Re: [apnic-talk] Spam filtering on spam reporting address

[Vivek Nigam <vivek@apnic.net>]

Jordi is right.
 
This policy requires the IRT email not to be filtered or require the use of forms to report spam or similar network abuse activities.
 
We will follow this request up with the Member. As a reminder to everyone on the list, the most efficient way to alert APNIC to IRT email issues such as this is to report them via the IRT escalation web form.
 
https://www.apnic.net/manage-ip/using-whois/abuse-and-spamming/report-invalid-or-unresponsivle-irt-emails-prop-125/

Thanks
Vivek

On 21/10/21, 3:59 pm, "apnic-talk-bounces@lists.apnic.net on behalf of JORDI PALET MARTINEZ" <apnic-talk-bounces@lists.apnic.net on behalf of jordi.palet@consulintel.es> wrote:

    Hi Ronald,

    If I understood your email on this case correctly, this is not just a matter of education, but also a clear policy violation:

    https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.apnic.net%2Fcommunity%2Fpolicy%2Fproposals%2Fprop-125&amp;data=04%7C01%7C%7Cb8d0ae01baec4441848308d99457cdcd%7C127d8d0d7ccf473dab096e44ad752ded%7C0%7C0%7C637703927846466047%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&amp;sdata=BIlTva4ueE0A5lcsvQZLpFQU3JwuBZ9%2FQtQt8pKMX%2F8%3D&amp;reserved=0



    Regards,
    Jordi
    @jordipalet



    El 21/10/21 5:12, "Ronald F. Guilmette" <apnic-talk-bounces@lists.apnic.net en nombre de rfg@tristatelogic.com> escribió:

        I received a spam today from [43.224.36.113] which is being routed by
        AS9873 - Lao Telecommunication Co Ltd.

        The APNIC WHOIS record for this network indicates that csoc@laotel.com
        is the email address to which such incidents may be reported.

        In general, network operators do not act on spam reports unless and until
        they have actually seen the spam message in question, including all of
        the relevant email headers.  This is both prudent and reasonable.

        Unfortunately, this network, and also many others, have failed to configure
        their abuse reporting mailboxes in a manner so as to allow the text of
        spam messages to be accepted via those reporting addresses.  The results
        in such cases are predictable, and are examplified by the bounce message
        shown here:

            https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpastebin.com%2Fraw%2FLX98NhcD&amp;data=04%7C01%7C%7Cb8d0ae01baec4441848308d99457cdcd%7C127d8d0d7ccf473dab096e44ad752ded%7C0%7C0%7C637703927846466047%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&amp;sdata=jIEjdkF7Zcf8L7q1fYfWs%2FpY4gTM7rnamMpuV%2F9pQKs%3D&amp;reserved=0

        I would like to just express my hope that, as part of its ongoing educational
        efforts, APNIC will work to educate its members regarding this common
        issue/problem.  It is all well and good to have abuse reporting addresses
        associated with IP blocks and ASNs in the WHOIS records, but if those
        reporting addresses are improperly configured, then they will have limited
        usefulness.


        Regards,
        rfg


        P.S.  I had to send this message to the apnic-talk list twice because the
        on my first attempt I included the entire text of the bounce message
        (which included the original spam message) directly my message to the
        apnic-talk list, and the anti-spam filters at apnic.net didn't like that.
        :-(

        In this instance however the SMTP 5xx rejection message I received was
        arguably appropriate because the apnic-talk list should not nomally be
        receiving messages that contain blacklisted URLs.
        _______________________________________________
        apnic-talk mailing list
        apnic-talk@lists.apnic.net
        https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmailman.apnic.net%2Fmailman%2Flistinfo%2Fapnic-talk&amp;data=04%7C01%7C%7Cb8d0ae01baec4441848308d99457cdcd%7C127d8d0d7ccf473dab096e44ad752ded%7C0%7C0%7C637703927846466047%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&amp;sdata=ihExIvDwK%2B5VC6p8Zqj2fEAUVLLAuO6D8NMciQhZTjQ%3D&amp;reserved=0



    **********************************************
    IPv4 is over
    Are you ready for the new Internet ?
    https://aus01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.theipv6company.com%2F&amp;data=04%7C01%7C%7Cb8d0ae01baec4441848308d99457cdcd%7C127d8d0d7ccf473dab096e44ad752ded%7C0%7C0%7C637703927846466047%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&amp;sdata=2s6Sl%2BfPjXdvyMjrfs1SL8%2BTa99B%2BE8l5ahXRmhHamc%3D&amp;reserved=0
    The IPv6 Company

    This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.



    _______________________________________________
    apnic-talk mailing list
    apnic-talk@lists.apnic.net
    https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmailman.apnic.net%2Fmailman%2Flistinfo%2Fapnic-talk&amp;data=04%7C01%7C%7Cb8d0ae01baec4441848308d99457cdcd%7C127d8d0d7ccf473dab096e44ad752ded%7C0%7C0%7C637703927846466047%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&amp;sdata=ihExIvDwK%2B5VC6p8Zqj2fEAUVLLAuO6D8NMciQhZTjQ%3D&amp;reserved=0