15:10:11 2005 Subject: [SpamCop-List] Re: [media] Microsoft's Anti-Spyware Beta To Debut Thursday References: Message-ID: "Rob" wrote > Am I reading that right? Glad MS don't work for MI5 :-)) Both MI5 and MS leak where they want to leak and disregard the rest. -- Bob Kanyak's Doghouse http://www.kanyak.com From SCsoc.5.myspamgobbler at spamgourmet.com Wed Jan 5 12:16:03 2005 From: SCsoc.5.myspamgobbler at spamgourmet.com (Brian) Date: Wed Jan 5 15:20:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 In-Reply-To: References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: geo_splash_12 wrote: > Miss Betsy wrote: > >> >> >>> I'm just trying to explain that blocking isn't (in this case even >>> wasn't) the right decision, but everybody seems to be too trigger >> >> >> happy >> >>> to look at the other solution that I mentioned. >>> > >> Unsubscribing is not a solution. > > > It depends on the reputation of the sender, oftentimes you're right, > sometimes you're not. There is a difference between black and white, > often called gray. > >> Trying to get a legitimate, brick and mortar, merchant to >> contribute to the community by not setting themselves above the >> normal industry standards can be attempted in more ways than >> blocking. > > > So, is there an industry standard? Where is it? Who believes it? > http://www.cluelessmailers.org/info/listmanagement.html From nobody at nowhere.invalid Wed Jan 5 21:17:58 2005 From: nobody at nowhere.invalid (Steven Maesslein) Date: Wed Jan 5 15:20:17 2005 Subject: [SpamCop-List] Re: Reporting virms may not be such a great idea... References: <41DBFE2B.6080105@spamcop.net> Message-ID: On Wed, 05 Jan 2005 15:48:11 +0100, Hans Salvisberg coughed into spamcop and left this in <41DBFE2B.6080105@spamcop.net>: > Responsible ISPs may act on the /reports/ and try to find and notify the > client that had the reported IP at the time when the virm was sent, but > the /blacklistings/ typically hurt the wrong guy. Users of dynamic IP addresses shouldn't be sending mail direct-to-mx in the first place. If they're affected by the blocklist at all then they're doing something they shouldn't be doing. -- Steve A revolving concretion of earthy or mineral matter accumulates no congeries of small, green bryophytic plant. From MikeE at ster.invalid Wed Jan 5 12:26:37 2005 From: MikeE at ster.invalid (Mike Easter) Date: Wed Jan 5 15:30:02 2005 Subject: [SpamCop-List] Re: Deputies: "This message looks like a bounce, will not report." References: Message-ID: Fred K wrote: > "Mike Easter" > I have my AV set to automatically fix/delete viruses. It attaches a > text file with the deleted virus name to the message. I would think > forwarding the message with the actual virus attached is not a good > thing. That is correct. In the past when SC notifies were not an option, all notifies to the provider for the infected propagator were done by sending some information about the characterization of the virm along with the complete headers and only sufficient body attached to demonstrate the 'nature' of the viral propagation. The actual virus is not sent. > But I seriously doubt much change in my case. I have been receiving > the old "Microwonderfuldamnsoft patch" and reporting it myself for > months, with no fix. But I will start reporting anyway. Perhaps those providers who weren't very interested in your reports of their client propagators will be more motivated by a potential spamcop problem. -- Mike Easter kibitzer, not SC admin From SCNews.5.myspamgobbler at spamgourmet.com Wed Jan 5 12:37:36 2005 From: SCNews.5.myspamgobbler at spamgourmet.com (Spam N Scams Reporter) Date: Wed Jan 5 15:40:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 In-Reply-To: References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: geo_splash_12 wrote: > Miss Betsy wrote: > >> >> > > Point is that there is a difference between black and white. I noticed > that both sorbs and spamcop have a lousy performance in detecting the > validity of common newsletters read by many subscribers. I've seen it > with Apple newslists (actually IP 17.254.6.26 is currently listed and it > is also wrong), Matlab digests, divx newsletters, and comsol digests. > The list goes on and on. Apparently I must conclude that it is very > difficult for a RBL to distinguish between good and bad. This is not about validating or validity of mail lists. This is about _spam_. > > Since valid newsletters are distributed in large numbers I think that > they are sensitive to being blocked. We have heard about all possibly > reasons why this is the case, spamtraps, obnoxious reporters, etc etc. > To an outsider it simply means that the false positives rating of a > blocklist goes up. (this is bad, I want the 0.1% false positives rating > to go down to 0.00001% or less) It may be that these newslists are > poluted. Too bad, Too bad for whom? For all the people that have to put up with being spammed with the newsletter because Apple, Matlab, divx, etc., use poor list management practices? because of the reputation of the organization behind > the newslist I advise recipients to unsubscribe if they don't want to > receive the newsletter. Apple has a poor reputation in my opinion. I tested their sign up policy and found it lacking. Who is Matlab? Divx? comsol? I have no experience with them. If I were to receive something from them, how would I know their reputation other than to assume that they were spammers? I DO NOT unsubscribe to anything that I have not subscribed to. This is a very poor way to do things. You are beginning to sound like a troll, as you fail to see what so many have said. DO NOT USE UNSUBSCRIBE. I'm aware of the uglyness of this idea. For > reputed newslists there is however no danger UNTIL the contrary is > proven. Apple has a poor reputation. The danger is found after making a poor judgment call and your email account is now flooded to the point that it is all but impossible to use. Innocent until proven guilty is a perfectly legal concept. > It is not about legality. It is about _spam_. > So what I'm trying to advocate is that we can do better than plain old > fashioned blocking. (It is the party line here, I know, and if you like > it then stop reading here) I've provided a fairly simple concept on how > you can fix the valid newslist blocking problem. Question is now whether > this is some weird idea that is never going to work, or, whether the > idea could be implemented in some procedure from which we could benefit. > > The only thing you need to do is to write a separate filter that tells > whether a particular e-mail is a valid digest is coming from a known IP > range. Once again, this is not about validity. Why should I go to the bother of trying to determine if a digest, email list, newsletter is coming from a 'valid' sender with a 'reputation'. Who's responsible for giving them the reputation? You? No open proxies should be inbetween you and this IP, and to > recognize the validity of the newslist you need to know some fingerprint > of that newslist. Is this an easy task, NO, certainly not. The problem > may seem like, you can never ever bla bla bla, solve this problem. It is > like answering, how do you make a fruit cordial, answer 1: add fruit, > sugar and water in a bowl and mix, answer 2: be nice to me. If new ideas > are to much for you then please also stop reading here. > > But, if you knew the right fingerprint (yes, a content question and not > a consent question) of a particular digest (like, Itunes newsletter bla > bla bla) and if you know that it was sent from a particular ip range > (like 17.254.6.[0-255] which belongs to Apple), plus some other > conditions, then you know that we are dealing with a valid newsletter > rather than a pill enhancer. It could be tested at the very moment that > somebody submits spam to spamcop or when it enters through a spamtrap in > the system. In either case the decision should be. Do not allow this > information to be blocked or at least return a different code in the DNS > lookup like, probably it is a newsletter that was accidentically reported. > It is not accidentally reported. Do you listen at all to what people have been trying to tell you? > So, who has the guts to write implement this procedure? > > Ejo > > From nobody at nowhere.invalid Wed Jan 5 21:44:05 2005 From: nobody at nowhere.invalid (Steven Maesslein) Date: Wed Jan 5 15:45:02 2005 Subject: [SpamCop-List] Re: [media] Microsoft's Anti-Spyware Beta To Debut Thursday References: Message-ID: On Wed, 05 Jan 2005 10:25:36 -0800, Tim McGraw coughed into spamcop and left this in : > Microsoft will roll out the first beta of its anti-spyware software > Thursday, Jan. 6, according to a leaked internal memo published by the > Neowin Web site. Well, I've always found that the best anti-spyware command ever was: echo "Y" | format c: /u -- Steve Nine megs for the secretaries fair, Seven megs for the hackers scarce, Five megs for the grads in smoky lairs, Three megs for system source. One disk to rule them all, One disk to bind them, One disk to hold all the files, And in the darkness grind 'em. From TJLWBECGSGWU at spammotel.com Wed Jan 5 21:04:11 2005 From: TJLWBECGSGWU at spammotel.com (Mathew Hendry) Date: Wed Jan 5 16:10:03 2005 Subject: [SpamCop-List] Re: Reporting virms may not be such a great idea... References: <41DBFE2B.6080105@spamcop.net> Message-ID: On Wed, 5 Jan 2005 21:17:58 +0100, Steven Maesslein wrote: >On Wed, 05 Jan 2005 15:48:11 +0100, Hans Salvisberg coughed into spamcop >and left this in <41DBFE2B.6080105@spamcop.net>: > >> Responsible ISPs may act on the /reports/ and try to find and notify the >> client that had the reported IP at the time when the virm was sent, but >> the /blacklistings/ typically hurt the wrong guy. > >Users of dynamic IP addresses shouldn't be sending mail direct-to-mx in >the first place. If they're affected by the blocklist at all then >they're doing something they shouldn't be doing. It isn't only direct-to-mx mail that is affected. SpamCop Mail and many other filtering systems check *all* IPs through which the mail passed, or claimed to pass. -- Mat. From wb8tyw at qsl.network Wed Jan 5 15:06:59 2005 From: wb8tyw at qsl.network (John E. Malmberg) Date: Wed Jan 5 16:10:13 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> In article , geo_splash_12 writes: > > So what I'm trying to advocate is that we can do better than plain old > fashioned blocking. Not with the currently installed software on many of the large mail servers. It is either accept all the mail and spam from an I.P. range or reject it all. You also have to have mail server processing capacity to do all the checks while the SMTP transaction is open, or you have no way of reliably indicating that mail was refused with SMTP rejects. Otherwise when a real mail gets misclassified by spam, there is no reliable way to notify the sender. To switch to accepting all the spam and then filtering based on user preferences would more than tripple the monthy bandwidth cost of one of my mail server operators. The last report I had from them is that the bandwidth costs were over $1,200 per month for legitimate e-mails. Then you add in the additional mail server costs, such as faster CPUs needed, more memory for the filter rules, more fault tolerant high speed disk space to store the spool files. (Since spam rates are currently estimated to be up to 75% of all delivery attempts, this would be a significant cost increase). But yes, if you could design a mail server program from scratch, there is quite a bit that you can do. > The only thing you need to do is to write a separate filter that tells > whether a particular e-mail is a valid digest is coming from a known IP > range. First it requires a mail server that has the ablity to use such a filter. That is not something that is standard. It also requires paying the bandwidth bills for all the spam coming from that I.P. range, which makes the it not feasable for many sites. Of course a mail server operator can always exempt an I.P range from blocking if they choose. And the more filter rules, the faster the server needs to be in order to apply them all in the SMTP transaction phase. If the filtering is done post SMTP phase, the server operator has to pay for all the bandwidth and storage, and then either tag or delete the suspected spam. There is no way to reliably