SPAMCOP HOME · SPAMCOP FAQ · NEWSGROUPS · FORUM FAQ · WEBMAIL · SSL WEBMAIL · SPAMCOPWIKI


 Other words, data, places -->  SpamCop Pages V  FAQs & Words V  Newsgroups V  WebMail V  News-Recent Stuff V   Poll on menu

------>------> Latest and Current Announcements <------<------

Welcome Guest ( Log In | Register )

> This is a User to User Support Forum

The primary mode of support here is peer-to-peer, meaning users helping other users. (please remember this at all times!)
Another try:
This forum is composed of people who have used spamcop and those who are learning about anti-spam efforts.

 
 Reply to this topicStart new topic
> Spamcop unable to see link
mshalperin
post Jul 28 2005, 08:02 PM
Post #1


Advanced Member
***

Group: Membera
Posts: 150
Joined: 31-May 04
Member No.: 1712
http://www.spamcop.net/sc?id=z790916688zdd...7e810eb17c0984z

Spamcop did not see a link visible in viewing the message:
f73refi.net/?id=c21
which resolves to: 194.126.188.30

inetnum: 194.126.188.0 - 194.126.191.255
netname: Tekcom
descr: Tekcom Project
country: RU
org: ORG-TP17-RIPE
admin-c: MV3243-RIPE
tech-c: MV3243-RIPE
status: ASSIGNED PI
mnt-by: RIPE-NCC-HM-PI-MNT
mnt-by: MNT-TEKCOM
mnt-lower: RIPE-NCC-HM-PI-MNT
mnt-routes: MNT-TEKCOM
mnt-domains: MNT-TEKCOM
changed: mixailovich[at]tekcom.ru 20050621
source: RIPE

organisation: ORG-TP17-RIPE
org-name: Tekcom Project
org-type: NON-REGISTRY
address: Russian Federation
address: Moscow
address: Verxniya Radichenskava St. 3-1
e-mail: mixailovich[at]tekcom.ru
admin-c: MV3243-RIPE
tech-c: MV3243-RIPE
mnt-ref: MNT-TEKCOM
mnt-by: MNT-TEKCOM
changed: mixailovich[at]tekcom.ru 20050621
source: RIPE

person: Mikhail Vlasov
address: Russian Federation
address: Moscow
address: Verxniya Radichenskava St. 3-1
e-mail: mixailovich[at]tekcom.ru
phone: +7 921 9246323
notify: mixailovich[at]tekcom.ru
nic-hdl: MV3243-RIPE
changed: registry[at]colocall.net 20050512
source: RIPE

% Information related to 'ORG-TP17-RIPE'

route: 194.126.188.0/22
descr: Tekcom, Moscow, Russia
origin: AS35060
mnt-by: MNT-TEKCOM
changed: mixailovich[at]tekcom.ru 20050621
source: RIPE
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
dra007
post Jul 28 2005, 08:26 PM
Post #2


Been There
Group Icon

Group: Memberp
Posts: 1413
Joined: 18-March 04
Member No.: 777
I get a lot of spam hosted by mixailovich[at]tekcom.ru lately, as many as 20-50 daily, ...they mostly get resolved by the parser.
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
StevenUnderwood
post Jul 28 2005, 08:50 PM
Post #3


What Life?
Group Icon

Group: Membersph
Posts: 5141
Joined: 20-January 04
From: Whitinsville, MA USA
Member No.: 12
QUOTE(mshalperin @ Jul 28 2005, 09:02 PM)
http://www.spamcop.net/sc?id=z790916688zdd...7e810eb17c0984z

Spamcop did not see a link visible in viewing the message:
f73refi.net/?id=c21
which resolves to: 194.126.188.30
*


<h2>Go to: f73refi.net/?id=c21</h2> is not a link but rather just a piece of text that is made large by the html tags. In html, a link would be surrounded by an HREF= reference or something similiar. No software following any published standard would or should show that code as a link.

Again, similiar to several recent threads, finding and reporting spamvertized web links is at best a secondary function of spamcop. Reporting and blocklisting the source of the spam is the primary function. Julian has made the decision to program his application to locate ONLY RFC compliant links. Yours is not the first such request to change the way spamcop works to locate links, so far very little visible change has been made to that part of the code. It seems that Julian is just keeping up with spammers tricks re: source location.


