I just got the following mail from the SpamCop administrator. It speaks for
itself, so I'm not adding comments here at the top.
Date: Wed, 22 Sep 2004 14:43:59 -0600
To: "Antoine J. Mechelynck" <antoine.mechelynck@...
From: SpamCop Admin <service@...
Subject: Re: Account suspended
Cc: "SpamCop/Ellen" <deputies@...
Please accept my apologies for the delay in getting back to you. Your
message got buried in my Inbox and I forgot all about it.
I reinstated your account so you can get back to reporting spam.
It looks like somebody at Daum.net has subscribed their Help Desk address
to the mailing list and their autoresponder is cheerfully banging out
responses to all the posters because that's the way the list software
constructs the return address.
I doubt that spam would include a link to their FAQ page.
Since it's not mail from the list you're reporting, and because the
responses are going to everybody, I guess it qualifies as UBE and is
eligible for reporting.
You should resume reporting it so we can use the reports to get their
attention. In the meantime, I will explain the situation to the Daum admin
who wrote to me. He didn't answer my last email, so I doubt that he looked
any further than the fact that I took his server off our list.
Maybe you could provide his address to the list subscribers so they can
contact him, too.
- Don -
>It is now more than two full business days that I have answered your
>"Warning" message about why my SC account had been suspended, and I have
>seen no sign of life from you since then. I hope you have received my
>answer of day before yesterday, but just in case you haven't, I am
>attaching a copy.
>I suppose that you have been investigating the case (or that, if you
>didn't receive my previous answer, that you will be). Since I am sincerely
>willing to find a solution allowing me to continue reporting the bulk of
>my spam even while you investigate this case, I suggest that you mark
>noreplymaster(at)hanmail.net as "resolved" at least temporarily -- IIUC,
>such setting can be reversed if it is found later that it is indeed a
>spammer and that spam is still coming out from there.
>Let me recapitulate the facts:
>I am subscribed to several mailing lists, very similar to the (former?)
>Spamcop ML/NG, except that they concern an editor program (named Vim and
>available on many platforms including Dos, Windows, Unix, Linux, Amiga,
>VMS, ...) rather than a spamfighting system. For more info about that,
>browse to http://vim.sourceforge.net/ -- the mailing lists are found under
>"Community". Anyone can subscribe to those mailing lists, provided only
>that he has and keeps a valid email address, used for confirmed opt-in, to
>receive the ML posts, and as "From" address to validate his own posts.
>The problem is, some time ago (several weeks IIRC) someone has followed
>the confirmed opt-in procedure, then set up a mailbot with the list as
>input. The list administrators have tried to track that someone, without
>success. Let's call him culprit(at)unknown.com for the sake of argument.
>Since that person has set up that mailbot, here is what happens whenever
>anyone posts to the lists in question (or at least to vim(at)vim.org, the
>"general help" list and also the most active one):
>1. user(at)domain.net (which is subscribed to the list) sends an email to
>2. The ezmlm mailbot at fu-berlin.de (i.e the listbot) notices the mail
>and broadcasts it to all subscribers of the list.
>3. The mailbot at culprit(at)unknown.com, which is one of those
>"subscribers", receives a copy of the mail. It quotes that mail in an HTML
>email in Korean and sends the result back to user(at)domain.net. The
>"From" and "Subject" lines are also in Korean except for the characters
>[Daum] near the beginning of each of them both; AFAICT, they do not vary.
>The "From" address is always set as noreplymaster(at)hanmail.net but you
>know at least as well as I do how little credit must be given to the
>"From" address in unwanted bulk mail.
>Apart from the posts quoted in them, those Korean email are fairly
>uniform; I think they are commercial but since I don't understand Korean I
>cannot be sure. From their global uniformity I believe that they qualify
>as "bulk". In any case, the considerable annoyance generated among list
>subscribers, and which has occasionally been discussed on the list even
>though it is actually off-topic, makes it obvious to me that they are
>unsolicited, not only by me, but by most or all of the other recipients
>Finally, AFAICT, the person best placed to put a stop to that annoying
>practice is someone in a position of power at the ISP from which the HTML
>autoreplies are sent; IOW, spam-fighting techniques should be effective
>against this nuisance.