notify the sender that the recipiant did not really get a misclassified message in a timely fashion. > So, who has the guts to write implement this procedure? The procedure is already implemented in scoring type filters such as SpamAssasin. Using it just requires a mail server software that allows SpamAssasin to be a Milter, and having the additional capacity to handle it. And how much more money that the mail server operator wants to pay per month. If you are willing to pay your e-mail provider to replace their current mail servers with ones having the higher capacity to handle content filtering and also to pay for the extra disk space, cooling, and bandwidth charges, they should have no problem setting things up the way that you desire. Again, though, none of that requires any change to spamcop.net's operation, it is just a matter of how the mail server decides to use the data. Spamcop.net runs an aggressive list, and will list real mail servers if a high enough mail originating from them is reported as spam, or if enough reporters make mistakes. It says this plainly in it's description. Therefore it by definition is more suitable for a scoring system than an absolute block. If your mail server operator does not understand that, that is not spamcop.net's problem. In this case, it has been confirmed by both news.admin.net-abuse.sightings and by the deputies that the reports of spam from that I.P. address are valid and not mistakes, so the spamcop.net blocking list is working exactly as advertised. It is your mail server's use of it that you are disagreeing with. -John wb8tyw@qsl.network Personal Opinion Only From tmcgraw at spamcop.net Wed Jan 5 13:09:40 2005 From: tmcgraw at spamcop.net (Tim McGraw) Date: Wed Jan 5 16:10:21 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 In-Reply-To: References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: geo_splash_12 wrote: > Miss Betsy wrote: > >> You can unsubscribe if you want to, but it is not a recommended >> solution, not even by the FTC. > > Blah, sure, we will not respond to the joe in the field bla bla > enhancers, I really got beyond this point. But thanks for reminding me > anyway. Unsubscribing from a valid newslist means that your problem > would be solved for now. iTunes sent email to a spamtrap, which never subscribes to anything. If you can personally guarantee that Apple will not sell a list with my email addy on it to the "joe in the field bla bla enhancers," you might have a case. The reason I *get* 100+ spamitems a day now is because I once made the mistake of trusting the wrong party. I won't make that mistake again. From wb8tyw at qsl.network Wed Jan 5 15:18:22 2005 From: wb8tyw at qsl.network (John E. Malmberg) Date: Wed Jan 5 16:20:06 2005 Subject: [SpamCop-List] Re: Reporting virms may not be such a great idea... References: <41DBFE2B.6080105@spamcop.net> Message-ID: In article <41DBFE2B.6080105@spamcop.net>, Hans Salvisberg writes: > Mike Easter wrote: >> What it sez down underneath is: >> >> Viruses -- Viruses are another form of spam and may be reported to >> SpamCop as such. > > I'm not sure that's a good idea. A lot of virm sources are dynamically > assigned IPs, and blacklisting them only causes problems for the next > guy who innocently gets assigned the blacklisted IP. All know dynamic pools are already blacklisted from sending directly to most commercial mail servers and many private ones. > I have an ADLS connection that is reset every 24 hours (to force me to > pay more to get a static IP if I want to run servers), and the days > where I find myself (or other innocent people) blacklisted are becoming > more common. If you are in a dynamic range that is not currently in the four most popular DNSbls for dynamic addresses, it is just a matter of one spam run from anywhere in the block that you are in to get the entire block mapped and listed. Note that in many cases, the ISPs submit their dynamic pools to the DNSbls because then they know that they will get less spam complaints about them. -John wb8tyw@qsl.network Personal Opinion Only From nobody at spamcop.net Wed Jan 5 16:20:31 2005 From: nobody at spamcop.net (Pop) Date: Wed Jan 5 16:25:04 2005 Subject: [SpamCop-List] Re: DMA opt out - is it worth it ? References: Message-ID: Warre wrote: >> KD wrote: >>> Hi all, >>> Whilst looking through our intranet site at work I >>> noticed a >>> link to dmaconsumers dot org as a way of opting out of emails >>> from >>> companies that use the the DMA preference list. Does anybody >>> know >>> if this is used by any of the usual spammers though I suspect >>> that >>> this is very unlikely ? Has anyone used this and reduced >>> their >>> spamload ? I'm up to 150 spams a day so any measures that >>> may >>> reduce this may be worth a shot. S'pose I could change my >>> email >>> address but it's a bigger exercise than I've really got the >>> spare >>> time for at the moment. >>> >>> Cheers, >>> Keith >>> >>> >> >> If the DMA simply passes the list on to whoever asks for it, >> without >> hashing the addresses for example, then i would expect many >> spammers >> to actually start sending spams to everyone on the list. >> >> Spammers usually don't honor opt-out requests, so they >> probably won't >> actively look for addresses to unsubscribe, either. >> >> You could start using sneakemail ( http://www.sneakemail.com ) >> for >> any legitimate sites that automatically process your email >> address; >> it keeps your address safe from spam and makes it a lot easier >> to >> change your address. Sneakemail is a very worthwhile site. I/ve been using it so long without any problems, I finally broke down and paid them. I love having a different address for anything I want. From nobody at spamcop.net Wed Jan 5 16:31:34 2005 From: nobody at spamcop.net (Pop) Date: Wed Jan 5 16:35:04 2005 Subject: [SpamCop-List] Re: Manual Reporting Page References: Message-ID: Blammo wrote: >> On 04 Jan 2005 Pop entered spamcop and left >> news:creo89$f8l$1@news.spamcop.net: >> >>> Is there any way to get rid of that old email reference that >>> comes up above the box to paste spam into? >>> >> >> Have you tried logging into Spamcop, clicking the "Report >> Spam" >> button then clicking "Remove all unreported spam"? >> Another possibility is that you are using a bookmark/ Favorite >> that >> is actually a link to that particular report, instead of just >> www.spamcop.net. >> >> -- >>> Ric Hmm, I'll have to think that over; too shot right now to do anything requiring intelligence. I do use a bookmark, but it's only to the sign-in page at SC. Nothing special about it, it's the same page I get to when I check in right at the sc.net address. I just skipped the interim an dwen to the same window that takes me to for signin. Or is that on ... dunno; too tired right now. Thanks, I'll try a couple different ways of accessing SC to sign in. Pop From nobody at spamcop.net Wed Jan 5 17:53:35 2005 From: nobody at spamcop.net (indigo) Date: Wed Jan 5 17:55:03 2005 Subject: [SpamCop-List] Re: Deputies: "This message looks like a bounce, will not report." References: Message-ID: Mike Easter wrote: > That is a very interesting change. It allows virus reporting, virus > bounce reporting, spam bounce reporting, as well as challenge > reporting which it always has. > > When coupled with the feature of allowing the listed to remove > themselves, that makes for some very interesting dynamics. Eh wot? Where is that stated, and what possible sense does it make for a real spammer to be allowed to unblock himself? From David1 at suescornerweb.com Wed Jan 5 18:29:43 2005 From: David1 at suescornerweb.com (David 1) Date: Wed Jan 5 18:30:03 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? In-Reply-To: References: Message-ID: BJ wrote: > David 1 wrote: > || Socks wrote: > ||| David 1 wrote in > news:crfdce$thg$1 > ||| @news.spamcop.net: > ||| > ||| > |||| Had a started a group today I > |||| never would have considered a yahoo group > |||| > |||| > ||| > ||| > ||| however, you're looking for a solution to your current > ||| problem, not to a hypothetical what-if. you can still post > ||| your attachments in your 20M files section and have your > ||| subscribers download from there. > || > || Yeah & have to put up with Yahoo crashing or stop responding, > || the extra work it takes to upload the files seperatly from > || the emails, the pick or joke not being carried over with the > || replies so that all know what's > || being talked about OHHHH & lets NOT forget about the ad on > || every page > || Plus the ad that added in as a so called waiting to load > || page, NO I > || don't think I'm going to put my subscribers through that & > || didn't I > || moved, but a group I moderate on a daily basis has decided > || what is right for him so I'm stuck on yahoo for the time > || being. Which now that you brought this up is another reason > || for yahoo to do this besides needing > || the space on the servers for the mail increase it gave > || everyone at the > || cost of the groups losing their message attachments ( & they > || did because what good is the archive if it just stores a > || message saying attachment removed for the picture group that > || I'm part time moderator of)They can > || now have folks telling other folks just to use the file > || section (20M > || when msg base use to be 100M) & sit through everything I > || described above. > || > > Sounds like your problem is with Yahoo. Go complain about > it there. > > BJ > > sorry I'm not the one that started this thread, I just didn't like one of the answers in it so I replied so if you don't have anything to add how about just going to the next message & for the record I did go to yahell first & the person I'm answering IMO doesn't understand how it works when they say just go to archives it's a pet peeve of mine I lost a lot of stuff when yahoo did that -- David 1 bad addy spamtrap@suescornerweb.com From baloo at ursine.dyndns.org Wed Jan 5 15:30:21 2005 From: baloo at ursine.dyndns.org (Paul Johnson) Date: Wed Jan 5 18:35:02 2005 Subject: [SpamCop-List] Re: [media] Microsoft's Anti-Spyware Beta To Debut Thursday References: Message-ID: <1104967821.532061@ursine.dyndns.org> Tim McGraw wrote: > Microsoft will roll out the first beta of its anti-spyware software > Thursday, Jan. 6, according to a leaked internal memo published by the > Neowin Web site. But the question begs to be asked: Why doesn't Microsoft just fix the bugs that make it's platform such a popular spyware target to begin with? -- Paul Johnson baloo@ursine.dyndns.org http://ursine.dyndns.org/~baloo/ From MikeE at ster.invalid Wed Jan 5 15:35:30 2005 From: MikeE at ster.invalid (Mike Easter) Date: Wed Jan 5 18:35:11 2005 Subject: [SpamCop-List] Re: Deputies: "This message looks like a bounce, will not report." References: Message-ID: indigo wrote: > Mike Easter wrote: >> When coupled with the feature of allowing the listed to remove >> themselves, that makes for some very interesting dynamics. > > Eh wot? Where is that stated, and what possible sense does it make > for a real spammer to be allowed to unblock himself? Take a SCbl listed IP and plug it in, let's say 200.86.204.97 http://www.spamcop.net/w3m?action=checkblock&ip=200.86.204.97 Then follow the information at - Automatic delisting - If you are the administrator of CM-lcis2-204-97.cm.vtr.net and you are sure it will not be receiving any more reports of spam, you may cause the system to be delisted without waiting for us to review the issue. You may only do this once per IP! So please be sure that the problem is really and truly resolved. If you delist your system and we get more spam reports about it, you will not be allowed to expedite delisting again. Delisting normally occurs 24 hours after spam reports have ceased. You must be able to receive mail at one of the addresses below. Until you have received and confirmed your request, it will not take effect. etc -- Mike Easter kibitzer, not SC admin From mfkmek820 at yahoo.com Wed Jan 5 14:35:13 2005 From: mfkmek820 at yahoo.com (Fred K) Date: Wed Jan 5 18:40:02 2005 Subject: [SpamCop-List] Re: [media] Microsoft's Anti-Spyware Beta To Debut Thursday References: <1104967821.532061@ursine.dyndns.org> Message-ID: "Paul Johnson" wrote in message news:1104967821.532061@ursine.dyndns.org... > But the question begs to be asked: Why doesn't Microsoft just fix the > bugs > that make it's platform such a popular spyware target to begin with? Because from my career as a professional software fixer I have learned that any large complex software application is NEVER finished. When it is retired legacy software it will still have bugs. Just the nature of a very complicated beast. Fred k From nobody at nowhere.invalid Thu Jan 6 00:48:15 2005 From: nobody at nowhere.invalid (Steven Maesslein) Date: Wed Jan 5 18:50:03 2005 Subject: [SpamCop-List] Re: Reporting virms may not be such a great idea... References: <41DBFE2B.6080105@spamcop.net> Message-ID: On Wed, 05 Jan 2005 21:04:11 +0000, Mathew Hendry coughed into spamcop and left this in : > It isn't only direct-to-mx mail that is affected. SpamCop Mail and many > other filtering systems check *all* IPs through which the mail passed, or > claimed to pass. SpamCop mail only diverts mail identified (whether correctly or not) as spam. As should any analysis tool that inspects headers further upstream than the last hop. -- Steve Don't be irreplaceable. If you can't be replaced, you can't be promoted. From TJLWBECGSGWU at spammotel.com Thu Jan 6 00:22:59 2005 From: TJLWBECGSGWU at spammotel.com (Mathew Hendry) Date: Wed Jan 5 19:25:08 2005 Subject: [SpamCop-List] Re: Reporting virms may not be such a great idea... References: <41DBFE2B.6080105@spamcop.net> Message-ID: On Thu, 6 Jan 2005 00:48:15 +0100, Steven Maesslein wrote: >On Wed, 05 Jan 2005 21:04:11 +0000, Mathew Hendry coughed into spamcop >and left this in : > >> It isn't only direct-to-mx mail that is affected. SpamCop Mail and many >> other filtering systems check *all* IPs through which the mail passed, or >> claimed to pass. > >SpamCop mail only diverts mail identified (whether correctly or not) as >spam. As should any analysis tool that inspects headers further upstream >than the last hop. Whether they should or not, not all of them do, and innocent dynamic IP users *are* adversely affected by blacklisting. I see complaints about spam-bounced/rejected mail on my current ISP's support newsgroups quite often. That's not to say it's entirely a bad thing; if there weren't any collateral damage then there would be negligable incentive for ISPs to do anything. -- Mat. From ric.gates at bigsleep.org Thu Jan 6 03:39:36 2005 From: ric.gates at bigsleep.org (Blammo) Date: Wed Jan 5 22:40:03 2005 Subject: [SpamCop-List] Re: Manual Reporting Page References: Message-ID: On 05 Jan 2005 Pop entered spamcop and left news:crhmbc$gpj$1@news.spamcop.net: > Blammo wrote: >>> On 04 Jan 2005 Pop entered spamcop and left >>> news:creo89$f8l$1@news.spamcop.net: >>> >>>> Is there any way to get rid of that old email reference that >>>> comes up above the box to paste spam into? >>>> >>> >>> Have you tried logging into Spamcop, clicking the "Report >>> Spam" >>> button then clicking "Remove all unreported spam"? >>> Another possibility is that you are using a bookmark/ Favorite >>> that >>> is actually a link to that particular report, instead of just >>> www.spamcop.net. >>> >>> -- >>>> Ric > > Hmm, I'll have to think that over; too shot right now to do > anything requiring intelligence. I do use a bookmark, but it's > only to the sign-in page at SC. Nothing special about it, it's > the same page I get to when I check in right at the sc.net > address. I just skipped the interim an dwen to the same window > that takes me to for signin. Or is that on ... dunno; too tired > right now. > > Thanks, I'll try a couple different ways of accessing SC to sign > in. > > Pop > I was thinking about this yesterday and I thought maybe if you submit a spam (via email) then click the "Cancel Reports" link it may clear out the database. Otherwise you may not see a link there if you don't have any reports waiting. I've seen some odd bugs where you can't submit a report, and perhaps you have one stuck in there. -- | Ric | From ric.gates at bigsleep.org Thu Jan 6 03:59:36 2005 From: ric.gates at bigsleep.org (Blammo) Date: Wed Jan 5 23:00:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <8G4c$yztKCRS@eisner.encompasserve.org> <$2$u2PRhSBal@eisner.encompasserve.org> Message-ID: On 05 Jan 2005 John E. Malmberg entered spamcop and left news:$2$u2PRhSBal@eisner.encompasserve.org: > Not with the currently installed software on many of the large mail > servers. It is either accept all the mail and spam from an I.P. range > or reject it all. > Many servers (Postfix, Sendmail) have the ability to delay connection rejects until after other rule checks. This feature has been around for quite some time. This is the only way to always allow mail to postmaster@ or abuse@, but I do agree that this does add some server load. I actually want to hack mine to add a type of "grey list" so I can always reject some but for the greys run more checks before rejecting. -- | Ric | From ric.gates at bigsleep.org Thu Jan 6 04:21:18 2005 From: ric.gates at bigsleep.org (Blammo) Date: Wed Jan 5 23:25:02 2005 Subject: [SpamCop-List] Re: Reporting virms may not be such a great idea... References: <41DBFE2B.6080105@spamcop.net> Message-ID: On 05 Jan 2005 Hans Salvisberg entered spamcop and left news:41DBFE2B.6080105@spamcop.net: > I have an ADLS connection that is reset every 24 hours (to force me to > pay more to get a static IP if I want to run servers), and the days > where I find myself (or other innocent people) blacklisted are becoming > more common. > I already see such IPs get tagged because the mail server checks the actual source IP even when it's sent through a valid MX server. For example CMU Sieve on Cyrus does this. Possibly just bad configuration, I don't know. -- | Ric | From nobody at devnull.spamcop.net Thu Jan 6 13:32:18 2005 From: nobody at devnull.spamcop.net (Patto) Date: Wed Jan 5 23:35:03 2005 Subject: [SpamCop-List] Error: couldn't parse head Message-ID: For the last few days I'm getting an error message for every spam I submit. Example tracker: http://www.spamcop.net/sc?id=z709822694ze34242622f1e1b2d2b0cc76bf363552ez I see nothing wrong with the message. But the message comes from an Exchange Server 2003, and is sent to SC as an attachment from Outlook 2003. Then I assume something *must* be wrong. But what, exactly...? Thanks! From ric.gates at bigsleep.org Thu Jan 6 04:44:33 2005 From: ric.gates at bigsleep.org (Blammo) Date: Wed Jan 5 23:45:03 2005 Subject: [SpamCop-List] Re: Reporting misdirect automaton responses now allowed ! References: Message-ID: On 05 Jan 2005 Mike Easter entered spamcop and left news:crgs5b$sm4$1@news.spamcop.net: > 'They' tint should let this stamp contain a Last Modified line on all > the faq pages: > Server parsed pages don't normally add that. In order to add it it has to be defined manually and you have to decide which document it should get the Last Modified date from. It probably would be better to just add it to the page itself. -- | Ric | From MikeE at ster.invalid Wed Jan 5 21:04:45 2005 From: MikeE at ster.invalid (Mike Easter) Date: Thu Jan 6 00:05:02 2005 Subject: [SpamCop-List] Re: Error: couldn't parse head References: Message-ID: Patto wrote: > For the last few days I'm getting an error message for every spam I > submit. Example tracker: www.spamcop.net/sc?id=z709822694ze34242622f1e1b2d2b0cc76bf363552ez > > I see nothing wrong with the message. But the message comes from an > Exchange Server 2003, and is sent to SC as an attachment from Outlook > 2003. Then I assume something *must* be wrong. But what, exactly...? SC expects a header to contain only header elements, and those elements must be properly configured. This line below isn't a header element and it isn't configured like a header element Microsoft Mail Internet Headers Version 2.0 If you get rid of that line, the item will parse just fine including the body with this result: www.spamcop.net/sc?id=z709837802z8b3ddd0e7e8cb60062444cd7a97fc4bdz Report Spam to: Re: 220.90.175.127 (Administrator of network where email originates) To: abuse@kornet.net (Notes) Re: 220.90.175.127 (Third party interested in email source) To: Cyveillance spam collection (Notes) Re: http://estoppal.lijniahk.info/barton?5i7o7pbqdg... (Administrator of network hosting website referenced in spam) To: abuse@mci.com (Notes) Re: http://guitar.fkekblla.info/?m3ufoamboxzjbmsbor... (Administrator of network hosting website referenced in spam) To: abuse@mci.com (Notes) -- Mike Easter kibitzer, not SC admin From nobody at devnull.spamcop.net Wed Jan 5 21:33:17 2005 From: nobody at devnull.spamcop.net (LioNiNoiL_a t_Y a h 0 0_d 0 t_c 0 m) Date: Thu Jan 6 00:35:03 2005 Subject: [SpamCop-List] Re: Spamcop detecting wrong thing? In-Reply-To: References: Message-ID: > I'm using Mozilla Firefox - are you on Firefox as well? Nope: I tried Firefox, but I like plain-Jane Mozilla better. -- "[Spammers] are the mutant spawn of a bizarre reproductive act involving a telemarketer, Larry Flynt, a tapeworm, and an executive of the Third Class Mail industry." -- Dave Barry From salvisberg at spamcop.net Thu Jan 6 06:51:03 2005 From: salvisberg at spamcop.net (Hans Salvisberg) Date: Thu Jan 6 00:45:03 2005 Subject: [SpamCop-List] Re: Reporting virms may not be such a great idea... In-Reply-To: References: <41DBFE2B.6080105@spamcop.net> Message-ID: Blammo wrote: > On 05 Jan 2005 Hans Salvisberg entered spamcop and left > news:41DBFE2B.6080105@spamcop.net: > > >>I have an ADLS connection that is reset every 24 hours (to force me to >>pay more to get a static IP if I want to run servers), and the days >>where I find myself (or other innocent people) blacklisted are becoming >>more common. >> > > > I already see such IPs get tagged because the mail server checks the actual > source IP even when it's sent through a valid MX server. For example CMU > Sieve on Cyrus does this. Possibly just bad configuration, I don't know. Here are the headers I got just now sending an email through my ISP (Bluewin) to SpamCop: Received: from unknown (192.168.1.101) by blade5.cesmail.net with QMQP; 6 Jan 2005 05:17:36 -0000 Received: from mail5.bluewin.ch (195.186.1.207) by mailgate.cesmail.net with SMTP; 6 Jan 2005 05:17:36 -0000 Received: from [192.168.123.200] (81.62.72.252) by mail5.bluewin.ch (Bluewin AG 7.0.035) 81.62.72.252 is the current dynamic IP assigned to my ADSL NAT Router, and I do SMTP to one of Bluewin's SMTP servers (here mail5.bluewin.ch). What I see is that IPs like 81.62.72.252 get blacklisted, and when I inherit a blacklisted one, then my emails get flagged as spam. Is that a "bad configuration"? Hans P.S. No, I really don't get the same address every time. After resetting the connection I got 62.203.223.240, then 83.76.255.7, etc. From tdy at blackhole.invalid Wed Jan 5 22:42:51 2005 From: tdy at blackhole.invalid (N. Miller) Date: Thu Jan 6 01:45:04 2005 Subject: [SpamCop-List] Re: Deputies: "This message looks like a bounce, will not report." References: Message-ID: In article , Mike Easter says... > I'll cite again what some seem to be missing under the list of > misdirected issues: > Viruses -- Viruses are another form of spam and may be reported to > SpamCop as such. {gulp} It seems that I stopped reading one section too soon. gomen-nasai -- Norman ~Win dain a lotica, En vai tu ri, Si lo ta ~Fin dein a loluca, En dragu a sei lain ~Vi fa-ru les shutai am, En riga-lint From nobody at devnull.spamcop.net Thu Jan 6 16:09:32 2005 From: nobody at devnull.spamcop.net (Patto) Date: Thu Jan 6 02:10:02 2005 Subject: [SpamCop-List] Re: Error: couldn't parse head In-Reply-To: References: Message-ID: Mike Easter wrote: > Patto wrote: > >>For the last few days I'm getting an error message for every spam I >>submit. Example tracker: > > www.spamcop.net/sc?id=z709822694ze34242622f1e1b2d2b0cc76bf363552ez > >>I see nothing wrong with the message. But the message comes from an >>Exchange Server 2003, and is sent to SC as an attachment from Outlook >>2003. Then I assume something *must* be wrong. But what, exactly...? > > > SC expects a header to contain only header elements, and those elements > must be properly configured. > > This line below isn't a header element and it isn't configured like a > header element > > Microsoft Mail Internet Headers Version 2.0 That is definitely new since I am connected to Exchange Server 2003. But why-oh-why can SC parse the headers correctly (/after/ that line), but stops processing the body? Anyway, I will try to find a way to eliminate that