[SpamCop-List] Re: How to get the attention of abuse@walla.net.il ?

[Hans Salvisberg]

Hi Mike,

Mike Easter wrote:
> You should not derive any fantastical conclusions about a virgin address
> getting spam.

No, trust me with what I'm saying. I'm using eight different email 
addresses with that one subscription service (for different lists), and 
five of them have received "Lecciones" spam. No random addresses at my 
domain have ever received any "Lecciones" spam.

> Step1 is very very common;  step2 is the part where fantastical and
> highly unusual information starts creeping in.  So, we've gone from the
> commonplace to the movie plot in one quick jump.  You may have lost me
> in the transition without more documentation of the facts of the breakin
> and theft.

Moreover, I've been in touch with the administrator of the subscription 
service and /he/ told me there was a break in and theft.


>>Until recently he
>>went by the name of "Ritche Lecciones", which might actually be his
>>real name.
> 
> The From of the halfway straightup spam sez Miraflor Lecciones
> <proven_biz12 at walla.com

Yes, of course.


>>>>and I keep complaining to walla.com / walla.net.il, but the spammer
>>>>keeps using those addresses and I've never had a reply from walla.
> 
> That makes walla unresponsive to a spamnotify;  but a spamcop notify
> about a spamvertiser is toothless to a spamvertised email address
> payload provider.  

Yes, that's why I brought it up here.

> You never did respond to the implied question of whether or not you are
> notifying unmunged or if you are using standard spamcop mungeing.

You read my implied response correctly: I notified munged and so part of 
the blame for walla.com's past non-responsiveness is mine.

>>It seems like walla is reading news here, because they replied with:
>>
>>>Dear sir or madam,
>>>
>>>Thank you for informing us this matter.
>>>
>>>This account is terminated.
>>>
>>>Best Regards,
>>>Ohad Harel-Walla! Abuse Team.
> 
> I thought you said that "I've never had a reply from walla."
> 
> What is that you cited above?

Yes, when I wrote "never", I never had had a reply. But the next day I 
received the reply I quoted above (even though my notification was 
munged, as the earlier ones which they ignored).

>>So, for now, I'm satisfied, but I'll keep your suggestion about
>>unmunged reporting handy.
> 
> So, that means that your notifies are munged I presume.  Naturally that
> also probably means that the walla response above is some kind of
> meaningless autoack, unless they've terminated a particular account, but
> subsequent ones are coming from a different account..
> 
> A non-responsive response is non-responsive.

Yes, munged. I never got an ack before, so something is different this 
time. They didn't say which account they terminated (actually there were 
two addresses in the spam), but I can at least hope that they did do 
something.

Maybe this thread "How to get the attention of abuse at walla.net.il ?" did 
get their attention.


Thanks for the how-to and background on upstream providers!


> For example, you wouldn't be complaining to an upstream adjacency about
> getting a spam.  You would be complaining about their downstream being
> unresponsive or something else which the upstream might care about, like
> not have a good contact address.

I understand what you're saying, but unresponsiveness is an elusive concept.

> What we are talking about here is about walla being
> unresponsive.  But, now I'm hearing that walla isn't being unresponsive,
> but that they have 'responded' -- but they haven't /actually/ terminated
> the email account -- so they are lying.  So, I suppose you could notify
> the upstream with the evidence that they are lying non-responders.

No, at this point they're not lying.

I started getting "Ritche Lecciones" spam in May, spamvertizing

    money_business at walla.com   and
    quiterneverwin at walla.com

http://www.webservertalk.com/archive147-2005-1-891046.html shows that he 
had been using these addresses at least since January. I reported this 
to walla, albeit in munged form, and included the url. In July I got 
another copy, and I sent a detailed letter to walla -- still no 
response. There's no way to tell whether they did something. Not getting 
an ack is not really 'evidence' for non-responsiveness.

Last week's spam was from "Miraflor Lecciones" and showed different 
email addresses

    real_moneybiz at walla.com  (contact)
    proven_biz at walla.com     (unsubscribe)
    proven_biz12 at walla.com   (sender/replyto)

but the drift was the same, and still at walla. At that point it's still 
impossible to tell whether walla did something or not. They may have 
shut down the former addresses, or the Miraflor variant may just come 
with its own set.

At least walla did did send me the generic reply quoted above to my 
latest report last week.

In the future, one of four things can happen:

1. Ritche gives up (unlikely)

2. Ritche changes provider (then walla is out of the loop)

3. Ritche uses new addresses @walla (then what?)

4. Ritche keeps using the same addresses (even then I have no case 
against walla, because they can claim that they did shut down the 
addresses and that Ritche was too stupid to change them)

It seems pretty hard to get 'evidence' for non-responsiveness...

Hans