Thursday, February 03, 2011

 

lunarpages.com thinks a phishing report is a "virus"

I've been receiving phish spam from a Lunarpages VPS ("lunariffic.com") this year.  When I send a sample, included inline in a plain text email, their inbound email machine (sharpmail.lunarpages.com, 64.50.162.254) waits until the end of the DATA phase of the SMTP conversation.  Then it says:




     554 rejected due to virus



which means it's refusing the message.  I opened a ticket in their abuse system.  The technician insisted that since the message says "virus" there must actually be a computer virus in the message.  I pointed out that the message was in plain text and contained nothing like any kind of malware, and he simply repeated the response.  The spamming continued.  I called tech support and they insisted that since I am not a customer they are not allowed to talk to me about it.  But he suggested I try sending from another provider.  I have not been able to identify any human being at Lunarpages who is allowed to talk to an email admin outside his own company.  Somehow, I suspect if postmaster@yahoo.com calls, they'll talk to him.  But maybe their lawyers have to arrange an appointment first.

I tried sending the spam report from my account at freeshell.org.  Same result.

This dysfunction, folks, is why the email medium is dying.

Incidentally, the RFC 2142 addresses abuse@lunarpages.com and abuse@lunariffic.com are listed as not working, with evidence, at RFC-Ignorant.org.  No surprise there, since they don't work.  The abuse.net clearinghouse suggests you try hostmaster there.

Comments:
I'm guessing they are using Clam Antivirus which does include some signatures catching phishing. They are being stupid. I'm doubtful as to whether they act meaningfully on abuse reports anyway- just look at all their SBL listings.
 
Post a Comment

Links to this post:

Create a Link



<< Home

This page is powered by Blogger. Isn't yours?