line. Thanks! From nobody at devnull.spamcop.net Thu Jan 6 16:17:06 2005 From: nobody at devnull.spamcop.net (Patto) Date: Thu Jan 6 02:20:02 2005 Subject: [SpamCop-List] Re: Error: couldn't parse head In-Reply-To: References: Message-ID: Mike Easter wrote: > Patto wrote: > >>For the last few days I'm getting an error message for every spam I >>submit. Example tracker: > > www.spamcop.net/sc?id=z709822694ze34242622f1e1b2d2b0cc76bf363552ez > >>I see nothing wrong with the message. But the message comes from an >>Exchange Server 2003, and is sent to SC as an attachment from Outlook >>2003. Then I assume something *must* be wrong. But what, exactly...? > > > SC expects a header to contain only header elements, and those elements > must be properly configured. > > This line below isn't a header element and it isn't configured like a > header element > > Microsoft Mail Internet Headers Version 2.0 Looks like this has already been discussed in the web-based forum http://forum.spamcop.net/forums/lofiversion/index.php/t1522.html But without a solution (except to buy yet another product...). From nobody at nowhere.invalid Thu Jan 6 12:32:53 2005 From: nobody at nowhere.invalid (Steven Maesslein) Date: Thu Jan 6 06:35:23 2005 Subject: [SpamCop-List] Re: Error: couldn't parse head References: Message-ID: On Thu, 06 Jan 2005 16:17:06 +0900, Patto coughed into spamcop and left this in : > But without a solution (except to buy yet another product...). Buy? There are plenty of open-source MTAs available on the 'Net for zero cost. Furthermore, most of them actually respect long-established standards, such as RFC822 for example. -- Steve We could certainly slow the aging process down if it had to work its way through Congress. From nobody at spamcop.net Thu Jan 6 09:46:06 2005 From: nobody at spamcop.net (Miss Betsy) Date: Thu Jan 6 09:45:09 2005 Subject: [SpamCop-List] Re: Reporting virms may not be such a great idea... References: <41DBFE2B.6080105@spamcop.net> Message-ID: "Mathew Hendry" wrote in message news:rjvot0tf0afr2gvhmjd4a5mgbmbmcts8kd@4ax.com... > Whether they should or not, not all of them do, and innocent dynamic IP > users *are* adversely affected by blacklisting. I see complaints about > spam-bounced/rejected mail on my current ISP's support newsgroups quite > often. That's not to say it's entirely a bad thing; if there weren't any > collateral damage then there would be negligable incentive for ISPs to do > anything. IMHO, we(tinw) should stop using the term 'collateral damage' - internet users are going to have to become responsible - either as ISPs or as consumers choosing a decent ISP if spam is to be stopped. Internet users who are ignorant of what is responsible internet use are irresponsible or incompetent - not innocent. IOW, like drivers on roads, internet users should have a basic understanding of the rules of the roads. At this point, internet users need to direct their anger at their ISPs when things go wrong so that there are more responsible ISPs. Miss Betsy From porpoise1954 at yahoo.co.uk Thu Jan 6 15:26:06 2005 From: porpoise1954 at yahoo.co.uk (Porpoise) Date: Thu Jan 6 10:40:04 2005 Subject: [SpamCop-List] Re: Another spammer's appropriate name References: <41DBD5BC.6E1DEC5F@grignon.inra.fr> Message-ID: "Ivan Sache" wrote in message news:41DBD5BC.6E1DEC5F@grignon.inra.fr... > Hi, > > Hanaro kindly forwarded me a spam "sent" by: > >> From: Sebastian Cul > > "Cul" being "ass" in French, I find this name particularly appropriate. Ermmm no. Actually, Cul (French) means bottom (in English). From nobody at spamcop.net Thu Jan 6 10:41:56 2005 From: nobody at spamcop.net (Pop) Date: Thu Jan 6 10:45:04 2005 Subject: [SpamCop-List] Clarify SC vs. SS conflict Message-ID: Hi Guys & Gals, Maybe you can claifry some things for me. Over the last week or so, I -think- I have one spammer sending me three to four spams per day, always spewing for pirated software, meds, or stocks. It appears automatic (duh!) because the Received times at the ISP are always about the same times, and spaced apart about the same amount of time. e.g. today's were at 11:27 PM, 12.44 AM and 1:47 AM respectively and that timeframe is typical. When I parse them at Spamcop, the trace this time was to dreamline.co.kr, kornet.net (which is sometimes kornet.com), and mci.com respectively. That mix of source is typical each day but not always the same. But, when I parse them with Sam Spade, NONE of those sources are found. Instead, Sam Spade attributes them to acme.bfast.com as a rule. So, which one is correct? Or the most correct? Or are they both correct? The consistancy of SC's parses -seems- good, but I still feel SC is the better choice for larting. I did, on a couple of occaions do manual LARTs so I could include gvt addresses, Javawoman's references, and so forth, but it made no difference. The mailbox they are arriving at was sent 'round the world in one of those dumb To: mailings with a full Address book full of addresses (my own daughter!) announding a new email address, so I'm not exactly surprised by this except that it took about two months to start happening. Below are the reference URLs and the SC vs SS info on the three received today, along with the To recommendations by SC and snippets of SS comments about "really sent by". Any explanation would be appreciated. Right now I'd even accept a list-washing to get the spread of the address stopped. ----------------------- http://www.spamcop.net/sc?id=z709961602z44db4d836076c8822a09a4d410389fb7z To: ip@cjdream.com (Notes) To: ip@dreamline.co.kr (Notes) ---------------------- http://www.spamcop.net/sc?id=z709962164z134d94c88920089c9d372a9225ad8a67z To: abuse@kornet.net (Notes) ---------------------- http://www.spamcop.net/sc?id=z709962608z1ab3401f8b9c0d534885a967eb57b610z To: abuse@kornet.net (Notes) Re: http://benchmark.lookofficesoft.info/ (Administrator of network hosting website referenced in spam) To: abuse@mci.com (Notes) ------------------------------ For all three, Sam Spade says: Received: from blade3.usadatanet.net ([127.0.0.1]) by localhost (blade3.usadatanet.net [127.0.0.1]) (amavisd-new, port 10024) with SMTP id 40683-02; Thu, 6 Jan 2005 01:47:41 -0500 (EST) localhost received this from someone claiming to be blade3.usadatanet.net but really from 127.0.0.1(acme.bfast.com) -------------------------- Received: from mxa.usadatanet.net ([127.0.0.1]) by localhost (mxa [127.0.0.1]) (amavisd-new, port 10024) with SMTP id 29984-01; Thu, 6 Jan 2005 01:47:35 -0500 (EST) localhost received this from someone claiming to be mxa.usadatanet.net but really from 127.0.0.1(acme.bfast.com) ---------------------------------------- Received: from 69.67.254.9 (unknown [220.64.215.18]) by mxa.usadatanet.net (Postfix) with SMTP id 239F99141; Thu, 6 Jan 2005 01:47:17 -0500 (EST) mxa.usadatanet.net received this from someone claiming to be 69.67.254.9 but really from 220.64.215.18(No rDNS) ------------------------------------------------ And a SS whois on one of the "no rDNS" addresses says: 01/06/05 10:19:24 IP block 220.64.215.18 Trying 220.64.215.18 at ARIN Trying 220.64.215 at ARIN OrgName: Asia Pacific Network Information Centre OrgID: APNIC Address: PO Box 2131 City: Milton StateProv: QLD PostalCode: 4064 Country: AU --------------------- Could this somehow be my own ISP frogging up the headers? TIA, Pop From David1 at suescornerweb.com Thu Jan 6 10:56:49 2005 From: David1 at suescornerweb.com (David 1) Date: Thu Jan 6 11:00:01 2005 Subject: [SpamCop-List] Re: Clarify SC vs. SS conflict In-Reply-To: References: Message-ID: Pop wrote: > Hi Guys & Gals, > snip > > -------------------------- > Received: from mxa.usadatanet.net ([127.0.0.1]) by > localhost (mxa [127.0.0.1]) (amavisd-new, port 10024) with > SMTP id 29984-01; Thu, 6 Jan 2005 01:47:35 -0500 (EST) > localhost received this from someone claiming > to be mxa.usadatanet.net > but really from 127.0.0.1(acme.bfast.com) > > ---------------------------------------- snip > --------------------- > > Could this somehow be my own ISP frogging up the headers? > > TIA, > > Pop > > Hey on acme.bfast.com I don't know about the acme part but the bfast.com belongs to an affill program I use to be a member of if that helps any sorry but I don't know which one it was that used it but that use to be the beginning part of our affill link but like I said the acme part wasn't included when I was a part of it. I think Bravenet uses them if I remember correctly but here again I'm not sure. -- David 1 bad addy spamtrap@suescornerweb.com From nobody at spamcop.net Thu Jan 6 11:11:04 2005 From: nobody at spamcop.net (Pop) Date: Thu Jan 6 11:15:04 2005 Subject: [SpamCop-List] Re: Manual Reporting Page References: Message-ID: Blammo wrote: >> On 05 Jan 2005 Pop entered spamcop and left >> news:crhmbc$gpj$1@news.spamcop.net: >> >>> Blammo wrote: >>>>> On 04 Jan 2005 Pop entered spamcop and left >>>>> news:creo89$f8l$1@news.spamcop.net: ... Another possibility is that you are using a bookmark/ Favorite >>>>> that >>>>> is actually a link to that particular report, instead of >>>>> just >>>>> www.spamcop.net. ==> Nope, that wasn't it. I understand what you meant and that was a good thought. >>>>> >>>>> -- >>>>>> Ric ... >> I was thinking about this yesterday and I thought maybe if you >> submit a spam (via email) then click the "Cancel Reports" link >> it >> may clear out the database. >> Otherwise you may not see a link there if you don't have any >> reports >> waiting. I've seen some odd bugs where you can't submit a >> report, and >> perhaps you have one stuck in there. >> >> -- >>> Ric Huh! That didn't fix it, but it DID get a different too-old report in there . Strraaange! I did discover however that if I turn off Show Tech Details, it doesn't show IFF I'm doing manual reporting. For email reports now though, it's still there. Maybe I need to let it cogitate for awhile; I'll try it again tomorrow when I do the spam. I turned off the Show Details thing and left it off; I'll see if that makes a difference in email reporting tomorrow. Maybe there's more than one "stuck" in there. This "new" one's worse than the other one! It's got a report to list a mile long ;-[! Thanks! Pop From MikeE at ster.invalid Thu Jan 6 08:13:51 2005 From: MikeE at ster.invalid (Mike Easter) Date: Thu Jan 6 11:15:19 2005 Subject: [SpamCop-List] Re: Clarify SC vs. SS conflict References: Message-ID: Pop wrote: > But, when I parse them with Sam Spade, NONE of those sources are > found. Instead, Sam Spade attributes them to acme.bfast.com as a > rule. SC is a much better parser than SS www.spamcop.net/sc?id=z709961602z44db4d836076c8822a09a4d410389fb7z > To: ip@cjdream.com (Notes) > To: ip@dreamline.co.kr (Notes) source 220.64.215.18 inetnum: 220.64.215.0 - 220.64.215.255 netname: YOUNGNAM-ANDONGINFRA-KR admin-c: SP880-KR = syoung00@empal.com tech-c: DL850-KR = ip@cjream.com www.spamcop.net/sc?id=z709962164z134d94c88920089c9d372a9225ad8a67z > To: abuse@kornet.net (Notes) source 221.149.14.23 inetnum: 221.149.14.0 - 221.149.14.127 netname: KORNET-HOTLINE2003321636-KR admin-c: DS5995-KR = ktmen1@kt.co.kr tech-c: DS5996-KR = ktmen1@kt.co.kr www.spamcop.net/sc?id=z709962608z1ab3401f8b9c0d534885a967eb57b610z > To: abuse@kornet.net (Notes) source 220.75.14.105 inetnum: 220.72.0.0 - 220.87.255.255 netname: KORNET admin-c: DL248-AP = ip@ns.kornet.net tech-c: GK40-AP = ip@ns.kornet.net > For all three, Sam Spade says: SS does bad parse on all 3 > And a SS whois on one of the "no rDNS" addresses says: > > 01/06/05 10:19:24 IP block 220.64.215.18 > Trying 220.64.215.18 at ARIN > Trying 220.64.215 at ARIN > OrgName: Asia Pacific Network Information Centre You are not using SS correctly there. You have to lookup the IP in the correct RiR. Arin can't tell who what is in the apnic db. All of those pastings above I took from SS looking up the IP in apnic, not arin. -- Mike Easter kibitzer, not SC admin From nobody at spamcop.net Thu Jan 6 11:18:13 2005 From: nobody at spamcop.net (Pop) Date: Thu Jan 6 11:20:03 2005 Subject: [SpamCop-List] Re: Reporting virms may not be such a great idea... References: <41DBFE2B.6080105@spamcop.net> Message-ID: ... >> IOW, like drivers on roads, internet users should have a basic >> understanding of the rules of the roads. At this point, >> internet >> users need to direct their anger at their ISPs when things go >> wrong >> so that there are more responsible ISPs. >> >> Miss