Habeas Reporting?

[Farelf]

"All warfare is based on deception." said Sun Tzu, except I suspect he said it in whatever passed for Mandarin 2,500 years ago. That being the case, these guys have to rate an "A" for audacity.

Received: from 32.97.166.40 (unknown[218.71.2.78](misconfigured sender))

by prserv.net (in4) with SMTP

id <200403101519381040bfr8gve>; Wed, 10 Mar 2004 15:22:12 +0000

X-Originating-IP: [218.71.2.78]

Received: from 0.64.5.179 by 218.71.2.78; Wed, 10 Mar 2004 00:15:11 -0300

Message-ID: <BPXGJRSYQGZSFRUUCZKH[at]telus.net>

X-Habeas-SWE-1: winter into spring

X-Habeas-SWE-2: brightly anticipated

X-Habeas-SWE-3: like Habeas SWE ™

X-Habeas-SWE-4: Copyright 2002 Habeas ™

X-Habeas-SWE-5: Sender Warranted Email (SWE) ™. The sender of this

X-Habeas-SWE-6: email in exchange for a license for this Habeas

X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant

X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this

X-Habeas-SWE-9: mark in spam to <http://www.habeas.com/report/>.

From: "inocencia riggs" <zg.inocencia[at]telus.net>

Reply-To: "inocencia riggs" <riggs[at]telus.net>

To: x

Cc: x, x, x, x, x, x, x, x, x

Subject: Fwd: All Pills Here. +X+ANAx - v|[at]gRa # Va|ium ? V1codin\ S0m[at] * Pn/t/ermin vpiyamxjhxec

Date: Wed, 10 Mar 2004 07:09:11 +0400

MIME-Version: 1.0

X-Mailer: Lotus Notes Release 5.0.9 November 16, 20016

Content-Type: multipart/mixed;

boundary="--68023425084512791290"

X-Mozilla-Status: 8001

X-Mozilla-Status2: 00000000

X-UIDL: 200403101519381040bfr8gve00099t

----68023425084512791290

Content-Type: text/html;

Content-Transfer-Encoding: 7Bit

We are one of the largest online pharmaceutical ordering services, providing medical consultations and prescription processing.

... etc, etc. (plain text) including URL link

Note also the "untruthful" Content-Type inside the first part boundary which would deceive link parsing.

Does SpamCop co-operate with the Habeas organization on these? I don't know much about them, I've only reported to SpamCop.

I guess if the spam fight was a war we would be in a strategically hopeless position (we don't use deceit ;-) Sun Tzu also said "If you know the enemy and know yourself, you need not fear the result of a hundred battles." It would be sort of great if we could have a "trophy room" showing the current flavours of spam tricks and deception. But I suppose that would be tantamount to composing a free "how to" manual for the little devils. Things used to far simpler when warfare was all edgeware and pointy sticks.

[Wazoo]

Yes, Habeas headers found get an automatic "send" to Habeas. In theory, they have the power, budget, lawyers, staff to go after folks for the "copyrite" violation .. how successful they've been, I couldn't guess.

[Farelf]

Thanks Wazoo. I just reported another one and *this time* was sufficiently awake to read the line "Habeas headers found - reporting" in my confirmation. I'm learning (slowly)

[Wazoo]

No problem , it was an easy answer because this speific issue has been raised over the last several days over in the newsgroups. One user also missed the "habeas report sent" notice, sent her own report in .. she just posted the answer from Habeas, who'd advised that SpamCop was already sending them the report, so she didn't have to do the extra work to send the additional copy <g> ... But, that response didn't include the good news that they'd tracked the lowlife down and had charges brought, so there's still the question as to just how powerful the legal side of their game plan is actually going.

[Farelf]

Wow - none for over a year, suddenly I'm swamped again with spam with Habeas headers, as in http://www.spamcop.net/sc?id=z800779994z21...8c8193246dff44z

SpamCop handling appears to have changed but I note

Internal spamcop handling: (habeas)

Just to be be sure I sent manual reports to support<at>habeas.com, who respond

Due to higher than normal support requests, we are experiencing a delay with regards to our average response time.

