groupboard Posted July 19 Posted July 19 Recently a lot of reports have showing bondedsender.org, and when reports it says reports disabled for bondedsender@spamcop.net, e.g.: https://www.spamcop.net/sc?id=z6904625174z31e073bbd1791c69185443e08501248bz The odd thing is when I go back to this report, it says it would be reported to abuse@nuxt.cloud, but when I originally reported it, it said reports disabled for bondedsender@spamcop.net. This is clearly just some small business' virus infected server, nothing that would be listed on Validity's whitelist. Recently there have been quite a few of these bondedsender reports. It says "confirmed opt in only", but no info on what actual whitelist it is on or how to report it. Quote
petzl Posted July 19 Posted July 19 (edited) 6 hours ago, groupboard said: Recently a lot of reports have showing bondedsender.org, and when reports it says reports disabled for bondedsender@spamcop.net, e.g.: https://www.spamcop.net/sc?id=z6904625174z31e073bbd1791c69185443e08501248bz The odd thing is when I go back to this report, it says it would be reported to abuse@nuxt.cloud, but when I originally reported it, it said reports disabled for bondedsender@spamcop.net. This is clearly just some small business' virus infected server, nothing that would be listed on Validity's whitelist. Recently there have been quite a few of these bondedsender reports. It says "confirmed opt in only", but no info on what actual whitelist it is on or how to report it. The clever dicks have disabled spamcop reports, don't stop them being reported and spamtraped Not using spamtrap poisoned emails as they have your address try unsubscribe if not working Companies like Google. Facebook seem to me a source for legit email addresses! Then report to UK CERT incidents [AT] ncsc [DOT] gov[DOT] uk Also include their abuse address https://www.first.org/members/teams/national_cyber_security_centre-uk IN SUBJECT put 147.45.196.3 UNSUBSCRIBE NOT WORKING/NEVER SUBSCRIBED https://www.spamcop.net/w3m?action=checkblock&ip=147.45.196.3 Causes of listing SpamCop users have reported system as a source of spam less than 10 times in the past week Express-delisting is not available (that means clever dick has checked the box "fixed" so they don't like it) Listing History In the past 7.0 days, it has been listed 2 times for a total of 27 hours Other hosts in this "neighborhood" with spam reports 147.45.196.111 147.45.196.133 147.45.196.136 147.45.196.253 Edited July 19 by petzl Quote
groupboard Posted July 20 Author Posted July 20 No, I think this is something else (unless there has been a change on spamcop). If sh**host.org says they've fixed the problem, spamcop will say "reports disabled for abuse@sh**host.org". However, in this case it's saying "reports disabled for bondedsender@admin.spamcop.net". Also, spamcop says "listed on plus.bondedsender.org" and "confirmed opt-in only". So, it's some kind of whitelist owned by validity.com (previously bondedsender.org). The odd thing is that if I click on a past report (e.g. the one I posted above), there is no mention of bondedsender.org. It's happened in about 5 reports in the past week. Or is it just some kind of trolling by spamcop? Quote
petzl Posted July 20 Posted July 20 (edited) 40 minutes ago, groupboard said: No, I think this is something else (unless there has been a change on spamcop). If sh**host.org says they've fixed the problem, spamcop will say "reports disabled for abuse@sh**host.org". However, in this case it's saying "reports disabled for bondedsender@admin.spamcop.net". Also, spamcop says "listed on plus.bondedsender.org" and "confirmed opt-in only". So, it's some kind of whitelist owned by validity.com (previously bondedsender.org). The odd thing is that if I click on a past report (e.g. the one I posted above), there is no mention of bondedsender.org. It's happened in about 5 reports in the past week. Or is it just some kind of trolling by spamcop? abuse@sh**host.org". possibly was the original abuse address which through SpamCops web page disable reports for their IP range SpamCop never forgets. Manual reports count much higher towards being placed on blocklist than spamtrap ones do Edited July 20 by petzl Quote
groupboard Posted July 20 Author Posted July 20 I think it's just a bug in spamcop. See for example: https://www.spamcop.net/sc?id=z6904670749zb8c1468c5b3de3ebee3bb8da862deac9z When I reported it, it said: "Reports disabled for bondedsender@admin.spamcop.net spam report id 7339673808 sent to: abuse@vodafone.cz /dev/null'ing report for abuse#finaltek.com@devnull.spamcop.net" Now, if you click on the report, there is no mention of bondedsender@admin.spamcop.net, and clearly this spam has nothing to do with bondedsender. Quote
AmyLynn Posted July 20 Posted July 20 Every report I've made today keeps coming back this way. I suspect spamcop is down. Quote