Betsy Amen to that! I had already left them, but there is one ISP in this area that will drop people's accounts if they complain too much! I've seen one of their shutdown notices and they're not at all polite. They're not a spam friendly ISP either; in fact, I suspect their main income is from local businesses (TV, radio stations etc.). The reason I left them a few years back is because you couldn't get tech support unless you were a locally known name or business. They should just be up front and say so, IMO. Sorry, guess that's a little OT; I thought it was informative at first - now I"m not so sure. Pop From MikeE at ster.invalid Thu Jan 6 08:28:16 2005 From: MikeE at ster.invalid (Mike Easter) Date: Thu Jan 6 11:30:03 2005 Subject: [SpamCop-List] Re: Clarify SC vs. SS conflict References: Message-ID: krnic/nic.or.kr abuse contact info follows, the preceding was apnic tech/admin Mike Easter wrote: > source 220.64.215.18 ip@dreamline.co.kr > source 221.149.14.23 abuse@kornet.net > source 220.75.14.105 abuse@kornet.net >> For all three, Sam Spade says: > > SS does bad parse on all 3 Here's the first one: Abbreviated Received lines *comment from (localhost [127.0.0.1]) by blade3.usadatanet.net *serves you from blade3.usadatanet.net ([127.0.0.1]) by localhost *serves you from (mxa.usadatanet.net [69.67.254.9]) by blade3.usadatanet.net *serves you from (localhost [127.0.0.1]) by mxa.usadatanet.net *serves you from mxa.usadatanet.net ([127.0.0.1]) by localhost *serves you from 69.67.254.9 (unknown [220.64.215.18]) by mxa.usadatanet.net *sourceline from cais.com ([26.109.247.71]) by conclusive.woodland.net *bogusline SS can't navigate those localhost lines. SC can not only navigate the localhost lines, but also can avoid tripping and chaining into the bogusline. -- Mike Easter kibitzer, not SC admin From philip at pch.home.cs.vu.nl Thu Jan 6 17:51:59 2005 From: philip at pch.home.cs.vu.nl (Philip Homburg) Date: Thu Jan 6 12:15:04 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: Message-ID: <21ekbkifeo552jmglrb899h653@inews_id.stereo.hq.phicoh.net> In article , Mike Easter wrote: >First, Apple is not going to lose its services because of getting >reported to its provider. The notify address for 17.254.6.27 rDNS >chatbox-smtp-out11.apple.com is abuse@apple.com but in the case of >some mainsleaze straightup spam their mail is handled by a different >mailing entity. Neither Apple nor a different mailing entity is going >to terminate Apple's account. > >Second, I don't disagree that Apple should be spanked for bad mailing >list management by getting itself listed in how many ever blocklists and >getting its mailings interfered with to how many ever tens of thousands >of people who want the mailing list; but remember, that 'we' tinw are >also 'spanking' all of those people who want the mailing list at the >same time. A big issue is whether Internet users can decide for themselves what kind of e-mail filtering they want, or whether their ISPs or companies decide what is good for them. When I subscribe to a mailing list, I use an unfiltered e-mail address. Lots of people on the Internet cannot mail any of my public e-mail addresses (because I do not accept mail from their ISPs) but I can easily use an unfiltered e-mail address to communicate with somebody. If enough people fine-grained demand control over the way their e-mail is filtered, then ISPs are likely to offer that. (I guess that Apple doesn't want to go for confirmed opt-in because they fear that too many of their users/customers don't understand it. The same class of users will probably not be able to use different e-mail addresses with different filter settings.) -- We just programmed the computers to revive us when it was all over... they were index linked to the [...] stock market prices you see, so that we'd be revived when everybody else had rebuilt the economy enough to be able to afford our rather expensive services again. -- Slartibartfast in THHGTTG From usenet1 at DE.LETE.THISljvideo.com Thu Jan 6 18:17:26 2005 From: usenet1 at DE.LETE.THISljvideo.com (Larry J.) Date: Thu Jan 6 13:20:03 2005 Subject: [SpamCop-List] Macromedia thanks me Message-ID: I've been reporting software piracy spam to Microsoft, Macromedia, Adobe, etc., for quite a long time. Today, I received my first thank-you from Macromedia: ================ Thank you. Chris Stickle Sr. Investigator, Anti-Piracy Macromedia, Inc. 99 Rhode Island St. San Francisco, CA 94103 415.832.5187 415.832.5140 fax cstickle@macromedia.com ================ -- Larry J. - Remove spamtrap in ALLCAPS to e-mail "Lord, are we worthy of the task that lies before us, or are we just jerking off..?" From nobody at devnull.spamcop.net Thu Jan 6 12:46:06 2005 From: nobody at devnull.spamcop.net (WazoO) Date: Thu Jan 6 13:50:03 2005 Subject: [SpamCop-List] Re: Clarify SC vs. SS conflict References: Message-ID: "Mike Easter" wrote in message news:crjo1e$nej$1@news.spamcop.net... > Pop wrote: > > But, when I parse them with Sam Spade, NONE of those sources are > > found. Instead, Sam Spade attributes them to acme.bfast.com as a > > rule. > > SC is a much better parser than SS Recalling the days when Steve was going to write up a "real" parsing and reporting tool that would solve all those problems with that idiot SpamCop thing Though admitting that I use the hell out of the SS for Windows thing, it hasn't been updated in how long? From nobody at spamcop.net Thu Jan 6 15:32:17 2005 From: nobody at spamcop.net (indigo) Date: Thu Jan 6 15:35:03 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? References: Message-ID: David 1 wrote: > sorry I'm not the one that started this thread, I just didn't like one > of the answers in it so I replied so if you don't have anything to add > how about just going to the next message & for the record I did go to > yahell first & the person I'm answering IMO doesn't understand how it > works when they say just go to archives it's a pet peeve of mine I > lost a lot of stuff when yahoo did that Like your snippers and the period key on your keyboard? ;-) From nobody at spamcop.net Thu Jan 6 15:34:04 2005 From: nobody at spamcop.net (indigo) Date: Thu Jan 6 15:35:16 2005 Subject: [SpamCop-List] Re: Deputies: "This message looks like a bounce, will not report." References: Message-ID: Mike Easter wrote: > indigo wrote: > > Mike Easter wrote: > >> When coupled with the feature of allowing the listed to remove > >> themselves, that makes for some very interesting dynamics. > > > > Eh wot? Where is that stated, and what possible sense does it make > > for a real spammer to be allowed to unblock himself? > > Take a SCbl listed IP and plug it in, let's say 200.86.204.97 > > http://www.spamcop.net/w3m?action=checkblock&ip=200.86.204.97 > > Then follow the information at - > Ah-so. Thnx. From nobody at spamcop.net Thu Jan 6 15:44:06 2005 From: nobody at spamcop.net (Miss Betsy) Date: Thu Jan 6 15:45:03 2005 Subject: [SpamCop-List] Re: Reporting virms may not be such a great idea... References: <41DBFE2B.6080105@spamcop.net> Message-ID: "Pop" wrote in message news:crjoc7$nof$1@news.spamcop.net... > ... > >> IOW, like drivers on roads, internet users should have a basic > >> understanding of the rules of the roads. At this point, > >> internet > >> users need to direct their anger at their ISPs when things go > >> wrong > >> so that there are more responsible ISPs. > >> > >> Miss Betsy > > Amen to that! I had already left them, but there is one ISP in > this area that will drop people's accounts if they complain too > much! I've seen one of their shutdown notices and they're not at > all polite. They're not a spam friendly ISP either; in fact, I > suspect their main income is from local businesses (TV, radio > stations etc.). The reason I left them a few years back is > because you couldn't get tech support unless you were a locally > known name or business. They should just be up front and say so, > IMO. > Sorry, guess that's a little OT; I thought it was informative at > first - now I"m not so sure. It shows that consumers need to be choosy about ISPs! Miss Betsy From David1 at suescornerweb.com Thu Jan 6 16:58:41 2005 From: David1 at suescornerweb.com (David 1) Date: Thu Jan 6 17:00:02 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? In-Reply-To: References: Message-ID: indigo wrote: > David 1 wrote: > >>sorry I'm not the one that started this thread, I just didn't like one >>of the answers in it so I replied so if you don't have anything to add >>how about just going to the next message & for the record I did go to >>yahell first & the person I'm answering IMO doesn't understand how it >>works when they say just go to archives it's a pet peeve of mine I >>lost a lot of stuff when yahoo did that > > > Like your snippers and the period key on your keyboard? ;-) > > yeah but I finally figured out where my enter button is now didn't I -- David 1 bad addy spamtrap@suescornerweb.com From nobody at spamcop.net Thu Jan 6 18:53:18 2005 From: nobody at spamcop.net (Pop) Date: Thu Jan 6 18:55:22 2005 Subject: [SpamCop-List] Re: Clarify SC vs. SS conflict References: Message-ID: Mike Easter wrote: >> krnic/nic.or.kr abuse contact info follows, the preceding was >> apnic >> tech/admin >> ... >> Abbreviated Received lines *comment >> from (localhost [127.0.0.1]) by blade3.usadatanet.net *serves >> you >> from blade3.usadatanet.net ([127.0.0.1]) by localhost *serves >> you >> from (mxa.usadatanet.net [69.67.254.9]) by >> blade3.usadatanet.net >> *serves you >> from (localhost [127.0.0.1]) by mxa.usadatanet.net *serves >> you >> from mxa.usadatanet.net ([127.0.0.1]) by localhost *serves >> you >> from 69.67.254.9 (unknown [220.64.215.18]) by >> mxa.usadatanet.net >> *sourceline >> from cais.com ([26.109.247.71]) by conclusive.woodland.net >> *bogusline >> >> SS can't navigate those localhost lines. SC can not only >> navigate >> the localhost lines, but also can avoid tripping and chaining >> into >> the bogusline. ... Woof! That's a LOT simpler than I was able to pull together! I came close, but ... no cigar since close doesn't count in this stuff as a rule. I got pretty lost at the "sourceline" part but have pulled it together now, I -think-. ANYway, guess I'll relegate SS back to non-spam business. Some people do foolish things when they get frustrated and I'm definitely "some people"! Don't usually get frustrated, but this was an exception for whatever reason. And it wasn't worth it . Some day maybe I'll ... learn! A Mike Easter Striker, (that's Navy talk for wanna-be) Pop From nobody at spamcop.net Thu Jan 6 15:57:58 2005 From: nobody at spamcop.net (Dar) Date: Thu Jan 6 19:00:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 References: <21ekbkifeo552jmglrb899h653@inews_id.stereo.hq.phicoh.net> Message-ID: > Mike Easter wrote: > >First, Apple is not going to lose its services because of getting > >reported to its provider. The notify address for 17.254.6.27 rDNS > >chatbox-smtp-out11.apple.com is abuse@apple.com but in the case of > >some mainsleaze straightup spam their mail is handled by a different > >mailing entity. Neither Apple nor a different mailing entity is going > >to terminate Apple's account. > > > >Second, I don't disagree that Apple should be spanked for bad mailing > >list management by getting itself listed in how many ever blocklists and > >getting its mailings interfered with to how many ever tens of thousands > >of people who want the mailing list; but remember, that 'we' tinw are > >also 'spanking' all of those people who want the mailing list at the > >same time. > > A big issue is whether Internet users can decide for themselves what kind of > e-mail filtering they want, or whether their ISPs or companies decide what > is good for them. > > When I subscribe to a mailing list, I use an unfiltered e-mail address. > Lots of people on the Internet cannot mail any of my public e-mail addresses > (because I do not accept mail from their ISPs) but I can easily use an > unfiltered e-mail address to communicate with somebody. > > If enough people fine-grained demand control over the way their e-mail is > filtered, then ISPs are likely to offer that. Agree -- positive and negative. I use generic email addresses on my clients' web sites -- info, feedback, etc, and these are all filtered. I tell them to use their personal email addresses for friends, family, clients, business