Spam Traps

[dbiel]

It seems that there is a lot of confusion as to how SpamCop uses spam Traps and what information if any is avaiable to those who have been caught by them.

Since there are basicly two ways of getting stuck in a spam trap and the solution to fix each is very different, is it possible to find out how one fell into the trap?

Method #1 email addressed to and delivered to a spam trap address

Method #2 email addressed to and delivered to someone other than a spam trap that contains either a forged from or reply to address that happens to be a spam trap address, which the receipeint either bounces back for varrious reasons or has set up an automatic reply ie vacation notice, that automaticly sends a message to the forged spam trap address.

The question is what does SpamCop do with bounces that hit their spam traps?

Are they considered the same as spam?

Are they discarded and ignored, if so there would be no listing and no problem, if not does SpamCop release any information regarding the type of mail that was caught in the spam trap (spam vs bounces)

Note: this message as also been emailed to deputies <at> spamcop.net

You may want to send a polite email to deputies <at> spamcop.net and after for additional information about the mail that was sent to the spamcop spam traps. They should be able to tell you if it's backscatter or spam.

This post has been edited by Chris Parker: Today, 09:30 AM

taken from post http://forum.spamcop.net/forums/index.php?showtopic=2312&hl=

[Chris Parker]

Since there are basicly two ways of getting stuck in a spam trap and the solution to fix each is very different, is it possible to find out how one fell into the trap

Yes, ask the deputies.

The question is what does SpamCop do with bounces that hit their spam traps?

From reading previous discussions about listings they appear to be same as any other mail destined for a spam trap.

Are they discarded and ignored, if so there would be no listing and no problem, if not does SpamCop release any information regarding the type of mail that was caught in the spam trap (spam vs bounces)

I've seen a number of people listed because of misdirected virus infection notifications. In my opinion backscatter (av and ndn) should be treated the same as intentional spam and the listings are justified. If someone forges my email address as the from address in a spam or virus run, the backscatter can be enormous. I've seen cases of 1,000's of backscatter messages an hour coming into people's boxes basically resulting in a DDoS attack.

[Merlyn]

Chris gave some good examples and there are many more.

Automatic responders like out of office, vacation and other automatic responses can be very hazardous.

To sum it up anything that responds/bounces to a "From" address can cause this.

Spammers scour the web and automatically pick up email addy's which they use in the "From" when sending their spew. If they happen to use a spamtrap located somewhere in the sourcecode of a site then the autoresponder replies to the spamtrap which never sent it. If people are not educated enough not to use such things the after they get blocked they learn quickly.

So I guess the best way to answer your question is there are three things that usually cause persons to get into spamtraps, stupidity, naivety or spamming.

[Wazoo]

Spamtrap hits are not the "same" as spam, counting a bit higher (and on a sliding scale) as far as status on the SpamCopDNSbl .... (my feelings getting hurt here ... this seems like the dozenth post today that does have an answer in the FAQ-in-progress ... look under the Blocking List section - What is on the List ..)

What is done with spamtrap hits ... much discussed over the years, but basically, they run on auto-pilot, feeding the BL ... only when a situation comes up, e-mail flows, does one of the Deputies go take a look at the contents ....

Type and amount of data released is based on the content of said data, who is involved in the conversation, and perhaps the mood of the folks involved at the time .... in the past, spcific IPs of a networked machine have been pointed out, the type of spam/exploit have been suggested, .... the stuff that if one knows what they are actually doing would allow a SysAdmin to pretty much jump right onto the problem area.

[dbiel]

Spamtrap hits are not the "same" as spam, counting a bit higher (and on a sliding scale) as far as status on the SpamCopDNSbl .... (my feelings getting hurt here ... this seems like the dozenth post today that does have an answer in the FAQ-in-progress ... look under the Blocking List section - What is on the List ..)

I guess that I need to learn a better way to ask questions.

SpamCop FAQ : SpamCop Blocking List information :

What is on the list?

<snip>

4) Spamtrap reports (mail sent to non-existant email addresses set up by SpamCop) are used to weight total reports. For spamtrap scores less than 6, the quantity of spamtrap is multiplied by 5 and added to the SUBE score. For larger spamtrap scores, the quantity is squared. For example, if a host has 2 spamtrap reports and 3 manual SUBE reports against it, its weighted SUBE score will be 13: 3 + (2 * 5) = 13. If a host has 7 spamtrap reports and 3 manual SUBE reports, its weighted SUBE score will be 52: 3 + (7 * 7) = 52.

A good explaination of how entries that get into to spam trap are used but does not address by question which I will restate differently

Does spam Cop filter messages addressed to spam traps to separate real messages from bounces (which under SpamCop's own reporting requirement are not spam and should not be reported) This policy apparently does not apply to spam traps

Automatic responders like out of office, vacation and other automatic responses can be very hazardous.

To sum it up anything that responds/bounces to a "From" address can cause this.

