Jump to content

Automatic deletion of blacklisted email


kbro

Recommended Posts

At present, I have my account set up such that all suspected spam gets sent to the Held Mail folder, and every couple of days I go there and report everything as spam, after checking carefully for false positives.

In addition to the spamcop blocklist I've got other filters turned on too, some of which are more likely to give a false positive than others. To cut down the amount of "definite" spam I have to deal with, I run a filter which looks for "X-SpamCop-Disposition: blocked bl.spamcop.net" and moves these straight to Trash. Then I'm just left with the messages caught by SpamAssassin and the like.

What I'd really like to be able to do is to have the filter run automatically, so that the "definite" spam goes straight to Trash without my intervention. It'd still be there for a month or so if I really needed to go look for something, but it'd be off the radar for normal usage.

I'd also like an easier way to set up the filters for this. At present, under Options -> Spamcop Tools -> Blacklists I can only select whether or not a particular blacklist is used (and whether or not SpamAssassin is used). What I'd like, for each blacklist, is a set of options "Don't Use", "Move to Held Mail", "Move to Trash". That would give me the control I'm after.

Many thanks for a great service.

Kevin Broadey

Link to comment
Share on other sites

Hi, Kevin!

...Welcome to the SpamCop Forums.

...Thanks for your suggestion. While I am not a SpamCop e-mail subscriber and therefore have no meaningful opinion on your suggestion, I just wanted to let you know that someone read it and found it most interesting. Hopefully, someone more knowledgeable than I will happen by in due course and give you more meaningful feedback.

...Good luck!

Link to comment
Share on other sites

  • 1 month later...

Long time reporter - first time posting (ala, Mr. Obvious). I've been wondering a similar thing as well. I also have an account with Pobox.com and have been pleased with their spam filters and they have options setup for many blocklists that allow you to either Flag, Hold, Bounce, or Ignore the email from each specific blocklist (about 65 available). These are just held or bounced/deleted so I don't know if the bad ones are being reported as spam but it is nice to have so many options.

I tried searching the forums here but did not find a post to help but maybe I missed it. Anyway, I would like a feature or option that allows auto-reporting of email based on several options and maybe this is what you are also asking. I check my Held Email account several times per day and 99% of all of it is able to be reported and it just gets boring to be on the 3rd day of "Check out this stock" or "<name> wrote" when it hits at a SpamAssassin rating of over 20. I would like a way to auto-report anything over a SpamAssassin level or if that country is on a Blocklist. There are options to block these and hold for review but auto-reporting would save a lot of manual reviewing.

Link to comment
Share on other sites

auto-reporting would save a lot of manual reviewing.

That manual reviewing is required by spamcop for a couple of reasons.

1. If you are doing full reporting, confirming where you are sending your reports is important to be sure you don't report your ISP accidentally.

2. If you are doing quick reporting, the check for step one is gone, so it is even more important to have some review over what is being submitted. In my inbox currently I have several valid messages that score over 10 on spamassassin. The highest I currently have is a 13.

Link to comment
Share on other sites

Thanks, Steve, and a lightning-fast response time as well. That is why I was suggesting a very high SpamAssassin score of 20 or maybe if that ISP has been reported more than 100,000 times or is on a blacklist already. I mean, if half a million other users have already reported the IP sending emails with a topic of "EQSE News" or "hi it's Jimenez" then is there a smart section or something learning all of this so that those IPs can at least be blocked until they are off a certain blocklist?

I have my Held Email holding every sender that is not on my Personal Whitelist. This stops even good email but I've noticed that all good emails are always under a SpamAssassin rating of 20 (more like 0 or 2 at most). I like this level of control as it allows zero spam to get through to my email though it means I have to report 100% of the spam that gets held. Do I need to allow SpamCop to do some auto-filtering and stop spam before it gets to me?

These are new features or options we are talking about so I'm just putting the thought out there. I agree that it won't work if it takes a manual-look at the emails to prevent false reports. I just notice that on another email provider I just select to flag/hold/bounce any email from "5-10-SG Misc. Broken Networks / blackholes.five-ten-sg.com=127.0.0.9" or "Bogus IP Addresses / bogons.dnsiplists.completewhois.com" or "If email has x number of flags or more" and it is nice that I don't have to deal with the number of emails hitting any of these pre-set options (on THAT email address I have received daily 207, 274, then 230 bounced emails) meaning that is 250 fewer reports I've had to report in SpamCop and that makes me happy.

Sure I would love to report spam and help cure the problem but I'd also rather never see email from certain countries or IPs or people on blacklists. I don't think SpamCop allows this though - you get all the mail and your only option is to either view it in your Inbox or to place it in the Held email (or run a set of filters to delete it, move it, etc.) but you always receive it -- I'd rather just block some of them completely as I'm sure I'm not the only person receiving that email so it will get reported by someone else somewhere else.

Link to comment
Share on other sites

Hi, Darren,

Thanks, Steve, and a lightning-fast response time as well. That is why I was suggesting a very high SpamAssassin score of 20 or maybe if that ISP has been reported more than 100,000 times or is on a blacklist already. I mean, if half a million other users have already reported the IP sending emails with a topic of "EQSE News" or "hi it's Jimenez" then is there a smart section or something learning all of this so that those IPs can at least be blocked until they are off a certain blocklist?

