agsteele Posted October 29, 2005 Share Posted October 29, 2005 Whilst reporting junk Email that contains URLs to spamvertised websites (including Geocities UK) can bring action from a few ISPs and web hosts, my experience is that many URLs are truly innocent bystanders. As a result an increasing number of ISPs are unable or unwilling to take time verifying that the spamvertised URL really does justify action against the user concerned. The real benefit of the reporting system is, in my view, the population of the blocklist in a timely and effective manner. Since Geocities isn't a mail server I'd not be too troubled. Andrew Link to comment Share on other sites More sharing options...
btech Posted November 2, 2005 Share Posted November 2, 2005 Seems as if Lycos is a new target for the re-directors... http://www.spamcop.net/sc?id=z822242673z5c...7659a4826bc5caz Link to comment Share on other sites More sharing options...
Miss Betsy Posted November 2, 2005 Share Posted November 2, 2005 I have that option enabled (so I receive all reports) and there are only a handfull of different ISP's I ever get a response from. Yahoo was just added to that short list today, in fact. 35092[/snapback] I discovered a while back (when I was also experimenting) that some robots do not respond to spamcop reports, but will respond to manual reports. Miss Betsy Link to comment Share on other sites More sharing options...
karlisma Posted November 9, 2005 Share Posted November 9, 2005 I know, i know: refresh the page until it parses correct.... it is true with single geocities.com link in it if they are two like here: http://www.spamcop.net/sc?id=z824767345z56...1baf691d682117z 50 times will (did not) not help. Dough! Link to comment Share on other sites More sharing options...
Wazoo Posted November 9, 2005 Share Posted November 9, 2005 I know, i know: refresh the page until it parses correct.... it is true with single geocities.com link in it 50 times will (did not) not help. Dough! 35714[/snapback] and yet, only a couple of seconds to package up the spam and forward it directly ..??? Link to comment Share on other sites More sharing options...
lcusdtech Posted November 9, 2005 Share Posted November 9, 2005 [quote name='Jeff G.' date='Oct 28 2005, 12:34 PM']When I turned on "Forward replies from people and robots", I started getting automatic replies from robots at the following ISP domains: Earthlink.net Home.nl cablecom.ch gaoland.net cantv.net hanaro.com InfoAve.Net pwebtech.com t-ipnet.de Verio.net comcast.net jerseytelecom.com gblx.net dtag.de club-internet.fr MCI.com NOOS.fr globix.com OCN.ad.jp mchsi.com Embratel.net.br sjrb.ca hinet.net StarHub.com netvisao.pt titan-networks.net [right][snapback]35098[/snapback][/right] [/quote] Add he.net to the list, I just got a nice response from them. From: <abuse[at]he.net> To: <1550742968[at]reports.spamcop.net> Date: 11/8/2005 10:35:12 PM Subject: [HE_ABUSE#1406398] [SpamCop (216.66.66.215) id:1550742968]K 12 Software Educational Software Savings We have notified the subcontracting ISP who is responsible for the IP space, and forwarded a copy of your complaint to them. They should be responding to your complaint shortly. If you do not hear back from them within 48 hours please click the following link and let us know: [url="http://abuseresponse.he.net/index.php?id=1406398"]http://abuseresponse.he.net/index.php?id=1406398[/url] Please do not alter the subject line in any replies. We apologize if you have received this email in error. Your original message to us is included below. --------Original Message-------- From: "LCUSD Techsupport" <1550742968[at]reports.spamcop.net> Subject: [SpamCop (216.66.66.215) id:1550742968]K 12 Software Educational Software Savings [ SpamCop V1.500 ] This message is brief for your comfort. Please use links below for details. Email from 216.66.66.215 / Mon, 07 Nov 2005 20:59:31 -0800 [url="http://www.spamcop.net/w3m?i=z1550742968z1e1cc95d0dd01491b2bf9413ce70ac86z"]http://www.spamcop.net/w3m?i=z1550742968z1...bf9413ce70ac86z[/url] [ Offending message ] Return-path: <info[at]k12-software.net> Received: from k12-software.net [216.66.66.215] by gw.lcusd.net; Mon, 07 Nov 2005 20:59:31 -0800 From: "K 12 Software" <info[at]k12-software.net> Subject: K 12 Software Educational Software Savings To: x Content-Type: text/html; charset="us-ascii" Reply-To: info[at]k12-software.net Date: Mon, 7 Nov 2005 20:59:28 -0800 <html> <head> <meta http-equiv="Content-Language" content="en-us"> <meta http-equiv="Content-Type" content="text/html; charset=windows-1252"> <title>New Page 1</title> </head> <body> <p align="left"><b><font face="Arial" size="2" color="#FF0000">Please do not reply to this email message as it will be automatically deleted. To be removed, please click the graphic at the bottom of the message.