Reporting atlassian.net sites that are sending spam

[rolecan]

Because theres no abuse or report page ...

Got plenty of SPAM from:

jira@ndu3f.atlassian.net

jira@b89jfh.atlassian.net

jira@rdydsysfgyhdfg.atlassian.net

jira@kjjhhg.atlassian.net

jira@h84hbnf.atlassian.net

jira@ndf8j4fgg.atlassian.net

jira@nmf98jr.atlassian.net

(just a few examples)

[Daniel Eads]

Hi @rolecan , welcome to the Community!

We're currently investigating some sites that have been abusing our platform to send emails related to a bitcoin scam. 5 of the 7 sites you listed are known to us already (as well as more) - if you are willing to list any additional sites, I can ensure we are taking action against them.

As for the cause of this spam, unfortunately we are still working through the technical details on blocking this type of abuse of Jira. The send email functionality is critical to Jira's functionality. We do have some limits in place regarding the number of emails a new site can send, but as you've seen, this attack has defeated that mechanism by simply spinning up a number of sites at once. We shut these sites down when they are known - example above, we've taken action against 5 you've listed already but your report helped identify another 2. We're also working on the mechanisms needed to detect this type of email before it leaves a Jira Cloud site. Again, if you are willing, please continue reporting these sites - and thank you for the ones you have reported already.

Cheers,
Daniel | Atlassian Support

[Aaron Alpar]

Please stop sending me emails!

I really don't care to hear about new Jira features, etc... not at the rate your spamming me with in-product popups, notifications and emails.

[Nic Brough -Adaptavist-]

This conversation is nothing to do with the Atlassian mail-outs you have signed up for.

Go to https://preferences.atlassian.com/main and log in, you may need to click on "email preferences".  This page allows you to unsubscribe yourself from the mail you signed up for before.

There is an "unsubscribe all" at the top you might find useful.

[Ryan Goggin]

Another one from today

jira@5fgdf.atlassian.net

[Andy Heinzer]

Thanks for reporting it. I have filed it with our anti-abuse team to review.  Sorry for the inconvenience.

[Ryan Goggin]

Is there a better way to report these in the future?

[Nic Brough -Adaptavist-]

In another thread on the same topic, the last suggestion was to simply forward any spam email (with as much of the email header detail as you can include easily, and no need to comment or complain) to abuse@atlassian.com

I think that's still the case, but Andy will correct me if it's changed recently!

[portalzine]

Still happening!

jira@sfjfkgkjjhrg.atlassian.net

jira@sdghadgsd.atlassian.net

jira@sfdbdffgd.atlassian.net

............

Now coming in every day. I am about to blacklist all emails from atlassian and only whitelist those really needed :)

Anything being done about that ?

Thanks

[Daniel Eads]

Hi @portalzine , thanks for this report.

We've started the process to investigate and suspend these sites. Reporting helps terminate sites that violate our terms of service and are being used for mail spam faster, and improves our detection of these instances. Thanks for taking the extra time to mention which email addresses you received spam from.

Cheers,
Daniel | Atlassian Support

[Andrei Popov]

Add another one:

jira@zzrlcecdc5hgot14oemb.atlassian.net

```

Delivered-To: [REDACTED]

Received: by 2002:a05:7010:c00c:b0:354:e4a2:c71d with SMTP id ja12csp1393342mdb;

        Mon, 22 May 2023 00:37:42 -0700 (PDT)

X-Google-Smtp-Source: ACHHUZ6dxQe3qLrQka2Yiahh+7bUUmP4UYHThW1EKeu72FXJUq9az/xGkKfRZQ/SXMiUYBo6g0ON

X-Received: by 2002:a17:902:e842:b0:1ac:63ac:109d with SMTP id t2-20020a170902e84200b001ac63ac109dmr13429188plg.15.1684741062230;

        Mon, 22 May 2023 00:37:42 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1684741062; cv=none;

        d=google.com; s=arc-20160816;

        b=L/joK5rHDcsUCw4qfl3kGxvxwK/Yb1tuRk1WjljyySV3ybWGX1mMlUdakZ4hJskbLw

         nwn4SZC0m78Xg4tY3WK5FH7tPgA+mhOm3U2opTE4dqss+MFXo7AgHDlE7SsRG4hfcFf9

         kOnzfbprImiNC9Pkcx/fg2ukWYpBz0aPZprNxidBFFLLn7haf5NhVZuB7CZ2aMsRH2p5

         xk7j0ampyC8ZO7wtHe5/cMgNDsS2ZwHUDlV4I0ALAnJJeavCPmiQvj4TGvfcuUHNH/Jf

         afEa9ntneDnxDdBeMOYZhemNQ+QCSlLKSeUuRaZXM8ShaU0Zfrc8WN8z+tSfYXFh0GbO

         LKYg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;

        h=subject:in-reply-to:from:message-id:reply-to:precedence

         :atl-sent-via:references:mime-version:date:to:dkim-signature;

        bh=rOURnoRlEgvZRwNHTOT7Kf2eWgQ+7DeQCv3caisN8ak=;

        b=f5X1SwKKd6NYKHwXS9wzM8adsBLgw8UPtAzojGr1M/NyIo9hgjDw+L024uq9q/Blhn

         tLxHyaMmSn5TYCy4unR0UpC4g0lcRRX+KbnGryv2HqB4oqVC/f4/8yzc+cOoVopNy68z

         b0nlSWURnQDsXI9PYP2GaRDBHJ7/xwT49dJHLmtboxnrgwddhFirb/iDhkqSU849isGg

         FY72cI//zeIcQTayCaT7+tdR7GX/7GiyUiCLsfLO6L/D9hAIQIGkqbIu4VWlBWc/ItXQ

         jR57rRPLVGD9+un3SKEGHlxmZc4EPdGB+rFEXbPrflzhCGeZ8Hp2A5iLYk6JV0lTeMlJ

         zhjA==

ARC-Authentication-Results: i=1; mx.google.com;

       dkim=pass header.i=@mail-us.atlassian.net header.s=sparkpost0223 header.b=McNOPo5z;

       spf=pass (google.com: domain of jira@mail-us.atlassian.net designates 156.70.150.15 as permitted sender) smtp.mailfrom=jira@mail-us.atlassian.net;

       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=atlassian.net

Return-Path: <jira@mail-us.atlassian.net>

Received: from mta-70-150-15.sparkpostmail.com (mta-70-150-15.sparkpostmail.com. [156.70.150.15])

        by mx.google.com with ESMTPS id b13-20020a170902650d00b001aaf639c4easi4100937plk.109.2023.05.22.00.37.42

        for <ceesaxp@gmail.com>

        (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

