Subject: Re: [feedback-report] Abuse Report with no Spam
From: Yakov Shafranovich <[email-masked]>
To: Marc Perkel <[email-masked]>
Cc: [email-masked]
Date: Fri, 13 Jul 2007 10:12:21 -0400
List-Id: Public forum for discussion on the feedback-report draft <abuse-feedback-report.mipassoc.org>

Marc Perkel wrote:
> OK - Here's a question about abouse reports that don't fit the specs.
> I'm now geneating this report to report viruses. I'm able to detect the
> presence of viruses without actually receiving the email based only on
> the behavior of the virus. What I'm doing is every 6 hours I'm sending a
> list of infected computers to abuse. This is the form I'm using now. How
> would something like this fit into an ARF model?
> 

ARF is meant for reporting a single email message. For viruses, that
would mean sending back the headers of a specific infected message
without the body. The current spec lets you do that in section 4, part d.

HOWEVER, based on your example what you are describing is not the same
thing. First of all, ARF is not intended for aggregate reporting. We
have discussed aggregated reporting a while back when Hotmail begun to
do it, but decided to pick this problem apart first. Second, reporting
virus-like behavior without actual emails is for sure not ARF. What you
want to do is report security problems such as virus infected machines,
not virus infected emails. For that, there are other draft standards
like this one:

http://www.cert.org/ietf/inch/inch.html

Yakov

Date: Thu, 12 Jul 2007 19:56:44 -0700
From: Marc Perkel <[email-masked]>
To: [email-masked]
Subject: [feedback-report] Abuse Report with no Spam

This is a multi-part message in MIME format.
--------------060302010303090806040804
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

OK - Here's a question about abouse reports that don't fit the specs. 
I'm now geneating this report to report viruses. I'm able to detect the 
presence of viruses without actually receiving the email based only on 
the behavior of the virus. What I'm doing is every 6 hours I'm sending a 
list of infected computers to abuse. This is the form I'm using now. How 
would something like this fit into an ARF model?

=========

This is an automated email courtesy report from the folks at junkemailfilter.com to alert you about computers on your system that are exhibiting behavior that are likely to be infected with a computer virus.

You might want to consider creating a automated script to block port 25 on the IP addresses listed here. We hope this information will help you in determining the source of the problem and shut it down. 

If you have any questions or feedback about this virus report or are interesting in learning about our spam filtering technology feel free to contact us. If this is a false positive please accept our apologies and let us know so we can fix the problem. 

Marc Perkel - Fearless Leader
Junk Email Filter dot com
http://www.junkemailfilter.com
[email-masked]

A total of 43 IP addresses were caught in the last 6 hours. Here is the list:

==== IP LIST BEGIN ====

168.103.248.37
168.103.53.217
209.180.137.105
209.181.101.107
216.160.51.100
216.160.58.37
63.146.231.50
63.224.156.86
63.224.20.56
63.227.99.48
63.229.114.247
63.229.124.14
65.100.21.211
65.101.29.244
67.42.217.236
70.56.91.76
71.209.173.155
71.209.176.195
71.209.180.122
71.210.64.59
71.211.180.185
71.213.53.14
71.213.74.165
71.214.242.2
71.218.182.36
71.218.83.207
71.219.159.90
71.220.127.74
71.220.130.81
71.220.166.237
71.34.12.210
71.34.160.108
71.35.145.113
71.36.119.219
71.37.237.242
75.161.146.212
75.161.168.86
75.162.239.190
75.163.139.152
75.163.187.101
75.163.92.9
75.166.125.243
75.166.92.193

===== IP LIST END =====

You might be wondering how we can detect virus infected computers without actually receiving spam from them. The way these computer were caught is that they continually attempted to connect to high numbered fake MX records when low numbered real MX servers were available. Only spammers and virus infected spam bots try to go in the back door first when the front door is open. The IP addresses listed here exhibited that kind of behavior.

The above list of IP addresses have been blacklisted on our DNS blacklist at hostkarma.junkemailfilter.com. The listing will automatically clear 3 days after the virus activity stops. For more information about our DNS Black/White/Yellow lists please visit http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists

This virus reporting system is still experimental. We hope you will find this information useful. Working together we can beat the spammers. If you have any feedback we would like to hear from you.

--------------060302010303090806040804
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
</head>
<body bgcolor="#ffffff" text="#000000">
OK - Here's a question about abouse reports that don't fit the specs.
I'm now geneating this report to report viruses. I'm able to detect the
presence of viruses without actually receiving the email based only on
the behavior of the virus. What I'm doing is every 6 hours I'm sending
a list of infected computers to abuse. This is the form I'm using now.
How would something like this fit into an ARF model?<br>
<br>
=========<br>
<div class="moz-text-plain" wrap="true" graphical-quote="true"
 style="font-family: -moz-fixed; font-size: 13px;" lang="x-western">
<pre wrap="">This is an automated email courtesy report from the folks at junkemailfilter.com to alert you about computers on your system that are exhibiting behavior that are likely to be infected with a computer virus.

You might want to consider creating a automated script to block port 25 on the IP addresses listed here. We hope this information will help you in determining the source of the problem and shut it down. 

If you have any questions or feedback about this virus report or are interesting in learning about our spam filtering technology feel free to contact us. If this is a false positive please accept our apologies and let us know so we can fix the problem. 

Marc Perkel - Fearless Leader
Junk Email Filter dot com
<a class="moz-txt-link-freetext" href="http://www.junkemailfilter.com">http://www.junkemailfilter.com</a>
<a class="moz-txt-link-abbreviated"
 href="mailto:[email-masked]">[email-masked]</a>

A total of 43 IP addresses were caught in the last 6 hours. Here is the list:

==== IP LIST BEGIN ====

168.103.248.37
168.103.53.217
209.180.137.105
209.181.101.107
216.160.51.100
216.160.58.37
63.146.231.50
63.224.156.86
63.224.20.56
63.227.99.48
63.229.114.247
63.229.124.14
65.100.21.211
65.101.29.244
67.42.217.236
70.56.91.76
71.209.173.155
71.209.176.195
71.209.180.122
71.210.64.59
71.211.180.185
71.213.53.14
71.213.74.165
71.214.242.2
71.218.182.36
71.218.83.207
71.219.159.90
71.220.127.74
71.220.130.81
71.220.166.237
71.34.12.210
71.34.160.108
71.35.145.113
71.36.119.219
71.37.237.242
75.161.146.212
75.161.168.86
75.162.239.190
75.163.139.152
75.163.187.101
75.163.92.9
75.166.125.243
75.166.92.193

===== IP LIST END =====

You might be wondering how we can detect virus infected computers without actually receiving spam from them. The way these computer were caught is that they continually attempted to connect to high numbered fake MX records when low numbered real MX servers were available. Only spammers and virus infected spam bots try to go in the back door first when the front door is open. The IP addresses listed here exhibited that kind of behavior.