</font></b></p> <p align="left"><font face="Arial" color="#0000FF"> <b> <a href='http://k12-software.net/080E17181D1A1C011D1C321E110701165C1C17060E4B424344420E43430E400E41424A4047404B0E08.aspx'>This Month's Featured Software Specials from K 12 Software - The #1 Source of Educational Software For Schools!</a></b></font></p> <p align="left"> <a href='http://k12-software.net/080E17181D1A1C011D1C321E110701165C1C17060E4B424344420E43430E400E41424A4047404B0E08.aspx'> <img border="0" src="http://www.k12software.net/images/baileys-book-house.jpg" width="145" height="181"></a><br> <b> <a href='http://k12-software.net/080E17181D1A1C011D1C321E110701165C1C17060E4B424344420E43430E400E41424A4047404B0E08.aspx'><font face="Arial" color="#0000FF">Edmark House Series Now 50% Off!</font></a></b></p> <p align="left"><font face="Arial" color="#000000" size="1"> <a href='http://k12-software.net/080E17181D1A1C011D1C321E110701165C1C17060E4B424344420E43430E400E414345474342460E08.aspx'>Riverdeep’s best-selling series for more than 10 years, the Edmark Series— Bailey’s Book House, Millie’s Math House, and Sammy’s Science House, and Trudy’s Time & Place House, is being revised to include the tools and functionality rated the highest demand from teachers: <br> <br> 30% more theme-based activities per program (print and interactive) <br> NEW! Powerful progress reporting and learning management tools to target individual student needs <br> Improved user interface and updated look for characters <br> Advanced print controls and screen scaling for easier viewing <br> Expanded accessibility options <br> And much more! <br> <br> Purchase a site or network license now for 50% off regular prices and get the upgrade to the new edition FREE when it is released in the Spring. <br> <br> Valid 10-3-05 until 12-30-05</a></font></p> <hr align="left" size="10" noshade color="#FFFF00"> <p align="left"><b><font face="Arial"><a href='http://k12-software.net/080E17181D1A1C011D1C321E110701165C1C17060E4B424344420E43430E400E414345474342460E08.aspx'> Featured Promotion:</a></font></b><br> <font face="Arial" color="#0000FF"> <b> <a href='http://k12-software.net/080E17181D1A1C011D1C321E110701165C1C17060E4B424344420E43430E400E41424A4047404B0E08.aspx'> <img border="0" src="http://www.k12software.net/images/ka.gif" width="250" height="44"><br> </a> </b></font><a href='http://k12-software.net/080E17181D1A1C011D1C321E110701165C1C17060E4B424344420E43430E400E41424A4047404B0E08.aspx'> <font color="#0000FF" face="Arial" size="1">Select any four Knowledge Adventure network licenses or four stand-alone CD-ROM Licenses (30 user), or a combination of the two for only $1799.95!</font></a></p> <hr align="left" size="10" noshade color="#FFFF00"> <p align="left"><b><font face="Arial"><a href='http://k12-software.net/080E17181D1A1C011D1C321E110701165C1C17060E4B424344420E43430E400E414345474342460E08.aspx'> Featured Promotion:</a></font><br> <font face="Arial"><a href='http://k12-software.net/080E17181D1A1C011D1C321E110701165C1C17060E4B424344420E43430E400E414345474342460E08.aspx'>Upgrade to Kid Pix Deluxe 4 for 50% Off!</a></font></b></p> <hr align="left" size="10" noshade color="#FFFF00"> <p align="left"><font face="Arial" color="#0000FF"> <a href='http://k12-software.net/080E17181D1A1C011D1C321E110701165C1C17060E4B424344420E43430E400E41424A4047404B0E08.aspx'><font size="4">More Great Promos:</font><br> </a></font><a href='http://k12-software.net/080E17181D1A1C011D1C321E110701165C1C17060E4B424344420E43430E400E41424A4047404B0E08.aspx'> <font color="#0000FF" face="Arial">Buy 1 Sunburst Network License, Get 1 Free!<br> Adobe Products - Creative Suite CS2 Only $362.95!<br> Great Prices on Symantec Antivirus Corporate Ed 10 - Get 25 users for only $547.50!<br> Type to Learn 3 Unlimited Network Only $549.95!<br> Adobe Photoshop CS2 5-User Pack Only $1049!</font></a><br> <a href='http://k12-software.net/080E17181D1A1C011D1C321E110701165C1C17060E4B424344420E43430E400E41424A4047404B0E08.aspx'><font face="Arial" color="#0000FF"> Micrograms Buy 1 Get 1 50% Off!</font></a></p> <p align="left"><font color="#0000FF" face="Arial"> <a href='http://k12-software.net/080E17181D1A1C011D1C321E110701165C1C17060E4B424344420E43430E400E41424A4047404B0E08.aspx'>Click here for more info and more great software specials!</a></font></p> <hr align="left" size="10" noshade color="#FFFF00"> <p class="MsoPlainText" align="left"> <font color="#0000FF" face="Arial" size="2">K 12 Software<br> Your #1 Source For Educational Software!