        Mon, 22 May 2023 00:37:42 -0700 (PDT)

Received-SPF: pass (google.com: domain of jira@mail-us.atlassian.net designates 156.70.150.15 as permitted sender) client-ip=156.70.150.15;

Authentication-Results: mx.google.com;

       dkim=pass header.i=@mail-us.atlassian.net header.s=sparkpost0223 header.b=McNOPo5z;

       spf=pass (google.com: domain of jira@mail-us.atlassian.net designates 156.70.150.15 as permitted sender) smtp.mailfrom=jira@mail-us.atlassian.net;

       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=atlassian.net

X-MSFBL: 6UgCbofmNELUWroKnqpCIo4wqT7DAn86rFehf8qiHg8=|eyJ0ZW5hbnRfaWQiOiJ

hdGxhc3NpYW51cyIsImN1c3RvbWVyX2lkIjoiMSIsIm1lc3NhZ2VfaWQiOiI2NDY

yYzUxYjZiNjQ4M2U0ODA2OSIsInN1YmFjY291bnRfaWQiOiIwIiwiciI6ImNlZXN

heHBAZ21haWwuY29tIn0=

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=mail-us.atlassian.net; s=sparkpost0223; t=1684741061;

i=@mail-us.atlassian.net;

bh=rOURnoRlEgvZRwNHTOT7Kf2eWgQ+7DeQCv3caisN8ak=;

h=To:Date:Content-Type:Message-ID:From:Subject:From:To:Cc:Subject;

b=McNOPo5zGcnaLga3deH05Q7/rERWxTKRWbB5HoKtsgCUQSQZorLIOYE7l5+5i+i6I

UXonNEMAcjefSQW3Cp5Nu8Dw7N2iQe5KPiKksKVb8KKSd1Qv4DwaO/rg55v6oLsxz3

PzAJiPXpqGzYUIXsNAOf3KgBHdXqEfSSJz4W2yN9VBN4PyDkGdcCNCoK6CgYA0JMLM

m/TPH88/r5qDkhHx9bhbizeb0qa2k4DJEvOS1oW056vjD+pQm5bHzkba48LNwKOSBd

LmZOeDz9dGXUFiZ4+A/G0gLVms+33jnEhGVIGXStlrM5AEoOrWrxEipmc/nXP4s5Lm

nlmGir0wMvRSQ==

To: [REDACTED]

Date: Mon, 22 May 2023 07:37:41 +0000

Content-Type: multipart/related; boundary="_----sxuUrDuk5ciEgdClerYk4g===_D7/96-22693-5CB1B646"

MIME-Version: 1.0

X-Atlassian-Mail-Message-Id: <d0d60ea4-da1f-438c-886f-91f2af8f24bd@zzrlcecdc5hgot14oemb.atlassian.net>

X-Atlassian-Mail-Transaction-Id: d0d60ea4-da1f-438c-886f-91f2af8f24bd

References: <CMvhbo02ncquMPL1ARbEBFWzZpQAtAIwIkXGqpbC650=@zzrlcecdc5hgot14oemb.atlassian.net>

Atl-Sent-Via: jira-np-distributor

Precedence: bulk

Reply-To: "aytesmfx87 (Jira)" <jira@zzrlcecdc5hgot14oemb.atlassian.net>

X-JIRA-FingerPrint: d2f6c335ca4d084fbbceac0f4dd36a20

Message-ID: <d0d60ea4-da1f-438c-886f-91f2af8f24bd@zzrlcecdc5hgot14oemb.atlassian.net>

From: "aytesmfx87 (Jira)" <jira@zzrlcecdc5hgot14oemb.atlassian.net>

In-Reply-To: <CMvhbo02ncquMPL1ARbEBFWzZpQAtAIwIkXGqpbC650=@zzrlcecdc5hgot14oemb.atlassian.net>

Subject: [JIRA] aytesmfx87 mentioned you on IZAPYMYXV-305