petzl Posted July 20 Posted July 20 7 hours ago, groupboard said: I think it's just a bug in spamcop. See for example: https://www.spamcop.net/sc?id=z6904670749zb8c1468c5b3de3ebee3bb8da862deac9z When I reported it, it said: "Reports disabled for bondedsender@admin.spamcop.net spam report id 7339673808 sent to: abuse@vodafone.cz /dev/null'ing report for abuse#finaltek.com@devnull.spamcop.net" Now, if you click on the report, there is no mention of bondedsender@admin.spamcop.net, and clearly this spam has nothing to do with bondedsender. I think it's a legacy issue, possibly from last millennium, same for a lot of now fake hard coded abuse addresses some now bouncing back? Quote
seweryn Posted July 21 Posted July 21 My todays reports has this problem too. Something is wrong. Quote
Spamnophobic Posted July 21 Posted July 21 (edited) More or less the same here; the screen just keeps going back to a new "Report another spam" screen with dev/nulled report, apparently ad infinitum. Is the system broken, or have spammers found another clever way to throw a spanner in the works of SpamCop? Most importantly, what should we do? Are there still any SpamCop admins we could alert? Incidentally this is a concerted serious extortion spam attack. Edited July 21 by Spamnophobic Added more informatoin Quote
AmyLynn Posted July 21 Posted July 21 I emailed the ADMIN. I thought about doing it yesterday. But I thought coming here would be enough. Still broken for me as well. EVERYTHING I report. Quote
groupboard Posted July 21 Author Posted July 21 Yep, spamcop seems to be broken. All reports are just showing "Internal spamcop handling: (bondedsender)" and then "Reports disabled for bondedsender@admin.spamcop.net". Also, not showing any past reports any more. Quote
Spamnophobic Posted July 22 Posted July 22 (edited) In working through "my" spam I have noticed that when I am in the seeming loop, that is, clicking "Send spam Report(s) Now", when it is just going to go back to the same report, on the "Unreported spam Saved:" the "Report Now" link has turned purple instead of being blue. My rather inexpert assessment is that the criminals have hacked the first spam report page to make the link refer back to the report that has already been (hopefully) submitted. If I click "Cancel" instead of "Send spam Report(s) Now" the reporting goes on to the next, not yet submitted report. Meanwhile "bondedsender@admin.spamcop.net", the only quoted destination for reports remains "disabled". Is Don D'Minion still around? Or any other Deputy? OMG, did I just remember correctly that Don died? If so I am very, very sorry for that. Edited July 22 by Spamnophobic Added information Quote
Spamnophobic Posted July 22 Posted July 22 20 hours ago, AmyLynn said: I emailed the ADMIN. I thought about doing it yesterday. But I thought coming here would be enough. Still broken for me as well. EVERYTHING I report. Not showing past reports on first refresh is standard SpamCop behaviour. Click on "View recent reports" to see those in "Report History" over 24 hours, then use the drop-down to view less recent reports, then keep clicking "Older Reports"; this will go back to maximally about 3 months ago, and on my side of the screen anyway, includes reports before these bogus reports. Hope this helps. Quote
groupboard Posted July 22 Author Posted July 22 2 hours ago, Spamnophobic said: Not showing past reports on first refresh is standard SpamCop behaviour. Click on "View recent reports" to see those in "Report History" over 24 hours, then use the drop-down to view less recent reports, then keep clicking "Older Reports"; this will go back to maximally about 3 months ago, and on my side of the screen anyway, includes reports before these bogus reports. Hope this helps. No matter what timeframe I click on, it never shows any reports. It just says "no reports found". Quote
gnarlymarley Posted July 22 Posted July 22 (edited) I do find it interesting that a disabled "Third party interested in email source" can override the actual abuse addresses listed in whois. I did notice this comment in the source of one the issues one. Comment: SpamCop::Web::Look $Revision$ produced by prod-sc-www03 Edited July 22 by gnarlymarley Quote
Spamnophobic Posted July 23 Posted July 23 22 hours ago, groupboard said: No matter what timeframe I click on, it never shows any reports. It just says "no reports found". Do you have any spam reports which should predate these bogus reports? If so, do these also say "no reports found"? However, clearly there is some kind of attack underway on SpamCop. In the last weeks I have been receiving huge amounts of extortion spam, so-called "from myself", a usual trick. That I have just been quietly reporting them has obviously infuriated the spammers. So now an attack is underway, at least that is my take on the situation. We really need help from SpamCop deputies to fix the system, as well as input from experienced spamfighters who can help block the attacks. Quote
