Slashdot Mirror
Trouble Getting to SpamCop?
geekwench writes "SpamCop was apparently the victim of a recent DoS attack. A false complaint to their domain registrar led to all primary DNS information being pulled. The problem is now fixed, but there may still be access issues for the next couple of days as ISPs clear the old DNS information out of their caches. You can read about it here and here. (Sounds to me as if SpamCop is proving to be a good-sized thorn in the sides of a number of spammers.)"
Because of caching, sometimes some things resolve and some don't... so, if www.spamcop.net doesn't work, try spamcop.net minus the www. Of course, if your mail server can't resolve their mail server properly, then submitted spam is a much bigger pain.
I've been having trouble getting into Spamhaus too. The spammers are up to something.
Thats very very funny. However its very evil. Do the y have any idea who did this?
Dave Bell
As spammers and virus writers get more and more integrated. Spammers have the money, virus writers have the skills, together they will play havoc with the cornfields of the Internet.
In the natural world, something like 60% of all species are parasitical, and the war between parasites and hosts is one of the defining aspects of all nature. Sex, for instance, is a way of shuffling locks faster than parasites can evolve keys.
It seems inevitable that software and communications will have to develop similar kinds of defenses against what is an inevitable onslaught from the parasitical forces that have developed to snack on the soft underbelly of the Net.
Cybersex, anyone?
Ceci n'est pas une signature
When are we going to do a distributed blacklist so this @$#$!@#@$ $pammer$ can't pull this crap?
I didn't use the preview button, so get over it!!!!
Mike
quietly reporting everything I get through spamcop and to the FCC.
It isn't helping, but maybe one of the ones I help get shut down will quit.
Veteran, Bermuda Triangle Expeditionary Force, 1992-1951
This is scary stuff... anyone can get any domain pulled with a little accusation?
We need to secure the domain registration/ownership process... seriously... We might not be able to take down microsoft.com, but with this complaint technique, I'm sure we could do some damage to a lot of less high profile companies... We need to get this fixed now! It's almost as bad as being allowed to call your neighbour a terrorist, and have him/her arrested indefinetly, with no proof...
---
Programming is like sex... Make one mistake and support it the rest of your life.
> Sounds to me as if SpamCop is proving to be a
> good-sized thorn in the sides of a number of
> spammers.
Maybe, but maybe not. The DOS attacks by spammers have been getting pretty brazen of late. SpamCop's a well-known name, and that's probably all it took to make it the target of an attack, regardless of how effective it is.
They've gotten almost no resistance to the attacks they've launched so far. They've got no reason not to launch an attack on anyone who even attempts to block spam at this point.
The amount of spam I receive every day has clearly been steadily growing for the last few months. Looks like the spammers are winning the war by DoSing spam fighters and hiring mercenary hackers with 450000 trojaned systems.
The owls are not what they seem
I was a religious SpamCop user for awhile. You tattle to SpamCop on a spam you receive, it checks its various databases, and then notifies various network authorities of the problem.
Problem being, that several of the network authorities are huge megacorps where the complaints get filed with the rest of 98,000 or are spamhosts themselves.
I gave up in favor of SpamAssassin and Mozilla's spam filtering, which turned out to be far more effective.
Isn't effectiveness the whole reason eight-year-olds tattle in the first place? ("Billy hit me!" Billy gets in trouble. (And Tommy gets beaten up after school.)) Somehow, I don't think enough spammers got in trouble.
When I send mail to spamcop, my ISP's mail server bounces it with a fatal DNS error.
Mea navis aericumbens anguillis abundat
It would be far more effective to simply drop any SMTP connections from networks in Brazil or China. Even better would be to actively scan emails for links pointing to that IP space, and dump any messages received. This would eliminate most spam from user mailboxes.
Spamcop is a nice parser, though, for those rare occasions in which reporting would do any good. Unfortunately, they're in bed with Cyveillance--don't forget to uncheck that box to avoid helping them.
They did have a disconnected phone number, which Joker might of have had some legal crap in their AUP, if so, it does change the situation a bit - but it seems that Joker was kind of a bitch here and the articles don't exactly give shining reviews of their customer service. Seems that the company is living up to their name.