--------------------
Steven P. Underwood, DNRC
Whitinsville, MA
underwood+forum[at]spamcop.net

-No trees were killed in the sending of this message. However, a large number of electrons were terribly inconvenienced.-
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Wazoo
post Jul 28 2005, 10:00 PM
Post #4


What Life?
Group Icon

Group: Forum Admin
Posts: 12536
Joined: 22-January 04
From: Iowa
Member No.: 18
As above, the reason the text you identify as a "link" is embedded within some terribly crafted 'extra' MIME description lines;
QUOTE
-------------------------------%SECONDBOUNDARY
Content-Type: text/html; charset="US-ASCII"
Content-Transfer-Encoding: 7bit

<html>
<body>
<h2>Go to: f73refi.net/?id=c21</h2>
<br><br>
To find out more about this low percentage L0an plan!
</body>
</html>

-------------------------------%SECONDBOUNDARY--

As stated above, the description states that the enclosed crap is HTML, yet .... the only (critical) thing not in HTML wrappings is the thing you identify as a link. One would really have to work to get a browser to make a trip there.
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
mshalperin
post Jul 28 2005, 11:26 PM
Post #5


Advanced Member
***

Group: Membera
Posts: 150
Joined: 31-May 04
Member No.: 1712
QUOTE(Wazoo @ Jul 28 2005, 10:00 PM)
As above, the reason the text you identify as a "link" is embedded within some terribly crafted 'extra' MIME description lines;

One would really have to work to get a browser to make a trip there.
*


Copy and paste (as I did to get to the original message)? I know that link reporting is a (very) secondary function of Spamcop, and of limited value, but spammers seem to be going to greater efforts to avoid site detection.
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
StevenUnderwood
post Jul 29 2005, 07:43 AM
Post #6


What Life?
Group Icon

Group: Membersph
Posts: 5141
Joined: 20-January 04
From: Whitinsville, MA USA
Member No.: 12
QUOTE(mshalperin @ Jul 29 2005, 12:26 AM)
Copy and paste (as I did to get to the original message)?  I know that link reporting is a (very) secondary function of Spamcop, and of limited value, but spammers seem to be going to greater efforts to avoid site detection.
*


Did that text show as a link in your email application? What email client are you using?


--------------------
Steven P. Underwood, DNRC
Whitinsville, MA
underwood+forum[at]spamcop.net

-No trees were killed in the sending of this message. However, a large number of electrons were terribly inconvenienced.-
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
mshalperin
post Jul 29 2005, 10:10 AM
Post #7


Advanced Member
***

Group: Membera
Posts: 150
Joined: 31-May 04
Member No.: 1712
QUOTE(StevenUnderwood @ Jul 29 2005, 07:43 AM)
Did that text show as a link in your email application?  What email client are you using?
*


No - it showed as text which could be copied and pasted to the address box in IE.
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Wazoo
post Jul 29 2005, 11:17 AM
Post #8


What Life?
Group Icon

Group: Forum Admin
Posts: 12536
Joined: 22-January 04
From: Iowa
Member No.: 18
QUOTE(mshalperin @ Jul 29 2005, 10:10 AM)
No - it showed as text which could be copied and pasted to the address box in IE.
*


I wasn't challenging your methodology of submitting the spam, it was as you stated here .... it was not a clickable link, someone "wanting" to go see the "stuff" would have to manually go through all the work to force their browser to end up at that web site. Normally, one would recommend doing a manual complaint on something ike this. However, in this specific case, it is well known that this spammer, the hosting service involved, the immediate upstream, and the next upstream are spam supporting activities, thus also known that complaints fall in deaf ears. At this point, the only real rcourse is to go after registration data on those that end up having bad data, setting up BLs or convincing your ISP to block the IP blocks involved. SpamCop reports will help in identifying the (usually) zombied computers used to source the spew itself, so don't stop reporting .... but ... the rest of the story boils down to the fact that shutting stuff down takes the effort od the supoorting host, which in this case is a lost cause, just as in the Chine Tietong/Railroad hosting scenario.
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
mshalperin
post Jul 29 2005, 01:07 PM
Post #9


