reports disabled for bondedsender

[groupboard]

Recently a lot of reports have showing bondedsender.org, and when reports it says reports disabled for bondedsender@spamcop.net, e.g.:

https://www.spamcop.net/sc?id=z6904625174z31e073bbd1791c69185443e08501248bz

The odd thing is when I go back to this report, it says it would be reported to abuse@nuxt.cloud, but when I originally reported it, it said reports disabled for bondedsender@spamcop.net. This is clearly just some small business' virus infected server, nothing that would be listed on Validity's whitelist.

Recently there have been quite a few of these bondedsender reports. It says "confirmed opt in only", but no info on what actual whitelist it is on or how to report it.

[petzl]

6 hours ago, groupboard said:

Recently a lot of reports have showing bondedsender.org, and when reports it says reports disabled for bondedsender@spamcop.net, e.g.:

https://www.spamcop.net/sc?id=z6904625174z31e073bbd1791c69185443e08501248bz

The odd thing is when I go back to this report, it says it would be reported to abuse@nuxt.cloud, but when I originally reported it, it said reports disabled for bondedsender@spamcop.net. This is clearly just some small business' virus infected server, nothing that would be listed on Validity's whitelist.

Recently there have been quite a few of these bondedsender reports. It says "confirmed opt in only", but no info on what actual whitelist it is on or how to report it.

The clever dicks have disabled spamcop reports, don't stop them being reported and spamtraped
Not using spamtrap poisoned emails as they have your address try unsubscribe if not working
Companies like Google. Facebook seem to me a source for legit email addresses!
Then report to UK CERT   incidents [AT] ncsc [DOT]  gov[DOT] uk
Also include their abuse address
https://www.first.org/members/teams/national_cyber_security_centre-uk
IN SUBJECT put
147.45.196.3 UNSUBSCRIBE NOT WORKING/NEVER SUBSCRIBED


https://www.spamcop.net/w3m?action=checkblock&ip=147.45.196.3

Causes of listing
SpamCop users have reported system as a source of spam less than 10 times in the past week
Express-delisting is not available (that means clever dick has checked the box "fixed" so they don't like it)
Listing History
In the past 7.0 days, it has been listed 2 times for a total of 27 hours
Other hosts in this "neighborhood" with spam reports
147.45.196.111  147.45.196.133  147.45.196.136   147.45.196.253

Edited July 19 by petzl

[groupboard]

No, I think this is something else (unless there has been a change on spamcop). If sh**host.org says they've fixed the problem, spamcop will say "reports disabled for abuse@sh**host.org". However, in this case it's saying "reports disabled for bondedsender@admin.spamcop.net". Also, spamcop says "listed on plus.bondedsender.org" and "confirmed opt-in only". So, it's some kind of whitelist owned by validity.com (previously bondedsender.org).

The odd thing is that if I click on a past report (e.g. the one I posted above), there is no mention of bondedsender.org. It's happened in about 5 reports in the past week.

Or is it just some kind of trolling by spamcop?

[petzl]

40 minutes ago, groupboard said:

No, I think this is something else (unless there has been a change on spamcop). If sh**host.org says they've fixed the problem, spamcop will say "reports disabled for abuse@sh**host.org". However, in this case it's saying "reports disabled for bondedsender@admin.spamcop.net". Also, spamcop says "listed on plus.bondedsender.org" and "confirmed opt-in only". So, it's some kind of whitelist owned by validity.com (previously bondedsender.org).

The odd thing is that if I click on a past report (e.g. the one I posted above), there is no mention of bondedsender.org. It's happened in about 5 reports in the past week.

Or is it just some kind of trolling by spamcop?

 abuse@sh**host.org". possibly was the original abuse address which through SpamCops  web page disable reports for their IP range
SpamCop never forgets. 
Manual reports count much higher towards being placed on blocklist than spamtrap ones do

Edited July 20 by petzl

[groupboard]

I think it's just a bug in spamcop. See for example:

https://www.spamcop.net/sc?id=z6904670749zb8c1468c5b3de3ebee3bb8da862deac9z

When I reported it, it said:

"Reports disabled for bondedsender@admin.spamcop.net

spam report id 7339673808 sent to: abuse@vodafone.cz
/dev/null'ing report for abuse#finaltek.com@devnull.spamcop.net"

Now, if you click on the report, there is no mention of bondedsender@admin.spamcop.net, and clearly this spam has nothing to do with bondedsender.