cards, etc., but NEVER on the web. If they wish to purchase products or sign up for whatever, I'll provide a throw-away email address for that purpose. If the throw-away becomes corrupted, I can always kill it and create a new one. Simple. However, it's amazing the number who still don't get it. Recently, one of my clients phoned to complain about the amount of spam he was receiving to his personal account. After talking to him for a few minutes, he admitted signing up -- somewhere on the web -- for *free stuff* and perhaps that was the reason he was receiving all the spam? Dar From nobody at spamcop.net Thu Jan 6 19:02:04 2005 From: nobody at spamcop.net (Pop) Date: Thu Jan 6 19:05:02 2005 Subject: [SpamCop-List] Re: Clarify SC vs. SS conflict References: Message-ID: ... >> ... the SS >> for Windows thing, it hasn't been updated in how >> long? Thanks! I was just getting around to wondering if I'd missed out on a new version; guess not. Jeeeeeez, I just noticed the copyright date's 1999!! Holy smoke! If there isn't something more recent there, I'm round-filing it! Besides, I know how to access all the tools it goes to for me now anyway! His site's been abbreviated for the time being; maintenance, apparently - I'll check back later. Pop From nobody at spamcop.net Thu Jan 6 19:04:15 2005 From: nobody at spamcop.net (Pop) Date: Thu Jan 6 19:05:11 2005 Subject: [SpamCop-List] Re: Clarify SC vs. SS conflict References: Message-ID: it hasn't been updated in how >> long? Woof again! Version 1.14's the latest according to the History page! 1999: Jeez, was there even an INTERNET back then? < G > Pop From MikeE at ster.invalid Thu Jan 6 16:24:36 2005 From: MikeE at ster.invalid (Mike Easter) Date: Thu Jan 6 19:25:06 2005 Subject: [SpamCop-List] Re: Clarify SC vs. SS conflict References: Message-ID: Pop wrote: > I got pretty lost at the "sourceline" part but > have pulled it together now, I -think-. SC is an excellent parser teacher. I would commend it to those who want to learn parsing and deriving reporting addresses. The exercise is to parse the headers and to determine the notify addresses. Having done so, then have SC perform the parse and provide its addresses. Then the 'student' would compare hir results with SC's and decide which is better, the student's or spamcop's, and to understand why SC got the result it did. The student gets to use more tools than SC. The student gets access to whatever kind of network tools or console s/he likes, such as SS, DNSstuff, which includes lists of spam db/s. As a result, as soon as the student is skilled at parsing, s/he should be able to derive better notify addies than SC, because s/he has more tools and db/s to work with. > ANYway, guess I'll relegate SS back to non-spam business. SS is extremely useful as a tool or set of tools; just not a good automatic parser. -- Mike Easter kibitzer, not SC admin From agent01413 at my-deja.com Fri Jan 7 00:49:31 2005 From: agent01413 at my-deja.com (Socks) Date: Thu Jan 6 19:50:03 2005 Subject: [SpamCop-List] Re: Why are you blocking Yahoo Groups ??? References: Message-ID: David 1 wrote in news:crht88$kae$1 @news.spamcop.net: > sorry I'm not the one that started this thread, I just didn't like one > of the answers in it so I replied so if you don't have anything to add > how about just going to the next message & for the record I did go to > yahell first & the person I'm answering IMO doesn't understand how it > works when they say just go to archives it's a pet peeve of mine I lost > a lot of stuff when yahoo did that i'm on a dozen or so yahoo groups, own 2 and co-moderate 2 others. it seems to me i am more comfortable using all the features than you are, so maybe it is you rather than me who dont understand how it works. From nobody at spamcop.net Thu Jan 6 20:23:29 2005 From: nobody at spamcop.net (Pop) Date: Thu Jan 6 20:25:03 2005 Subject: [SpamCop-List] OT: PING DAVID 1 re messages Message-ID: David 1, I have now received two at-first-appearing irrelevant emails from you at one of my personal email addresses, which, by the way, is essentially a spamtrap, and mostly unused nowadays. --------------------------- The first one is here: http://www.spamcop.net/sc?id=z710098164zeb408c19647b1adf2403720d26741711z which was just a referral to your su...er site, but quoted part of a post I made to SC. --------------------------------- The second one is here: http://www.spamcop.net/sc?id=z710097799za67a97cc4c047f29772a24d5b6bef2cez which consisted of: ----------- "Ok, I checked my old records & didn't find them did a google & the closest I ot out of the first 200 entries was Distance Learning, Online Education, University Of Phoenix Online *...* link exchange program | about us Warning: main(/home/rchang/links/php/links.php): failed to open stream: No such file or directory in /home/*befast*/edu/tt101 *...* www.tech-technical-institute-101.com/ - Cached - Similar pages " ------------------------------------- I found it interesting that the two auto-parses (not sent, Cancelled) resulted in two different sets of carriers in the SC listing. You can see it at the parse references above. Maybe it was just the mood of the 'net at the time. As you can see, Spampal is also picking you up on blocklists. The second one has an unmodified Subject line, exactly as my system presented it to me. Don't recall whether I removed the Spam Pal entry on the first one or not. To make matters worse, I almost did report the second one. It wasn't until the last moment that I noticed something in the text that made it look applicable to anything I'd said. Since I don't normally read spam bodies, it's only because I recognized the David 1 in the From that I caught it. It is VERY unusual for me to remember newsgroup poster's names. If I initially screwed up and sent something to your personal email address, I apologize because I never meant to. IMO, you should not use a real address in any newsgroup. Nobody@spamcop.net is still a good one, last I knew. Thus, to prevent further mailings I am using the group to address you. I will, again, remove your address from my address book. Please, let's only communicate via the groups and if you DO decide to communicate directly, be certain to make it very obvious very early in the mail that will tell me it's not spam. The first email I suspect was a screwup on my part by hitting the wrong button. However, the second mail from you appears to be a response I wasn't expecting in my mail box. I feel pretty sure you are "innocent" of any intentional wrongdoing, and that I may have compounded the problem, and thus I am giving you wide latitude, and begging the forgiveness of the rest of the group for wasting bandwidth on a pretty much OT subject. My real objections, since I do feel fairly sure you're OK to correspond with, is that if I do continue to communicate with you by email, then most anyone could pose as you and try to trick me into responding to them from my personal addresses. As in, a spammer who wants to do me bad. Besides, by communicating off-group, we deprive others of possibly meaningful data since I think you were commenting on the bfast relationship, though it was pretty confusing. So, please remove my address from your address book if it was entered there automatically or manually. I will do the same at my end. Regards, Pop From nobody at devnull.spamcop.net Fri Jan 7 10:34:53 2005 From: nobody at devnull.spamcop.net (Patto) Date: Thu Jan 6 20:35:03 2005 Subject: [SpamCop-List] Re: Error: couldn't parse head In-Reply-To: References: Message-ID: Steven Maesslein wrote: > On Thu, 06 Jan 2005 16:17:06 +0900, Patto coughed into spamcop and left > this in : > > >>But without a solution (except to buy yet another product...). > > > Buy? > > There are plenty of open-source MTAs available on the 'Net for zero > cost. Furthermore, most of them actually respect long-established > standards, such as RFC822 for example. There was a link to SpamSource: USD 20. I have already bought SpamDeputy (years ago), but I don't use it any more. I am currently using the free OLSpamCop, but that doesn't go as far as removing Microsoft-added "headers". What would you recommend for my case? From nobody at spamcop.net Thu Jan 6 18:01:05 2005 From: nobody at spamcop.net (NerdRevenge) Date: Thu Jan 6 20:55:03 2005 Subject: [SpamCop-List] Internal spamcop handling = PAY US AND NOT GET LISTED? Message-ID: I must have reported this guy for spamming yahoo groups 50 times in the past few months. Abuse complaints go to: 219.95.60.157 abuse@tm.net.my Internal spamcop handling: (yahoo) I have had others report this spammer also, but nothing happens. I guess this means Yahoo likes people spamming their groups and pays SC a stipend for not being listed. Yahoo is helping to facilitate this spammer by broadcasting his spam to thousands of people with one single email he sends. http://www.spamcop.net/sc?id=z710107704zde0cd780e325a67d40c6dd84ad94f569z -- "That intellectual torpor maybe sufficient to earn a job at some disaster prone part of the world like Chernobyl or NASA, but it won't cut the mustard with me." - Professor Maximillian Arturo From MikeE at ster.invalid Thu Jan 6 17:57:16 2005 From: MikeE at ster.invalid (Mike Easter) Date: Thu Jan 6 21:00:03 2005 Subject: [SpamCop-List] Re: Error: couldn't parse head References: Message-ID: Patto wrote: > I am currently using the free OLSpamCop, but that doesn't go as > far as removing Microsoft-added "headers". > > What would you recommend for my case? I'm guessing you mean Leon Mayne's gizmo that used to be at http://www.olspamcop.org/ [which is currently offline]. He has a webspace here http://www.uea.ac.uk/~l003/ that still points there. It seems like that tool would be able to do something 'simple' like removing that line. I seem to recall that it had a Basic macro functionality to it, didn't it? -- Mike Easter kibitzer, not SC admin From notspam at alias.hotpop.com Thu Jan 6 19:02:56 2005 From: notspam at alias.hotpop.com (JV) Date: Thu Jan 6 21:05:03 2005 Subject: [SpamCop-List] Re: dispute listing of ip 17.254.6.27 In-Reply-To: References: <8G4c$yztKCRS@eisner.encompasserve.org> Message-ID: Mike Easter wrote: > Mike Easter wrote: > >>Suppose that all spam could be put into two classes... > > >> - that which is full of bogosity > > >> - that which is straightup, > > >>Suppose also that all spam recipients could be put into two classes >> >> - rabid antispammers > > >> - just hit deleters, > > >>So, one argument is that if you could distinguish the two classes of >>spammers, and you were the latter type of recipient, > > > Naturally, I'm a person who believes that there is no black and white, > but just one big grayzone which merges indistinguishably from one > extreme to the other. > > In the case of the 'masses' out there which is some shades of gray, > variable grayshades, the average shade is much more like the JHD than > like the rabid anti-. > > When anti-/s get together and commiserate about how it ought to be, they > are not only a minority, but they are also going up against important > interests; legislative, DMA, and mainsleaze commercial and political, > who want email marketing to have a great deal of latitude, because it is > a very valuable medium. > > Healthy email marketing is good. The vast majority of spam is very bad. > The current average shade of gray of spam is very black. > > Love the term "bogosity", it should be added to Websters Dictionary. Much of what you seem to intend to say is good. Exhaustion? From David1 at suescornerweb.com Thu Jan 6 21:22:25 2005 From: David1 at suescornerweb.com (David 1) Date: Thu Jan 6 21:25:09 2005 Subject: [SpamCop-List] Re: OT: PING DAVID 1 re messages In-Reply-To: References: Message-ID: Pop wrote: > David 1, > I have now received two at-first-appearing irrelevant emails from > you at one of my personal email addresses, which, by the way, is > essentially a spamtrap, and mostly unused nowadays. > --------------------------- > The first one is here: > http://www.spamcop.net/sc?id=z710098164zeb408c19647b1adf2403720d26741711z > which was just a referral to your su...er site, but quoted part > of a post I made to SC. > --------------------------------- > The second one is here: > http://www.spamcop.net/sc?id=z710097799za67a97cc4c047f29772a24d5b6bef2cez > which consisted of: > ----------- > "Ok, I checked my old records & didn't find them did a google & > the > closest I ot out of the first 200 entries was > Distance Learning, Online Education, University Of Phoenix Online > *...