Re: Citibank phishing fools spamcop

Read in .spam, discussing in .help, posting to .spam & .help, f/ups in
.help

Eric wrote:
> The phishing link in the body of this email is not being parsed
> properly and not being reported.
>
> http://citibusinessonline.da-us.c1tlbank.com/cbusol/signon.do

citibusinessonline.da-us.c1tlbank.com does not resolve for my resolver,
for spamcop's resolver, or for dnsstuff's nor the gtld resolvers.

I think it's dead, Jim [Bones (Dr. Leonard) McCoy on the original Star
Trek]

> Also, when I submit the report, firefox brings me to a page in source
> code instead of html, and a report sent to [email protected]
> goes to dev-null. Why is that?

I don't know about your source code page view in FF, but the reason for
devnulling the spoof addy is this:

Parsing input: citigroup.com
Host citigroup.com (checking ip) = 192.193.217.120
host 192.193.217.120 = citibank.com (cached)
Routing details for 192.193.217.120
Report routing for 192.193.217.120: [email protected]
[email protected] redirects to [email protected]
[email protected] bounces (6 sent : 6 bounces)

If a redirect addy bounces, then SC is going to devnull it.

>
http://www.spamcop.net/sc?id=z899512392z27f4f1df34c194a7a021036571ca6ee7z

If you post the tracker only, which is all you need to do, since it
provides access to the original spam in a better condition than the spam
you post into .spam, there is no need to post anything to .spam.  .spam
is only for posting 'junk' such as complete spams, not for discussing.
No complete spams are allowed in the discussion groups -- but of course
trackers are.  So there is no need to use the group .spam at all if you
post a tracker.


-- 
Mike Easter
kibitzer, not SC admin