Eircom.net and SPAM...................!

Ripwave

Originally posted by Dinarius
It's that Eircom are doing NOTHING about it.

Eircome provide a FREE ISP service. Blocking spam really isn't their job.

The current Microsoft Update virus plague, due to the not inconsiderable size of the attachments (about 117kb to 159kb) is rendering the slower dial-up accounts unusable.

I personally have about 5 eircom.net e-mail accounts. Members of my immediate family have another 5 or 6. Not one of these accounts has received a single copy of the Swen virus that you're complaining about.

I have written to Eircom (again!) about getting rid of the tinet.ie address.

That's a totally seperate issue - you're not getting any Swen messages sent to tinet.ie addresses, I presume?

Deleting the MX record for tinet.ie would get you about a 2 week respite on your spam - spammers may be scum, but they're not stupid, and it would take them just a couple of minutes to replace the tinet.ie addresses with eircom.net addresses (you don't think they wouldn't notice, do you?).

Ripwave

Originally posted by Bond-James Bond
Its eircoms job to stop their servers from being used as spam relays.

And do you have any evidence that eircoms.nets servers are being used as spam relays? (They were in the past, but that issue was fixed. If you have evidence of current activity, post it. If you don't, then stop spreading misinformation.).

Dinarius

Just got this from a UK friend I've been corresponding with......

"BT Openworld have virus and spam software available for their email customers, I have had about 6 notifications from BT that they have blocked the MS update virus email. The spam filter is also great,it is done at their end and about 95% of spam is directed into a spam folder that you can look at via webmail if you want,all spam older than 15 days gets deleted from it. All I get downloaded into Outlook now are genuine emails and just a few spam that the BT filter couldn't decide on. It was great to be able to go on holiday for a fortnight and not have about 700 emails to wade through when I got back."

So, it can be done! Oh, for a real ISP.

Cloudmark is far better than Mailwasher. It can be had on a free one month trial. In conjunction with a broadband connection, it's excellent, leaving you Inbox free of about 90% plus of spam. It works in a similar way to BTOpenworld's service. i.e. There is a spam folder where you can check in case something has slipped throught the net. In my experience, nothing ever has.

D.

mneylon

Originally posted by bricks

And even if they did filter email messages from Microsoft that had attachments, B]

None of those emails came from Microsoft

vibe666

Originally posted by Bond-James Bond
Its eircoms job to stop their servers from being used as spam relays.

correct, that's why they are not used as relays. the only people who have SMTP access to mail1.eircom.net are eircom.net customers and a few other select irish ISP's. this is done by simply restricting the IP range that can send mail through the server.

As for eircom blocking spam, why should they? they are offering a free service (email is free, if you have a subscription account then you are paying for cheaper access not the email account itself, as you aren't required to have an eircom.net email address if you have a sub account).

As for spam, I have had the same eircom.net email address for a year and a half and have never had a single unsolicited email come through the account at all.

If you are getting spam it's for one of 4 reasons:

1. You have signed up for some porn at some point thinking it was gonna get you free smut.

2. You signed up to a perfectly innocent mailing list for model trains, news, football or whatever and despite telling all their customers they never sell your information to others, they did and now you've ended up on about a hundred diofferent lists for porn printer cartridges and viagra and don't know why.

3. Your email address is listed on a website somewhere, whether it be contact details for your own site, or some forum where you've openly left your address and one of the spam bots that trawls web pages for addresses has picked you up and you're now on loads of lists.

4. Or you've been posting on newsgroups with your correct email address listed in your posts and again, spam bots have picked it up and you're now on their books.

the only other way would be for the spamsters to use an already existing mailing list and just tack the eircom.net domain onto the end of the existing addresses. then they send out a whole rake of html rich porno mails and the scripts in them tell said spamsters which address was a sucessful 'hit' when OE of whatever mail client downloads the images in the mail from their server.

So, if you don't want SPAM you need to do the following:

Don't sign up for anything with your main email address. if you must then use a web based email account like hotmail which has spam filtering built in, and keep your eircom address for private use.

Don't leave your email address on any website or newsgroup posts.

Don't have the preview turned on in OE (or whatever mail client you have) and delete any mails that look dodgy without opening them.

If you are getting spam then change your email address to something new and stop using the old one. once you've done that you can click on the 'To' box in an email message and add all yuor email buddies to the list (everyone you have ever replied to should be in there) and send a single email to all of them at once telling them of your new address.

If you really need to keep your existing address (business cards maybe) then use Mailwasher www.mailwasher.net before you open Outlook and set it up to bounce all the spams back to the senders (this generally doesn't do much these days as most spammers fake the return address anyway, but it doesn't hurt).

above all stop whinging at the Rat for providing you with a free email address and not policing what you do with it, a lot of people would be grateful that they don't get everything censored. Have you been to China?