In summary (I am getting much to long winded)

I think we need to make a change in the FAQ

SpamCop FAQ

Why am I Blocked?

Why Am I Blocked? Probable Causes

If your email has suddenly been blocked by the SpamCop blocklist, it is probably:

because a virus has infected a computer that uses your ISP to connect to the Internet or you have an open proxy or open relay on your computer.

because your ISP allows people to send spam (email that you have not requested and do not want)

because, as in all systems, there may have been a mistake.

Add one more point

Your system uses auto responders (ie Vacation Notices) that reply to every email received including spam which may have used a forge form or reply to address that just happens to be a spam trap address. Or your system bounces spam or other selected mail to a forged email address instead of bouncing back to the IP address

[Miss Betsy]

I thought the same thing, but actually it is in the Why Am I Blocked FAQ in John's FAQ for people who run servers.

If you are auto-responding to viruses, spamtraps may be listing you. Auto-responding to viruses is an extremely bad practice, and should be discontinued immediately. Those virus warnings are useless, and are not going to anyone that can stop the viruses from being sent to your network. Responding to them is just adding to the havoc created by the virus writer.

The same is true of sending bounce email messages. If you are accepting email and then sending emails to notify of undeliverable messages or bad content, spamcop should not be listing you, but please change to using SMTP rejects

I don't remember at the moment whether the deputies will delist if the spam trap hits are bounces. The problem is that even they delist, the server will be listed again as soon as more bounces hit the spam traps because I don't think the spamtraps do any filtering. There must be something in the algorithym so that 'true' typos or mistakes don't result in a listing.

The 'Why Am I Blocked FAQ' was written with the non-technically fluent in mind which is why it is not in the opening lines you quoted. Presumably someone who is a server admin is more technically fluent which is why they are directed to more technical reasons in the links.

Possibly, since so many questions are asked about spamtrap hits, it would be a good idea to separate it out and put it in a more prominent place - but not in the opening lines - in the FAQ for server admins since no end user has control over email bounces and it is way beyond most technically non-fluent people's understanding.

Miss Betsy

[StevenUnderwood]

Does spam Cop filter messages addressed to spam traps to separate real messages from bounces (which under SpamCop's own reporting requirement are not spam and should not be reported) This policy apparently does not apply to spam traps

To my knowledge, no they do not filter the spamtrap addresses at all.

There must be something in the algorithym so that 'true' typos or mistakes don't result in a listing.

I don't think this is correct either.

[dbiel]

Miss Betsy, thank you for your reply.

There is one very key point that was left out. - Vacation Notices.

This is something every individual user does have control of.

That should definitely be included in any listing as to why I am blocked.

Also a statement about the recommended use or NON use of them should also be prominently posted.

[Miss Betsy]

Only Wazoo can edit the text, but how about adding to the initial list

Auto-responses that are replying to spam with forged spamtrap email addresses (such as Vacation notices, virus notifications, and 'created email' bounces)

That would cover the 'bounces' that Mailwasher creates and are also user controlled.

Since the server admin FAQ are next , that would be ok. In fact re-reading that list, IMHO, it could be reworked to emphasize that it is the IP address one is using.

Revised Why Am I Blocked? Probable Causes

If your email has suddenly been blocked by the SpamCop blocklist, it may be because:

1) You share an IP address with other email users and there is someone who

        Is using auto-responses that are replying to spam with forged spamtrap email addresses (such as Vacation notices, virus notifications, and 'created email' bounces)

        has a computer with  a virus that allows it to send spam without the owner's knowledge   

        is spamming and your internet service provider is allowing it to happen

        or, as in all systems, there may have been a mistake.

[b]If you are a server administrator[/b], and the blocklist only lists spamtraps, then auto responses are the likely culprit.  If the blocklist lists spam traps and reports, then the SMTP/Auth exploit is the next most common cause (see these links).  After those two, open relays/proxies or you have someone who is really spamming (a new customer, perhaps?)

Also please see

Miss Betsy

[dbiel]

Miss Betsy, thank you for your reply

Only Wazoo can edit the text, but how about adding to the initial list

The item I was referencing was you contribution the the FAQ "Why am I Blocked"

Since you are still listed as the creator of the post you do have editing rights, but I can understand how you might feel more confortable deferring the edits to Wazoo which is perfect fine with me.

I do still think that it should be added to your post.

Your comment that it should go else were is also good, but should be in addition to not instead of.

I have enjoyed reading many of your posts.

[Miss Betsy]

Actually since it is 'closed' I can't edit either (I tried).

I am sorry that I don't have time to pay a lot of attention to Wazoo's efforts to get the FAQ in working order (my middle name is 'JeffG' - that's not nice, but I couldn't resist - it's not meant to be negative, but maybe realistic).

Thanks for the nice words about my posts.

Miss Betsy

[Wazoo]

Was going to do a cut/paste, but I note that the "new" doesn't seem to match the "old" ... phone call interrupted that, off to see if I can sort out the zoned air conditioning settings at the Community Center .. Dad's about had it with folks down there complaining about it being too cold, and as it's all digital, obviously I can figure it out <g> Maybe, in the meantime, ...????