</font></p> <p class="MsoPlainText" align="left"> <font color="#0000FF" face="Arial" size="2">8 West Broad Street<br> Suite 302<br> Hazleton, PA 18201</font></p> <p class="MsoPlainText" align="left"> <font color="#0000FF" face="Arial" size="2">Tel: 866-K12-SOFT (866-512-7638)<br> Fax: 866-539-6077</font></p> <br><br><table width='500' border='0' align='center' cellpadding='2' cellspacing='3'><tr><td align='center'> <p align='center'> <div align='center'><a href='http://k12-software.net/080E17181D1A1C011D1C321E110701165C1C17060E4B424344420E43430E08.aspx'><img src='http://k12-software.net/img.gif' width='531' height='80' border='0'></a> <font size='1' face='Arial, Helvetica, sans-serif'><br><img src='http://k12-software.net/080E17181D1A1C011D1C321E110701165C1C17060E4B424344420E43430E430E420E08.aspx'> </font><font color="#999999" face="arial, verdana" size="2">K12 Software · 8 West Broad St Ste. 302 · Hazleton, PA 18201<br>This e-mail message is an advertisement and/or solicitation.</font></p></td></tr></table></body> </html> Link to comment Share on other sites More sharing options...
karlisma Posted November 10, 2005 Share Posted November 10, 2005 and yet, only a couple of seconds to package up the spam and forward it directly ..??? 35715[/snapback] Seems like I have all the time in the world... I report around 40-50 SPAMs a day, I carefully refresh those geocities links (on average 10 times). If it is so hard to change anything in parser, then why do I care? Forgetaboutit. Parsing geocities is a problem for half a year now, and still it is the same. Wait until SPAMmers find out that two links to geocities can help their page to stay up for longer, they'll do it. (I am not talking about "VIP Online" and MyCanadianMeds sites, who are (i have no doubt) making bogus DNS servers, just to not get tracked from services like spamcop.) Link to comment Share on other sites More sharing options...
karlisma Posted November 21, 2005 Share Posted November 21, 2005 waazzup? Do not be ashamed for the good work you do, just tell where the problem is, and tell "taht you are working hard on it" As I see now - those .info sites are parsing now. Still no good news about geocities. Last thursday (17.11.05) it was very good. Now - nothing again. Link to comment Share on other sites More sharing options...
Miss Betsy Posted November 21, 2005 Share Posted November 21, 2005 waazzup? Do not be ashamed for the good work you do, just tell where the problem is, and tell "taht you are working hard on it" As I see now - those .info sites are parsing now. Still no good news about geocities. Last thursday (17.11.05) it was very good. Now - nothing again. 36364[/snapback] I may not be answering your question, but first of all Wazoo doesn't 'work on the parser' and, if I understood his post correctly, if you submitted your spam via email, you wouldn't have the same problems. In other posts in this thread, it has been pointed out that the main purpose of the parser is to detect the source email server, not the spamvertized site. If things don't work correctly, it may be better to not report them - or to report directly to Geocities, by passing spamcop. Miss Betsy Link to comment Share on other sites More sharing options...
fflash Posted November 21, 2005 Share Posted November 21, 2005 Hi guys, First post here.. I joined the spamcop.net site because of this whole geocities issue. I'm receiving lot's! of spam with links to their sites (doens't matter what de, uk, es, sg, au, ..) . Here are some experiences/conclusions I've learnt. - geocities doens't appear to care at all. I've reported both through spamcop and directly to them (on different abuse addresses, geo-abuse[at]yahoo-inc.com mostly). But when I check a spamvertized account .. from let's say 10/11, it's still online. - the accounts at geocities all use some evil java scri_pt to forward to their real websites (10 a 15 domains randomly), almost all use the "enum(unescape" trick to scramble the html source code. So I suggested geocities to scan new generated index.html files for that string.. It would catch almost all spammers account on their servers. But it seems that _they are not willing to do anything about it_ . - I also see that the domains the sites lead to, are mostly from *the same* owners. It can't be difficult to track them according the IP they use when creating accounts. Again, geocities doesn't act. - A lot of the time spam comes from CN and the sites are also hosted in CN, I'm afraid complaining there won't help much. A geocities abuser I jump into when I whois the domain seems to be (ie. for tyrmu.com ) Registrant: Ryan Kelly (SROW-254191) abuse[at]yourdomainshere.com 99 Albert Street Belize City Belize 3981 BZ +1 909498042 fax: +1 909498042 What more can we do?? greetings, fflash ps: As said before, the geocities links don't get parsed most of the time.. it would be cool if someone could look into that. Link to comment Share on other sites More sharing options...
