[SC-Help] Re: Citibank phishing fools spamcop

[Mike Easter]

Read in .spam, discussing in .help, posting to .spam & .help, f/ups in
.help

Eric wrote:
> The phishing link in the body of this email is not being parsed
> properly and not being reported.
>
> http://citibusinessonline.da-us.c1tlbank.com/cbusol/signon.do

citibusinessonline.da-us.c1tlbank.com does not resolve for my resolver,
for spamcop's resolver, or for dnsstuff's nor the gtld resolvers.

I think it's dead, Jim [Bones (Dr. Leonard) McCoy on the original Star
Trek]

> Also, when I submit the report, firefox brings me to a page in source
> code instead of html, and a report sent to emailspoof at citigroup.com
> goes to dev-null. Why is that?

I don't know about your source code page view in FF, but the reason for
devnulling the spoof addy is this:

Parsing input: citigroup.com
Host citigroup.com (checking ip) = 192.193.217.120
host 192.193.217.120 = citibank.com (cached)
Routing details for 192.193.217.120
Report routing for 192.193.217.120: pwong at mail.citicorp.com
pwong at mail.citicorp.com redirects to emailspoof at citigroup.com
emailspoof at citigroup.com bounces (6 sent : 6 bounces)

If a redirect addy bounces, then SC is going to devnull it.

>
http://www.spamcop.net/sc?id=z899512392z27f4f1df34c194a7a021036571ca6ee7z

If you post the tracker only, which is all you need to do, since it
provides access to the original spam in a better condition than the spam
you post into .spam, there is no need to post anything to .spam.  .spam
is only for posting 'junk' such as complete spams, not for discussing.
No complete spams are allowed in the discussion groups -- but of course
trackers are.  So there is no need to use the group .spam at all if you
post a tracker.


-- 
Mike Easter
kibitzer, not SC admin