A new low for spam

[oldskoolflash]

I am getting so disillusioned by reporting spam. It seems that spamcop is slipping further and further behind the spammers in this battle. I keep getting gif spam with no referenced websites and sources that change so quickly it is obvious the spammer doesn't care if they get reported and added to a blacklist.

Also I am finding spamcop less and less reliable at correctly tracing the source and is often giving hotmail reporting addresses (obviously owned by the spammer). Also am finding spamcop is failing to pharse headers properly (even after multiple refreshes) and correctly give reporting addresses for referenced websites.

And today, a new low, 35 spam emails overnight all from different sources, all referencing the same website http://kassir.ru - spamcop failed to find a reporting address for any of them! I hit a brick wall when trying to find a host for this website (probably for the same reason spamcop is failing to find a reporting address).

Sorry to vent, but I have to ask is it really worth the effort......?

[oldskoolflash]

A bit of an update - I think this may be a campaign against a legitimate website (see below) - I have had spammers do this before with the (genuine) dutch lottery website. They deliberately send malicious spam to addresses they know report spam. They are basically getting us to work for them....

I really hate these b*******

Tracking link: http://kassir.ru/

[report history]

ISP does not wish to receive report regarding http://kassir.ru/

Resolves to 217.73.200.248

Routing details for 217.73.200.248

[refresh/show] Cached whois for 217.73.200.248 : postmaster[at]stack.net abuse[at]stack.net

Using abuse net on postmaster[at]stack.net

abuse net stack.net = postmaster[at]stack.net, abuse[at]stack.net

Using best contacts postmaster[at]stack.net abuse[at]stack.net

ISP does not wish to receive reports regarding http://kassir.ru/ - no date available

http://kassir.ru/ has been appealed previously.

[turetzsr]

<snip>

It seems that spamcop is slipping further and further behind the spammers in this battle. I keep getting gif spam with no referenced websites

<snip>

...This shouldn't be a problem, per se. Not all spam references a web site. The principal goal of SpamCop is to determine the source of spam (IP address) and the abuse address for that source. The presence or absence of a referenced website has no bearing on the SpamCop's ability to do its principal job.

and sources that change so quickly it is obvious the spammer doesn't care if they get reported and added to a blacklist.

...Again, not a problem vis-a-vis SpamCop's principal mission.

Also I am finding spamcop less and less reliable at correctly tracing the source and is often giving hotmail reporting addresses (obviously owned by the spammer). Also am finding spamcop is failing to pharse headers properly (even after multiple refreshes)

<snip>

...This is (IMHO) a problem. Please forward evidence (spam with complete headers and tracking URL of the parse) to the SpamCop deputies at e-mail address deputies[at]spamcop.net. Thanks!

[oldskoolflash]

This is (IMHO) a problem. Please forward evidence (spam with complete headers and tracking URL of the parse) to the SpamCop deputies at e-mail address deputies[at]spamcop.net. Thanks!

Thanks, I've got quite a few examples of this, ill forward them, but it seems the parser is just using the contact info provided for that IP address. I do think that the parser should be a bit smarter and discard these addresses as fake.

BTW I have posted an example in this thread.