Very large JoeJob in progress against Spamcop (fwd)

Date: Sat, 7 Sep 2002 08:51:00 -0500 (CDT)
From: J.A. Terranson <measl@mfn.org>
To: incidents@securityfocus.com
Cc: abuse@valueweb.com, abuse@spamcop.net
Subject: Very large JoeJob in progress against Spamcop

I have received a boatload of these, from a Valueweb customer
impersonating Julian Haight/SpamCop. The subject lines vary among a
fixed list, including the below "Spam from your network", "Spamcop is
watching you", "Spamcop will shut down your website", etc.

Valueweb is a home-user DSL provider, and the origin IP of these is
clearly not SpamCop.

Yours,

J.A. Terranson
sysadmin@mfn.org

Return-Path: <abuse@spamcop.net>
Received: from spamcop.net ([64.70.191.50])
by cliff.mfn.org (8.11.1/8.9.3) with SMTP id g87AKkc12347
for <abuse@convictedchildmolesters.org>; Sat, 7 Sep 2002 05:20:47 -0500

(CDT)

(envelope-from abuse@spamcop.net)
Message-Id: <eg1oqcdsl67apkbd.6l7i2p113n0@spamcop.net>
Reply-To: spam.reporting@reports.spamcop.net
To: abuse@convictedchildmolesters.org
X-Mailer: X-Mailer: Web Based Pronto
From: abuse@spamcop.net
MIME-Version: 1.0
X-Encoding: MIME
Content-Type: multipart/alternative;
boundary="----=_NextPart_38663300828774"
Date: Sat, 07 Sep 2002 06:25:28 -0500
Subject: Spam from your network

SpamCop.net - protecting the internet through technology

Why Am I Getting This Email?

You have recieved this email because spamcop.net has had recent complaints

related to your network (convictedchildmolesters.org).

What Types of complaints?

Open mail ports, violations of our acceptable use polices, and other

various complaints. EMail us for specifics...

What do I need to do?

Close any open relays on your network, enforce a anti spam A.U.P.

(Acceptable USse Policy), and shut down abusive users.

SpamCop's original spam reporting service will help you report spam

quickly and accurately. Or choose from a variety of filtering options
ranging from the easiest web-mail account to advanced network-wide spam
blocking.

Accused of spamming?

Answers to most common questions. Like: My email was blocked! SpamCop got

it wrong! How can I fix it? Falsely accused? What is spam? Find help here
for internet and hosting providers, small and large-scale bulk mailers and
advertisers.

Other Questions or Comments?

SpamCop has several dedicated (and spam-free) news groups where you can

get help, suggest new features or report bugs. Or you can search the entire
site, FAQ and all support-forum content in one place.

Reporting and Filtering Options..

VISIT http://spamcop.net

Copyright (c) 1998-2002 Julian Haight, All rights reserved.

jane42@mail.julianhaight.com

Yes, we got bunch of these as well (at least 10), just two came in today.
I know for sure its not actual spamcop since they send copy of email in
question. Plus email was sent to all email addresses of particular
dedicated hosting website, but the website is used for advertising and
customers would not be showing as being from that ISP. I assumed somebody
is trying to have us ignore future spamcop emails and put it in the
blacklist. The ip addresses it coma from are 64.70.191.50 (valueweb),
65.67.149.57 (swbell dsl). If anybody else gets similar reports, I suggest
you all ignore it or better store all them in separate folder and then
sent to spamcop in case they decide to press charges for forgery (this
should be criminal case I think).