[Wazoo]

SpamCop handling appears to have changed but I note Just to be be sure I sent manual reports to support<at>habeas.com, who respond

32169[/snapback]

I am curious, noting that the Tracking URL shows that Mole Reporting mode is in use. In that display, the only place that the Habeas complaint shows up is under the "if reported today" section. In contrast to other report actions that go to 'internal' addresses and such, there is no report-ID showing for this specific complaint. Therefore, my "guess" is that this complaint would actually be overriden by the Mole status setting ... ???

[Farelf]

<snip>Therefore, my "guess" is that this complaint would actually be overriden by the Mole status setting ... ???

32177[/snapback]

Thanks Wazoo - looks like you are right, therfore us underappreciated, overworked Moles should manually report if we want to involve Habeas. (Noting the correct reporting address appears to be reports <at> habeas.com)

[StevenUnderwood]

therfore us underappreciated, overworked Moles should manually report if we want to involve Habeas. (Noting the correct reporting address appears to be reports <at> habeas.com)

32184[/snapback]

You underappreciated, overworked Moles should manually report to anybody you actually want to receive a report (or turn off mole status). That is the whole purpose of Mole status...NO REPORTS.

[Farelf]

<snip>That is the whole purpose of Mole status...NO REPORTS.

32185[/snapback]

Yes, but that was not always the case so far as reports to Habeas were concerned, the highlighting of which was the whole purpose of my previous post, along with a little attempted humor, so I failed dismally on both counts, thanks for that ;-) Whether or not third party reports were actually sent is another matter but that's what the confirmations seemed to show. No longer ... it is apparently all perfectly consistent, as you say.

[StevenUnderwood]

Yes, but that was not always the case so far as reports to Habeas were concerned, the highlighting of which was the whole purpose of my previous post,

32193[/snapback]

Sorry, missed that part

[Wazoo]

However, worth sending a query upstream ... as we're all trying to guess at appearances at this point.

[Richard W]

Does SpamCop co-operate with the Habeas organization on these?  I don't know much about them, I've only reported to SpamCop.

3797[/snapback]

Where Habeas headers are picked up, SC will send a report to them through our internal routing. However, where a user has chosen to be a "mole", no reports are sent to anyone, including Habeas.

The report record for this shows:

# xxxx ( http://www.62mort.net/book ) To: mole[at]devnull.spamcop.net

# xxxx ( http://www.62mort.net/?id=a67 ) To: mole[at]devnull.spamcop.net

# xxxx ( 80.64.90.94 ) To: mole[at]devnull.spamcop.net

Interestingly, this is the only spam of 15 in our db for that IP with the Habeas header. There are several that show up when looking at the report history on the URL though, so habeas should be aware.

Richard

SpamCop Deputy

[Wazoo]

Thanks Richard for the fast and detailed response!

[Farelf]

Yes, good to have clarified, thanks to all.

Habeas headers in connection with that URL http://www.62mort.net/... - yes, interesting, all but one spam I received refering to the URL carried Habeas headers. Unfortunately my mail is heavily filtered so this is no certain indication of what was sent.

If further research is productive, reports with Habeas headers were:

http://www.spamcop.net/sc?id=z800780001z5b...dc1fc703556c4ez

http://www.spamcop.net/sc?id=z800780000zc8...909ea032eefe02z

http://www.spamcop.net/sc?id=z800779994z21...8c8193246dff44z

http://www.spamcop.net/sc?id=z800779992z1a...ad4e35ab971c70z

http://www.spamcop.net/sc?id=z800779997z89...fd37205a8a5de9z

http://www.spamcop.net/sc?id=z800724026z40...cc2613e550bbdez

(Feel we can most likely leave it all in the hands of Habeas, myself).