abuse[at]att.net refusing spamcop reports

[fliptop]

hi all - just wanted to let the group know that if you receive spam from at&t's network, you'll get a response that abuse[at]att.net refuses spamcop reports. i called at&t and was told that they should be submitted to abuse_rbl[at]abuse-att.net. just an fyi.

regards, paul

[StevenUnderwood]

hi all - just wanted to let the group know that if you receive spam from at&t's network, you'll get a response that abuse[at]att.net refuses spamcop reports. i called at&t and was told that they should be submitted to abuse_rbl[at]abuse-att.net. just an fyi.

Did you forward that information on the the deputies? Any rejection I get I forward for their information and usually the next time, there is another report address or it goes to devnull.

[fliptop]

Did you forward that information on the the deputies? Any rejection I get I forward for their information and usually the next time, there is another report address or it goes to devnull.

no, i didn't. thanks for the tip.

regards, paul

[turetzsr]

...Thanks, paul!

...You posted this to the "SpamCop Email System & Accounts" forum but it doesn't seem to have to do with the SpamCop e-mail service per se , so I have moved it to the "SpamCop Reporting Help" forum.

[Merlyn]

hi all - just wanted to let the group know that if you receive spam from at&t's network, you'll get a response that abuse[at]att.net refuses spamcop reports. i called at&t and was told that they should be submitted to abuse_rbl[at]abuse-att.net. just an fyi.

It would seem to me for AT&T that both addresses above point to the same trashcan

[Farelf]

It would seem to me for AT&T that both addresses above point to the same trashcan

That may be so - seems to me SC reports receive far less attention than do manual reports (generally, not AT&T specifically). Which is understandable but if they don't want SC reports all they have to do is say so. Guess they want to maintain the appearance of concern. The other thing about manual reports (sometimes to abuse addresses that SC knows better than to use) is one gets to see the fairly high proportion of "mailbox exceeds allocation" replies. Some of these might be fake (emulating one of the MailWasher functions) but clearly we are looking at volumes in the order of 10^{large numbers} per day. Nothing new here, but it has to be getting worse, like everything else associated with the spam phenomenon.

[sgrayban]

Just a FYI here about AT&T's abuse dept.

I have a neighbour who works for them and he told me yesterday that they forward all spam reports they get to the customer in question. He also said that since AT&T refuses to allow munged headers to remove the reporter that he advises people to simply not report any spam to AT&T because the spammer will most likely retaliate and then deny any knowledge of the spam.

He also said the abuse_rbl[at]abuse-att.net forwards to the same abuse[at]att.net mailbox.

[Merlyn]

He also said the abuse_rbl[at]abuse-att.net forwards to the same abuse[at]att.net mailbox.

Déjà Vu

[fliptop]

he advises people to simply not report any spam to AT&T because the spammer will most likely retaliate and then deny any knowledge of the spam.

is there any consensus among the group about how to treat isp's that do this? what's the point of having a mechanism to report spam if the effort will get you nowhere?

i would guess that most of the at&t machines that send this spam are parts of a botnet and are using at&t's or sbc's broadband connection. does at&t really not want to know about these machines so they can alert their (surely clueless) customers of the problem?

when a company like at&t has this kind of policy, i have half a mind to block delivery of their mail in sendmail access, with a reply indicating the decision at&t has made in this regard. however, unless every mail server administrator did the same, it's doubtful it would have an effect. in fact, the effect would probably be the opposite of what i would want, because it's likely my clients would complain, and not the at&t customers who are trying to send the (possibly legitimite) mail in the 1st place.

regards, paul

[Wazoo]

There's a real bit of a problem with the way this discussion is going.

First of all, what is now AT&T isn't exactly what most people thing it is. The referenced conversation piece about "sending direct to the customer" may or may not mean what it sounds like. The abuse[at]att.net covers a whole lot of territory, not all of it actually managed directly by what is known as AT&T .... There's a whole slew of companies leasing bandwidth and infrastructure from what is called AT&T.

For example, an IP address actually managed by MediaCom shows a spam reporting address of abuse[at]att.net ... and in that case, att.net would forward that complaint "direct to their customer" .... mediacom .... This is not "the spammer" .... yet, it definitely fits into the previous description offered.

'General consensus' is probably all over the map. It's been a long time since I've seen or even heard of real retribution from a spam complaint, and I send most of mine out manually, as the SpamCop.net parseing/reporting things doesn't go far enough to make me happy. Like zillions of other people, yes, I've had an address wrapped in a forged From" line and had to work through all that massive load of bad incoming stff, but .. this is hardly seen as a retribution tactic ... so many people never heard of SpamCop.net or knew how to complain about spam to beging with, but thay get hammered by the same spammer abuse scenario ....

[fliptop]

There's a real bit of a problem with the way this discussion is going.

First of all, what is now AT&T isn't exactly what most people thing it is. The referenced conversation piece about "sending direct to the customer" may or may not mean what it sounds like. The abuse[at]att.net covers a whole lot of territory, not all of it actually managed directly by what is known as AT&T .... There's a whole slew of companies leasing bandwidth and infrastructure from what is called AT&T.

hi wazoo - thanks for your thoughts on this. here's the spam i reported:

http://www.spamcop.net/sc?id=z1172879549z0...f3cb1045c2e7f1z

to me, sccmmhc91.asp.att.net looks like an at&t mail server.

the whole point to my original post was to state the reporting address for at&t mail servers should be changed, that's all. if spamcop administrators can do it, great, otherwise i'll just manually cut-and-paste it into the reporting message.

later on, i was wondering how the group handles mail servers from isp's that don't accept spamcop reports. not necessarily at&t per se, but any isp. it didn't really have anything to do with the original topic.

thanks, paul