[SC-Help] Re: Phish mail usually not reported to real site

[Garen Erdoisa]

Bill wrote:
> I notice that when I pass phish mail that I've received through
> Spamcop, it typically does not end up reporting it to the owner
> of the website that is being spoofed. I personally think that
> ebay/Paypal mail should always been sent to spoof at ebay/paypal,
> etc. The only times it seems to get reported to the actual site
> is when there is a link to that site in the email. The user

I've noticed that about paypal and ebay also. It seems that in the case 
of paypal and ebay, both of them don't like the format of spamcop 
reports. For those, I do a separate report directly to spoof at ebay/paypal 
in addition to spamcop, then try to remember to uncheck anything spamcop 
has routed their way.  I also forward copies phish emails to 
reportphishing [at] antiphishing [dot] org  which has both paypal, ebay, 
and many other financial institutions as sponsors. According to their 
website they do interface internationally with law enforcement as well 
to help get phishing sites shut down as soon as possible. Unfortunately 
it seems that 10 new zombie sites pop up for every one that gets shut 
down these days.

Spamcop I feel is mostly useful for notifying the abuse desks of 
affected sites (as a courtesy) about new sources of spam originating 
from networks under their control.

It's not much use for notifying an abuse desk about a spam problem when 
the abuse desk doesn't care. Those  types of sites tend to be hard coded 
into spamfilters if they let it go long enough, which are 100 times 
harder to get out of than a mere DNS blocklist, since a spamfilter has 
to go through a publish cycle and have people actually install the updates.

What those abuse desks choose to do with the reports they receive is 
entirely up to them. If they do nothing, the affected IP's eventually 
end up being blocked or filtered one way or another. So eventually the 
problem is taken care of by them, or by the rest of us collectively.

> should have a way of telling Spamcop "this is phish mail" and
> selecting where it gets sent to, as well as the FBI or whoever
> investigates these things.

You can add user defined recipients in your settings. Look in 
preferences, report handling options, Public standard report recipients

It's just a comma separated list of email address which will let you 
check/uncheck for each spam report.

It used to default to unchecked, but spamcop made a change (maybe a bug 
that they haven't fixed yet) that now has those all default to checked.

Because of that, I took most of them off of mine since I found myself 
sometimes inadvertently sending spam reports to the wrong places when I 
got in a hurry because of forgetting to uncheck a box in that list.

> 
> Bill

Garen