```

[Andy Heinzer]

Thanks for the report, I have raised this with our anti-abuse team for further review.

[Chris Brown]

Here is an example.

Your team is waiting for you to join them

Admin has invited you to collaborate on ocyihoxorj4xq.atlassian.net

Here's what Admin and your team are using to work seamlessly and accomplish more, together:

Project and issue tracking

Cheers, The Atlassians

[Andy Heinzer]

Hi @Chris Brown Thanks for reporting this. I can confirm that this site has been suspended for violating our terms of service. 

In the future, should you receiving these kinds of invitations, I recommend forwarding that information directly to our abuse@atlassian.com mailbox.  You can also post here to Community, but this typically takes us longer to identify and respond to these.

[Justin Seldomridge]

Constant spam from 

<jira@lv3dneekcdv.atlassian.net>

[Andy Heinzer]

Thanks for reporting it.  I have informed our anti-abuse team. 

[Gytis Liutkus]

Got some spam today from:

confluence@l5619yfoy68dpqj.atlassian.net

confluence@nqrz4ylkvuhkbl4.atlassian.net

confluence@1tzavs7b7g5fr85.atlassian.net

confluence@vnjovc6wjnovzvq.atlassian.net

confluence@s2mpvk2t3lsb5ue.atlassian.net

[Nic Brough -Adaptavist-]

There's another conversation about these where Atlassian have asked us to send on spam from these dubious sites to abuse@atlassian.com (forward the email with full headers, no more information needed)

[Andy Heinzer]

Thanks for flagging this. Sorry for the inconvenience.

