Reporting spam from a friend's compromised account?

[mtford]

Sometimes I receive spam from a person who is known to me - either through a hacked webmail account or an infected mail client. Should I report this type of spam via SpamCop, or will this cause further problems for the person whose account was compromised? Is it better just to tell the person concerned?

[turetzsr]

...For what it's worth, my inclination would be to let both your friend and the abuse address of her/ his e-mail account know.

[Farelf]

I had something similar recently but it was just the friend's e-mail address was on some spammer's list, spam wasn't actually coming from his account, just spoofed (the more common situation). That was easy, notify both him and source's ISP.

In Australia the major ISPs have a voluntary agreement with/through the ACMA communications watchdog which says, inter alia/amongst other things, that they should help customers clear up infected computers - as opposed to unilaterally closing the accounts when there is proof of spam through them. So with an Oz ISP in a situation of actual compromise, the decision would be easy too - notify both. And SpamCop really wants you to report as well - see http://forum.spamcop.net/forums/index.php?...p;f=3&id=45

But, unless sure of your local situation with regard to both actual spam origin and ISP behaviour, I would be just a little cautious about letting the ISP know in the first instance. Can't hurt to let the friend have a shot at fixing it first (if they have half a clue), change passwords and scan computers etc. And to give them the chance to alert others on the address list. Good way to lose friends though - like telling people they have body lice, not all will react in the desired manner. Anyway, the common "compromised address list" type of spam is not usually high-volume by source, so not likely to show up on blocking lists very quickly. He/she can alert the ISP when fixed - yes they should certainly know what has happened as well, for the benefit of other customers.

Just my opinion ...

[SpamCopAdmin]

Report the spam. SpamCop ignores the email addresses in spam because they are almost always either fake or forged.

- Don D'Minion - SpamCop Admin -

- Service[at]Admin.SpamCop.net -

.

[turetzsr]

...In case there were any doubt (there shouldn't be), Don's advice 80849[/snapback] is to be heeded over mine 80840[/snapback].