[Politech logo]

Politech is the oldest Internet resource devoted to politics and technology. Launched in 1994 by Declan McCullagh, the mailing list has chronicled the growing intersection of culture, technology, politics, and law. Since 2000, so has the Politech web site.

More details on report spam to SpamCop, get dubbed a spammer



Previous Politech message:

"Report spam to SpamCop, get listed as a spammer"
http://www.politechbot.com/p-04638.html

---

Date: Wed, 9 Apr 2003 20:54:17 -0400 (EDT)
From: security curmudgeon <jericho@attrition.org>
To: Declan McCullagh <declan@well.com>
Cc: InfoSec News <isn@attrition.org>, abuse@spamcop.net, abuse@globalvision.net,
     abuse@infosat.net
Subject: More problems with SpamCop, go figure.

Once again, we have been flagged as spammers by the cluebags over at
spamcop.net, who we have had a run-in or two with before. This time, they
go even above and beyond their previous levels of stupidity.

For the past year, I have been agressive on reporting spam and maintaining
a custom list of blocked domains/relays that is used on attrition.org. For
every piece of spam that came in, I would blackhole them on our system,
then report them to abuse@(their isp). I would send all Nigerian Scam mail
to the appropriate address at treasury.gov (419.fcd@usss.treas.gov). For
domains that didn't maintain abuse/postmaster contacts, I would report
them to rfc-ignorant.org and further blacklist their entire domain from
mailing attrition. WHat did this behavior get me? Listed on spamcop
*again*.

http://spamcop.net/w3m?action=checkblock&ip=66.80.146.7

Notice the two pieces of mail they show currently. Both of them are my
reports of spam to other ISPs. In each case, I mailed their abuse@
contact, included full headers, and prefaced the subject with "SPAM:" so
they could clearly identify the mail. Given that I am reporting the mail
TO THEM via their abuse contact, the headers have THEIR IP space, it
should be trivial to understand what is happening here. Instead,
globalvision.net and infosat.net apparently felt the need to send my mail
in and complain of spamming.

Here is the mail I sent to the abuse address at globalvision.net (still in
my sent-mail). In turn for me reporting globalvision spam, they send my
complaint to spamcop reporting *me* for spamming. And as we all know,
spamcop will play the part of the blind sheep and dutifully blackhole us
w/o question, even though they KNOW (from previous contact) we are as
anti-spam as you can get. Their claims of not being able to change their
system are complete lies, as the most trivial system can account for
whitelisting domains.

Of course, what is SpamCop's stance on this?

http://spamcop.net/fom-serve/cache/298.html

In short, "too bad", I have no recourse for their stupidity. I'm still
amazed that anyone would support these ass clowns in any way.

Brian Martin
Attrition.org

ps: if anyone from spamcop bothers to reply, do so from a different
domain. you have been blacklisted on attrition.org since Oct 1, 2000 for
your past antics, lack of cooperation in resolving this same type of
issue, and for *spamming us* (ironic eh?).

[jericho's spam complaint snipped. --DBM]

---

Date: Wed, 9 Apr 2003 22:26:18 -0400 (EDT)
From: security curmudgeon <jericho@attrition.org>
To: Declan McCullagh <declan@well.com>
Subject: spamcop math or whitelists?


re:
http://www.attrition.org/news/content/03-04-10.001.html

http://spamcop.net/w3m?action=checkblock&ip=216.127.43.88

in short, they have sample mail for domains (very low in some cases, like
attrition) and spam complaints. they do math, if threshold met, they
blackhole the domain.

spamcop.net themselves have 2110 samples, 26 spam complaints (ironic
unto itself).

216.127.43.88 not listed in bl.spamcop.net.

Rationale: Spam score 0.00: spam report ratio (0.000) falls under
threshold (0.020)

now, i was thinking "what if they met the threshold, would they
auto-blacklist themselves?" and noticed these numbers. is my math off or
should they have met their threshold? does this mean they run whitelists?
why do they refuse to add known anti-spam domains (like us) to their white
lists?

---

Date: Wed, 9 Apr 2003 21:21:31 -0500 (CDT)
From: William Knowles <wk@c4i.org>
To: bl@admin.spamcop.net, weblink7@mail.julianhaight.com
Cc: Thomas C. Greene <tcgreene@bellatlantic.net>,
     Declan McCullagh <declan@well.com>
Subject: Thanks for blacklisting Attrition.org and killing a list...

As the administrator of InfoSec News, an information security list run
from c4i.org and mailed out from attrition.org, I'd like to thank you
for ruining my day and that of many others.

You have taken the word of a spammer complaining that they were
getting spammed, when in reality you blacklisted the victim and with
that blackholed a list that goes out to over 3400 subscribers
world-wide, not to mention a great deal of U.S. Government and
military subscribers that depend on the open source intelligence
resources of InfoSec News, now blacklisted by SpamCop for up to 
48 hours.

http://spamcop.net/w3m?action=checkblock&ip=66.80.146.7

It is no picnic now fielding the boucebacks from InfoSec News 
subscribers and the torrent of mail from others wondering where 
their security news is.

With this blacklist in effect, we are effectively dead in the water,
and time critical information languishes, unable to forward onward to
administrators on the front lines in Iraq, secure operations center(s)
at the Pentagon. anti-terrorism watch desks around the world,
universities, corporations, and the average administrator.

A grateful nation thanks you very much!

William Knowles
Moderator/Editor
InfoSec News
wk@c4i.org



*==============================================================*
"Communications without intelligence is noise;  Intelligence
without communications is irrelevant." Gen Alfred. M. Gray, USMC
================================================================
C4I.org - Computer Security, & Intelligence - http://www.c4i.org
*==============================================================*






-------------------------------------------------------------------------
POLITECH -- Declan McCullagh's politics and technology mailing list
You may redistribute this message freely if you include this notice.
-------------------------------------------------------------------------
To subscribe to Politech: http://www.politechbot.com/info/subscribe.html
This message is archived at http://www.politechbot.com/
Declan McCullagh's photographs are at http://www.mccullagh.org/
Like Politech? Make a donation here: http://www.politechbot.com/donate/
-------------------------------------------------------------------------




Enter your email address to join Politech, Declan McCullagh's moderated technology and politics announcement list:

Return to politechbot.com