The above list of IP addresses have been blacklisted on our DNS blacklist at hostkarma.junkemailfilter.com. The listing will automatically clear 3 days after the virus activity stops. For more information about our DNS Black/White/Yellow lists please visit <a
 class="moz-txt-link-freetext"
 href="http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists">http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists</a>

This virus reporting system is still experimental. We hope you will find this information useful. Working together we can beat the spammers. If you have any feedback we would like to hear from you.

</pre>
</div>
<br>
</body>
</html>

--------------060302010303090806040804--

Date: 13 Jul 2007 02:31:19 -0000
From: John Levine <[email-masked]>
To: [email-masked]
Subject: Re: [feedback-report] Mixed text and mime?
Organization: 
Cc: 

>I'm surprised there are that many. If you were to send them ARFs  
>anyway, do you think they would ignore the complaints or find a way  
>to read them?

I've been sending all my reports as ARF basically as an experiment, and I've
found very few places complain.

A certain number of ticketing systems still smash or discard attachments,
so rather than trying to recognize them all, I've been archiving the spam
and put a URL in each complaint that lets them fetch the spam.  I realize
this doesn't scale for large systems very well.

R's,
John

Date: Wed, 11 Jul 2007 15:27:33 -0700
From: "J.D. Falk" <[email-masked]>
Organization: Yahoo!
To: [email-masked]
Subject: Re: [feedback-report] Mixed text and mime?

On 2007-07-11 14:09, Marc Perkel wrote:

> I'm with you - I wish everyone would take this standard format. It's a 
> good standard. But even big companies often have morons running their 
> email systems.

Being insulting doesn't encourage use of new technology.

The number of sites which have implemented ARF is tiny.  The number of 
admins who've even heard of ARF is only slightly larger.  It's not a 
formal standard yet, merely a completed draft in need of friendly, 
patient evangelism.

-- 
J.D. Falk, Anti-Spam Product Manager
Yahoo! Mail

From: Joshua Baer <[email-masked]>
Subject: Re: [feedback-report] Mixed text and mime?
Date: Wed, 11 Jul 2007 16:18:43 -0500
To: "Marc Perkel" <[email-masked]>
Cc: [email-masked]

--Apple-Mail-5--276906302
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
	charset=US-ASCII;
	delsp=yes;
	format=flowed

I don't think they are morons its just that they are using a CRM  
software that can't handle the messages. These people probably don't  
have much ability change that, but then again sometimes those systems  
don't change unless they _have_ to so we may need to find ways to  
incentivize them.

~Josh

On Jul 11, 2007, at 4:09 PM, Marc Perkel wrote:

> I created the list and added them to it because I was sending ARF  
> format and got complaints. In some cases the messages bounced  
> refusing email with attachments.
>
> I'm with you - I wish everyone would take this standard format.  
> It's a good standard. But even big companies often have morons  
> running their email systems.
>
> Joshua Baer wrote:
>> I'm surprised there are that many. If you were to send them ARFs  
>> anyway, do you think they would ignore the complaints or find a  
>> way to read them?
>>
>> ~Josh
>>
>>
>> On Jul 11, 2007, at 3:20 PM, Marc Perkel wrote:
>>
>>> Well, since I started sending ARF a few days ago I had to put these
>>> domains on an exception list for plain text.
>>>
>>> qwest.net
>>> rr.com
>>> cogeco.net
>>> mchsi.com
>>> tiscali.nl
>>> domeneshop.no
>>> chello.nl
>>> covad.com
>>> speakeasy.net
>>> inode.at
>>> nauticom.net
>>> midco.net
>>>
>>> I wish ARF would catch on because I want to do this right.
>>>
>>> Joshua Baer wrote:
>>> > I'm not sure I see the harm in sending all ARF. It was designed  
>>> to be
>>> > just as useful to a person as to a computer. Even if I'm not  
>>> "set up
>>> > to interpret it" (which I assume you mean set up to process the
>>> > messages automatically), I'd still rather get an ARF message  
>>> than just
>>> > getting a raw message forwarded.
>>> >
>>> > As Steve said, if they can't handle MIME, they probably can't  
>>> handle
>>> > much of anything. If they can't handle MIME, they can't even  
>>> view half
>>> > the messages that the complaint is about.
>>> >
>>> > ~Josh
>>> >
>>> >
>>> > On Jul 11, 2007, at 1:43 PM, J.D. Falk wrote:
>>> >
>>> >> On 2007-07-10 15:56, Marc Perkel wrote:
>>> >>
>>> >>> It's kind of interesting that some abuse folks ask for text  
>>> mode and
>>> >>> some ask for mime as specified in this standard. I'm  
>>> contemplating
>>> >>> doing a combination where I have both. Anyone have any opinions
>>> >>> about this?
>>> >>
>>> >> If the recipient doesn't ask for ARF, don't send them ARF.  This
>>> >> format is still too new (and too unpublished) to assume that  
>>> everyone
>>> >> will be set up to interpret it.
>>> >>
>>> >> --
>>> >> J.D. Falk, Anti-Spam Product Manager
>>> >> Yahoo! Mail
>>> >> _______________________________________________
>>> >> abuse-feedback-report mailing list
>>> >> [email-masked]
>>> >> http://mipassoc.org/mailman/listinfo/abuse-feedback-report
>>> >
>>> > _______________________________________________
>>> > abuse-feedback-report mailing list
>>> > [email-masked]
>>> > http://mipassoc.org/mailman/listinfo/abuse-feedback-report
>>>
>>
>>
>> _______________________________________________
>> abuse-feedback-report mailing list
>> [email-masked]
>> http://mipassoc.org/mailman/listinfo/abuse-feedback-report
>>

--Apple-Mail-5--276906302
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=ISO-8859-1