Dinarius

Ripwave wrote:

"Deleting the MX record for tinet.ie would get you about a 2 week respite on your spam - spammers may be scum, but they're not stupid, and it would take them just a couple of minutes to replace the tinet.ie addresses with eircom.net addresses (you don't think they wouldn't notice, do you?)."

Do you honestly believe that if the tinet.ie address was discontinued that there is some guy out there who would sit back in his chair and think,

"Hhhhhhhhmmmmmmmm, that's very interesting. The tinet.ie address was bounced back. I wonder what he's using now. Ah! Yes! It's owned by the same company as Eircom.net. Let's try that................" ;-)

No way!

These people are dealing in hundreds of millions of emails a month. They don't have time for such niceties. They are sent from giant servers based, mostly, in South Korea, Thailand and China. And to a lesser degree in the US. (If Bush ever decides to bomb these, I for one won't mind.)

Spam addresses are generated principally by either harvesting or (mostly) by computer generated guesswork. Literally! If the computer gets it wrong and the mail is bounced, they don't care. They just keep on trying.

As an aside, that is why including an alphanumeric element in your email address makes it virtually bullet proof. Except to harvesting, of course. But, while davejones@eircom.net looks fine, davejones88qq@eircom.net looks truly awful on a business card or headed notepaper, which is what many of us require.

So, yes, if tinet.ie was discontinued, I WOULD lose about 25% of my spam.

As for Eircom, I got a reply to my email from Customer Services and will post at a later date. Suffice to say for the moment that it wasn't very satisfactory. But, what's new..............?

jd wrote:

"Not quite true..
afaik a high proportion of these particular viruses are actually removed, but they are not catching them all.."

Based on what I understand from the reply I received, this is not so. In any case, the Microsoft Update scam has been running all summer and it is THE most popular, though not the most dangerous, of current viruses. So, why haven't Eircom done anything about it?

Ripwave wrote:

"Eircome provide a FREE ISP service. Blocking spam really isn't their job."

There is NO such thing as a free ISP.

Well plenty of other ISPs think it is part of their job. As far as I am concerned, I no longer have a tinet.ie address. Yet, I get mail (all spam) to that address. I certainly believe that it is their job to stop that.

D.

Valentia

If you are getting spam it's for one of 4 reasons:

5. You had an old tinet.ie account which was changed to eircom.net and the morons wont delete all the tinet accounts as they said they would 4 or 5 years ago!!!

vibe666

ANd why do you get lots of spam on that address? please see reasons 1-4 above.

change your email addrss. it's not hard, and it takes 5 minutes on the eircom.net website.

'oh, but what about all my business cards?'

change them too. if you have the time and energy to whine about it so much then you can afford to get your business cards changed, and in any case why didn't you change the address before you got all these cards printed? it's not like all this spam happened overnight is it.

Dinarius

vibe666 wrote:

"As for spam, I have had the same eircom.net email address for a year and a half and have never had a single unsolicited email come through the account at all."

I've had mine for 7 years, which may explain my spam problem in part. But, for the business reasons you've already mentioned, I need it.

"If you really need to keep your existing address (business cards maybe) then use Mailwasher www.mailwasher.net before you open Outlook and set it up to bounce all the spams back to the senders (this generally doesn't do much these days as most spammers fake the return address anyway, but it doesn't hurt)."

Actually, it will hurt you eventually - a lot! It confirms your email address as live.

Also, with Mailwasher, you have to still clean out your inbox yourself. For me, this is the only one worth using.

http://www.cloudmark.com/

It costs $3.99 a month. It sets itself up with Outlook or Outlook Express. It creates a seperate folder for spam and puts it all in there automatically. The whole thing works on the basis of a community of users working together. Ingenious! Most people who try it for a month stick with it.

D.

Dinarius

Valentia,

I take it we're in agreement?

;-)

D.

Dinarius

Why does it say Moved next to this thread on the main page?

Why does it say that Frank Grimes was the last to post on this thread yesterday? Obviously, he wasn't.

Why is there no Replies Total or Read Total?

At least, that's how it is on my screen!

Thanks.

D.

vibe666

Originally posted by Dinarius
Actually, it will hurt you eventually - a lot! It confirms your email address as live.

Not true I'm afraid. the whole point of mailwasher is that it sends a standard bounce message which is sent whenever an email address is not valid.

all the spammer gets (assuming it's not a faked return address) is a mailer-deamon message to say the address is not valid, and typically if this is received spammers with remove said address from their lists to save bandwidth.

these days though with bandwidth being as cheap as it is, they aren't too bothered.