[Gytis Liutkus]

Thanks, I will use abuse@atlassian.com for reporting malicious sites going forward.

[Dianne Skoll]

A new spam run.  Here are headers.

Received: by jcsu.edu id b7r55dv3s2i7 for <dREDACTED>; Fri, 11 Mar 2022 09:13:09 -0500 (envelope-from <info@jcsu.edu>)
Delivered-To: adinafieste@gmail.com
Received: by 2002:a55:835a:0:b0:14d:e4a5:ad1f with SMTP id 26csp253741egz;
Fri, 11 Mar 2022 06:07:52 -0800 (PST)
X-Google-Smtp-Source: ABdhPJxF+JX+MvaivX5hsp9xLnENUwTR3r5Fpkm4y9dwC1nDNel/pvW6PK+Xk51nss7lwFJAn4NE
X-Received: by 2002:a05:6a00:ad2:b0:4f1:2734:a3d9 with SMTP id c18-20020a056a000ad200b004f12734a3d9mr10061588pfl.61.1647007672352;
Fri, 11 Mar 2022 06:07:52 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1647007672; cv=none;
d=google.com; s=arc-20160816;
b=QHXeCHiEe77148RpKr6dKDtkS4/GKCihlxD0BwmfXwzenXYaZp5JryW8jwN2vlqC0o
iO8jZJEMnCDyLNmhP6XCfaHGNVQ6KyiTJMnrUgjIPy07tIgM0LaCiWfO37x6LnG9FFGX
1qEoD/v2P7Z9LUCXqW+fuBiGM5R6OI5stMW30WUEYQtqTVUEfYsHRdXdH9gofv8pFcvV
AN3QYZAv6GVA5lzvlvHti3qzh7vY2WEvdwarQgakfj/8Xej/Pkz0JGR9v+AM5huSi+vb
pclZB1N75PfJo8vdm7Lcd1eE7qlviI0MjHIxXwyT6A26UAgqoHQe8O4jFRUqIkmuyAlT
jSSw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=mime-version:precedence:auto-submitted:date:delivered-to
:atlassianmail-meta-obsolete-id:atlassianmail-meta-transaction-id
:message-id:subject:reply-to:from:dkim-signature;
bh=tIcHWQWpkow4chmsV8TnTPTTffVngWfhrSc8kEj+Jjg=;
b=LqbVCy5xUTML77CR0qMhMwS12ONjRC6kLeVZCPqndbnY6D0WZrF0AXtX/Dthz1DQMd
RIwKtNJ5SDT/RFFOtCW8wXYJVFh4pCFoNmwwhZfCHYfoVlLxQkDI/BUEB6W2nZXG3RT1
DPgSSQ2UmVJr+wV0/Vq1RxPuaZRU2LF8Upbo/RuBVesqBEyspq+n9EtcgINbKXH0QyGD
cyiFjGwXE5JjQz+ruLv2VC+Agv8SdXVWS6wYUIdSlSPoWOYzhYV7EQ5yg8+kktquji8b
282W0LQ7LOIK7qArZAEHADeXj5CN00KtBH9bzYvvf3S1FKZLvgEJLDFxCbm2JlxBiha4
aEgQ==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@mail-us.atlassian.net header.s=atl201805 header.b=mmRVLaKn;
spf=pass (google.com: domain of jira@mail-us.atlassian.net designates 192.174.81.96 as permitted sender) smtp.mailfrom=jira@mail-us.atlassian.net;
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=atlassian.net
Return-Path: <jira@mail-us.atlassian.net>
Received: from mta-81-96.sparkpostmail.com (mta-81-96.sparkpostmail.com. [192.174.81.96])
by mx.google.com with ESMTPS id q11-20020a170903204b00b00151c6f5d7basi6682346pla.4.2022.03.11.06.07.51
for <adinafieste@gmail.com>
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Fri, 11 Mar 2022 06:07:52 -0800 (PST)
Received-SPF: pass (google.com: domain of jira@mail-us.atlassian.net designates 192.174.81.96 as permitted sender) client-ip=192.174.81.96;
Authentication-Results: mx.google.com;
dkim=pass header.i=@mail-us.atlassian.net header.s=atl201805 header.b=mmRVLaKn;
spf=pass (google.com: domain of jira@mail-us.atlassian.net designates 192.174.81.96 as permitted sender) smtp.mailfrom=jira@mail-us.atlassian.net;
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=atlassian.net
X-MSFBL: z7QGoogk+6Ca04CyT29/aRLp8fAYhuJYiEPxnOj07fk=|eyJzdWJhY2NvdW50X2l
kIjoiNCIsInIiOiJhZGluYWZpZXN0ZUBnbWFpbC5jb20iLCJ0ZW5hbnRfaWQiOiJ
hdGxhc3NpYW51cyIsIm1lc3NhZ2VfaWQiOiI2MjJhYjc1NzJiNjIzODhmNWU0YiI
sImN1c3RvbWVyX2lkIjoiMSJ9
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mail-us.atlassian.net; s=atl201805; t=1647007671;
i=@mail-us.atlassian.net;
bh=tIcHWQWpkow4chmsV8TnTPTTffVngWfhrSc8kEj+Jjg=;
h=From:Subject:Message-ID:Date:Content-Type;
b=mmRVLaKn7MkLXB1d1se61oNoT2u2BYD7JmPuMXkVQ6578r4pSAsZUClU8DMNtKe/6
cJBsE/jptYw7oE8fEdizlX0ljq2fyciHN5jTWMrRGB1/eD5/7D5bOe27lPkt6yxpAu
+3vVd9FJknjmH16zZymT7mzZBZuQKv5TvlQJomKM=
From: "NFT daily" <jira@5fgdf.atlassian.net>
Reply-To: <jira@5fgdf.atlassian.net>
Subject: [JIRA] This is your time! Seize the moment and get on board with NFTs
Message-ID: <2028006580.31.1647007670848@ef6c7e00f855>
AtlassianMail-Meta-Transaction-ID: 01FXWMX8TJW3MDE1JV30K1DDHV
AtlassianMail-Meta-Obsolete-ID: 01FXWMX8TJW3MDE1JV30K1DDHV
X-Atl-Queueid: DABB11C6-8D58-4503-A195-710B2162F3E1
Delivered-To: adinafieste@b89a1cf3f383
Date: Fri, 11 Mar 2022 14:07:49 +0000 (UTC)
Received: from ef6c7e00f855 (ef6c7e00f855 [10.106.86.104]) by gmail.com with SMTP id f3426ea4b4854361866e002cfcbc5d8b@gmail.com; Fri, 11 Mar 2022 14:07:51 +0000
X-Atl-Mail-Meta: cloud_id="8d59a599-86de-48bb-912b-57f0c68fe5c8",product="jira",tenant="https://5fgdf.atlassian.net",fe="jira@5fgdf.atlassian.net"
Auto-Submitted: auto-generated
Precedence: bulk
X-Jira-Fingerprint: c9a0f0436f04a573b2ad3db8d2f22217
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary=enmime-4f64d24e-8646-4f87-a199-b001e4e9600f