Spamnophobic Posted July 23 Posted July 23 On 7/20/2024 at 12:56 AM, petzl said: The clever dicks have disabled spamcop reports, don't stop them being reported and spamtraped Not using spamtrap poisoned emails Quote as they have your address Of course they have "my" address. That is why I give it to them. Like cheese in a mousetrap. If you "unsubscribe" you'll just get even more spam. spam, spam, spam. On 7/20/2024 at 12:56 AM, petzl said: try unsubscribe if not working Companies like Google. Facebook seem to me a source for legit email addresses! Then report to UK CERT incidents [AT] ncsc [DOT] gov[DOT] uk Also include their abuse address https://www.first.org/members/teams/national_cyber_security_centre-uk IN SUBJECT put 147.45.196.3 UNSUBSCRIBE NOT WORKING/NEVER SUBSCRIBED https://www.spamcop.net/w3m?action=checkblock&ip=147.45.196.3 Causes of listing SpamCop users have reported system as a source of spam less than 10 times in the past week Express-delisting is not available (that means clever dick has checked the box "fixed" so they don't like it) Listing History In the past 7.0 days, it has been listed 2 times for a total of 27 hours Other hosts in this "neighborhood" with spam reports 147.45.196.111 147.45.196.133 147.45.196.136 147.45.196.253 Quote
groupboard Posted July 23 Author Posted July 23 4 hours ago, Spamnophobic said: Do you have any spam reports which should predate these bogus reports? If so, do these also say "no reports found"? However, clearly there is some kind of attack underway on SpamCop. In the last weeks I have been receiving huge amounts of extortion spam, so-called "from myself", a usual trick. That I have just been quietly reporting them has obviously infuriated the spammers. So now an attack is underway, at least that is my take on the situation. We really need help from SpamCop deputies to fix the system, as well as input from experienced spamfighters who can help block the attacks. I've been using spamcop for decades. If I click on a link for a past report, I can see it. It's just the "past reports" link at the top of the spamcop website which isn't showing any reports. Quote
ninth Posted July 23 Posted July 23 5 hours ago, groupboard said: I've been using spamcop for decades. If I click on a link for a past report, I can see it. It's just the "past reports" link at the top of the spamcop website which isn't showing any reports. The past reports tab works for me at this stage? Quote
Cutsnake88 Posted July 25 Posted July 25 (edited) I've been getting the same message for virtually every report for the past couple of weeks Odd thing is, if I look at reports from a few days ago, it just says "No reports filed". I emailed Spamcop, and they're telling me it's a bug/error at Validity, and has something to do with "accredit.habeas.com". I've never heard of habeas, so I don't know what he's on about. Screenshots of all of this are below. Edited July 25 by Cutsnake88 Screenshots were looking wonky Quote
groupboard Posted July 25 Author Posted July 25 On 7/23/2024 at 3:12 PM, ninth said: The past reports tab works for me at this stage? Ok, thanks, I think I've figured out that problem. I see I have two different spamcop accounts. When I log in using my old account, I do see all my past reports. However, I've been logged in to my new account when reporting for the past few years, and that account has no past reports. The reporting doesn't seem to care which account you're logged into, it just uses the submission address. Makes sense, but I forgot about that. I see my alias for spamcop is the old account, so it is reporting via my old account even though I haven't been logged into it for a year. I've updated my alias to use the correct submission address. Anyway, that solves the no past reports issue. However, I see the bondedsender issue is still happening. Quote
Spamnophobic Posted July 29 Posted July 29 There seems to be some improvement. Although my report still sends a copy to the dreaded "bondedsender", a copy is now being also sent to the administrator of the mailserver from which the spam was sent. And the loopback on "Unreported spam saved" seems to have gone. I hope we are winning! If such success continues, as the next step "bondedsender" will no longer be receiving reports from me. Quote
petzl Posted July 29 Posted July 29 10 hours ago, Spamnophobic said: There seems to be some improvement. Although my report still sends a copy to the dreaded "bondedsender", a copy is now being also sent to the administrator of the mailserver from which the spam was sent. And the loopback on "Unreported spam saved" seems to have gone. I hope we are winning! If such success continues, as the next step "bondedsender" will no longer be receiving reports from me. Been a issue for years just got worse! Quote
jeffc Posted August 29 Posted August 29 For info, the "bonded sender" problem seems fixed as of around August 12. According to another forum post/thread there was a bug and it was fixed. My reports seem to be going to valid abuse contacts again. Hope yours are too. Quote
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.