<HTML><BODY style=3D"word-wrap: break-word; -khtml-nbsp-mode: space; =
-khtml-line-break: after-white-space; ">I don't think they are morons =
its just that they are using a CRM software that can't handle the =
messages. These people probably don't have much ability change that, but =
then again sometimes those systems don't change unless they _have_ to so =
we may need to find ways to incentivize them.<DIV><BR =
class=3D"khtml-block-placeholder"></DIV><DIV>~Josh</DIV><DIV><BR><DIV><DIV=
>On Jul 11, 2007, at 4:09 PM, Marc Perkel wrote:</DIV><BR =
class=3D"Apple-interchange-newline"><BLOCKQUOTE type=3D"cite">  I =
created the list and added them to it because I was sending ARF format =
and got complaints. In some cases the messages bounced refusing email =
with attachments.<BR> <BR> I'm with you - I wish everyone would take =
this standard format. It's a good standard. But even big companies often =
have morons running their email systems. <BR> <BR> Joshua Baer wrote: =
<BLOCKQUOTE =
cite=3D"mid:[email-masked]" =
type=3D"cite">  <DIV>I'm surprised there are that many. If you were to =
send them ARFs anyway, do you think they would ignore the complaints or =
find a way to read them?</DIV>  <DIV><BR =
class=3D"khtml-block-placeholder">  </DIV>  <DIV>~Josh</DIV>  <DIV><BR =
class=3D"khtml-block-placeholder">  </DIV>  <BR>  <DIV>  <DIV>On Jul 11, =
2007, at 3:20 PM, Marc Perkel wrote:</DIV>  <BR =
class=3D"Apple-interchange-newline">  <BLOCKQUOTE type=3D"cite"><P><FONT =
size=3D"2">Well, since I started sending ARF a few days ago I had to put =
these<BR> domains on an exception list for plain text.<BR>    <BR> =
qwest.net<BR> rr.com<BR> cogeco.net<BR> mchsi.com<BR> tiscali.nl<BR> =
domeneshop.no<BR> chello.nl<BR> covad.com<BR> speakeasy.net<BR> =
inode.at<BR> nauticom.net<BR> midco.net<BR>    <BR> I wish ARF would =
catch on because I want to do this right.<BR>    <BR> Joshua Baer =
wrote:<BR> &gt; I'm not sure I see the harm in sending all ARF. It was =
designed to be<BR> &gt; just as useful to a person as to a computer. =
Even if I'm not "set up<BR> &gt; to interpret it" (which I assume you =
mean set up to process the<BR> &gt; messages automatically), I'd still =
rather get an ARF message than just<BR> &gt; getting a raw message =
forwarded.<BR> &gt;<BR> &gt; As Steve said, if they can't handle MIME, =
they probably can't handle<BR> &gt; much of anything. If they can't =
handle MIME, they can't even view half<BR> &gt; the messages that the =
complaint is about.<BR> &gt;<BR> &gt; ~Josh<BR> &gt;<BR> &gt;<BR> &gt; =
On Jul 11, 2007, at 1:43 PM, J.D. Falk wrote:<BR> &gt;<BR> &gt;&gt; On =
2007-07-10 15:56, Marc Perkel wrote:<BR> &gt;&gt;<BR> &gt;&gt;&gt; It's =
kind of interesting that some abuse folks ask for text mode and<BR> =
&gt;&gt;&gt; some ask for mime as specified in this standard. I'm =
contemplating<BR> &gt;&gt;&gt; doing a combination where I have both. =
Anyone have any opinions<BR> &gt;&gt;&gt; about this?<BR> &gt;&gt;<BR> =
&gt;&gt; If the recipient doesn't ask for ARF, don't send them ARF.=A0 =
This<BR> &gt;&gt; format is still too new (and too unpublished) to =
assume that everyone<BR> &gt;&gt; will be set up to interpret it.<BR> =
&gt;&gt;<BR> &gt;&gt; --<BR> &gt;&gt; J.D. Falk, Anti-Spam Product =
Manager<BR> &gt;&gt; Yahoo! Mail<BR> &gt;&gt; =
_______________________________________________<BR> &gt;&gt; =
abuse-feedback-report mailing list<BR> &gt;&gt; <A =
moz-do-not-send=3D"true" =
href=3D"mailto:[email-masked]">abuse-feedback-report@m=
ipassoc.org</A><BR> &gt;&gt; <A moz-do-not-send=3D"true" =
href=3D"http://mipassoc.org/mailman/listinfo/abuse-feedback-report">http:/=
/mipassoc.org/mailman/listinfo/abuse-feedback-report</A><BR> &gt;<BR> =
&gt; _______________________________________________<BR> &gt; =
abuse-feedback-report mailing list<BR> &gt; <A moz-do-not-send=3D"true" =
href=3D"mailto:[email-masked]">abuse-feedback-report@m=
ipassoc.org</A><BR> &gt; <A moz-do-not-send=3D"true" =
href=3D"http://mipassoc.org/mailman/listinfo/abuse-feedback-report">http:/=
/mipassoc.org/mailman/listinfo/abuse-feedback-report</A><BR>    </FONT> =
</P>  </BLOCKQUOTE>  </DIV>  <BR>  <PRE wrap=3D""><HR size=3D"4" =
width=3D"90%">
_______________________________________________
abuse-feedback-report mailing list
<A class=3D"moz-txt-link-abbreviated" =
href=3D"mailto:[email-masked]">abuse-feedback-report@m=
ipassoc.org</A>
<A class=3D"moz-txt-link-freetext" =
href=3D"http://mipassoc.org/mailman/listinfo/abuse-feedback-report">http:/=
/mipassoc.org/mailman/listinfo/abuse-feedback-report</A>
  </PRE> </BLOCKQUOTE>  </BLOCKQUOTE></DIV><BR></DIV></BODY></HTML>=

--Apple-Mail-5--276906302--

Date: Wed, 11 Jul 2007 14:09:14 -0700
From: Marc Perkel <[email-masked]>
To: Joshua Baer <[email-masked]>
Subject: Re: [feedback-report] Mixed text and mime?
Cc: [email-masked]

This is a multi-part message in MIME format.
--------------020103030101000307030705
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

I created the list and added them to it because I was sending ARF format 
and got complaints. In some cases the messages bounced refusing email 
with attachments.

I'm with you - I wish everyone would take this standard format. It's a 
good standard. But even big companies often have morons running their 
email systems.