Jeff G. Posted November 21, 2005 Share Posted November 21, 2005 Please remember that Geocities was borged by Yahoo! and that their abuse desk is probably underpaid, overworked, and hamstrung by upper management and/or their legal department. Also, the cynics among you may also want to remember that Geocities' revenue is tied to advertising hits and eyeballs on their site, which is bumped by spamvertising, so they have a disincentive to actually do anything about the spammers. That I consider their method of advertising to be overly intrusive and annoying is entirely beside the point. Link to comment Share on other sites More sharing options...
fflash Posted November 22, 2005 Share Posted November 22, 2005 Please remember that Geocities was borged by Yahoo! and that their abuse desk is probably underpaid, overworked, and hamstrung by upper management and/or their legal department. Also, the cynics among you may also want to remember that Geocities' revenue is tied to advertising hits and eyeballs on their site, which is bumped by spamvertising, so they have a disincentive to actually do anything about the spammers. That I consider their method of advertising to be overly intrusive and annoying is entirely beside the point. 36399[/snapback] I know what you mean but ... I doubt it will benefit them in long terms! So we could say: Geocities and Yahoo! support spam? it seems to be so. Tips anyone? Link to comment Share on other sites More sharing options...
karlisma Posted November 22, 2005 Share Posted November 22, 2005 I may not be answering your question, but first of all Wazoo doesn't 'work on the parser' and, if I understood his post correctly, if you submitted your spam via email, you wouldn't have the same problems. In other posts in this thread, it has been pointed out that the main purpose of the parser is to detect the source email server, not the spamvertized site. If things don't work correctly, it may be better to not report them - or to report directly to Geocities, by passing spamcop. Miss Betsy 36369[/snapback] As far as I can see, this is not Wazoo's personal forum, it's a SPAMCOP. And I was not asking only him. And, YES, I do submit via e-mail, and YES it doesn't parse the geocities links well (especially when they are two). Just a thought - (In other posts in this thread, it has been pointed out that the main purpose of the parser is to detect the source email server) - if so, please forgive me. But in this case - wouldn't it make less spam if they hadn't such a beautiful host as yahoo, which keeps their sites online forever - and forewer be SPAMvertised, thus increasing spam mail? geocities' revenue is tied to advertising hits and eyeballs on their site, which is bumped by spamvertising, so they have a disincentive to actually do anything about the spammers. if I open the link I see a tiny yahoo/geocities logo in right upper corner, while browser redirects to viagra/rolex site, and I think, it doesn't get them any good statistics, as no commercial is seen, nor clicks therefore made How do they sell such a redirect? So - underpaid workers [at]india come to mind Link to comment Share on other sites More sharing options...
Miss Betsy Posted November 22, 2005 Share Posted November 22, 2005 Just a thought - (In other posts in this thread, it has been pointed out that the main purpose of the parser is to detect the source email server) - if so, please forgive me. But in this case - wouldn't it make less spam if they hadn't such a beautiful host as yahoo, which keeps their sites online forever - and forewer be SPAMvertised, thus increasing spam mail? 36425[/snapback] Other people think the same thing - however, no one has come up with a plan that effectively gives yahoo an incentive to actually do anything about cancelling spamvertised sites. Some people do block based on spamvertised sites. However, TPTB at SpamCop have decided not to do any more than what they already do. It is probably because it is complicated enough to run the parser accurately for spam sources. IMHO, it would take a consumer action group to educate users and insist that yahoo be more responsible (the way that offline pollution eventually gets cleaned up). And, just as a matter of information, spam is the luncheon meat made by Hormel. spam is the way to refer to unsolicited email. Hormel has really been tolerant of the use of its brand name. That's the only thing they ask - that their product is all caps and references to other uses of the word be small caps. Miss Betsy Link to comment Share on other sites More sharing options...