Frank Grimes

Originally posted by Dinarius
Why does it say that Frank Grimes was the last to post on this thread yesterday?

I was the last to post to the thread when it was in the IOFFL board, it was moved here (Net/Comms) yesterday.

Dinarius

Vibe666,

Apologies. You're right. I had forgotten that.

But, having used both, Cloudmark is miles better! ;-)

D.

drrnwbb

i have been usign cloudmark for about a year now and i love it, they did mess up a bit though when they introduced the monthly charge. the last free beta took to uninstalling itself, so i switched over to spamassassin pro which (for me) wasnt as good.

but my spam problem is with eircom.net. i get a lot of emails sent to my account that are also cc'd to a lot of other people with eircom.net addresses. and it frequently has either my username or another eircom.net username in the subject matter. my username begins with "d", so in the cc section there is usually about 20 other eircom net addresses beginning with "d". the only thing stopping me from stopping using my eircom.net addy is several years of legacy, ive used it to sign up with a lot of services and it would be a pain in the arse to change them all to another of my email addys.

(note, i went from getting about 1spam a month on the account to getting about 80 a day about a year ago, dont know where it all went wrong)

goddam eircom.net

dw

vibe666

seriously people whats with all the blaming of eircom for the spam? they don't send spam and they don't sell your email address to anyone do they? no they don't or I'd be getting spam too.

and drrnwbb, you just answered your own question there.

The reason you get lots of spam in your own words: 'is several years of legacy, ive used it to sign up with a lot of services'

please see my previous reason for your spam filled inbox.

2. You signed up to a perfectly innocent mailing list for model trains, news, football or whatever and despite telling all their customers they never sell your information to others, they did and now you've ended up on about a hundred diofferent lists for porn printer cartridges and viagra and don't know why.

drrnwbb

Originally posted by vibe666

drrnwbb, you just answered your own question there.

The reason you get lots of spam in your own words: 'is several years of legacy, ive used it to sign up with a lot of services'

hehe.. i knew when i wrote that id get some comment, and you are right of course. but i wasnt blaming eircom.net for the spam problem. if you read my post again you will see that my problem is slightly different. its the format of the emails. sent to eircom.net customers in bulk and this can be seen in the cc part of the email, sometimes with usernames in the message header. im not an IT spam expert so i dont know what eircom can do about it, but my eircom.net spam quantity is at least 10times the amount of other more public email addesses i have with other providers.

dw

jd

Originally posted by Dinarius
Ripwave wrote:

"jd wrote:

"Not quite true..
afaik a high proportion of these particular viruses are actually removed, but they are not catching them all.."

Based on what I understand from the reply I received, this is not so. In any case, the Microsoft Update scam has been running all summer and it is THE most popular, though not the most dangerous, of current viruses. So, why haven't Eircom done anything about it?

Actually they do-when mail relay load increases.Emails with certain payloads are remopved. Eircomnet also use tarpitting-but that's another story..

java

Dinarius, the Microsoft update scam, aka w32.swen was discovered on September 18th according to symantec. Hardly "all summer". Not even summer infact.

Capt'n Midnight

Yeah they could do a bit more.

I take it they have spam control on their internal corporate email.. so they are aware of the problem and have access to reports on junk mails. -

Also how much does squid guard cost ?
If they wanted to they could set up a Second Proxy or number so that customers who wanted to go to blacklisted sites could do so while the punters would be steared away from X-rated / hate / other waste of time sites...

What SMTP software do Eircom use on thier public servers - then people could suggest appropiate packages / blacklists / rules for it... - Depending on who you believe up to 50% of all email is SPAM so Eircom could reduce the workload on their servers by half !!

(note: since the Gov't are trying to get full email retention of 3 years in place - imagine how much SPAM will be need to be archived)

seamus

Originally posted by Capt'n Midnight
Yeah they could do a bit more.

I take it they have spam control on their internal corporate email.. so they are aware of the problem and have access to reports on junk mails. -

eircom.net staff use the same mail servers and same domain as their customers. And yes, they suffer from spam too.