.
I wonder how much better a distributed system would work . .
1q2w3e4r5t6y7u8i9o0pqawsedrftgthyjukilo;p'azsxdcf
It's been reported that SpamCop is paying upwards to $30K / year for bandwidth as a direct cause of the continous DDOS attacks on it.
The spammers are doing everything they can to squeeze the anti-spammers out. They use frivolous lawsuits (aka Mark Felstein and his porn spamming backers) or DDOS attacks that either knock the anti-spam resources off completely or increase the costs so that no hobbyist can run them.
And while all this is going on, the law enforcement agencies are doing nothing to counter the clearly illegal acts of the spammers.
And ISPs are doing NOTHING to reduce the number of zombies on their networks. So the DDOS attacks continue.
Nice going.
It's only a matter of time when someone (Al Queda?) will use the zombie network for something that will truly be noticed.
Proletariat of the world, unite to kill spammers
Is this the wave of the future? If you dont like someone just make up something and 'report' them... Let them pay the bill to fight it. Be it with their ISP or the HSD......
---- Booth was a patriot ----
I reported every single spam email I got to SpamCop for over 4 months, did the follow up confirmations and all. My spam intake went throught the roof in that 4 month period.
http://destiney.com/spam.php
Finally I just gave up and stop reporting spam to them at all.
...we have client-side spam filtering.
Note to M1-ers: a curt but otherwise insightful message is not "Flamebait" or "Troll".
www.blackboxvoting.com
I'll tell you why: they are not numerous enough. I'm the abuse mailbox handler for a well-known company that is disliked on and off line. Out of a 5-million-address mailing, I get maybe 12 complaints. Management does not care to alter anything about our "customer retention management" system. In fact, with only 12 complaints our of 5 million emails, they think we're doing pretty damn good, and so do I.
We do the following:
1. Opt-out only. You do business with us, you're on the list and have to taken yourself off of it to stop getting our mailings. There is no choice to opt-out at time of purchase, no choice to omit your email address.
2. Sell your address to our partners. Our contracts with our partners requires us to collect addresses when we make a sale for them, and pass the address lists along.
3. Pass off opting out of partners' lists to our partners.
(We spell all this out in the online Terms of Service which is displayed before a customer makes a purchase. People still buy).
Still, with all these "bad practices" in place, we only get a dozen complaints out of several million spams sent. We're on AOL's whitelist of approved spammers^Wmarketers whose mailings bypass their spam filters. We're on other ISP whitelists, too. If we get a Spamcop complaint, I dutifully click on the link in the notice, check "account terminated" and that's the end of it. But with only a handful of them each week, I can take care of the Abuse mailbox in less than a hour a week. Anti-spammers have had no adverse effect on us in the four years we've been doing it this way.
The problem is that anti-spammers demand a nuke-first ask-questions-later policy for shutting down 'bad' sites.
Unfortunately, that policy can also bite you in the ass. You can't have it both ways.
Network Associates is reporting an E variant that just came out of W32/Mimail that attacks the following domains:
. org
spews.org
spamhaus.org
spamcop.net
www.spews
www.spamhaus.org
www.spamcop.net
Here is the link to the description:
Link to W32/Mimail.e@mm description
This might explain some of the other issues folks mentioned above like getting to Spamhaus, etc... I saw a few instances of W32/Mimail.c@mm on Friday in my day job. That one launched DoS against darkprofits.net besides sending itself to everyone in an address book.
bbh
IANAL, but doesn't this give reason for some sort of lawsuit? Joker have, on account of one false complaint about wrong adres info, suspended a service which i presume was still being paid, without any warnings after their first one, though a reply had been given. I don't know which law applies here, but in Holland, this would be reason enough for a court meeting.
On top of that, there is ofcourse the question of: how is this possible? are there rules for actions of this kind? returning a fax is, IMHO, indeed no prove at all, though it will probably hold in court.
And a question to the lawyers here: if you, with bad intentions, use this method to bring down sites, is that a crime? I'd think yes, but then, Joker has to give the name of the person that claimed te info being false.