Joshua Baer wrote:
> I'm surprised there are that many. If you were to send them ARFs 
> anyway, do you think they would ignore the complaints or find a way to 
> read them?
>
> ~Josh
>
>
> On Jul 11, 2007, at 3:20 PM, Marc Perkel wrote:
>
>> Well, since I started sending ARF a few days ago I had to put these
>> domains on an exception list for plain text.
>>
>> qwest.net
>> rr.com
>> cogeco.net
>> mchsi.com
>> tiscali.nl
>> domeneshop.no
>> chello.nl
>> covad.com
>> speakeasy.net
>> inode.at
>> nauticom.net
>> midco.net
>>
>> I wish ARF would catch on because I want to do this right.
>>
>> Joshua Baer wrote:
>> > I'm not sure I see the harm in sending all ARF. It was designed to be
>> > just as useful to a person as to a computer. Even if I'm not "set up
>> > to interpret it" (which I assume you mean set up to process the
>> > messages automatically), I'd still rather get an ARF message than just
>> > getting a raw message forwarded.
>> >
>> > As Steve said, if they can't handle MIME, they probably can't handle
>> > much of anything. If they can't handle MIME, they can't even view half
>> > the messages that the complaint is about.
>> >
>> > ~Josh
>> >
>> >
>> > On Jul 11, 2007, at 1:43 PM, J.D. Falk wrote:
>> >
>> >> On 2007-07-10 15:56, Marc Perkel wrote:
>> >>
>> >>> It's kind of interesting that some abuse folks ask for text mode and
>> >>> some ask for mime as specified in this standard. I'm contemplating
>> >>> doing a combination where I have both. Anyone have any opinions
>> >>> about this?
>> >>
>> >> If the recipient doesn't ask for ARF, don't send them ARF.  This
>> >> format is still too new (and too unpublished) to assume that everyone
>> >> will be set up to interpret it.
>> >>
>> >> --
>> >> J.D. Falk, Anti-Spam Product Manager
>> >> Yahoo! Mail
>> >> _______________________________________________
>> >> abuse-feedback-report mailing list
>> >> [email-masked] 
>> <mailto:[email-masked]>
>> >> http://mipassoc.org/mailman/listinfo/abuse-feedback-report
>> >
>> > _______________________________________________
>> > abuse-feedback-report mailing list
>> > [email-masked] 
>> <mailto:[email-masked]>
>> > http://mipassoc.org/mailman/listinfo/abuse-feedback-report
>>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> abuse-feedback-report mailing list
> [email-masked]
> http://mipassoc.org/mailman/listinfo/abuse-feedback-report
>   

--------------020103030101000307030705
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
  <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
I created the list and added them to it because I was sending ARF
format and got complaints. In some cases the messages bounced refusing
email with attachments.<br>
<br>
I'm with you - I wish everyone would take this standard format. It's a
good standard. But even big companies often have morons running their
email systems. <br>
<br>
Joshua Baer wrote:
<blockquote
 cite="mid:[email-masked]"
 type="cite">
  <div>I'm surprised there are that many. If you were to send them ARFs
anyway, do you think they would ignore the complaints or find a way to
read them?</div>
  <div><br class="khtml-block-placeholder">
  </div>
  <div>~Josh</div>
  <div><br class="khtml-block-placeholder">
  </div>
  <br>
  <div>
  <div>On Jul 11, 2007, at 3:20 PM, Marc Perkel wrote:</div>
  <br class="Apple-interchange-newline">
  <blockquote type="cite">
    <p><font size="2">Well, since I started sending ARF a few days ago
I had to put these<br>
domains on an exception list for plain text.<br>
    <br>
qwest.net<br>
rr.com<br>
cogeco.net<br>
mchsi.com<br>
tiscali.nl<br>
domeneshop.no<br>
chello.nl<br>
covad.com<br>
speakeasy.net<br>
inode.at<br>
nauticom.net<br>
midco.net<br>
    <br>
I wish ARF would catch on because I want to do this right.<br>
    <br>
Joshua Baer wrote:<br>
&gt; I'm not sure I see the harm in sending all ARF. It was designed to
be<br>
&gt; just as useful to a person as to a computer. Even if I'm not "set
up<br>
&gt; to interpret it" (which I assume you mean set up to process the<br>
&gt; messages automatically), I'd still rather get an ARF message than
just<br>
&gt; getting a raw message forwarded.<br>
&gt;<br>
&gt; As Steve said, if they can't handle MIME, they probably can't
handle<br>
&gt; much of anything. If they can't handle MIME, they can't even view
half<br>
&gt; the messages that the complaint is about.<br>
&gt;<br>
&gt; ~Josh<br>
&gt;<br>
&gt;<br>
&gt; On Jul 11, 2007, at 1:43 PM, J.D. Falk wrote:<br>
&gt;<br>
&gt;&gt; On 2007-07-10 15:56, Marc Perkel wrote:<br>
&gt;&gt;<br>
&gt;&gt;&gt; It's kind of interesting that some abuse folks ask for
text mode and<br>
&gt;&gt;&gt; some ask for mime as specified in this standard. I'm
contemplating<br>
&gt;&gt;&gt; doing a combination where I have both. Anyone have any
opinions<br>
&gt;&gt;&gt; about this?<br>
&gt;&gt;<br>
&gt;&gt; If the recipient doesn't ask for ARF, don't send them ARF.&nbsp;
This<br>
&gt;&gt; format is still too new (and too unpublished) to assume that
everyone<br>
&gt;&gt; will be set up to interpret it.<br>
&gt;&gt;<br>
&gt;&gt; --<br>
&gt;&gt; J.D. Falk, Anti-Spam Product Manager<br>
&gt;&gt; Yahoo! Mail<br>
&gt;&gt; _______________________________________________<br>
&gt;&gt; abuse-feedback-report mailing list<br>
&gt;&gt; <a moz-do-not-send="true"
 href="mailto:[email-masked]">[email-masked]</a><br>
&gt;&gt; <a moz-do-not-send="true"
 href="http://mipassoc.org/mailman/listinfo/abuse-feedback-report">http://mipassoc.org/mailman/listinfo/abuse-feedback-report</a><br>
&gt;<br>
&gt; _______________________________________________<br>
&gt; abuse-feedback-report mailing list<br>
&gt; <a moz-do-not-send="true"
 href="mailto:[email-masked]">[email-masked]</a><br>
&gt; <a moz-do-not-send="true"
 href="http://mipassoc.org/mailman/listinfo/abuse-feedback-report">http://mipassoc.org/mailman/listinfo/abuse-feedback-report</a><br>
    </font> </p>
  </blockquote>
  </div>
  <br>
  <pre wrap="">
<hr size="4" width="90%">
_______________________________________________
abuse-feedback-report mailing list
<a class="moz-txt-link-abbreviated" href="mailto:[email-masked]">[email-masked]</a>
<a class="moz-txt-link-freetext" href="http://mipassoc.org/mailman/listinfo/abuse-feedback-report">http://mipassoc.org/mailman/listinfo/abuse-feedback-report</a>
  </pre>
</blockquote>
</body>
</html>

--------------020103030101000307030705--

From: Joshua Baer <[email-masked]>
Subject: Re: [feedback-report] Mixed text and mime?
Date: Wed, 11 Jul 2007 16:02:04 -0500
To: ARF mailing list <[email-masked]>

--Apple-Mail-3--277905514
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
	charset=US-ASCII;
	delsp=yes;
	format=flowed

I couldn't agree more - which is one more reason we need to finish  
defining how you ask for them in a standard way...