[AmyLynn]

Every report I've made today keeps coming back this way. I suspect spamcop is down. 

[petzl]

7 hours ago, groupboard said:

I think it's just a bug in spamcop. See for example:

https://www.spamcop.net/sc?id=z6904670749zb8c1468c5b3de3ebee3bb8da862deac9z

When I reported it, it said:

"Reports disabled for bondedsender@admin.spamcop.net

spam report id 7339673808 sent to: abuse@vodafone.cz
/dev/null'ing report for abuse#finaltek.com@devnull.spamcop.net"

Now, if you click on the report, there is no mention of bondedsender@admin.spamcop.net, and clearly this spam has nothing to do with bondedsender.

I think it's a legacy issue, possibly from last millennium, same for a lot of now fake hard coded abuse addresses some now bouncing back?

[seweryn]

My todays reports has this problem too. Something is wrong.

[Spamnophobic]

More or less the same here; the screen just keeps going back to a new "Report another spam" screen with dev/nulled report, apparently ad infinitum. Is the system broken, or have spammers found another clever way to throw a spanner in the works of SpamCop? Most importantly, what should we do? Are there still any SpamCop admins we could alert? Incidentally this is a concerted serious extortion spam attack.

Edited July 21 by Spamnophobic
Added more informatoin

[AmyLynn]

I emailed the ADMIN. I thought about doing it yesterday. But I thought coming here would be enough. Still broken for me as well. EVERYTHING I report.

[groupboard]

Yep, spamcop seems to be broken. All reports are just showing "Internal spamcop handling: (bondedsender)" and then "Reports disabled for bondedsender@admin.spamcop.net".

Also, not showing any past reports any more.

[Spamnophobic]

In working through "my" spam I have noticed that when I am in the seeming loop, that is, clicking "Send spam Report(s) Now", when it is just going to go back to the same report, on the "Unreported spam Saved:" the "Report Now" link has turned purple instead of being blue. My rather inexpert assessment is that the criminals have hacked the first spam report page to make the link refer back to the report that has already been (hopefully) submitted.

If I click "Cancel" instead of "Send spam Report(s) Now" the reporting goes on to the next, not yet submitted report. Meanwhile "bondedsender@admin.spamcop.net", the only quoted destination for reports remains "disabled".

Is Don D'Minion still around? Or any other Deputy?

OMG, did I just remember correctly that Don died? If so I am very, very sorry for that.

Edited July 22 by Spamnophobic
Added information

[Spamnophobic]

20 hours ago, AmyLynn said:

I emailed the ADMIN. I thought about doing it yesterday. But I thought coming here would be enough. Still broken for me as well. EVERYTHING I report.

Not showing past reports on first refresh is standard SpamCop behaviour. Click on "View recent reports" to see those in "Report History" over 24 hours, then use the drop-down to view less recent reports, then keep clicking "Older Reports"; this will go back to maximally about 3 months ago, and on my side of the screen anyway, includes reports before these bogus reports. Hope this helps.

[groupboard]

2 hours ago, Spamnophobic said:

Not showing past reports on first refresh is standard SpamCop behaviour. Click on "View recent reports" to see those in "Report History" over 24 hours, then use the drop-down to view less recent reports, then keep clicking "Older Reports"; this will go back to maximally about 3 months ago, and on my side of the screen anyway, includes reports before these bogus reports. Hope this helps.

No matter what timeframe I click on, it never shows any reports. It just says "no reports found".

[gnarlymarley]

I do find it interesting that a disabled "Third party interested in email source" can override the actual abuse addresses listed in whois. I did notice this comment in the source of one the issues one.

Comment:
SpamCop::Web::Look $Revision$ produced by prod-sc-www03 Edited July 22 by gnarlymarley

[Spamnophobic]

22 hours ago, groupboard said:

No matter what timeframe I click on, it never shows any reports. It just says "no reports found".

Do you have any spam reports which should predate these bogus reports? If so, do these also say "no reports found"?

However, clearly there is some kind of attack underway on SpamCop. In the last weeks I have been receiving huge amounts of extortion spam, so-called "from myself", a usual trick. That I have just been quietly reporting them has obviously infuriated the spammers. So now an attack is underway, at least that is my take on the situation. We really need help from SpamCop deputies to fix the system, as well as input from experienced spamfighters who can help block the attacks.

