Jump to content

False and malicious reports. What gives?


felosi
 Share

Recommended Posts

I have tried to contact spamcop staff in the past but never even got as much as a reply so I figured I may get some questions answered in here.

I didnt know where to post this. But in the last week I have received 2 spamcop complaints through my network abuse for simple vbulletin emails.

One of them was a newsletter and the other was a happy birthday email.

Anyone with any common sense knows that you must be subscribed to a forum before you recieve anything like that. And the forum in question had email verification upon signups.

And what really boils my blood and this has happened before is when I respond and explain these reports I get this comment on the report thing

Something like "ISP has said spam will stop" or something along that lines. First off EVERY single time Ive had to deal with spamcop is by malicious or overzealous members reporting the stuff. NEVER have I had to resolve any REAL spam issue. Its all been false reports. 6 times now! on 3 different servers!. Second off comments like that, are libelous because it implies that there was indeed real spam coming from my server and I said it would stop. When nothing can be further form the truth. I dont know how long spamcop keeps them notes on there but its not right.

I dont even allow any mass mailing on my servers, people with forums are allowed to send a newsletter up to twice a month and thats it. I dont even have that many customer I would feel sorry for someone who had a lot of customers who send newsletters and had to deal with this stuff.

My question is do admins even review this stuff before firing off emails to abuse departments accusing people of spamming? Is forum mail now considered spam? What is the deal? Why are so many people allowed to use spamcop as a weapon for revenge and harassment?

Like I said I have never had ANY real issue of spam on my servers, never had any run ins with sorbs, spamhaus or anyone. I did have a run in with sorbs once over an eggdrop showing on their scanner as a windows trojan but was quickly resolved. It seems Im getting these false complaints form spamcop on a regular basis now.

Im lucky my network gives people a chance to resolve this, most networks would kick someone off just for getting the spamcop complaint. Im not really sure how it works here but I would think an admin or someone would at least look over the mail before firing off potentially damaging abuse reports to networks.

And then you got people like Jamie Baillie who have harassed people with spamcop for years yet it still goes on , why?

Well I just wanted to come here and get a few questions answered, I think its going too far getting abuse reports for vbulletin forum emails. So if an admin or seasoned spam copper would enlighten me on your guys practices I would sure appreciate it.

For reference the last 2 issues I had to deal with (false complaints) are here

http://www.spamcop.net/sc?id=z1445864683za...18c1db19b8f1eez

http://www.spamcop.net/sc?id=z1441928948z8...5ae80eb7e9f748z

I could dig up the rest if I have to. The ones I got before this was a disgruntled member of a freebie site sending in malicuous complaints. I would explain to spamcop each time, attaching a note to resolve each issue. Yet I kept on getting abuse reports, if anyone would lIke I will dig those up.

Im sure you guys deal with real spam a lot but I think its pretty safe to say a LOT of bogus and malicious reports come through here and its not right. Even being accused of this stuff is very damaging to a company's reputation.

Moderator Edit: changed sample URLs from the ISP Report Center handling URLs to the actual Tracking URLs for the spam reports in question.

Edited by Wazoo
Link to comment
Share on other sites

My question is do admins even review this stuff before firing off emails to abuse departments accusing people of spamming?

Short answer is no.

If you will look at the Reporting Server Status graph in the upper right of this forum and check the stats you will notice that there are 20 + reports sent each second, 1.68M per day. No each report is not reviewed. Reporters that submit lots of bad reports are dealt with.

Is forum mail now considered spam? What is the deal?

Not by SpamCop. Some people that report spam to SpamCop may considered news letters or forum mail as spam if they have not requested the email or don't have a relationship with the sender. I know I do. I get lots of mass mailings from "groups" that I do not have relations with and I report them.

I didn't bother to look it up, but from the numbers of reports you say you have received I'm not sure why you are so excited. You have not been put on any list. What seems to be the issues is that some of the mailing list used by one or more of your clients have gotten some bad addresses on them.

Mail list maintenance is an ongoing effort. I would suggest that you could use the reports you have received as an opportunity to remind your clients of this ongoing need for review.

Link to comment
Share on other sites

I have tried to contact spamcop staff in the past but never even got as much as a reply

Three people handling 800-1800 e-mails a day, they say .... details, specifics, words probably factor into getting direct answers.

Anyone with any common sense knows that you must be subscribed to a forum before you recieve anything like that. And the forum in question had email verification upon signups.

None of the above rules out someone receivig spam via the Forum. There have been idiots here that used e-mail links, PM links to send their garbage to some specifically selected people ... in addition to those isiots actually posting their spam in the Forum. Some users may not understand that the more appropriate complaint flow should be to the Forum Admin .. some SpamCop.net reporters do act with blinders one, and there are ramifications for that "bad reporting" .... yet there is also the issue that the e-mail address used by someone registering for the Forum may ot actually be used by that same person today ....

And what really boils my blood and this has happened before is when I respond and explain these reports I get this comment on the report thing

Something like "ISP has said spam will stop" or something along that lines.

Assumedly, you are talking abnout the options available on the "Abuse Report Center" ... there is no accusation there, simply a list of options for the 'responsible party" to choose from with various impact to receiving future reports, ranging from a 24-hour halt to new notifications to 'never contact me again' ...

NEVER have I had to resolve any REAL spam issue. Its all been false reports. 6 times now! on 3 different servers!.

and you handled these exactly how? As 'seen' in the two examples offered, your 'comments' are not going anywhere for someone 'in charge' to handle .....

Second off comments like that, are libelous because it implies that there was indeed real spam coming from my server and I said it would stop. When nothing can be further form the truth. I dont know how long spamcop keeps them notes on there but its not right.