~Josh

On Jul 11, 2007, at 3:33 PM, Steve Atkins wrote:

> On Jul 11, 2007, at 1:20 PM, Marc Perkel wrote:
>
>
> > Well, since I started sending ARF a few days ago I had to put these
> > domains on an exception list for plain text.
> >
> > qwest.net
> > rr.com
> > cogeco.net
> > mchsi.com
> > tiscali.nl
> > domeneshop.no
> > chello.nl
> > covad.com
> > speakeasy.net
> > inode.at
> > nauticom.net
> > midco.net
> >
> > I wish ARF would catch on because I want to do this right.
> >
>
> Do what right?
>
> ARF really isn't intended for non-consensual mail, so sending it to
> people who haven't explicitly asked for
> it isn't necessarily a great idea.
>
> Cheers,
>    Steve
>
>
> _______________________________________________
> abuse-feedback-report mailing list
> [email-masked]
> http://mipassoc.org/mailman/listinfo/abuse-feedback-report
>

--Apple-Mail-3--277905514
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=ISO-8859-1

<HTML><BODY style=3D"word-wrap: break-word; -khtml-nbsp-mode: space; =
-khtml-line-break: after-white-space; "><DIV>I couldn't agree more - =
which is one more reason we need to finish defining how you ask for them =
in a standard way...</DIV><DIV><BR =
class=3D"khtml-block-placeholder"></DIV><DIV>~Josh</DIV><DIV><BR =
class=3D"khtml-block-placeholder"></DIV><BR><DIV><DIV>On Jul 11, 2007, =
at 3:33 PM, Steve Atkins wrote:</DIV><BR =
class=3D"Apple-interchange-newline"><BLOCKQUOTE type=3D"cite">  <P><FONT =
size=3D"2">On Jul 11, 2007, at 1:20 PM, Marc Perkel wrote:<BR> <BR> <BR> =
&gt; Well, since I started sending ARF a few days ago I had to put =
these=A0<BR> &gt; domains on an exception list for plain text.<BR> =
&gt;<BR> &gt; qwest.net<BR> &gt; rr.com<BR> &gt; cogeco.net<BR> &gt; =
mchsi.com<BR> &gt; tiscali.nl<BR> &gt; domeneshop.no<BR> &gt; =
chello.nl<BR> &gt; covad.com<BR> &gt; speakeasy.net<BR> &gt; =
inode.at<BR> &gt; nauticom.net<BR> &gt; midco.net<BR> &gt;<BR> &gt; I =
wish ARF would catch on because I want to do this right.<BR> &gt;<BR> =
<BR> Do what right?<BR> <BR> ARF really isn't intended for =
non-consensual mail, so sending it to=A0<BR> people who haven't =
explicitly asked for<BR> it isn't necessarily a great idea.<BR> <BR> =
Cheers,<BR> =A0=A0 Steve<BR> <BR> <BR> =
_______________________________________________<BR> =
abuse-feedback-report mailing list<BR> <A =
href=3D"mailto:[email-masked]">abuse-feedback-report@m=
ipassoc.org</A><BR> <A =
href=3D"http://mipassoc.org/mailman/listinfo/abuse-feedback-report">http:/=
/mipassoc.org/mailman/listinfo/abuse-feedback-report</A><BR> </FONT> =
</P>  </BLOCKQUOTE></DIV><BR></BODY></HTML>=

--Apple-Mail-3--277905514--

From: Joshua Baer <[email-masked]>
Subject: Re: [feedback-report] Mixed text and mime?
Date: Wed, 11 Jul 2007 16:01:07 -0500
To: [email-masked]

--Apple-Mail-2--277962835
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
	charset=US-ASCII;
	delsp=yes;
	format=flowed

I'm surprised there are that many. If you were to send them ARFs  
anyway, do you think they would ignore the complaints or find a way  
to read them?

~Josh

On Jul 11, 2007, at 3:20 PM, Marc Perkel wrote:

> Well, since I started sending ARF a few days ago I had to put these
> domains on an exception list for plain text.
>
> qwest.net
> rr.com
> cogeco.net
> mchsi.com
> tiscali.nl
> domeneshop.no
> chello.nl
> covad.com
> speakeasy.net
> inode.at
> nauticom.net
> midco.net
>
> I wish ARF would catch on because I want to do this right.
>
> Joshua Baer wrote:
> > I'm not sure I see the harm in sending all ARF. It was designed  
> to be
> > just as useful to a person as to a computer. Even if I'm not "set up
> > to interpret it" (which I assume you mean set up to process the
> > messages automatically), I'd still rather get an ARF message than  
> just
> > getting a raw message forwarded.
> >
> > As Steve said, if they can't handle MIME, they probably can't handle
> > much of anything. If they can't handle MIME, they can't even view  
> half
> > the messages that the complaint is about.
> >
> > ~Josh
> >
> >
> > On Jul 11, 2007, at 1:43 PM, J.D. Falk wrote:
> >
> >> On 2007-07-10 15:56, Marc Perkel wrote:
> >>
> >>> It's kind of interesting that some abuse folks ask for text  
> mode and
> >>> some ask for mime as specified in this standard. I'm contemplating
> >>> doing a combination where I have both. Anyone have any opinions
> >>> about this?
> >>
> >> If the recipient doesn't ask for ARF, don't send them ARF.  This
> >> format is still too new (and too unpublished) to assume that  
> everyone
> >> will be set up to interpret it.
> >>
> >> --
> >> J.D. Falk, Anti-Spam Product Manager
> >> Yahoo! Mail
> >> _______________________________________________
> >> abuse-feedback-report mailing list
> >> [email-masked]
> >> http://mipassoc.org/mailman/listinfo/abuse-feedback-report
> >
> > _______________________________________________
> > abuse-feedback-report mailing list
> > [email-masked]
> > http://mipassoc.org/mailman/listinfo/abuse-feedback-report
>

--Apple-Mail-2--277962835
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=ISO-8859-1