* link exchange > program | about us Warning: > main(/home/rchang/links/php/links.php): > failed to open stream: No such file or directory in > /home/*befast*/edu/tt101 *...* > www.tech-technical-institute-101.com/ - Cached > > - Similar pages > " > ------------------------------------- > > I found it interesting that the two auto-parses (not sent, > Cancelled) resulted in two different sets of carriers in the SC > listing. You can see it at the parse references above. Maybe it > was just the mood of the 'net at the time. > As you can see, Spampal is also picking you up on > blocklists. The second one has an unmodified Subject line, > exactly as my system presented it to me. Don't recall whether I > removed the Spam Pal entry on the first one or not. > To make matters worse, I almost did report the second one. It > wasn't until the last moment that I noticed something in the text > that made it look applicable to anything I'd said. Since I don't > normally read spam bodies, it's only because I recognized the > David 1 in the From that I caught it. It is VERY unusual for me > to remember newsgroup poster's names. > If I initially screwed up and sent something to your personal > email address, I apologize because I never meant to. IMO, you > should not use a real address in any newsgroup. > Nobody@spamcop.net is still a good one, last I knew. > Thus, to prevent further mailings I am using the group to > address you. I will, again, remove your address from my address > book. Please, let's only communicate via the groups and if you > DO decide to communicate directly, be certain to make it very > obvious very early in the mail that will tell me it's not spam. > The first email I suspect was a screwup on my part by hitting > the wrong button. However, the second mail from you appears to > be a response I wasn't expecting in my mail box. > > I feel pretty sure you are "innocent" of any intentional > wrongdoing, and that I may have compounded the problem, and thus > I am giving you wide latitude, and begging the forgiveness of the > rest of the group for wasting bandwidth on a pretty much OT > subject. > My real objections, since I do feel fairly sure you're OK to > correspond with, is that if I do continue to communicate with you > by email, then most anyone could pose as you and try to trick me > into responding to them from my personal addresses. As in, a > spammer who wants to do me bad. Besides, by communicating > off-group, we deprive others of possibly meaningful data since I > think you were commenting on the bfast relationship, though it > was pretty confusing. > > So, please remove my address from your address book if it was > entered there automatically or manually. I will do the same at > my end. > > Regards, > > Pop > > > see s.spam for the message I replied to guess I should be thankful for the "wide latitude" You know this is BS I answered the damn message, did the search since I couldn't remember my facts at what I thought was your request trying to help excuse the hell out of me YES I know better then to email off line with out asking first I thought I proved that when I asked mike a little while ago. I use my real addy because I dont' hide behind nothing I never want to have to hide again but that's for another group. Gee had you written me in private I could have sent the message to you in an attachment so that you could see it. Like I said before I've given up on who's who around here & maybe it's just ime I left & hopefully someone around this place will help if ever I do have a problem I know one thing I"m tired of getting jumped around here, sorry folks I never claimed to know anything, I just came to see what was going on. Sre hope you can take the headers I"m leaving & burn the person that started this which is the person that sent me the note NOT me for the record. -- David 1 bad addy spamtrap@suescornerweb.com From notspam at alias.hotpop.com Thu Jan 6 19:29:39 2005 From: notspam at alias.hotpop.com (JV) Date: Thu Jan 6 21:30:05 2005 Subject: [SpamCop-List] Re: Reporting virms may not be such a great idea... In-Reply-To: References: <41DBFE2B.6080105@spamcop.net> Message-ID: Pop wrote: > ... > >>>IOW, like drivers on roads, internet users should have a basic >>>understanding of the rules of the roads. At this point, >>>internet >>>users need to direct their anger at their ISPs when things go >>>wrong >>>so that there are more responsible ISPs. >>> >>>Miss Betsy > > > Amen to that! I had already left them, but there is one ISP in > this area that will drop people's accounts if they complain too > much! I've seen one of their shutdown notices and they're not at > all polite. They're not a spam friendly ISP either; in fact, I > suspect their main income is from local businesses (TV, radio > stations etc.). The reason I left them a few years back is > because you couldn't get tech support unless you were a locally > known name or business. They should just be up front and say so, > IMO. > Sorry, guess that's a little OT; I thought it was informative at > first - now I"m not so sure. > Pop > > Consider this... If I send a light weight comment or complaint to my ISP, I get a response. If it's a possible legal complaint then there is no response at all. ISP's and their tech support are so legally cognizant that customers get little or no support for what may be a minor issue. If it looks bad, nothing. From ric.gates at bigsleep.org Fri Jan 7 02:29:48 2005 From: ric.gates at bigsleep.org (Blammo) Date: Thu Jan 6 21:30:15 2005 Subject: [SpamCop-List] Re: Reporting virms may not be such a great idea... References: <41DBFE2B.6080105@spamcop.net> Message-ID: On 05 Jan 2005 Hans Salvisberg entered spamcop and left news:crij20$2gt$1@news.spamcop.net: > Blammo wrote: >> On 05 Jan 2005 Hans Salvisberg entered spamcop and left >> news:41DBFE2B.6080105@spamcop.net: >> >> >>>I have an ADLS connection that is reset every 24 hours (to force me >>>to pay more to get a static IP if I want to run servers), and the >>>days where I find myself (or other innocent people) blacklisted are >>>becoming more common. >>> >> >> >> I already see such IPs get tagged because the mail server checks the >> actual source IP even when it's sent through a valid MX server. For >> example CMU Sieve on Cyrus does this. Possibly just bad >> configuration, I don't know. > > Here are the headers I got just now sending an email through my ISP > (Bluewin) to SpamCop: > > Received: from unknown (192.168.1.101) > by blade5.cesmail.net with QMQP; 6 Jan 2005 05:17:36 -0000 > Received: from mail5.bluewin.ch (195.186.1.207) > by mailgate.cesmail.net with SMTP; 6 Jan 2005 05:17:36 -0000 > Received: from [192.168.123.200] (81.62.72.252) by mail5.bluewin.ch > (Bluewin AG 7.0.035) > > 81.62.72.252 is the current dynamic IP assigned to my ADSL NAT Router, > and I do SMTP to one of Bluewin's SMTP servers (here > mail5.bluewin.ch). What I see is that IPs like 81.62.72.252 get > blacklisted, and when I inherit a blacklisted one, then my emails get > flagged as spam. > > Is that a "bad configuration"? > Right, well not bad configuration but the spam filter should ignore (81.62.72.252) if it's the first (bottom) received header. In my opinion if you are sending through your ISP mail5.bluewin.ch then then you are "probably" not spamming. But if you bypassed mail5.bluewin.ch then (81.62.72.252) should be checked. A virus (or spam) would probably bypass mail5.bluewin.ch and connect directly to mailgate.cesmail.net. -- | Ric | From MikeE at ster.invalid Thu Jan 6 18:37:05 2005 From: MikeE at ster.invalid (Mike Easter) Date: Thu Jan 6 21:40:03 2005 Subject: [SpamCop-List] Re: Internal spamcop handling = PAY US AND NOT GET LISTED? References: Message-ID: NerdRevenge wrote: > I must have reported this guy for spamming yahoo groups 50 times in > the past few months. www.spamcop.net/sc?id=z710107704zde0cd780e325a67d40c6dd84ad94f569z > Abuse complaints go to: > > 219.95.60.157 > abuse@tm.net.my > Internal spamcop handling: (yahoo) It seems that there would be many ways to report spamming in yahoo groups. In this case, the provider for the IP source is the .my Telekom Malaysia Berhad which has 3 abuse.net reg'd addies, the one above apparently bounces the least, but the other two are postmaster@tm.net.my & tmcops@tm.net.my - which sometimes bounce and sometimes work. > I have had others report this spammer also, but nothing happens. You could also report the apparent yahoo webmail sender/user to yahoo and to the group master. I would assume the yahoo addy has to be good to use the webmailer to spam: gdlooking_guy@yahoo.com Yahoo's abuse addy is mail-abuse@yahoo-inc.com & postmaster@yahoo.com and the group master is kevins_story-owner@yahoogroups.com -- Mike Easter kibitzer, not SC admin From ric.gates at bigsleep.org Fri Jan 7 02:37:36 2005 From: ric.gates at bigsleep.org (Blammo) Date: Thu Jan 6 21:40:12 2005 Subject: [SpamCop-List] Re: Manual Reporting Page References: Message-ID: On 06 Jan 2005 Pop entered spamcop and left news:crjnup$ndt$1@news.spamcop.net: > Huh! That didn't fix it, but it DID get a different too-old > report in there . Strraaange! > I did discover however that if I turn off Show Tech Details, it > doesn't show IFF I'm doing manual reporting. For email reports > now though, it's still there. Maybe I need to let it cogitate > for awhile; I'll try it again tomorrow when I do the spam. I > turned off the Show Details thing and left it off; I'll see if > that makes a difference in email reporting tomorrow. Maybe > there's more than one "stuck" in there. This "new" one's worse > than the other one! It's got a report to list a mile long ;-[! > Yes, try it again, you may have several stuck in there. If it still gives you trouble then you probably need to get someone at Spamcop to clear it out. -- | Ric | From ric.gates at bigsleep.org Fri Jan 7 02:46:11 2005 From: ric.gates at bigsleep.org (Blammo) Date: Thu Jan 6 21:50:03 2005 Subject: [SpamCop-List] Re: Internal spamcop handling = PAY US AND NOT GET LISTED? References: Message-ID: On 06 Jan 2005 NerdRevenge entered spamcop and left news:crkq41$dsh$1@news.spamcop.net: > 219.95.60.157 > abuse@tm.net.my > Internal spamcop handling: (yahoo) > > I have had others report this spammer also, but nothing happens. > I get the impression that Yahoo doesn't give a shit. I was reporting 10 a day of the same spam and nothing ever happened as far as I can tell. Sometimes it seems like the more I report, the more they send. There was one that I would get every few days and report them all, sometimes I would get two at the same time, now I'll get 4 all at exactly the same time - the messages are all exactly the same but the received time is slightly different. -- | Ric | From nobody at spamcop.net Thu Jan 6 18:54:43 2005 From: nobody at spamcop.net (NerdRevenge) Date: Thu Jan 6 21:50:10 2005 Subject: [SpamCop-List] Re: Internal spamcop handling = PAY US AND NOT GET LISTED? References: Message-ID: "Mike Easter" wrote in message news:crkshv$fq6$1@news.spamcop.net... > NerdRevenge wrote: >> I must have reported this guy for spamming yahoo groups 50 times in >> the past few months. > www.spamcop.net/sc?id=z710107704zde0cd780e325a67d40c6dd84ad94f569z > >> Abuse complaints go to: >> >> 219.95.60.157 >> abuse@tm.net.my >> Internal spamcop handling: (yahoo) > > It seems that there would be many ways to report spamming in yahoo > groups. > > In this case, the provider for the IP source is the .my Telekom Malaysia > Berhad which has 3 abuse.net reg'd addies, the one above apparently > bounces the least, but the other two are postmaster@tm.net.my & > tmcops@tm.net.my - which sometimes bounce and sometimes work. > >> I have had others report this spammer also, but nothing happens. > > You could also report the apparent yahoo webmail sender/user to yahoo > and to the group master. > > I would assume the yahoo addy has to be good to use the webmailer to > spam: gdlooking_guy@yahoo.com Yahoo's abuse addy is > mail-abuse@yahoo-inc.com & postmaster@yahoo.com and the group master > is kevins_story-owner@yahoogroups.com > I have done this before. The problem with this particular group is that the owner vanished 2 years ago. Yahoo will not appoint a new owner. Yahoo refuses to take action against this user or admit