SPAMCOP HOME · SPAMCOP FAQ · NEWSGROUPS · FORUM FAQ · WEBMAIL · SSL WEBMAIL · SPAMCOPWIKI


 Other words, data, places -->  SpamCop Pages V  FAQs & Words V  Newsgroups V  WebMail V  News-Recent Stuff V   Poll on menu

------>------> Latest and Current Announcements <------<------

Welcome Guest ( Log In | Register )

> This is a User to User Support Forum

The primary mode of support here is peer-to-peer, meaning users helping other users. (please remember this at all times!)
Another try:
This forum is composed of people who have used spamcop and those who are learning about anti-spam efforts.

 
Reply to this topicStart new topic
> Why arn't these links reported (e5t8.com )?
moreofless
post Feb 29 2012, 04:44 PM
Post #1


Member
**

Group: Members
Posts: 31
Joined: 29-February 12
Member No.: 10580



http://beasleydirect.e5t8.com/link/t/1617_...3903d42a/h/1510

http://resourcenation.e5t8.com/link/t/1745...3903d42a/h/1618

http://technologywhitepapers.e5t8.com/link...3903d42a/h/1630

All of them are part of e5t8.com
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
turetzsr
post Feb 29 2012, 06:08 PM
Post #2


What Life?
Group Icon

Group: Membersph
Posts: 5135
Joined: 26-January 04
From: Michigan USA
Member No.: 59



Hi, moreofless,
...In order to help you, I am afraid we are going to need to see the Tracking URL, as described in the article "How-to Post a Question - Short" section labeled "The Details." This will allow us to see what the links looked like to the SpamCop parser, which determines whether and to whom to report links.
...Also highly recommended for your review is the SpamCop Forum (to which there are links near the top left of every SpamCop Forum page) article "SpamCop reporting of spamvertized sites - some philosophy."


--------------------
..Regards,
...Steve T

...A Happy SpamCop.net reporting user (not an employee)
...Please avoid replying via e-mail, as it is not secure
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
moreofless
post Mar 1 2012, 04:28 PM
Post #3


Member
**

Group: Members
Posts: 31
Joined: 29-February 12
Member No.: 10580



Here is the tracking URL of the latest version of this spam:

http://www.spamcop.net/sc?id=z5268705920z1...828567b030bd00z
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
turetzsr
post Mar 1 2012, 05:14 PM
Post #4


What Life?
Group Icon

Group: Membersph
Posts: 5135
Joined: 26-January 04
From: Michigan USA
Member No.: 59



Hi, moreofless,
...Thank you for the Tracking URL.
...Here is what I see there that seems relevant:
CODE
Resolving link obfuscation
http://technologywhitepapers.e5t8.com/remo...3903d42a#nowrap
http://technologywhitepapers.e5t8.com/link...3903d42a/h/1631


Tracking link: http://technologywhitepapers.e5t8.com/remo...3903d42a#nowrap
No recent reports, no history available
Resolves to 74.217.151.81
Routing details for 74.217.151.81
[refresh/show] Cached whois for 74.217.151.81 : abuse[at]internap.com
Using abuse net on abuse[at]internap.com
abuse net internap.com = noc[at]internap.com
Using best contacts noc[at]internap.com
Reports disabled for noc[at]internap.com

Using noc#internap.com[at]devnull.spamcop.net for statistical tracking.

Tracking link: http://technologywhitepapers.e5t8.com/link...3903d42a/h/1631
No recent reports, no history available
Resolves to 74.217.151.81
Routing details for 74.217.151.81
[refresh/show] Cached whois for 74.217.151.81 : abuse[at]internap.com
Using abuse net on abuse[at]internap.com
abuse net internap.com = noc[at]internap.com
Using best contacts noc[at]internap.com
Reports disabled for noc[at]internap.com

Using noc#internap.com[at]devnull.spamcop.net for statistical tracking.
...Does my pointing to this specific section help (note, especially, the lines that start with "Reports disabled for ...") or do you still have questions?


--------------------
..Regards,
...Steve T

...A Happy SpamCop.net reporting user (not an employee)
...Please avoid replying via e-mail, as it is not secure
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
moreofless
post Mar 1 2012, 06:33 PM
Post #5


Member
**

Group: Members
Posts: 31
Joined: 29-February 12
Member No.: 10580



Actually I am not a technical person. Can you translate this into English?

Is the organization hosting the files being referenced in the spam being made aware of that?