<HTML><BODY style=3D"word-wrap: break-word; -khtml-nbsp-mode: space; =
-khtml-line-break: after-white-space; "><DIV>I'm surprised there are =
that many. If you were to send them ARFs anyway, do you think they would =
ignore the complaints or find a way to read them?</DIV><DIV><BR =
class=3D"khtml-block-placeholder"></DIV><DIV>~Josh</DIV><DIV><BR =
class=3D"khtml-block-placeholder"></DIV><BR><DIV><DIV>On Jul 11, 2007, =
at 3:20 PM, Marc Perkel wrote:</DIV><BR =
class=3D"Apple-interchange-newline"><BLOCKQUOTE type=3D"cite">  <P><FONT =
size=3D"2">Well, since I started sending ARF a few days ago I had to put =
these<BR> domains on an exception list for plain text.<BR> <BR> =
qwest.net<BR> rr.com<BR> cogeco.net<BR> mchsi.com<BR> tiscali.nl<BR> =
domeneshop.no<BR> chello.nl<BR> covad.com<BR> speakeasy.net<BR> =
inode.at<BR> nauticom.net<BR> midco.net<BR> <BR> I wish ARF would catch =
on because I want to do this right.<BR> <BR> Joshua Baer wrote:<BR> &gt; =
I'm not sure I see the harm in sending all ARF. It was designed to =
be<BR> &gt; just as useful to a person as to a computer. Even if I'm not =
"set up<BR> &gt; to interpret it" (which I assume you mean set up to =
process the<BR> &gt; messages automatically), I'd still rather get an =
ARF message than just<BR> &gt; getting a raw message forwarded.<BR> =
&gt;<BR> &gt; As Steve said, if they can't handle MIME, they probably =
can't handle<BR> &gt; much of anything. If they can't handle MIME, they =
can't even view half<BR> &gt; the messages that the complaint is =
about.<BR> &gt;<BR> &gt; ~Josh<BR> &gt;<BR> &gt;<BR> &gt; On Jul 11, =
2007, at 1:43 PM, J.D. Falk wrote:<BR> &gt;<BR> &gt;&gt; On 2007-07-10 =
15:56, Marc Perkel wrote:<BR> &gt;&gt;<BR> &gt;&gt;&gt; It's kind of =
interesting that some abuse folks ask for text mode and<BR> &gt;&gt;&gt; =
some ask for mime as specified in this standard. I'm contemplating<BR> =
&gt;&gt;&gt; doing a combination where I have both. Anyone have any =
opinions<BR> &gt;&gt;&gt; about this?<BR> &gt;&gt;<BR> &gt;&gt; If the =
recipient doesn't ask for ARF, don't send them ARF.=A0 This<BR> &gt;&gt; =
format is still too new (and too unpublished) to assume that =
everyone<BR> &gt;&gt; will be set up to interpret it.<BR> &gt;&gt;<BR> =
&gt;&gt; --<BR> &gt;&gt; J.D. Falk, Anti-Spam Product Manager<BR> =
&gt;&gt; Yahoo! Mail<BR> &gt;&gt; =
_______________________________________________<BR> &gt;&gt; =
abuse-feedback-report mailing list<BR> &gt;&gt; <A =
href=3D"mailto:[email-masked]">abuse-feedback-report@m=
ipassoc.org</A><BR> &gt;&gt; <A =
href=3D"http://mipassoc.org/mailman/listinfo/abuse-feedback-report">http:/=
/mipassoc.org/mailman/listinfo/abuse-feedback-report</A><BR> &gt;<BR> =
&gt; _______________________________________________<BR> &gt; =
abuse-feedback-report mailing list<BR> &gt; <A =
href=3D"mailto:[email-masked]">abuse-feedback-report@m=
ipassoc.org</A><BR> &gt; <A =
href=3D"http://mipassoc.org/mailman/listinfo/abuse-feedback-report">http:/=
/mipassoc.org/mailman/listinfo/abuse-feedback-report</A><BR> </FONT> =
</P>  </BLOCKQUOTE></DIV><BR></BODY></HTML>=

--Apple-Mail-2--277962835--

From: Steve Atkins <[email-masked]>
Subject: Re: [feedback-report] Mixed text and mime?
Date: Wed, 11 Jul 2007 13:33:41 -0700
To: ARF mailing list <[email-masked]>

On Jul 11, 2007, at 1:20 PM, Marc Perkel wrote:

> Well, since I started sending ARF a few days ago I had to put these  
> domains on an exception list for plain text.
>
> qwest.net
> rr.com
> cogeco.net
> mchsi.com
> tiscali.nl
> domeneshop.no
> chello.nl
> covad.com
> speakeasy.net
> inode.at
> nauticom.net
> midco.net
>
> I wish ARF would catch on because I want to do this right.
>

Do what right?

ARF really isn't intended for non-consensual mail, so sending it to  
people who haven't explicitly asked for
it isn't necessarily a great idea.

Cheers,
   Steve

Date: Wed, 11 Jul 2007 13:20:17 -0700
From: Marc Perkel <[email-masked]>
To: Joshua Baer <[email-masked]>
Subject: Re: [feedback-report] Mixed text and mime?
Cc: [email-masked]

Well, since I started sending ARF a few days ago I had to put these 
domains on an exception list for plain text.

qwest.net
rr.com
cogeco.net
mchsi.com
tiscali.nl
domeneshop.no
chello.nl
covad.com
speakeasy.net
inode.at
nauticom.net
midco.net

I wish ARF would catch on because I want to do this right.

Joshua Baer wrote:
> I'm not sure I see the harm in sending all ARF. It was designed to be 
> just as useful to a person as to a computer. Even if I'm not "set up 
> to interpret it" (which I assume you mean set up to process the 
> messages automatically), I'd still rather get an ARF message than just 
> getting a raw message forwarded.
>
> As Steve said, if they can't handle MIME, they probably can't handle 
> much of anything. If they can't handle MIME, they can't even view half 
> the messages that the complaint is about.
>
> ~Josh
>
>
> On Jul 11, 2007, at 1:43 PM, J.D. Falk wrote:
>
>> On 2007-07-10 15:56, Marc Perkel wrote:
>>
>>> It's kind of interesting that some abuse folks ask for text mode and 
>>> some ask for mime as specified in this standard. I'm contemplating 
>>> doing a combination where I have both. Anyone have any opinions 
>>> about this?
>>
>> If the recipient doesn't ask for ARF, don't send them ARF.  This 
>> format is still too new (and too unpublished) to assume that everyone 
>> will be set up to interpret it.
>>
>> -- 
>> J.D. Falk, Anti-Spam Product Manager
>> Yahoo! Mail
>> _______________________________________________
>> abuse-feedback-report mailing list
>> [email-masked]
>> http://mipassoc.org/mailman/listinfo/abuse-feedback-report
>
> _______________________________________________
> abuse-feedback-report mailing list
> [email-masked]
> http://mipassoc.org/mailman/listinfo/abuse-feedback-report

From: Steve Atkins <[email-masked]>
Subject: Re: [feedback-report] Mixed text and mime?
Date: Wed, 11 Jul 2007 12:35:34 -0700
To: ARF mailing list <[email-masked]>

On Jul 11, 2007, at 12:17 PM, J.D. Falk wrote:

> On 2007-07-11 12:00, Joshua Baer wrote:
>
>
>> I'm not sure I see the harm in sending all ARF. It was designed to  
>> be  just as useful to a person as to a computer. Even if I'm not  
>> "set up  to interpret it" (which I assume you mean set up to  
>> process the  messages automatically), I'd still rather get an ARF  
>> message than  just getting a raw message forwarded.
>>
>
> I'm sure that's true in a lot of cases, but it's not safe to assume  
> that /everyone/ can receive and view ARF.  Different clients do all  
> sorts of wonky things with MIME types they don't recognize, and the  
> big commercial customer support systems (kana, remedy, etc) are  
> especially bad about it.
>

Yup.