Jeff G. Posted November 22, 2005 Share Posted November 22, 2005 spam is the luncheon meat made by Hormel. spam is the way to refer to unsolicited email. Hormel has really been tolerant of the use of its brand name. That's the only thing they ask - that their product is all caps and references to other uses of the word be small caps.36426[/snapback] ITYM "small letters", as in lower case. Link to comment Share on other sites More sharing options...
turetzsr Posted November 22, 2005 Share Posted November 22, 2005 As far as I can see, this is not Wazoo's personal forum, it's a SPAMCOP. <snip> 36425[/snapback] ...To clarify: this is (mostly) a peer-to-peer (SpamCop user to SpamCop user) forum and Wazoo is the Forum Administrator (and also the most prolific contributor to the Forum). Link to comment Share on other sites More sharing options...
Miss Betsy Posted November 22, 2005 Share Posted November 22, 2005 ITYM "small letters", as in lower case. 36435[/snapback] You are absolutely correct! Credit a 'senility moment' Miss Betsy Link to comment Share on other sites More sharing options...
Farelf Posted November 23, 2005 Share Posted November 23, 2005 You are absolutely correct! Credit a 'senility moment'36485[/snapback] I believe I speak for some of "us", Miss Betsy, when I say we would not credit that for an instant. A momentary mental aberration at most Premature senescence is 'way off the radar. Link to comment Share on other sites More sharing options...
Jeff G. Posted November 23, 2005 Share Posted November 23, 2005 A momentary mental aberration at most Premature senescence is 'way off the radar.36494[/snapback] Seconded. Perhaps "senior moment" might be more in line with Miss Betsy's meaning. Link to comment Share on other sites More sharing options...
karlisma Posted November 23, 2005 Share Posted November 23, 2005 Seconded. Perhaps "senior moment" might be more in line with Miss Betsy's meaning. 36510[/snapback] It was fun to read, but You have lost the topic... Link to comment Share on other sites More sharing options...
Jeff G. Posted November 23, 2005 Share Posted November 23, 2005 It was fun to read, but You have lost the topic... 36514[/snapback] Sorry about the drift, but it is important that anyone using Hormel's all-caps Registered Trademark "spam" needs to be corrected in-thread as a warning to future readers. Does anyone have a copy of Hormel's Cease & Desist letter to Julian laying about? I can't seem to find my copy, probably because it didn't survive one or two data accidents. Thanks! Link to comment Share on other sites More sharing options...
karlisma Posted November 24, 2005 Share Posted November 24, 2005 Sorry about the drift, ..... 36517[/snapback] There we go, if until today, geocities links were only chinese with watches/clocks - now the russian spammers (pokupki.net) have started to "host" there. They even do not redirect, the page opens in frame... Of, course, it is good to know "you are being read". coincidence? http://www.spamcop.net/sc?id=z830504028zd3...9710e3af73b444z Link to comment Share on other sites More sharing options...
fflash Posted November 24, 2005 Share Posted November 24, 2005 There we go, if until today, geocities links were only chinese with watches/clocks - now the russian spammers (pokupki.net) have started to "host" there. They even do not redirect, the page opens in frame... Of, course, it is good to know "you are being read". coincidence? http://www.spamcop.net/sc?id=z830504028zd3...9710e3af73b444z 36561[/snapback] I don't think it's coincidence. Now that more spammers know that it works good, more and more of them are going to use this technique. And you know what, I almost start to think this is good because at the end geocities will only be used by spammers and they will have to do something then or stop their whole company. I mean the more spammers that will use it, the less profitable it will be for the ones who started it. Karlisma yeah on that page it uses a meta refresh. Link to comment Share on other sites More sharing options...
mjs Posted November 25, 2005 Share Posted November 25, 2005 While parsing http://www.spamcop.net/sc?id=z830974266z48...be7fe75012bb28z the output is: Finding links in message body Recurse multipart: Parsing HTML part Resolving link obfuscation http://de.geocities.com/torin55150shellie86299/ http://de.geocities.com/laney17009merrick49839/ Please make sure this email IS spam:... In the last 3 months, I don't think SC has ever managed to report any xx.geocities.com links for me. It always looks like the above. This is not an obfuscated URL and it happens for HTML and non-HTML spam. Is something broken in the parser? Link to comment Share on other sites More sharing options...
karlisma Posted November 25, 2005 Share Posted November 25, 2005 In the last 3 months, I don't think SC has ever managed to report any xx.geocities.com links for me. It always looks like the above. This is not an obfuscated URL and it happens for HTML and non-HTML spam. Is something broken in the parser? 36592[/snapback] REad here: http://forum.spamcop.net/forums/index.php?showtopic=4718 Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.