In all: interesting things may come out of this...
It's about time. I can't say I'm surprised. Childishness over the internet seems to be a trend lately. -.-
~Kyrthira Phelan~
There is a new email worm called W32/Mimail-E that is designed to create a distributed denial of service attack on the anti-spam websites of spamcop, SPEWS, and spamhause. See: sophos write-up.
SPF support for most open source mail servers can be found at libspf2.
I saw it.
CEE5210S The signal SIGHUP was received.
There is no proven connection between the issues at the registrar and Jamie Baillie's attempt to have SpamCop shut down, but the complaint to Joker (the registrar) was anonymous and clearly vindictive.
Oh yes.. the domain name cesmail.net will often work in place of spamcop.net for those still struggling to get through.
Never email donotemail@WeAreSpammers.com
So I use Outlook XP for email (go ahead and laugh now). One of Spamcop's most useful features is the ability for the user to simply forward spam directly to a predefined email address (one for each end user) and have Spamcop handle the rest. I have one or two addresses within a domain that I own which receive nothing but spam. I usually just filter them all to the trash, but I decided to start forwarding them along to Spamcop and let them do their thing. When it works, Spamcop is great.
So I tried this with Outlook. Spamcop simply responds that it cannot find the spam within the forwarded message. Apparently it doesn't parse Outlook mail properly. This seems weird considering Outlook is the most widely used commercial email program... you think they would write their filters with Outlook in mind. But ok... I go back to my server. I set up aliases for the two offending usernames and send the spam directly to spamcop, never having it touch my Outlook. I figured this would solve the problem.
Nope, Spamcop couldn't read that spam either. And Spamcop won't tell you what the problem is, exactly. I've never been able to get the email forwarding thing to work properly, and it's frustrating because it would be a great service.
Has anyone had a good experience with email forwarding? Can anyone suggest a simply solution to this problem?
--
RumorsDaily
They *assume* that email is a reliable way of contacting someone, but the *require* you to fax a document to them. I do not even have a fax machine and, off hand, I don't know where I could send a fax from the US to Germany. I suspect that it would cost at least a couple of bucks and would take a fair amount of time.
They sent *one* email before shutting the domain down. They did not reply to the (one) email that was sent in reply. I've never used joker as a registrar, but I bet they send out more than just one email to remind people to renew their domain.
The email that joker sent needs to be rewritten by someone who knows english and to make it clearer. I found it quite ambiguous.
Granted, Julian freely admits that there was a bad phone number and also that he didn't fax a response to them. Part of the fault does lie with Julian, but I think far more lies with joker.
SPF support for most open source mail servers can be found at libspf2.
I work for an ISP and honestly, we love SpamCop. Our abuse mail gets a lot of complaints. We can take action on maybe 2% of them, because people simply don't give us enough information. "Stop sending me spam" does nothing for us, nor do the 75% of people who forward the spam and do not inlcude the headers. (Honestly, how can so many people still not know to include full headers when reporting spam?)
The SpamCop reports have ALL the information we need (timestamps with time zone are crucial) to track down a spammer and get them off our network. The other nice thing is that once all the SpamCop complaints are handled, we usually find that the few regular spam reports we can track were about the same people we just got done banning due to the SpamCop reports.
So, at least for us, SpamCop is very effective. Granted that's just one ISP, but there ya go.
WWJD?
JWRTFM!
There have been times when I have reported spam to Spamcop and received an apology from the spammer's ISP less than two hours later.
Second, on their pages, they have at the top a recommendation for a specific web hosting company, presumably the one they use--this isn't a banner ad, but rather an ad written right into their HTML, so it sure looks like it is their personal recommendation for web hosting. When I was looking for a new hosting company for my site, I wanted to find one that was not soft on spam, so that I would not have to worry about ending up in SPEWS, and figured that the one SpamCop uses would have to be good. Checked out their plans, and they were good. I was ready to sign up, but decided it would be dumb not to at least Google a bit...and I found that that hosting company does NOT have a good reputation in the anti-spam community!