If they can't handle ARF they probably can't handle message/rfc822,  
and they won't be useful for handling a large fraction of abuse  
reports. That doesn't mean there aren't a lot of them out there, of  
course, but if they can't handle ARF they're unlikely to be able to  
handle ARF+plain-text either, which is where we started.

>
> Hopefully that'll change in a few years, after we've actually  
> published this thing.
>

It would be fairly easy in many cases for a recipient who cared to  
receive ARF reports in particular with a plain-text system to do a  
little MIME cracking on the front-end and put plaintextified versions  
into their ticketing system, so it doesn't even need to wait on major  
ticketing system upgrades.

Cheers,
   Steve

Date: Wed, 11 Jul 2007 12:17:15 -0700
From: "J.D. Falk" <[email-masked]>
Organization: Yahoo!
To: [email-masked]
Subject: Re: [feedback-report] Mixed text and mime?

On 2007-07-11 12:00, Joshua Baer wrote:

> I'm not sure I see the harm in sending all ARF. It was designed to be  
> just as useful to a person as to a computer. Even if I'm not "set up  
> to interpret it" (which I assume you mean set up to process the  
> messages automatically), I'd still rather get an ARF message than  
> just getting a raw message forwarded.

I'm sure that's true in a lot of cases, but it's not safe to assume that 
/everyone/ can receive and view ARF.  Different clients do all sorts of 
wonky things with MIME types they don't recognize, and the big 
commercial customer support systems (kana, remedy, etc) are especially 
bad about it.

Hopefully that'll change in a few years, after we've actually published 
this thing.

-- 
J.D. Falk, Anti-Spam Product Manager
Yahoo! Mail

From: Joshua Baer <[email-masked]>
Subject: Re: [feedback-report] Mixed text and mime?
Date: Wed, 11 Jul 2007 14:00:00 -0500
To: [email-masked]

I'm not sure I see the harm in sending all ARF. It was designed to be  
just as useful to a person as to a computer. Even if I'm not "set up  
to interpret it" (which I assume you mean set up to process the  
messages automatically), I'd still rather get an ARF message than  
just getting a raw message forwarded.

As Steve said, if they can't handle MIME, they probably can't handle  
much of anything. If they can't handle MIME, they can't even view  
half the messages that the complaint is about.

~Josh

On Jul 11, 2007, at 1:43 PM, J.D. Falk wrote:

> On 2007-07-10 15:56, Marc Perkel wrote:
>
>> It's kind of interesting that some abuse folks ask for text mode  
>> and some ask for mime as specified in this standard. I'm  
>> contemplating doing a combination where I have both. Anyone have  
>> any opinions about this?
>
> If the recipient doesn't ask for ARF, don't send them ARF.  This  
> format is still too new (and too unpublished) to assume that  
> everyone will be set up to interpret it.
>
> -- 
> J.D. Falk, Anti-Spam Product Manager
> Yahoo! Mail
> _______________________________________________
> abuse-feedback-report mailing list
> [email-masked]
> http://mipassoc.org/mailman/listinfo/abuse-feedback-report

Date: Wed, 11 Jul 2007 11:43:01 -0700
From: "J.D. Falk" <[email-masked]>
Organization: Yahoo!
To: [email-masked]
Subject: Re: [feedback-report] Mixed text and mime?

On 2007-07-10 15:56, Marc Perkel wrote:

> It's kind of interesting that some abuse folks ask for text mode and 
> some ask for mime as specified in this standard. I'm contemplating doing 
> a combination where I have both. Anyone have any opinions about this?

If the recipient doesn't ask for ARF, don't send them ARF.  This format 
is still too new (and too unpublished) to assume that everyone will be 
set up to interpret it.

-- 
J.D. Falk, Anti-Spam Product Manager
Yahoo! Mail

From: Steve Atkins <[email-masked]>
Subject: Re: [feedback-report] Mixed text and mime?
Date: Tue, 10 Jul 2007 16:15:30 -0700
To: ARF mailing list <[email-masked]>

On Jul 10, 2007, at 3:56 PM, Marc Perkel wrote:

> It's kind of interesting that some abuse folks ask for text mode  
> and some ask for mime as specified in this standard. I'm  
> contemplating doing a combination where I have both. Anyone have  
> any opinions about this?

If the recipient can't handle MIME, odds are good that they can't
do much useful with reports in any format.

Spamcop reports are a good example of what happens when
the sender doesn't send MIME. The original mail is included
inline, as plain text, in the report.

If, as is not unusual, the original mail was base64 encoded
then there's no way for the recipient of the report to see the
content of the original mail without jumping through some
horrible hoops or having some overly smart ticketing
software.

Cheers,
   Steve

Date: Tue, 10 Jul 2007 15:56:30 -0700
From: Marc Perkel <[email-masked]>
To: [email-masked]
Subject: [feedback-report] Mixed text and mime?

It's kind of interesting that some abuse folks ask for text mode and 
some ask for mime as specified in this standard. I'm contemplating doing 
a combination where I have both. Anyone have any opinions about this?

Date: Tue, 10 Jul 2007 15:03:36 -0700
From: Marc Perkel <[email-masked]>
To: [email-masked]
Subject: Re: [feedback-report] Reply-to address

This is a multi-part message in MIME format.
--------------000100040109080705090803
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

John Levine wrote:
>> I guess what I'm suggesting is blessing the reply-to as an official
>> optional field in the specification in the feedback report section.
>>     
>
> I don't see the point of repeating information that's already present
> in the ARF report.  We could copy every single header field into the
> report section.  What would be the advantage of doing so?
>
> R's,
> John
>   

The only reason to bless it as an optional field is that in certain 
cases the reply-to is the actual offending address that you want the 
abuse department to target. The reply-to is the one that will hurt the 
scammer the most. And like I said, optional field.