One possible interpretation, but the real issue .... did you actually 'challenge' those reports?

I dont even allow any mass mailing on my servers, people with forums are allowed to send a newsletter up to twice a month and thats it.

Sentence doesn't really parse, especially if one goes with that a "newsletter" can be 'addressed' to multiple users. That sure sounds like 'mass mailing' ...????

My question is do admins even review this stuff before firing off emails to abuse departments accusing people of spamming?

Already touched on by Lking ... addressed in numerous FAQ entries

Is forum mail now considered spam?

See Spammers love Forum name = e-mail address .... that attempt to notify users here to 'fix' their registration data / display name ended up with dozens of those 'notifications that they had new PM traffic' resulted in dozens of "reported spam" from 'this Forum' ....

And then you got people like Jamie Baillie who have harassed people with spamcop for years yet it still goes on , why?

Please leave that issue within NANAE

I could dig up the rest if I have to. The ones I got before this was a disgruntled member of a freebie site sending in malicuous complaints. I would explain to spamcop each time, attaching a note to resolve each issue. Yet I kept on getting abuse reports, if anyone would lIke I will dig those up.

As above, a 'challenge' wasn't actually offered to the folks that could/would act on it. All you really did was to stuff a database with some background material.

Link to comment
Share on other sites

From: "Wazoo"

To: "SpamCop Deputies"

Subject: disgruntled admin: 72.20.5.94

Date: Sun, 30 Sep 2007 14:57:32 -0500

Forum Topic: False and malicious reports. What gives?

http://forum.spamcop.net/forums/index.php?showtopic=8778

User states that previous attempts at contacting "someone" resulted with no reply.

However, seems to also suggest that putting in a response in the Abuse Report Response Center 'should' have resulted in some action from someone .... I have suggested that 'actual' contact was never attempted.

User registered to the Forum as;

felosi (elided)

xxxxx[at]xxxxxx.com

Members (1 Posts)

Joined: 30-September 07

Posted were ISP handling URLs, I edited the starting post to convert those to Tracking URLs.

original data;

munged for this post

munged for this post

changed to:

http://www.spamcop.net/sc?id=z1445864683za...18c1db19b8f1eez

http://www.spamcop.net/sc?id=z1441928948z8...5ae80eb7e9f748z

Link to comment
Share on other sites

Ok I understand now. I didnt know you guys produced this on such a massive scale.

Not "us" .... it's the spammer spew that drives the numbers.

Sorry for the rant earlier. Just one of those days, and I took offense from it.

As rants go, yours was pretty mild <g>

Possibly missing (though documented within the various FAQs) .... the Parsing & Reporting system is a tool .. it's the actual reporting user that makes the call as to which reports go out to which trageted / offered addresses.

Link to comment
Share on other sites

Not "us" .... it's the spammer spew that drives the numbers.

As rants go, yours was pretty mild <g>

Possibly missing (though documented within the various FAQs) .... the Parsing & Reporting system is a tool .. it's the actual reporting user that makes the call as to which reports go out to which trageted / offered addresses.

Yeah thats what I meant, Processing would have been a better word.

I dont know what I was thinking, I really thought each report went through the hands of staff members and sent on to abuse departments. But I know the deal now. I guess its something admins have to deal with for the greater good.

I was thinking the reports were like something fixing to get me blacklisted or something. That is what I was most upset about.

Link to comment
Share on other sites

I was thinking the reports were like something fixing to get me blacklisted or something. That is what I was most upset about.

general description: http://www.spamcop.net/bl.shtml

specific data: http://www.spamcop.net/w3m?action=checkblo...p;ip=72.20.5.94

72.20.5.94 not listed in bl.spamcop.net

listing/de-listing: What is the SpamCop Blocking List (SCBL)?

Link to comment
Share on other sites

And what really boils my blood and this has happened before is when I respond and explain these reports I get this comment on the report thing

Something like "ISP has said spam will stop" or something along that lines.

SNIP

Second off comments like that, are libelous because it implies that there was indeed real spam coming from my server and I said it would stop. When nothing can be further form the truth. I dont know how long spamcop keeps them notes on there but its not right.

Another observation, the label that appears is also automated. It could, perhaps, more usefully say that the ISP has received the report and has taken appropriate action but I don't believe it is a statement of judgement although I can see why you might read it that way.

Andrew

Link to comment
Share on other sites

There is no human review of the spam that is submitted. The user is solely responsible for what he reports.

It's not possible to subscribe a spamtrap address to an opt-in list because the mail comes directly to us. It is not fed to us by a person who can review the emails. If a trap address was submitted to an opt-in list, the confirmation request would come to us and would be recorded as spam. There is no response to trap spam so it's not possible to confirm the subscription. It usually happens because of spam coming to the subscription address with a harvested trap address forged in as the return address.

If you use the link in the SpamCop report to come to our site and resolve the issue and leave a note, no one will see it unless they have a reason to review the notes about that particular IP. There is almost never a reason for us to do that.

If you "resolve" the issue by saying that the message isn't spam or that the spam outbreak will be stopped, SpamCop will refuse to report the IP for 24 hours and say that the "ISP has said spam will stop." The purpose of that is to relieve the abuse desk from a flood of reports about a spam run they already know about.

There are two users reporting the traffic. I haven't heard back from them, so I don't know why. Although, I noticed that none of the emails have any unsubscribe instructions. You might consider insisting that your clients include that information, along with a full disclosure of specifically what forum the recipient's address came from, in any traffic they send from your servers.

I have suspended both of ny users until they agree to stop reporting the traffic.

- Don D'Minion - SpamCop Admin -

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...