You'd think one sure-fire way to find a white-hat ISP would be to use the one that a major anti-spam site recommends, so this was quite a shock.
So I use Outlook XP for email
What's it like to live your life at Defcon 1 with Outlook?
Spamcop is great if the ISP or web host actually responds to the complaints. I work for a web hosting company and we investigate every complaint that comes in. If it's legit the account gets terminated.
I still think by the time spamcop gets to us it's too late though. You can't unsend spam, once it's out it's out. They'll just get a different account on another host. What we need is some kind of filtering on the incoming and outgoing sides. Or the world could just switch to something besides Outlook, which helps these viruses and worms propagate.
Check out SpamSource. It's a plugin for Outlook that'll let you forward email correctly to SpamCop or any other service.
Outlook doesn't forward all the headers properly if you just use the "Forward" button which makes trying to submit spam that way useless. There is a way to get the complete headers, but it's time consuming, so SpamSource makes things much easier.
It's partially free, depending on what features you enable. Hopefully someone will create a totally free full featured workalike eventually.
"People that quote themselves in their signatures bother me" - athakur999
Right now, Spamcop is THE most effective anti-spam solution bar none. End users don't realize the effect Spamcop has on overall network performance and the reduction of spam they receive in their inbox. Most users naively think client-side filtering helps when it's little more than a band-aid on a severed artery.
In the last 24 hours, one of my modest-sized mail servers reported these stats:
accepted mail: 2480 messages
spamcop blacklist rejected mail: 8216 messages
This is with no legitimate mail being blocked and a rather conservative set of relay blacklist rules.
That's more than 70% of the e-mail we receive clearly identified as spam and rejected at the server level.
But at least we stop the spammer as soon as he connects. We don't receive any of the junk e-mail once we identify mail coming from a known spam source. This reduces our operational costs, tax on hardware and software and available bandwidth to all users. Client-side filtering consumes all these resources and offloads the burden on the end-user to pay for software that still does not effectively deal with spam.
When you employ client-side filtering you do NOT stop spam; you do NOT reduce anyone's operational cost. When you deny mail relay access from spammers you DO cost the spammers time and money!
Spamcop has proven itself to be the most effective and productive solution at present, which is why it's being targetted by spammers. Using Spamcop's RBL, spammers can't even connect to participating networks. When you employ client-side filtering, you help spammers because their argument for de-regulation of spam involves putting the cost burden on the users - all they care about is delivering X messages and that is still accomplished, whether your mail filter catches it or you manually delete the junk, so this "solution" encourages future spam activity and also breathes more life into companies like Symantec that actually profit from the spam epidemic.
There are only two more-effective solutions to the spam problem: 1. The Federal Government finally deciding to pursue the spammers who break into computer systems (which has been illegal since before the Internet existed), and the employment of a sanctioned smtp whitelist.
I posted a previous comment with my detailed analysis of the issue and exactly how it can be realistically solved.
Who needs SpamCop...s </A>.Its free, open source, and works almost as well as my Mailblocks account...
Just use <A href="http://spambayes.sourceforge.net/">SpamBaye
Suggest you read the archives on the Spamcop newsgroup - this was discussed at great length there, with various solutions offered, if I remember rightly. The fault is not with Spamcop, but with how email from Outlook is constructed.
The next thing to consider, is that hosting of hotmail type services may end up moving to other countries to save costs. Suddenly not being able to recieve mail from such a source is the sort of thing that gets sysadmins sacked.
Personal, recreational email is a different story - you could limit it to only the contents of your address book without much drama. You'll still get spam though - just not much of it.
From a while back...
here
Ceci n'est pas une signature
I wonder how long an admin would keep his job when his managers are subject to the full tide of Chinese spam.
I have my important domains at directnic.com which provides amazing 24/7 trouble-ticket based support. I don't even think the somewhat less tech savvy the, yet ultra cheap godaddy.com would try this.
Spamcop has a detailed explainantion of the issues with the way the Outlook forwards mail. They also have suggested workarounds for Lookout's shortcomings.
"Whoever would overthrow the liberty of a nation must begin by subduing the freeness of speech."--Benjamin Franklin