Freelotto.com

[Kasper Sacharias Eenberg]

Is this site spamming?

I really can't figure it out! (They have full names/addresses) and hit
the 'RCVD_IN_BSP_TRUSTED -4.30' rule.

But the mails look obviously like spam to me.

With regards,
Kasper

[Matus UHLAR - fantomas]

On 02.07.09 08:36, Kasper Sacharias Eenberg wrote:
> Is this site spamming?
>
> I really can't figure it out! (They have full names/addresses) and hit
> the 'RCVD_IN_BSP_TRUSTED -4.30' rule.
>
> But the mails look obviously like spam to me.

they seem not to mail random addresses but googling revealed complaints of
non-working unsubscribing...

--
Matus UHLAR - fantomas, uhlar@... ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
If Barbie is so popular, why do you have to buy her friends?

[Michael Scheidell]

Matus UHLAR - fantomas wrote:

> On 02.07.09 08:36, Kasper Sacharias Eenberg wrote:
>  
>> Is this site spamming?
>>
>> I really can't figure it out! (They have full names/addresses) and hit
>> the 'RCVD_IN_BSP_TRUSTED -4.30' rule.
>>
>> But the mails look obviously like spam to me.
>>    
>
> they seem not to mail random addresses but googling revealed complaints of
> non-working unsubscribing...
>
>  

anyone running their own SA install, or have the ability to adjust
scores should do this:

score RCVD_IN_BSP_TRUSTED 10
tflags RCVD_IN_BSP_TRUSTED net


which is why you should always understand that ANY company thats to PAYS
ANYONE or ANY COMPANY to get negative scores in order to slip past
anti-spam engines is suspect.

I actually take all those 'certified' rules (that certify spammers in
fact) and make them positive scores.

have not had one compliant yet, but, then again, all your users might be
waiting for their 'free lotto' numbers in order to prepare for their
business day meetings.

google for 'freelotto.com+spam' and see what appear to be 75,000 'hits'
for that combination.


What I don't understand is why SpamAssassin default rules still give a
credit on it and other rules where there is a questionable business
model behind this practice.

mass mailed (bulk) spam or not, is not business critical email and users
can always whitelist any marketing list they want stuff from.


--
Michael Scheidell, CTO
Phone: [phone], x 1259
 > *| *SECNAP Network Security Corporation

    * Certified SNORT Integrator
    * 2008-9 Hot Company Award Winner, World Executive Alliance
    * Five-Star Partner Program 2009, VARBusiness
    * Best Anti-Spam Product 2008, Network Products Guide
    * King of Spam Filters, SC Magazine 2008

_________________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
_________________________________________________________________________

[J.D. Falk-2]

Kasper Sacharias Eenberg wrote:

> Is this site spamming?
>
> I really can't figure it out! (They have full names/addresses) and hit
> the 'RCVD_IN_BSP_TRUSTED -4.30' rule.
>
> But the mails look obviously like spam to me.

If you've got any proof of spam from any BSP_TRUSTED IP, please report it to
senderscorecertified.com@... or via the web form at
http://www.returnpath.net/support/ and our compliance team will take
appropriate action.  Thanks!

--
J.D. Falk
Return Path Inc
http://www.returnpath.net/

[Cory Hawkless]

I get mail from this domain on my Junk email user but i had to subscribe,
However my SA\Amavis install seems to be hitting most of these recently

-----Original Message-----
From: Matus UHLAR - fantomas [mailto:uhlar@...]
Sent: Thursday, 2 July 2009 5:16 PM
To: users@...
Subject: Re: Freelotto.com

On 02.07.09 08:36, Kasper Sacharias Eenberg wrote:
> Is this site spamming?
>
> I really can't figure it out! (They have full names/addresses) and hit
> the 'RCVD_IN_BSP_TRUSTED -4.30' rule.
>
> But the mails look obviously like spam to me.

they seem not to mail random addresses but googling revealed complaints of
non-working unsubscribing...

--
Matus UHLAR - fantomas, uhlar@... ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
If Barbie is so popular, why do you have to buy her friends?

[Matus UHLAR - fantomas]

On 03.07.09 09:11, Cory Hawkless wrote:
> I get mail from this domain on my Junk email user but i had to subscribe,
> However my SA\Amavis install seems to be hitting most of these recently

did you manage to unsubscribe?

> On 02.07.09 08:36, Kasper Sacharias Eenberg wrote:
> > Is this site spamming?
> >
> > I really can't figure it out! (They have full names/addresses) and hit
> > the 'RCVD_IN_BSP_TRUSTED -4.30' rule.
> >
> > But the mails look obviously like spam to me.

> they seem not to mail random addresses but googling revealed complaints of
> non-working unsubscribing...

--
Matus UHLAR - fantomas, uhlar@... ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
BSE = Mad Cow Desease ... BSA = Mad Software Producents Desease

[Cory Hawkless]

Lol, This might seem wrong but I don't want to, I want every single bit of
load I can get on my mail server! Makes testing configurations easier when
there is actually traffic going through it.

So I couldn't say if the unsubscribe process works as i've never tried it.

