[SpamCop-List] Re: What the blazes happened here?

[Geoffrey Hyde]

"Mike Easter" <MikeE at ster.invalid> wrote in message
news:dhjd8h$r7c$1 at news.spamcop.net...
> Geoffrey Hyde wrote:
>
> www.spamcop.net/sc?id=z810628202zaf678942fb9d8fe752b4526c0b4f9903z
>
>> This is apparently some *very weird* and not-funny bounce message (I
>> considered it for a bit, and reported it as spam - if their
>> mailserver's broken or compromised, they better godamn well fix it
>> fast!! - from a news posting I sent to LUGNET news server.
>
> I wouldn't have reported it as spam.  It is some kind of problem with a
> mailing list item.  The normal SC mungeing interferes a little bit with
> trying to interpret it..

If you want an unmunged email to analyze, please email me, as my address is
not intentionally hidden, I handle spams on a case-by-case basis as I get
them.

I'm not posting using a mailing list, I'm posting using a NNTP server,
which, as far as I know, is supposed to be a direct connection to the lugnet
news server in question, therefore unless someone else received it through
an unlikely echo off some compromised server, it's what I consider to be
spam.  The LUGNET mailserver is not supposed to send me anything back except
an authorisation message, which I click a link in to take me to the the post
authorisation screen.

>> The posting attached is mine, yes, but I don't know what the hell it
>> is they're playing with as far as the bounce message goes.  And FWIW,
>> it succeeded in being posted so LUGNET received it okay, don't know
>> why this mailserver bounced it back.
>
> You email the LUG and the lug remails your item.  Then, when someone on
> the list has a mail problem, ideally the problem would go back to the
> lug.  But instead, you got the bounce.

I don't know how a posting I made got onto a mailing list when I was
supposed to have connected to a news server.  News servers, in my
experience, do not normally regurgitate posts to other people's mailservers
or news clients, therefore the treatment of this bounce message as spam.  I
do know that some people use "news-by-mail" however that is not what I use,
and if this has caused me to be an unlucky recipient of someone else's
email, it's still spam IMHO.

>> If a SC admin (or deputy) has valid reason to believe this is not spam
>> please fill me in on as to why, and perhaps I'll consider having it
>> cancelled.  Until then it sounds like a duck, walks like a duck,
>> looks like a duck (IE is spam) and will remain reported until I find
>> reason to believe otherwise.
>
> You can't actually cancel a report.  The ntc.net.pk server 202.83.174.53
> was reported as a spamsource.  It is not currently listed in the SCbl
> and so it doesn't currently have a SC 'problem' from your report or
> others which might have occurred because of a misdirected bounce..

I'm glad, because time and repeated spam emails it's sending out will tell
what happened here.  If indeed it's not a spamsource, then great, they fixed
the problem with the bounce to me.  And that's fine.

> The LUG tried to send your listitem to 664 at nu.edu.pk and mail for
> nu.edu.pk is handled by mail3.nu.edu.pk and lhr.nu.edu.pk - The headers
> for the LUG mail minus some addresses due to SC mungeing can be seen at
> your tracker.

What you mean is the LUGNET news server picked this item up, and mailed it
out on someone else's mailing list address, and somehow, by doing so,
enabled me to get spammed by it.  It's never happened to me before, and I
don't know why it should suddenly start now, I have no valid reason that
this message is sent to me, therefore I still consider what I got as spam.

> If you/I engage the nu.edu.pk server in an smtp transaction it will
> appear to accept mail addressed to 644 and it also appears to accept
> mail addressed to a bogus username.  Then after actually accepting that
> mail, if it can't handle it, it is forcing itself to have to point its
> bounce at something in the headers of the LUG mailer.

"It's spam, but not as we know it, Jim"  If it's going to bounce mail
anywhere I fail to see why it should bounce it to me, I'm not (a) a LUGNET
Admin, (b) an intended recipient, nor am I (c) a person in charge of the
server who can fix this sort of problem.  Therefore, I repeat, it IS TO ME,
a SPAM email.  And it will remain so.

> Those headers say that you are the From and that the Sender is the LUG
> and that the Reply-To is yours.
>
> Naturally it would have been better if the DSN went to the LUG and not
> each of tho members of the list.  Suboptimal handling of mailing list
> items which bounce is very problematic.

So I'd have to email someone at LUGNET who deals with this kind of problem?
Sheesh!  I wish they would get this "suboptimal" problem fixed up ASAP.

> Your report will result in Amir Hanif in Islamabad getting the SC report
> because he is the admin contact for National Telecom Corporation listed
> in apnic for ntc.net.pk which is the netblock over the mail in and out
> for nu.edu.pk which is National University of Computer & Engineering in
> Lahore.

Well, perhaps he will be able to explain things a bit better.

As to the rest of your posts, I can't see what you're talking about very 
clearly.  But it's plain the admins running the mailing list need to get 
better control over where it bounces messages to.  Otherwise they're going 
to wind up having random people reported for having other people spammed, 
including myself.

-- 
Cheers ...

Geoffrey Hyde