DavidT Posted November 11, 2004 Posted November 11, 2004 I've just discovered that all of the reports that SpamCop sends regarding abuse from the largest provider in Italy are being published to the Web in archives that are indexed by the search engines. This means that if you are using the "Leave spam copies intact" option in your reporting preferences, and you happen to report something coming from their IP space, an unmunged copy (including your email address) will not only be sent to the abuse addresses, but will then also be archived on the Web at: http://listserv.nic.it/listserv/abuse.html Unfortunately, they have not protected the site against Web spiders, and so all of the details of SpamCop reports sent to them are now in Google (and other engines). I discovered this by searching for one of my addresses (and I generally try to minimize exposure of my email addresses on websites) and found one of the reports I submitted recently on a Nigerian 419 scam...hoping that they would cancel the source email account. When something from the SMTP servers (perhaps originating from their webmail system, according to my analysis) of the Italian ISP "tin.it" gets reported, it goes to: Reporting addresses: abuse[at]tin.it postmaster[at]tin.it abuse[at]na.nic.it e.berti[at]tin.it The one that is producing the archives is the one at "na.nic.it" and so I will send an urgent message to the Deputies suggesting that no more abuse reports get sent to that address. In their archive, I found reports regarding the same 419 from the same email address a week later, so they didn't even take action, and yet the source IP isn't in the SpamCop DNSBL (despite plenty of current reporting "History" found when parsing the IP)...perhaps because it's not part of the dynamic IP space of individual users, but appear to involve their SMTP servers and perhaps their webmail system. I was using the "Leave spam copies intact" option and only reporting the most agregious items (such as 419 scams) in hopes that ISPs would take the reports more seriously and take action, but not to have them archived for address-harvesting spiders to pick them up. I've stopped using that option. DT
GraemeL Posted November 11, 2004 Posted November 11, 2004 Elen removed them from the list of recipients about two weeks ago. Her post is in the news groups with message-id: clmrgp$tcs$1[at]news.spamcop.net Reports should no longer be going to them -- let me know if you see differently. Ellen
Wazoo Posted November 11, 2004 Posted November 11, 2004 Thanks GraemeL .... I was trying to remember just how long ago that this issue had been hit on over there .. saved me that search. Thanks.
DavidT Posted November 11, 2004 Author Posted November 11, 2004 Elen removed them from the list of recipients about two weeks ago. Then someone has "un-removed" them, because my report was sent 10 days ago, and you'll see plenty of current ones at: http://listserv.nic.it/cgi-bin/wa?A1=ind0411b&L=abuse#691 They're all being harvested by spammers as we speak.... :angry: DT
Jeff G. Posted November 11, 2004 Posted November 11, 2004 Ellen told me Tue, 9 Nov 2004 at 15:12:16 -0500 that she devnulled the reports to nic.it.
DavidT Posted November 11, 2004 Author Posted November 11, 2004 Ellen told me Tue, 9 Nov 2004 at 15:12:16 -0500 that she devnulled the reports to nic.it. She didn't dev/null the correct address, because it you look here, http://listserv.nic.it/cgi-bin/wa?A1=ind0411b&L=abuse#691 you'll see plenty of SpamCop reports continuing to be sent, even today. The problem is, she didn't "dev/null" the address that's going straight to the online archives, which is: abuse[at]na.nic.it If you put certain "tin.it" IPs into the parser (specifically ones in the range 212.216.176.*), you'll see that: Reporting addresses: abuse[at]tin.it postmaster[at]tin.it abuse[at]na.nic.it e.berti[at]tin.it are all being sent reports. The "na.nic.it" address is the problem. Does anyone know how to "page" Ellen? I've sent an urgent message to the "deputies" address but haven't received a response. DT
Wazoo Posted November 11, 2004 Posted November 11, 2004 Deputies address is good ... it also means that there are more eyes to see in addition to Ellen's. On the other hand, that e-mail box does have a tendency to get overloaded at times <g> I don't know all the background on this ISP, but perhaps there's some research going on in trying to track down the range of IPs it controls .. going with that Ellen handled "this set" of IPs, but these recent reports are coming from yet "another set" of IPs ...??? just a guess at a possibility right now ... headed out again ...
Tim P Posted November 11, 2004 Posted November 11, 2004 Deputies address is good ... it also means that there are more eyes to see in addition to Ellen's. On the other hand, that e-mail box does have a tendency to get overloaded at times <g> I don't know all the background on this ISP, but perhaps there's some research going on in trying to track down the range of IPs it controls .. going with that Ellen handled "this set" of IPs, but these recent reports are coming from yet "another set" of IPs ...??? just a guess at a possibility right now ... headed out again ... 20065[/snapback] Judging from the recent crap(spam) Ive been getting from past reports that had been sent to abuse[at]nic.it.... the spammers have been using the reporting # and sending back more spam through those report #s. Duh For those other than the recipients.... Turn those addresses into spamtraps, I say
Jeff G. Posted November 11, 2004 Posted November 11, 2004 I agree with Tim P. about making those Report ID email addresses into spamtraps. I've never gotten a useful reply to a spam report sent to abuse at na.nic.it or nic.it.
Ellen Posted November 13, 2004 Posted November 13, 2004 Ellen told me Tue, 9 Nov 2004 at 15:12:16 -0500 that she devnulled the reports to nic.it. 20048[/snapback] Yes we devnulled nic.it but missed the other address -- I devnulled that today -- or maybe it was yesterday. I apologize for missing that.
mrmaxx Posted November 15, 2004 Posted November 15, 2004 Yes we devnulled nic.it but missed the other address -- I devnulled that today -- or maybe it was yesterday. I apologize for missing that. 20127[/snapback] Awww...Ellen, you're only human... You're entitled to make one or two mistakes per week. Guess you used one last week. ;-) Keep up the good work!
Ellen Posted November 15, 2004 Posted November 15, 2004 Awww...Ellen, you're only human... You're entitled to make one or two mistakes per week. Guess you used one last week. ;-) Keep up the good work! 20162[/snapback] :-)
adrian1 Posted November 19, 2004 Posted November 19, 2004 still addresses available at http://listserv.nic.it/listserv/abuse.html
Wazoo Posted November 19, 2004 Posted November 19, 2004 still addresses available at http://listserv.nic.it/listserv/abuse.html I gave up looking ... are you talking about additional reports since the date Ellen said she turned it all off? Are you expecting that someone "here" would have the "powers" needed to have those folks remove what's already there? If you've got some specific items that you're trying point at, how about actually providing some pointers?
Recommended Posts
Archived
This topic is now archived and is closed to further replies.