a problem exists.. This group is not the only one he uses to propagate his spam. I would estimate that his spam is sent to 20 other groups at the same time as the mail headers lists the groups he sends to. That is why I said thousands of users get spammed with only a single email. I must them assume SC is on the side of yahoo and maybe benefits in the form of some of economic gain. Nerd > > -- > Mike Easter > kibitzer, not SC admin > From nobody at spamcop.net Thu Jan 6 19:00:30 2005 From: nobody at spamcop.net (NerdRevenge) Date: Thu Jan 6 21:55:03 2005 Subject: [SpamCop-List] Re: Internal spamcop handling = PAY US AND NOT GET LISTED? References: Message-ID: "Blammo" wrote in message news:Xns95D6BEFD4A666blammo@216.154.195.61... > On 06 Jan 2005 NerdRevenge entered spamcop and left > news:crkq41$dsh$1@news.spamcop.net: > >> 219.95.60.157 >> abuse@tm.net.my >> Internal spamcop handling: (yahoo) >> >> I have had others report this spammer also, but nothing happens. >> > > I get the impression that Yahoo doesn't give a shit. I was reporting 10 a > day of the same spam and nothing ever happened as far as I can tell. So sad. Maybe they will get the hint if we flood all their contact inboxes with complaints. Yahoo must be paying off spamcop to not get listed. > Sometimes it seems like the more I report, the more they send. There was > one that I would get every few days and report them all, sometimes I would > get two at the same time, now I'll get 4 all at exactly the same time - > the > messages are all exactly the same but the received time is slightly > different. > > -- > | Ric > | From nobody at devnull.spamcop.net Fri Jan 7 12:01:02 2005 From: nobody at devnull.spamcop.net (Patto) Date: Thu Jan 6 22:05:03 2005 Subject: [SpamCop-List] Re: Error: couldn't parse head In-Reply-To: References: Message-ID: Mike Easter wrote: > Patto wrote: > >>I am currently using the free OLSpamCop, but that doesn't go as >>far as removing Microsoft-added "headers". >> >>What would you recommend for my case? > > > I'm guessing you mean Leon Mayne's gizmo that used to be at > http://www.olspamcop.org/ [which is currently offline]. He has a > webspace here http://www.uea.ac.uk/~l003/ that still points there. > > It seems like that tool would be able to do something 'simple' like > removing that line. I seem to recall that it had a Basic macro > functionality to it, didn't it? Yes, http://www.olspamcop.org/ is currently offline. I think the macro stuff has been removed for version 3. A new beta version is currently being tested; I may ask Leon if he'd consider removing that Microsoft stuff. From MikeE at ster.invalid Thu Jan 6 19:13:45 2005 From: MikeE at ster.invalid (Mike Easter) Date: Thu Jan 6 22:15:04 2005 Subject: [SpamCop-List] Re: Internal spamcop handling = PAY US AND NOT GET LISTED? References: Message-ID: NerdRevenge wrote: > Yahoo must be paying off spamcop to not get listed. There isn't anything about reporting that particular spam which would contribute to the SC blocklist. The blocklist is based on reports from reporters or spamtraps which are parsed for the spamsource. That spamsource, in this case the .my provider, not yahoo, scores a count toward being listed. The listing process itself is 'algorithmic' -- based on the 'mathematics' described here http://www.spamcop.net/fom-serve/cache/297.html What is the SpamCop Blocking List (SCBL)? The other reporting which would come out of that notify would be the websites, which do /not/ contribute to the blocklist. The notification for that would be the internal handling of SC to yahoo and the devnull/ed notify about the www.veenaimovies.com spamvertisement, because those notifies bounce. Your repetitive remarks about yahoo paying off spamcop to not get listed indicate that you don't have a good understanding of how the SC blocklisting process works, and also that you haven't looked around the newsgroups to see the complaints about SC listing the yahoo mail servers in the newsgroup subject "Why are you blocking Yahoo Groups ???" -- Mike Easter kibitzer, not SC admin From nobody at devnull.spamcop.net Fri Jan 7 12:13:37 2005 From: nobody at devnull.spamcop.net (Patto) Date: Thu Jan 6 22:15:20 2005 Subject: [SpamCop-List] Re: Internal spamcop handling = PAY US AND NOT GET LISTED? In-Reply-To: References: Message-ID: NerdRevenge wrote: > I must have reported this guy for spamming yahoo groups 50 times in the past > few months. > > Abuse complaints go to: > > 219.95.60.157 > abuse@tm.net.my > Internal spamcop handling: (yahoo) > > I have had others report this spammer also, but nothing happens. > ... I am not a great friend of Yahoo, but I have experienced that they act pretty quickly when reporting via http://add.yahoo.com/fast/help/abuse/cgi_abuse (chat, groups, geocities, etc.) or http://add.yahoo.com/fast/help/us/mail/cgi_spam_intl (yahoo.com, yahoo.co.uk, etc.) From MikeE at ster.invalid Thu Jan 6 19:23:31 2005 From: MikeE at ster.invalid (Mike Easter) Date: Thu Jan 6 22:25:02 2005 Subject: [SpamCop-List] Re: Internal spamcop handling = PAY US AND NOT GET LISTED? References: Message-ID: Mike Easter wrote: > NerdRevenge wrote: >> Yahoo must be paying off spamcop to not get listed. > > There isn't anything about reporting that particular spam which would > contribute to the SC blocklist. IMTS - I meant to say - There isn't anything about reporting that particular spam which would contribute anything /yahoo/ to the SC blocklist. The parser is designed to determine the source of the spam, not the webmailer it came thru'. However, if I would manually report something like that, I would report the yahoo user as described in the previous post. The fact that some yahoo links appear in the body don't make for SC blocklisting. -- Mike Easter kibitzer, not SC admin From drd at coastlandtech.com Thu Jan 6 22:33:00 2005 From: drd at coastlandtech.com (drd) Date: Thu Jan 6 22:35:04 2005 Subject: [SpamCop-List] Spamcop is not listen to it users so, so-long Spancop - Hello Spamhaus Message-ID: I am an ISP and I have been using Spamcop to filter email on my web servers. I have like the blocking it has been doing, and have been supporting it. It has been blocking thousand of message a day. When I found out what was going on, I couldn't believe it. So I start checking, and Yep, Spamcop is blocking Yahoo groups. I have customers, who are very upset over this, then I looked at this news group and all of the message and it seems like no action is going to be taken. Well I am sorry to have to do this, but I can't support a product that doesn't respond to the complaints. So I will be looking into changing to a different black listing. At this point is looks like Spamhaus. The reason I am saying this, and posting this message is I like Spamcop and I hate to have to change. But if Spamcop doesn't start doing better then more and more will do what I am going to do, leave and this could be the start of the end. I know I going to get flamed over this post, and that too is sad, I and trying to be constructive here and let the people here know that Spamcop should be more concerned about what the users are complaining about, not just saying 'it up to you ISP' or whitelist them.. Don From nobody at spamcop.net Thu Jan 6 19:42:37 2005 From: nobody at spamcop.net (NerdRevenge) Date: Thu Jan 6 22:40:03 2005 Subject: [SpamCop-List] Re: Internal spamcop handling = PAY US AND NOT GET LISTED? References: Message-ID: "Mike Easter" wrote in message news:crkv90$i66$1@news.spamcop.net... > Mike Easter wrote: >> NerdRevenge wrote: >>> Yahoo must be paying off spamcop to not get listed. >> >> There isn't anything about reporting that particular spam which would >> contribute to the SC blocklist. > > IMTS - I meant to say - There isn't anything about reporting that > particular spam which would contribute anything /yahoo/ to the SC > blocklist. The parser is designed to determine the source of the spam, > not the webmailer it came thru'. > > However, if I would manually report something like that, I would report > the yahoo user as described in the previous post. > > The fact that some yahoo links appear in the body don't make for SC > blocklisting. > Its not a yahoo link. The email may have originated from Maylasia however YAHOO is rebroadcasting that spammers email to thousands of others via its groups users mailing lists There should be some liability on the part of yahoo for facilitating that spam I still stand by my assertions that Yahoo is paying off SC. Nerd > > -- > Mike Easter > kibitzer, not SC admin > From nobody at spamcop.net Thu Jan 6 19:43:12 2005 From: nobody at spamcop.net (NerdRevenge) Date: Thu Jan 6 22:40:12 2005 Subject: [SpamCop-List] Re: Internal spamcop handling = PAY US AND NOT GET LISTED? References: Message-ID: "Patto" wrote in message news:crkup2$hjk$1@news.spamcop.net... > NerdRevenge wrote: >> I must have reported this guy for spamming yahoo groups 50 times in the >> past few months. >> >> Abuse complaints go to: >> >> 219.95.60.157 >> abuse@tm.net.my >> Internal spamcop handling: (yahoo) >> >> I have had others report this spammer also, but nothing happens. >> ... > > I am not a great friend of Yahoo, but I have experienced that they act > pretty quickly when reporting via > http://add.yahoo.com/fast/help/abuse/cgi_abuse (chat, groups, geocities, > etc.) or http://add.yahoo.com/fast/help/us/mail/cgi_spam_intl (yahoo.com, > yahoo.co.uk, etc.) See my reply to Blammo Nerd From nobody at spamcop.net Thu Jan 6 19:46:51 2005 From: nobody at spamcop.net (NerdRevenge) Date: Thu Jan 6 22:45:03 2005 Subject: [SpamCop-List] Re: Spamcop is not listen to it users so, so-long Spancop - Hello Spamhaus References: Message-ID: "drd" wrote in message news:crkvtf$ijk$1@news.spamcop.net... >I am an ISP and I have been using Spamcop to filter email on my web >servers. I have like the blocking it has been doing, and have been >supporting it. It has been blocking thousand of message a day. When I found >out what was going on, I couldn't believe it. So I start checking, and Yep, >Spamcop is blocking Yahoo groups. I have customers, who are very upset over >this, then I looked at this news group and all of the message and it seems >like no action is going to be taken. I wish it was true, but I still get spam from yahoo groups. I think SC has it own white list (those who pay) > > > > Well I am sorry to have to do this, but I can't support a product that > doesn't respond to the complaints. So I will be looking into changing to > a different black listing. At this point is looks like Spamhaus. The > reason I am saying this, and posting this message is I like Spamcop and I > hate to have to change. But if Spamcop doesn't start doing better then > more and more will do what I am going to do, leave and this could be the > start of the end. I know I going to get flamed over this post, and that > too is sad, I and trying to be constructive here and let the people here > know that Spamcop should be more concerned about what the users are > complaining about, not just saying 'it up to you ISP' or whitelist them.. > > > > Don > From MikeE at ster.invalid Thu Jan 6 19:47:39 2005 From: MikeE at ster.invalid (Mike Easter) Date: Thu Jan 6 22:50:03 2005 Subject: [SpamCop-List] Re: Spamcop is not listen to it users so, so-long Spancop - Hello Spamhaus References: Message-ID: drd wrote: > I am an ISP and I have been using Spamcop to filter email on my web > servers. You should be careful about how you do that. SC is a very frisky and dynamic blocklist that runs on 'autopilot' for early detection of spamsources and also automatic delisting. SC's mail clients don't lose their yahoo group mails even when the yahoo servers are SC listed, they are simply tagged. > Spamcop should be more concerned about what > the users are complaining about, not just saying 'it up to you ISP' > or whitelist them.. A blocklist is simply a blocklist working as the blocklist is designed with the resultant 'good and bad' effects. A server doing spamfiltering has to figure out how he is going to use blocklists and other filtering strategies for the best results. Here are some snippages from the faq at http://www.spamcop.net/fom-serve/cache/297.html The SCBL is an aggressive spam-fighting tool. By using this list, you can block a lot of spam, but you also may block or filter wanted email. Because of this limitation, one should strongly consider using the SCBL