[Spamnophobic]

On 7/20/2024 at 12:56 AM, petzl said:

The clever dicks have disabled spamcop reports, don't stop them being reported and spamtraped
Not using spamtrap poisoned emails

Quote

as they have your address

Of course they have "my" address. That is why I give it to them. Like cheese in a mousetrap. If you "unsubscribe" you'll just get even more spam. spam, spam, spam.

On 7/20/2024 at 12:56 AM, petzl said:

 

try unsubscribe if not working
Companies like Google. Facebook seem to me a source for legit email addresses!
Then report to UK CERT   incidents [AT] ncsc [DOT]  gov[DOT] uk
Also include their abuse address
https://www.first.org/members/teams/national_cyber_security_centre-uk
IN SUBJECT put
147.45.196.3 UNSUBSCRIBE NOT WORKING/NEVER SUBSCRIBED


https://www.spamcop.net/w3m?action=checkblock&ip=147.45.196.3

Causes of listing
SpamCop users have reported system as a source of spam less than 10 times in the past week
Express-delisting is not available (that means clever dick has checked the box "fixed" so they don't like it)
Listing History
In the past 7.0 days, it has been listed 2 times for a total of 27 hours
Other hosts in this "neighborhood" with spam reports
147.45.196.111  147.45.196.133  147.45.196.136   147.45.196.253

 

[groupboard]

4 hours ago, Spamnophobic said:

Do you have any spam reports which should predate these bogus reports? If so, do these also say "no reports found"?

However, clearly there is some kind of attack underway on SpamCop. In the last weeks I have been receiving huge amounts of extortion spam, so-called "from myself", a usual trick. That I have just been quietly reporting them has obviously infuriated the spammers. So now an attack is underway, at least that is my take on the situation. We really need help from SpamCop deputies to fix the system, as well as input from experienced spamfighters who can help block the attacks.

I've been using spamcop for decades. If I click on a link for a past report, I can see it. It's just the "past reports" link at the top of the spamcop website which isn't showing any reports.

[ninth]

5 hours ago, groupboard said:

I've been using spamcop for decades. If I click on a link for a past report, I can see it. It's just the "past reports" link at the top of the spamcop website which isn't showing any reports.

The past reports tab works for me at this stage?

[Cutsnake88]

I've been getting the same message for virtually every report for the past couple of weeks  Odd thing is, if I look at reports from a few days ago, it just says "No reports filed".  

I emailed Spamcop, and they're telling me it's a bug/error at Validity, and has something to do with "accredit.habeas.com". I've never heard of habeas, so I don't know what he's on about.

Screenshots of all of this are below.

 

 

 

 

 

 

 

Edited July 25 by Cutsnake88
Screenshots were looking wonky

[groupboard]

On 7/23/2024 at 3:12 PM, ninth said:

The past reports tab works for me at this stage?

Ok, thanks, I think I've figured out that problem. I see I have two different spamcop accounts. When I log in using my old account, I do see all my past reports. However, I've been logged in to my new account when reporting for the past few years, and that account has no past reports. The reporting doesn't seem to care which account you're logged into, it just uses the submission address. Makes sense, but I forgot about that.

I see my alias for spamcop is the old account, so it is reporting via my old account even though I haven't been logged into it for a year. I've updated my alias to use the correct submission address. Anyway, that solves the no past reports issue. However, I see the bondedsender issue is still happening.

[Spamnophobic]

There seems to be some improvement. Although my report still sends a copy to the dreaded "bondedsender", a copy is now being also sent to the administrator of the mailserver from which the spam was sent. And the loopback on "Unreported spam saved" seems to have gone.

I hope we are winning!

If such success continues, as the next step "bondedsender" will no longer be receiving reports from me.

[petzl]

10 hours ago, Spamnophobic said:

There seems to be some improvement. Although my report still sends a copy to the dreaded "bondedsender", a copy is now being also sent to the administrator of the mailserver from which the spam was sent. And the loopback on "Unreported spam saved" seems to have gone.

I hope we are winning!

If such success continues, as the next step "bondedsender" will no longer be receiving reports from me.

Been a issue for years just got worse!

 

[jeffc]

For info, the "bonded sender" problem seems fixed as of around August 12.  According to another forum post/thread there was a bug and it was fixed.

My reports seem to be going to valid abuse contacts again.  Hope yours are too.