[SpamCop-List] Re: How to get the attention of email@example.com ?
hans at salvisberg.invalid
Tue Oct 18 18:28:13 EDT 2005
Mike Easter wrote:
> You should not derive any fantastical conclusions about a virgin address
> getting spam.
No, trust me with what I'm saying. I'm using eight different email
addresses with that one subscription service (for different lists), and
five of them have received "Lecciones" spam. No random addresses at my
domain have ever received any "Lecciones" spam.
> Step1 is very very common; step2 is the part where fantastical and
> highly unusual information starts creeping in. So, we've gone from the
> commonplace to the movie plot in one quick jump. You may have lost me
> in the transition without more documentation of the facts of the breakin
> and theft.
Moreover, I've been in touch with the administrator of the subscription
service and /he/ told me there was a break in and theft.
>>Until recently he
>>went by the name of "Ritche Lecciones", which might actually be his
> The From of the halfway straightup spam sez Miraflor Lecciones
> <proven_biz12 at walla.com
Yes, of course.
>>>>and I keep complaining to walla.com / walla.net.il, but the spammer
>>>>keeps using those addresses and I've never had a reply from walla.
> That makes walla unresponsive to a spamnotify; but a spamcop notify
> about a spamvertiser is toothless to a spamvertised email address
> payload provider.
Yes, that's why I brought it up here.
> You never did respond to the implied question of whether or not you are
> notifying unmunged or if you are using standard spamcop mungeing.
You read my implied response correctly: I notified munged and so part of
the blame for walla.com's past non-responsiveness is mine.
>>It seems like walla is reading news here, because they replied with:
>>>Dear sir or madam,
>>>Thank you for informing us this matter.
>>>This account is terminated.
>>>Ohad Harel-Walla! Abuse Team.
> I thought you said that "I've never had a reply from walla."
> What is that you cited above?
Yes, when I wrote "never", I never had had a reply. But the next day I
received the reply I quoted above (even though my notification was
munged, as the earlier ones which they ignored).
>>So, for now, I'm satisfied, but I'll keep your suggestion about
>>unmunged reporting handy.
> So, that means that your notifies are munged I presume. Naturally that
> also probably means that the walla response above is some kind of
> meaningless autoack, unless they've terminated a particular account, but
> subsequent ones are coming from a different account..
> A non-responsive response is non-responsive.
Yes, munged. I never got an ack before, so something is different this
time. They didn't say which account they terminated (actually there were
two addresses in the spam), but I can at least hope that they did do
Maybe this thread "How to get the attention of abuse at walla.net.il ?" did
get their attention.
Thanks for the how-to and background on upstream providers!
> For example, you wouldn't be complaining to an upstream adjacency about
> getting a spam. You would be complaining about their downstream being
> unresponsive or something else which the upstream might care about, like
> not have a good contact address.
I understand what you're saying, but unresponsiveness is an elusive concept.
> What we are talking about here is about walla being
> unresponsive. But, now I'm hearing that walla isn't being unresponsive,
> but that they have 'responded' -- but they haven't /actually/ terminated
> the email account -- so they are lying. So, I suppose you could notify
> the upstream with the evidence that they are lying non-responders.
No, at this point they're not lying.
I started getting "Ritche Lecciones" spam in May, spamvertizing
money_business at walla.com and
quiterneverwin at walla.com
http://www.webservertalk.com/archive147-2005-1-891046.html shows that he
had been using these addresses at least since January. I reported this
to walla, albeit in munged form, and included the url. In July I got
another copy, and I sent a detailed letter to walla -- still no
response. There's no way to tell whether they did something. Not getting
an ack is not really 'evidence' for non-responsiveness.
Last week's spam was from "Miraflor Lecciones" and showed different
real_moneybiz at walla.com (contact)
proven_biz at walla.com (unsubscribe)
proven_biz12 at walla.com (sender/replyto)
but the drift was the same, and still at walla. At that point it's still
impossible to tell whether walla did something or not. They may have
shut down the former addresses, or the Miraflor variant may just come
with its own set.
At least walla did did send me the generic reply quoted above to my
latest report last week.
In the future, one of four things can happen:
1. Ritche gives up (unlikely)
2. Ritche changes provider (then walla is out of the loop)
3. Ritche uses new addresses @walla (then what?)
4. Ritche keeps using the same addresses (even then I have no case
against walla, because they can claim that they did shut down the
addresses and that Ritche was too stupid to change them)
It seems pretty hard to get 'evidence' for non-responsiveness...
More information about the SpamCop-List