Advanced Member
***

Group: Membera
Posts: 150
Joined: 31-May 04
Member No.: 1712
QUOTE(Wazoo @ Jul 29 2005, 11:17 AM)
  However, in this specific case, it is well known that this spammer, the hosting service involved, the immediate upstream, and the next upstream are spam supporting activities, thus also known that complaints fall in deaf ears.  At this point, the only real rcourse is to go after registration data on those that end up having bad data, setting up BLs or convincing your ISP to block the IP blocks involved.  SpamCop reports will help in identifying the (usually) zombied computers used to source the spew itself, so don't stop reporting .... but ... the rest of the story boils down to the fact that shutting stuff down takes the effort od the supoorting host, which in this case is a lost cause, just as in the Chine Tietong/Railroad hosting scenario.
*


Not to mention the Russian mafia group(s)... I know that reporting these is mostly futile, but it must create some annoyance for them to bother with trying to conceal their sites from Spamcop (also by flooding the spam with a large number of fake sites). Keeping statistics on them may be of some value for future legal enforcement tactics (maybe wishful thinking).
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Jeff G.
post Jul 29 2005, 01:57 PM
Post #10


T-shirt wearing out
Group Icon

Group: Membersph
Posts: 3730
Joined: 2-July 04
From: Northeast New Jersey (New York Metro Area), USA ... Please read my sig. :)
Member No.: 2041
My list of manual report targets for tekcom.ru currently includes: support[at]criticalpath.net, mixailovich[at]tekcom.ru, postmaster[at]tekcom.ru, abuse[at]tekcom.ru, abuse[at]t-ipnet.de, hostmaster[at]1and1.co.uk, postmaster[at]1and1.co.uk, abuse[at]1and1.co.uk, abuse[at]schlund.de, postmaster[at]schlund.info, abuse[at]schlund.info, abuse[at]level3.net, spamtool[at]level3.net, abuse[at]hanaro.com, dmanager[at]yesnic.com, abuse[at]mci.com, postmaster[at]asianetcom.net, abuse[at]asianetcom.net, and the manual report targets I listed for chinatietong.com.

Also, please note that email to the following email addresses bounces in violation of various RFCs: provencaux[at]popaccount.com, gravesides[at]popaccount.com, postmaster[at]gravesides.com, abuse[at]gravesides.com, postmaster[at]bowdlerise.com, abuse[at]bowdlerise.com, lwangpei[at]chinatietong.com, abuse[at]yesnic.com, postmaster[at]yesnic.com, postmaster[at]popaccount.com, abuse[at]popaccount.com, postmaster[at]provencaux.net, abuse[at]provencaux.net, akmal.bhutta[at]virgin.net, postmaster[at]virgin.net, abuse[at]virgin.net, webmaster[at]swissrolexes4me.com, postmaster[at]swissrolexes4me.com, and abuse[at]swissrolexes4me.com.

In addition, please note that addresses at tek.net are inappropriate for such reports - tek.net admins are well aware of the forgery of their domain name in DNS records used by tekcom.ru.


--------------------
Best Regards, Jeff G. (full signature)
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
mshalperin
post Aug 1 2005, 05:07 PM
Post #11


Advanced Member
***

Group: Membera
Posts: 150
Joined: 31-May 04
Member No.: 1712
QUOTE(Jeff G. @ Jul 29 2005, 01:57 PM)
My list of manual report targets for tekcom.ru currently ]   the manual report targets I listed for chinatietong.com[/url]
*


Thanks for the lists - I'm using them for user added addresses within Spamcop. Does sending true manual reports to these spamlords do any good? Doesn't sending reports directly from your email address, rather than Spamcop, just identify and expose you to whatever retributions they can come up with?
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Jeff G.
post Aug 1 2005, 05:29 PM
Post #12


T-shirt wearing out
Group Icon

Group: Membersph
Posts: 3730
Joined: 2-July 04
From: Northeast New Jersey (New York Metro Area), USA ... Please read my sig. :)
Member No.: 2041
I don't report them from the spammed address, I report them from one of my abuse@ role accounts.