[jvisc]

Hello, I would like to report the following which has sent me spam via Jira

jira@diabetsoluenva.atlassian.net

[Nic Brough -Adaptavist-]

There's another conversation about these where Atlassian have asked us to send on spam from these dubious sites to abuse@atlassian.com (forward the email with full headers, no more information needed)

[Andy Heinzer]

@jvisc Thanks for reporting it to us.  I have flagged this site for investigation by our anti-abuse team. 

[Maximilian Dietrich]

Hi Jira support team,

We are also encountering SPAM from a variety of your subdomains, including

• jira@adinisthefreed.atlassian.net
• jira@benchdrak.atlassian.net
• jira@dd3sx.atlassian.net

Since you have been made aware of this issue in March this year and it still persists, I would like to know how you are planning on mitigating the issue and a time frame when we can expect it to be solved.

Thanks in advance for your help.

Kind regards

Maximilian Dietrich | IT system administrator | SAXOPRINT GmbH

[Daniel Eads]

Hi @Maximilian Dietrich ,

Thank you for reporting these sites. One of the three you mentioned has already been disabled by our anti-abuse team. Based on your report, we've marked the other two for takedown.

Some information about the steps we're taking to reduce this type of email abuse is in previous replies. For Free sites, we do limit the number of emails that can be sent. Sites generating content like this are often identified automatically, but we do appreciate being notified of any spam emails you get in order to take down the sites and improve our detection capabilities. I have asked our internal anti-abuse team if there is additional information we can share at this time!

Thanks,
Daniel Eads | Atlassian Support

[Christian Seuß]

Hi,

actually I got spam from jira@balimaakyahabibi.atlassian.net

I'm not able to adress a support request so I try to adress this issue here, hopefully you can help.

Spam is annouced as shopping voucher from LIDL.

Anybody in the same situation?

Best regards Christian

[Andy Heinzer]

Thanks for reporting that subdomain @Christian Seuß I will report this to our anti-abuse team for further investigation.

[Nina Eickeler]

Hello, 

We would like to report more email addresses from which we got a lot of spam the last weeks:

jira@ffd5.atlassian.net
jira@ddcx.atlassian.net
jira@4dx.atlassian.net
jira@nrf8uj.atlassian.net

Thank you for taking care of them.

Best regards,
Nina

[Daniel Eads]

Hi @Nina Eickeler , thank you for this report!

Our anti-abuse team has already suspended two of these sites, and I've started the process on the other two.

Cheers,
Daniel | Atlassian Support

[Nina Eickeler]

Hello, 

I also would like to report some mail addresses from which we got a lot of spam mails. It would be great if you could block them as well:

jira@zamata.atlassian.net
jira@antropo.atlassian.net
jira@s3dsf.atlassian.net
jira@az3s.atlassian.net
jira@c5f.atlassian.net
jira@x4fd.atlassian.net
jira@nbtc2.atlassian.net
jira@ssc5.atlassian.net
jira@ccx3.atlassian.net
jira@oo9sd.atlassian.net
jira@dd7s.atlassian.net
jira@l9omn.atlassian.net
jira@v6hj.atlassian.net
jira@s3dd.atlassian.net
jira@btcweek.atlassian.net
jira@8jnmf.atlassian.net
jira@g4hj.atlassian.net
jira@v6ikdf.atlassian.net
jira@n8djf.atlassian.net
jira@g54h.atlassian.net
jira@hnd8nf.atlassian.net
jira@nd8hnd.atlassian.net

Thanks & Cheers,
Nina

[Nic Brough -Adaptavist-]

At a glance, the couple of those I've just tried are "unavailable", which makes me think Atlassian have already caught them and killed off the spam systems, so you shouldn't get any more.

[Daniel Eads]

Hi @Nina Eickeler , welcome to the Community!

We've flagged these sites for takedown. Thanks for reporting - this helps us get them out of your way and points at some cases to help improve our anti-abuse capabilities.

Cheers,
Daniel | Atlassian Support

[Nic Brough -Adaptavist-]

Um, this report actually looks like spam itself, as there's a link to a website behind all the emails.  I guess that that is an artefact of where you copied the addresses from.

The list is all email addresses that would have come from Cloud Jira systems where you have been added as a user, or someone has used a 3rd party app to send emails from them.

This is not really something Atlassian could deal with - someone has set up all those systems and then used them (or allowed them to be used) for spam.  Technically, you should be getting in touch with the administrators to ask them to remove you from their system, but if they're malicious spammers, that's actually the worst thing you could do (confirms there's a human on the end of your email so you'll actually get even more)

I do know Atlassian has a problem with spam accounts - in order to create an Atlassian Cloud system, you have to have an Atlassian account (same as you do to post here) and it's clear from the amount of spam the Community gets posted that it is too easy to create a throwaway Atlassian account which you can then use for spam, I didn't know the bots were also capable of commissioning entire Cloud systems to do more spam!

I'll get some Atlassians to have a look at this for you, I think it's important for them to see the general problem as well as doing something about the specific Cloud Jiras that have spammed you.