For example, I have received a bunch of emails that are clearly PHISHING in nature. These messages refer to an email address where the receiver is instructed to send information so the sender can steal from them. Spamcop deals with the sender but not the "reply to" address listed in the fake job description. I reported these email addresses to the host of those email accounts and those domains were closed. spam and PHISHING messages have little value if the websites and email addresses are closed.
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
turetzsr
post Mar 1 2012, 11:45 PM
Post #6


What Life?
Group Icon

Group: Membersph
Posts: 5135
Joined: 26-January 04
From: Michigan USA
Member No.: 59



QUOTE(moreofless @ Mar 1 2012, 06:33 PM) *
Actually I am not a technical person. Can you translate this into English?
...Well, I'm not the world's most technical person, either, but here is how I'd interpret it (with respect to the first link the SpamCop parser found, http:/ /technologywhitepapers.e5t8.com/remo...3903d42a#nowrap):
QUOTE
This indicates that SpamCop sees the link in the spam body.
QUOTE
No recent reports, no history available
SpamCop checked its recent archive of reports and did not find a reference with this link.
QUOTE
Resolves to 74.217.151.81
SpamCop looked up technologywhitepapers.e5t8.com in a translation table and found that the IP address for that domain is 74.217.151.81.
QUOTE
Routing details for 74.217.151.81
[refresh/show] Cached whois for 74.217.151.81 : abuse[at]internap.com
SpamCop looked up the e-mail address to which internet abuse, such as spam, should be reported for that IP address and discovered that the abuse e-mail address is abuse[at]internap.com.
QUOTE
Using abuse net on abuse[at]internap.com
abuse net internap.com = noc[at]internap.com
SpamCop looked up the abuse e-mail address to see if that is really the correct place to send a complaint and found that instead it should check for noc[at]internap.com.
QUOTE
Using best contacts noc[at]internap.com
SpamCop is going to look for the best e-mail address to use to contact noc[at]internap.com.
QUOTE
Reports disabled for noc[at]internap.com
SpamCop found a flag that indicates that for some reason it can not or should not report abuse to noc[at]internap.com. This might be for any of a number of reasons, for example because previous reports sent to noc[at]internap.com bounced with an error message or because someone at internap.com asked that reports not be sent.
QUOTE
Using noc#internap.com[at]devnull.spamcop.net for statistical tracking.
For future reference and for calculating the incidence of spamvertized links mentioning technologywhitepapers.e5t8.com, for whatever use it might make of such statistics, it is storing the information under the heading of "noc#internap.com[at]devnull.spamcop.net."
QUOTE(moreofless @ Mar 1 2012, 06:33 PM) *
Is the organization hosting the files being referenced in the spam being made aware of that?
...Presumably not, because of the "Reports disabled for noc[at]internap.com" note.

QUOTE(moreofless @ Mar 1 2012, 06:33 PM) *
For example, I have received a bunch of emails that are clearly PHISHING in nature. These messages refer to an email address where the receiver is instructed to send information so the sender can steal from them. Spamcop deals with the sender but not the "reply to" address listed in the fake job description. I reported these email addresses to the host of those email accounts and those domains were closed. spam and PHISHING messages have little value if the websites and email addresses are closed.
...As far as I can see, you are correct and have done the right thing in reporting the abuse to the host of the "reply-to" e-mail accounts. For what it's worth, I do the same thing for many of the spams I see, especially "419" scams.


--------------------
..Regards,
...Steve T

...A Happy SpamCop.net reporting user (not an employee)
...Please avoid replying via e-mail, as it is not secure
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Farelf
post Mar 1 2012, 11:54 PM
Post #7


What Life?
Group Icon

Group: Membersph
Posts: 6575
Joined: 23-February 04
From: Western Australia
Member No.: 491



Here is an old topic dealing with the question "Why are reports disabled?". I think nothing much has changed:

http://forum.spamcop.net/forums/index.php?showtopic=7708

It would need a member of the SC staff to provide any specific information about reports concerning the activity of e5t8.com (and they might prefer not to do that). I think it is a safe bet that the hosting InterNap Network is well aware that there are grounds for complaint about the abuse of their facilities however the e-mail you received goes some way towards demonstrating/pretending compliance with CAN-ЅPAM provisions which perhaps allows InterNap to remain indifferent - or worse, perhaps to pass on complaint details to the spammer (Registrant) who shelters from the public through the WhoisGuard within the Registrar's domain records.

(IMG:style_emoticons/default/biggrin.gif) Domain Dossier shows there is no registered mail exchange for that domain. A service scan of e5t8.com (74.217.151.81) indicates an email service exists (SMTP - 25) with a response "220 malibu1.com (NO UCE) ESMTP IndiMail 1.152" which I note only for the sheer irony of the (NO UCE) part. malibu1.com won't pass on mail from just any old source though - "553 sorry, that domain isn't allowed to be relayed thru this MTA without authentication #5.7.1".

Agree it is best to close down phish "drop boxes" which is why the perpetrators work hard to make them bulletproof.

P.S. Oh, should add SC ignores "From:" and "Reply-to:" addresses in spam - got to be that those were mostly spoofed early in the history of spam. Not for some kinds of phish though (as in this case). Google.com is responsible for the return e-mail address in your case but SC won't send reports there, as explained. You can still get the abuse address through SC (entering just the e-mail address in the paste-in submission box in your members.spamcop.net page). Maybe you knew all that.


--------------------
Plus ça change, plus c’est la même chose
User is offlineProfile CardPM
Go to the top of the page
+Quote Post

Reply to this topicStart new topic
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:

 

- Lo-Fi Version Time is now: 23rd September 2014 - 05:21 AM