[Miss Betsy]

Why Am I Blocked? Probable Causes

If your email has suddenly been blocked by the SpamCop blocklist, it is maybe because you share an IP address with other email users and there is someone who

* Is using auto-responses that are replying to spam with forged spamtrap email

addresses (such as Vacation notices, virus notifications, and 'created email'

bounces);

* has a computer with a virus that allows it to send spam without the owner's knowledge;

* is sending unsolicited emails and your internet service provider is allowing it;

* or because, as in all systems, there may have been a mistake.

The spamcop.net listing will expire automatically within 48 hours of the last report of spam from it.

For people who are operating servers:

Am I really listed in the SpamCop Blocklist?:

You can check the status of any server by entering its address at http://www.spamcop.net/bl.shtml. The reason an IP address is listed can also be obtained from that page.

If the blocklist only lists spamtraps,

then auto responses are the likely culprit.

If the blocklist lists spam traps and reports,

then the SMTP/Auth exploit is the next most common cause

see these links:

http://news.spamcop.net/cgi-bin/fom?file=372

http://www.winnetmag.com/article/articleid/40507/40507.html

http://www.winnetmag.com/article/articleid/42406/42406.html

After those two, the next most likely are open relays/proxies or you have someone who is really spamming (a new customer, perhaps?)

Please also see (very helpful):

* How can I get removed from SpamCop's blocking system?

* John's explanation at John's revised post, for Why Am I Blocked FAQ

* Merlyn's explanation at FAQ Entry: Why is my email blocked?

The rest of this FAQ is for people who do not run servers. Post the IP address that is blocked in the Spamcop web forum or newsgroup. There are many knowledgeable people in the SpamCop groups who will help you figure out why and offer solutions. If you need to know what triggered the report from a spamtrap, email deputies <at> spamcop.net. Only they can see. However, a post will generally get you faster replies and more specific help on what is the problem.

Can you cut an paste this? You have editing rights!!!

Miss Betsy

[Wazoo]

A bit more than cut/paste involved .... added some, re-worded some .... now waiting for the hits to arrive ...

[dbiel]

Miss Betsy, Thank you for posting the revised copy, and thanks to Wazoo for intergrating it into the FAQ.

So much for bad assumptions (I hate that word, gets me into trouble most of the time)

Assumption, if the edit button is still there, it must still work.

Assumption, closed thread means no more new posts.

Both are bad assumptions on my part.

Closed, means just that. Until it is unlocked, it can not be changed.

Thanks again.

[WB8TYW]

Automatic responders like out of office, vacation and other automatic responses can be very hazardous.

Out of office and Vaction notices on voice mail have been documented to be used by criminals for use in successfully stealing from companies. Confidential documents, and pre-production top secret prototypes have been stolen this way.

They have been used to get help desks to give out dialup phone numbers for internal computer systems, and to even get account names and passwords.

An Out of Office or Vacation notice on e-mail external to your network can provide these criminals with the information that they need to know who's identity can be stolen with a low likely hood of detection.

Think of an "out of office" notice on either voice mail or e-mail as being the same thing as a pile of newspapers in front of your house while you are on vacation.

Only instead of getting the contents of the house, the theives can get a hold of any asset at the company that you are allowed access to, or any amount of money that you are authorized to spend with out higher level approval.

-John

Personal Opinion Only

[Merlyn]

As far as I am concerned, if it is a real spamtrap then nothing has to be done.

Mail should have never been sent to it, period.

Anyone that sends to a spamtrap is either a spammer or it is a totally outdated auto response system that has no business on the web, a response system that is poorly setup or thought about, or is a cluless idiot that bought an opt-in list (yea right) or has their own robot scanning the web or many other things.

Spamcop should not give any info and the system sending the email/spam to the spamtrap should fix their system. If they can't then they should hire someone that knows how.

[dbiel]

Thanks John (WB8TYW) for your reply - very well worded.

Wazoo, how about adding John's post to the FAQ under the heading

"Vacation Notices - why they are dangerous to use"

The link to his post is http://forum.spamcop.net/forums/index.php?...indpost&p=14928

[dbiel]

The following might be taken as the "official" SpamCop position on the subject.

It is a composite of several emails received from Ellen in reply to my inital question (post#1) which was also sent via email to deputies [at] spamcop.net

Exactly how we treat spams that arrive at spamtraps is information that we do not post publicly.

If the owner of the IP that has been listed in the blocklist because of spamtrap hits gets in touch with us, there is some limited information that we can provide. When someone writes and asks for information it is helpful if they identify themselves and their relationship to the IP in question.

Ellen

deputies [at] spamcop.net

Thanks to Ellen for her replies. It should be noted that Ellen replied quite promptly to my requests, the delay in posting here is due to the fact that it required several rounds of email to explain the reason for the question and delays on my part in getting back to Ellen with answers.