SpamCopAdmin Posted December 13, 2004 Share Posted December 13, 2004 Some users are getting spam via our "report reply" system that translates the reporting address on SpamCop complaints to the user who filed the report and then forwards the message to him. The problem is that the spammer is using numbers that are really "old" in our system and we shouldn't be forwarding the spam to a user. ReportID numbers are supposed to age out of our system a month after they were used and become invalid after that. Replies to reports over a month old are supposed to go to the trash instead of being sent to the user. I'm looking into the problem. It looks like a spammer is using a number generator to create reportID numbers to be used with our [at]reports.spamcop.net address. For example, a recent spam was sent to 194356809 [at] reports.spamcop.net and forwarded to a user by us. Current reportID numbers are in the 1313340000 range now. I'm sure that 194356809 was a valid report number at some point way back when, but as you can see, we're a Billion numbers past that now. It should have aged out of our system as a valid report ID number a month after it was used. The traffic is spam, so it should be reported, but with one caution. It's important that the spam not be confused with actual replies to our current reports. Replies to reports aren't spam and shouldn't be reported. - Don - Link to comment Share on other sites More sharing options...
Wazoo Posted December 13, 2004 Share Posted December 13, 2004 A bit of other discussion from spamcop.help newsgroup 29Nov04 "Aviatrix" wrote in message news:cog9b2$qh7$1[at]news.spamcop.net... > For the past few weeks I have been receiving the occasional Chinese spam > (one or two a week) at an address ending in [at]reports.spamcop.net. > > If I understand things corectly, reports I send through the Spamcop > system have a unique address [at]reports.spamcop.net in the "from" line. So > it looks like a Spamcop report of mine got intercepted by a spammer... > > Do these [at]reports.spamcop.net addresses self-destruct after a while, or > can I expect this Chinese spam to get through to me for the rest of my > life? Yes they do self destruct after a while -- it used to be 30 days, I am not sure if that time got lengthened. Please email me the report numbers -- the local part of the email address -- so that I can see if they are report numbers for reports sent to a recipient who we have already beaten up or whether we need to go do that. deputies <at> spamcop.net TIA Ellen No more data is needed at this point. 13Dec04 "Martin Rogoff" wrote in message > I got a rash of them today. Yes -- everyone is getting them -- how delightful -- NOT. Anyway -- we have opened a ticket on it and hopefully will have a fix in place in the not too distant future altho I do not know how long it will take. In the interrim just keep reporting them. Ellen Link to comment Share on other sites More sharing options...
dobbin Posted December 14, 2004 Share Posted December 14, 2004 As another recipient of these, I would be just as happy to not receive any reports.spamcop.net emails at all. I have reported thousands of spam emails via Spamcop and have only seen two responses from administrators that were even vaguely of interest. Dobbin Link to comment Share on other sites More sharing options...
Ellen Posted December 14, 2004 Share Posted December 14, 2004 As another recipient of these, I would be just as happy to not receive any reports.spamcop.net emails at all. I have reported thousands of spam emails via Spamcop and have only seen two responses from administrators that were even vaguely of interest. Dobbin 21393[/snapback] I hear you but one of the things we do tell abuse desks is that they can write to the user if they have questions or comments. And some of them do. Link to comment Share on other sites More sharing options...
Jeff G. Posted December 19, 2004 Share Posted December 19, 2004 Please ensure that the templates you use for informing ISPs about the reply capability mention the month aging timeframe. Thanks! Link to comment Share on other sites More sharing options...
Wazoo Posted December 19, 2004 Share Posted December 19, 2004 And a bit of follow up (and some disagreement about some words) from Don over in the newsgroups; Steven Maesslein wrote: >-Don't forget the "abuse[at]nic.it" factor. That particular address feeds a >-mailing list run by the Italian (so-called) anti-spam (wannabe) >-authorities. Same problem, different source. We quit sending reports to that database some time ago, so the problem should go away soon. ReportID numbers are supposed to age out of our system a month after they were used and become invalid after that. Replies to reports over a month old are supposed to go to the trash instead of being sent to the user. Something went wrong with the filters and we suddenly started forwarding the replies (spam) no matter how old the "reportID" number was. Julian either already has or will soon push new code to fix that. - Don - Link to comment Share on other sites More sharing options...
Jeff G. Posted December 20, 2004 Share Posted December 20, 2004 Julian, thanks for the fix. Wazoo and Don, thanks for the updates. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.