-----Original Message-----
From: Matus UHLAR - fantomas [mailto:uhlar@...]
Sent: Friday, 3 July 2009 5:12 PM
To: users@...
Subject: Re: Freelotto.com

On 03.07.09 09:11, Cory Hawkless wrote:
> I get mail from this domain on my Junk email user but i had to subscribe,
> However my SA\Amavis install seems to be hitting most of these recently

did you manage to unsubscribe?

> On 02.07.09 08:36, Kasper Sacharias Eenberg wrote:
> > Is this site spamming?
> >
> > I really can't figure it out! (They have full names/addresses) and hit
> > the 'RCVD_IN_BSP_TRUSTED -4.30' rule.
> >
> > But the mails look obviously like spam to me.

> they seem not to mail random addresses but googling revealed complaints of
> non-working unsubscribing...

--
Matus UHLAR - fantomas, uhlar@... ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
BSE = Mad Cow Desease ... BSA = Mad Software Producents Desease

[RobertH-2]

 

>
> If you've got any proof of spam from any BSP_TRUSTED IP,
> please report it to senderscorecertified.com@... or via
> the web form at http://www.returnpath.net/support/ and our
> compliance team will take appropriate action.  Thanks!
>
> --
> J.D. Falk
> Return Path Inc

shouldnt you folks know that your customers are spamming before we do?

then you could spank a lil hiney....

or at least charge them a lot more for abusing your services  ;-)

maybe it isnt the smartest idea in the world, yet shouldnt your types of
companies have several "stealth" email addresses on yourt customers lists
that get email from them just like everyone else that is getting spammed?

and then actually have eyeballs on your clients workings ???

if you cannot be trusted to do a really good job, then MS is right and the
rules pertaning to your customers email should be made positive or at least
removed from SA

 - rh

[Matus UHLAR - fantomas]

> > If you've got any proof of spam from any BSP_TRUSTED IP,
> > please report it to senderscorecertified.com@... or via
> > the web form at http://www.returnpath.net/support/ and our
> > compliance team will take appropriate action.  Thanks!

On 03.07.09 12:32, RobertH wrote:
> shouldnt you folks know that your customers are spamming before we do?

yes, they actually should know that even before they start spamming...

> maybe it isnt the smartest idea in the world, yet shouldnt your types of
> companies have several "stealth" email addresses on yourt customers lists
> that get email from them just like everyone else that is getting spammed?

what will that proove? That they actually did send the email? If you know
you are on the list, how can you detect if that is _unsolicited_ email?

--
Matus UHLAR - fantomas, uhlar@... ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
- Holmes, what kind of school did you study to be a detective?
- Elementary, Watson.

[Neil Schwartzman-2]

On 03/07/09 3:32 PM, "RobertH" <roberth@...> wrote:

> or at least charge them a lot more for abusing your services  ;-)

A long time ago, Bonded Sender charged per complaint. We don't operate that
way; we have a declining percentage of acceptable complaint rates for each
volume tier assigned to a customer (derive from totals to
Hotmail/Yahoo!/Senderbase/two anonymous web-mail sources). The more they
send, the more we charge.

Ultimately, the services a Sender abuses aren't ours, but those of our
receivers. Should they go over a given complaint rate, or fall afoul of our
other metrics (posted here previously), the IP or Client is suspended.

> if you cannot be trusted to do a really good job, then MS is right and the
> rules pertaning to your customers email should be made positive or at least
> removed from SA

If we don't perform to your standards, zeroing them out is certainly within
your right. Making them a positive sign given the totality of our client
list would be, in my mind, silly. Unless you enjoy false positives.

 
--
Neil Schwartzman
Director, Certification Security & Standards
Return Path Inc.
0142002038

[J.D. Falk-2]

I AM NOT DEFENDING FREELOTTO.COM, merely discussing the theory behind the
"Certified" service which is queried in the BSP rules in SpamAssassin.


RobertH wrote:

> shouldnt you folks know that your customers are spamming before we do?

How can a 3rd party automatically discern whether or not you subscribed to a
particular bit of mail?  Or whether or not you consider the mail to be
living up to your expectations for those messages?

I can think of a few ways, but they'd all involve serious privacy violations
-- and possibly brain surgery.  Much better for all concerned if you'd be
willing to tell us when you're unhappy about one of the IPs on the list.

> or at least charge them a lot more for abusing your services  ;-)

Nope.  If they're proven to be violating the standards, they're no longer
part of the program.

> maybe it isnt the smartest idea in the world, yet shouldnt your types of
> companies have several "stealth" email addresses on yourt customers lists
> that get email from them just like everyone else that is getting spammed?
>
> and then actually have eyeballs on your clients workings ???

Of course we do -- but those addresses /did/ subscribe to the list, and they
don't make value judgments.

--
J.D. Falk
Return Path Inc
http://www.returnpath.net/

[Joseph Brennan]

Freelotto.com went on our local blocklist on October 31, 2001.  No one
here has ever asked us about not getting mail from that domain.

Joseph Brennan
Columbia University Information Technology