--------------------
Best Regards, Jeff G. (full signature)
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
btech
post Aug 2 2005, 07:58 PM
Post #13


Advanced Member
Group Icon

Group: Memberp
Posts: 446
Joined: 17-June 04
From: Texas
Member No.: 1895
This site has been slipping past the parser for a few days...
http://www.spamcop.net/sc?id=z792526445zfa...7ed155513f0be2z

Any ideas why?
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
StevenUnderwood
post Aug 2 2005, 08:04 PM
Post #14


What Life?
Group Icon

Group: Membersph
Posts: 5141
Joined: 20-January 04
From: Whitinsville, MA USA
Member No.: 12
QUOTE(btech @ Aug 2 2005, 08:58 PM)
This site has been slipping past the parser for a few days...
http://www.spamcop.net/sc?id=z792526445zfa...7ed155513f0be2z

Any ideas why?
*


Yeah, none of the boundry numbers match.... Message states boundary="--5160792793851006" buth that boundry is never shown...proper handling of this message whould show a blank body.


--------------------
Steven P. Underwood, DNRC
Whitinsville, MA
underwood+forum[at]spamcop.net

-No trees were killed in the sending of this message. However, a large number of electrons were terribly inconvenienced.-
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
WHAnderson
post Aug 9 2005, 08:02 AM
Post #15


Newbie
*

Group: Members
Posts: 2
Joined: 9-August 05
Member No.: 4412
QUOTE(Wazoo @ Jul 28 2005, 11:00 PM)
As above, the reason the text you identify as a "link" is embedded within some terribly crafted 'extra' MIME description lines;

As stated above, the description states that the enclosed crap is HTML, yet .... the only (critical) thing not in HTML wrappings is the thing you identify as a link.  One would really have to work to get a browser to make a trip there.
*



I am not sure why you said "One would really have to work to get a browser to make a trip there."

That redirect link, f73refi.net/?id=c21, takes me right to the webpage found at, http://f73refi.net/?id=c21. I didn't have to do anything but click on it.

Maybe our browsers are making it too easy for these Spammers.
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Jeff G.
post Aug 9 2005, 09:55 AM
Post #16


T-shirt wearing out
Group Icon

Group: Membersph
Posts: 3730
Joined: 2-July 04
From: Northeast New Jersey (New York Metro Area), USA ... Please read my sig. :)
Member No.: 2041
WHAnderson, what exact application is showing you that "f73refi.net/?id=c21" is a clickable link? Thanks!


--------------------
Best Regards, Jeff G. (full signature)
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
WHAnderson
post Aug 9 2005, 11:16 AM
Post #17


Newbie
*

Group: Members
Posts: 2
Joined: 9-August 05
Member No.: 4412
I was using Outlook 2000. But, I don't think SpamCop had received the entire contents of the SPAM Email. Unfortunately, I have already deleted my copy.

The redirect code, f73refi.net/?id=c21, is part of an "href" statement with a graphic, it was not a stand alone link as shown in the earlier post.

Also, if you do a copy & paste to a browser the web page pops right up.


QUOTE(Jeff G. @ Aug 9 2005, 10:55 AM)
WHAnderson, what exact application is showing you that "f73refi.net/?id=c21" is a clickable link?  Thanks!
*
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
StevenUnderwood
post Aug 9 2005, 01:07 PM
Post #18


What Life?
Group Icon

Group: Membersph
Posts: 5141
Joined: 20-January 04
From: Whitinsville, MA USA
Member No.: 12
QUOTE(WHAnderson @ Aug 9 2005, 12:16 PM)
I was using Outlook 2000.  But, I don't think SpamCop had received the entire contents of the SPAM Email.  Unfortunately, I have already deleted my copy.

The redirect code, f73refi.net/?id=c21, is part of an "href" statement with a graphic, it was not a stand alone link as shown in the earlier post.
*


If that is the case, it would explain why our explanations and your experiences are different. You should also take extreme care in reporting if you are not getting the complete message, as that could be seen as modifying the message.
QUOTE(WHAnderson @ Aug 9 2005, 12:16 PM)
Also, if you do a copy & paste to a browser the web page pops right up.
*


That is because it is a web browser and expects anything pasted into it's address bar to be a web link. An email application should NOT be making that jump (but MS often does).


--------------------
Steven P. Underwood, DNRC
Whitinsville, MA
underwood+forum[at]spamcop.net

-No trees were killed in the sending of this message. However, a large number of electrons were terribly inconvenienced.-
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
« Next Oldest · SpamCop Reporting Help · Next Newest »
 

Reply to this topicStart new topic
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:

 

- Lo-Fi Version Time is now: 21st November 2009 - 10:19 PM
Invision Power Board - Apple IIGs Powered © 2009  IPS, Inc.