Our man in Havana

Here are the headers for this message:

Return-Path: <admin@duma.gov.ru>
Delivered-To: eircom.net-xxxxxxxxx@eircom.net
Received: (vpopmail 64692 invoked by uid 16); 23 Oct 2003 13:03:03 +0100
Received: (qmail 64112 messnum 3212081 invoked from network[159.134.167.160/p167-160.as1.lmk.limerick.eircom.net]); 23 Oct 2003 12:02:54 -0000
Received: from p167-160.as1.lmk.limerick.eircom.net (HELO localhost) (159.134.167.160)
by mail01.svc.cra.dublin.eircom.net (qp 64112) with SMTP; 23 Oct 2003 12:02:54 -0000
From: "Microsoft" <security@microsoft.com>
To: <xxxxxxxx@eircom.net>
Subject: Use this patch immediately !
MIME-Version: 1.0
Status: U
X-UIDL: 1066910583.64692.mail01.svc.cra.dublin.eircom.net,S=13448
Content-Type: multipart/mixed;boundary="xxxx"

--xxxx
Content-Type: text/plain;
Content-Transfer-Encoding: 7bit

Dear friend , use this Internet Explorer patch now!
There are dangerous virus in the Internet now!
More than 500.000 already infected!

--xxxx
Content-Type: plain/text
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="Norton AntiVirus Deleted1.txt"

Tm9ydG9uIEFudGlWaXJ1cyByZW1vdmVkIHRoZSBhdHRhY2htZW50OiBwYXRjaC5leGUuDQpU
aGUgYXR0YWNobWVudCB3YXMgaW5mZWN0ZWQgd2l0aCB0aGUgVzMyLkR1bWFydUBtbSB2aXJ1
cy4=
--xxxx


This is what spam cop says:

Saved email:
This page may be saved for future reference:
http://www.spamcop.net/sc?id=z179355601z4c2b11284ddbe0533bb8272a2990c46bz


Please make sure this email IS spam:
From: "Microsoft" <security@microsoft.com> (Use this patch immediately !)
Content-Type: text/plain;
Content-Transfer-Encoding: 7bit
View full message



Report Spam to:


Re:159.134.167.160 (Administrator of network where email originates)
To: abuse@eircom.net (Notes)


Re:159.134.167.160 (Third party interested in email source)
To: Cyveillance spam collection (Notes)
Additional notes (optional - max 2000 characters):

.........................................................................................................


So Eircom is responsible for the spam!

Capt'n Midnight

RE: So Eircom is responsible for the spam!

eh no - it just means that at least one person using eircom has been infected... it's a virus NOT spam.

BTW: a lot of spammers use fake abuse@spamdomain.com email addresses - so when you try to complain / report the abuse all you are doing is putting your reply address onto their mailing list..

Dinarius

Probably just coincidence, but since I wrote to Eircom last week and CC'd it to ComReg, the deluge of Microsoft Update Virus spam has reduced to a trickle. Wonder if they're trying to filter it?

On a related point, does anyone know of a commercial (NOT private) email address using the tinet.ie ending?

If you do, could you please post the name of the company or enterprise?

Many thanks.

D.

De Rebel

As the law stands at present if eircom were to scan your mails and delete some of them based on arbitrary criteria set by eircom themselves from time to time you could probably go after them for invasion of privacy and consequential loss.

SPAM needs to be stopped at source. The vast majority of spam originates from a very small number of professional spammers. Almost all of these operate from North America. The US Government and its National Infrastructure Protection Agency are probably the bodies with the best chance of controlling SPAM. And they have shown a singular disinterest in taking any significant action. Whinge to them if you must.

Dinarius

"SPAM needs to be stopped at source."

With respect, more than a little naive, I would have thought.

Yes, the US is responsible for a lot of spam and doesn't seem to give a damn - they are resisting any introduction of an "opt in" law, for example, which seems incredible. But, nothing about the current US should surprise us.

But, even if the US did change its mind, the quantity of spam emanating from South East Asia would still be a plague.

An child can recognize spam. That is the principle on which the likes of Cloudmark work, and work very well.

As has been said already, many ISPs do it. Why not Eircom?

Anyway, we're going over old terrain here.

Anyone know of a company using the tinet.ie address? I'd love to know if there is!

Thanks.

D.

Dinarius

Oh, come, come now!

There must be at least ONE business still using the @tinet.ie address!?

D. ;-)

Our man in Havana

Originally posted by Dinarius
Oh, come, come now!

There must be at least ONE business still using the @tinet.ie address!?

D. ;-)

Found this one. I wrote to them about a job a while back.

C&C Security Ltd ccsecurity@tinet.ie

Only one I have found so far.

James

java

Very smart Bond-James Bond, very smart, putting legitimite email addresses up on a website where any spammer doing a web search can harvest the address. And people wonder why their email addresses get spammed. Case in point.

Dinarius

http://www.guardian.co.uk/online/spam/story/0,13427,1073596,00.html

Hallelujah!

.............if it happens.

Knowing Eircom, they'll probably seek a derrogation on its impelmentation. ;-)

D.