--------------000100040109080705090803
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
  <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<br>
<br>
John Levine wrote:
<blockquote cite="mid:[email-masked]"
 type="cite">
  <blockquote type="cite">
    <pre wrap="">I guess what I'm suggesting is blessing the reply-to as an official
optional field in the specification in the feedback report section.
    </pre>
  </blockquote>
  <pre wrap=""><!---->
I don't see the point of repeating information that's already present
in the ARF report.  We could copy every single header field into the
report section.  What would be the advantage of doing so?

R's,
John
  </pre>
</blockquote>
<br>
The only reason to bless it as an optional field is that in certain
cases the reply-to is the actual offending address that you want the
abuse department to target. The reply-to is the one that will hurt the
scammer the most. And like I said, optional field.<br>
<br>
</body>
</html>

--------------000100040109080705090803--

Date: 10 Jul 2007 21:53:12 -0000
From: John Levine <[email-masked]>
To: [email-masked]
Subject: Re: [feedback-report] Reply-to address
Organization: 
Cc: 

> I guess what I'm suggesting is blessing the reply-to as an official
> optional field in the specification in the feedback report section.

I don't see the point of repeating information that's already present
in the ARF report.  We could copy every single header field into the
report section.  What would be the advantage of doing so?

R's,
John

Date: Tue, 10 Jul 2007 12:31:59 -0700
From: Marc Perkel <[email-masked]>
To: "J.D. Falk" <[email-masked]>
Subject: Re: [feedback-report] Reply-to address
Cc: [email-masked]

J.D. Falk wrote:
> On 2007-07-10 09:46, Marc Perkel wrote:
>
>> I'd like to suggest that reporting the reply-to address be part of 
>> your specification if the reply-to is different than the from 
>> address. Often fraud spam will have a different reply-to so when the 
>> from address is shut down then it is replaced. But the reply-to cuts 
>> the scammer off from the suckers.
>
> The entire original message is included in the report (or all of the 
> headers, if you use that option.)  So, the information is already 
> there, and the report generator can choose to send reports to the 
> domain in the Reply-To: header if they wish.
>

In cases like yahoo, hotmail, and gmail I've been sending reports to the 
reply-to if the reply-to is also a big freemail host and the from is one 
freemail host and the reply-to is different. I guess what I'm suggesting 
is blessing the reply-to as an official optional field in the 
specification in the feedback report section.

Orininal-Reply-To: [email-masked]

Date: Tue, 10 Jul 2007 12:06:54 -0700
From: "J.D. Falk" <[email-masked]>
Organization: Yahoo!
To: Marc Perkel <[email-masked]>, [email-masked]
Subject: Re: [feedback-report] Reply-to address
Cc: 

On 2007-07-10 09:46, Marc Perkel wrote:

> I'd like to suggest that reporting the reply-to address be part of your 
> specification if the reply-to is different than the from address. Often 
> fraud spam will have a different reply-to so when the from address is 
> shut down then it is replaced. But the reply-to cuts the scammer off 
> from the suckers.

The entire original message is included in the report (or all of the 
headers, if you use that option.)  So, the information is already there, 
and the report generator can choose to send reports to the domain in the 
Reply-To: header if they wish.

-- 
J.D. Falk, Anti-Spam Product Manager
Yahoo! Mail

Date: Tue, 10 Jul 2007 09:46:20 -0700
From: Marc Perkel <[email-masked]>
To: [email-masked]
Subject: [feedback-report] Reply-to address

I'd like to suggest that reporting the reply-to address be part of your 
specification if the reply-to is different than the from address. Often 
fraud spam will have a different reply-to so when the from address is 
shut down then it is replaced. But the reply-to cuts the scammer off 
from the suckers.

I ogten see this:

From: [email-masked]
Reply-to: [email-masked]

Date: Sun, 08 Jul 2007 09:59:47 -0700
From: Marc Perkel <[email-masked]>
To: Steve Atkins <[email-masked]>
Subject: Re: [feedback-report] ARF reporting tools? What works with Exim
Cc: ARF mailing list <[email-masked]>

Steve Atkins wrote:
>
> On Jul 8, 2007, at 9:28 AM, John Levine wrote:
>
>>> OK - now for my question. What tools are out there to generated these
>>> reports. I'm using Exim. I'd rather not have to figure it out from
>>> scratch if someone has already done it.
>>
>> I think we've all rolled our own.  The format is intended to be trivial
>> to generate.
>
> There's some sample code at http://wordtothewise.com/resources/arf.html
>
> It's not something I'd use for long term production use, but it might get
> you started.
>
> Cheers,
>   Steve
>
>

I figured it out. I coded up a script in Pascal and it's working great. 
Getting positive feedback from those recipients who appreciate it.

From: Steve Atkins <[email-masked]>
Subject: Re: [feedback-report] ARF reporting tools? What works with Exim
Date: Sun, 8 Jul 2007 09:45:09 -0700
To: ARF mailing list <[email-masked]>

On Jul 8, 2007, at 9:28 AM, John Levine wrote:

>> OK - now for my question. What tools are out there to generated these
>> reports. I'm using Exim. I'd rather not have to figure it out from
>> scratch if someone has already done it.
>
> I think we've all rolled our own.  The format is intended to be  
> trivial
> to generate.

There's some sample code at http://wordtothewise.com/resources/arf.html

It's not something I'd use for long term production use, but it might  
get
you started.

Cheers,
   Steve

Date: 8 Jul 2007 16:28:26 -0000
From: John Levine <[email-masked]>
To: [email-masked]
Subject: Re: [feedback-report] ARF reporting tools? What works with Exim
Organization: 
Cc: 

>OK - now for my question. What tools are out there to generated these 
>reports. I'm using Exim. I'd rather not have to figure it out from 
>scratch if someone has already done it.

I think we've all rolled our own.  The format is intended to be trivial
to generate.

R's,
John

Date: Sat, 07 Jul 2007 08:08:49 -0700
From: Marc Perkel <[email-masked]>
To: [email-masked]
Subject: [feedback-report] ARF reporting tools? What works with Exim

OK - now for my question. What tools are out there to generated these 
reports. I'm using Exim. I'd rather not have to figure it out from 
scratch if someone has already done it.

Date: Sat, 07 Jul 2007 08:06:04 -0700
From: Marc Perkel <[email-masked]>
To: [email-masked]
Subject: [feedback-report] Hello - I'm new

Hi everyone. I'm Marc Perkel with Junk Email Filter dot com. Just 
introducing myself. I started doing some automated abuse reporting and a 
couple of people who were receiving my reports pointed me here. I'm glad 
to see some kind of standard being formed. I would like to learn how to 
set it up.

Marc Perkel
http://www.junkemailfilter.com