<snip>

Do I need to allow SpamCop to do some auto-filtering and stop spam before it gets to me?

<snip>

Sure I would love to report spam and help cure the problem but I'd also rather never see email from certain countries or IPs or people on blacklists. I don't think SpamCop allows this though - you get all the mail and your only option is to either view it in your Inbox or to place it in the Held email (or run a set of filters to delete it, move it, etc.) but you always receive it -- I'd rather just block some of them completely as I'm sure I'm not the only person receiving that email so it will get reported by someone else somewhere else.

...The SpamCop e-mail service doesn't do this, IIUC, by philosophy. Judging by the number of complaints of e-mail being blocked by other e-mail providers, though, there are quite a few such providers from which you could choose that will do this for you.
<snip>

though it means I have to report 100% of the spam that gets held.

<snip>

meaning that is 250 fewer reports I've had to report in SpamCop

<snip

...You make it sound as if you must report every e-mail you identify as spam. You're under no such obligation. You can just report the spam that your time and inclination permits. Naturally, the more the better, but whatever you do report is appreciated!
I just notice that on another email provider I just select to flag/hold/bounce any email from "5-10-SG Misc. Broken Networks / blackholes.five-ten-sg.com=127.0.0.9" or "Bogus IP Addresses / bogons.dnsiplists.completewhois.com" or "If email has x number of flags or more" and it is nice that I don't have to deal with the number of emails hitting any of these pre-set options (on THAT email address I have received daily 207, 274, then 230 bounced emails) meaning that is 250 fewer reports I've had to report in SpamCop and that makes me happy.
...To what address does it bounce? Many bounces are directed to the envelope "From" address, which is usually forged -- I hope they do not do it that way!
Link to comment
Share on other sites

You make it sound as if you must report every e-mail you identify as spam. You're under no such obligation. You can just report the spam that your time and inclination permits. Naturally, the more the better, but whatever you do report is appreciated!

On the contrary, I log in several times a day just for the thrill of reporting the spam (and love when it displays, "Yum, this spam is fresh." My average reporting time is now down to 7 hours and, at present, the last email in my Held Email section was #18,459. I can't remember how long I've had my full-account but have probably reported in the neighborhood of about 18,000 emails (I have my filters set to hold anything not on my whitelist so that bumps up the count but it also lets me report everything instead of having some slip through to my email program). I'd love to be able to generate a chart/graph on my reports showing the increase/decrease after making changes to the filtering to see if things are making a difference. I used to do the full reporting and read through and learn why and how it was being stopped but I have been using the Quick Reporting ever since that feature was developed and love the ease of it.

To what address does it bounce? Many bounces are directed to the envelope "From" address, which is usually forged -- I hope they do not do it that way!

I can not answer that and they might keep it a secret so people don't copy their system. All I know is that I receive 0% of any spam from that service and it is bouncing 250 messages a day. I even signed up for a MySpace account with that address to specifically check what spam gets sent to it. In the first week I saw no increase really (hard to tell though) but 15 actual/good emails got through without being held, without having to be released, without raising any flags. Sure they were from an actual mailserver but their system works extremely efficiently and never lets through any spam. I don't know if it reports it and maybe I should release some of those messages to my SpamCop account and report it and see what I find.

Don't get me wrong - I've been extremely pleased with SpamCop ever since I signed up with them many years ago though I can't remember when that was (any Admins wanna look it up for me?). This is under the New Feature Report so I was just running one up the flagpole.

Link to comment
Share on other sites

On the contrary, I log in several times a day just for the thrill of reporting the spam

<snip>

...Well, I can certainly relate to that -- me, too! :D <big g>
To what address does it bounce? Many bounces are directed to the envelope "From" address, which is usually forged -- I hope they do not do it that way!
I can not answer that and they might keep it a secret so people don't copy their system.

<snip>

...If you have some time I hope you'll check. If they won't release the information (which I can understand), I hope you'll at least let them know that they should not be bouncing it back to e-mail addresses they find in the envelope. Thanks! :) <g>
Link to comment
Share on other sites

When I get a chance I will try but feel free to contact them yourself. The domain/provider is listed in my first post. My personal contact there has since moved from that job and I have to go through the normal channels and hit the public-access of IT support. Great folks though (shameful freebie plug).

Link to comment
Share on other sites

Turetzsr -- I received a response from Pobox.com about their bounced spam emails. Again, they have options for holding, flagging, bouncing, and ignoring a condition (blocklist) and I'm currently using the "hold" feature where I can release it to my SpamCop account and then report it or inspect it.

"Messages which we 'bounce' using spam Protection are messages which our server simply rejects. This means that we do not generate bounce notifications, but the servers sending to us should instead. As the people on the forum you're at are probably aware, spammers generally don't generate Bounce Notifications, instead simply dropping rejections to their servers. We don't create a lot of bounced back spam, however." -- Pobox Customer Service

Link to comment
Share on other sites

<snip>

Turetzsr -- I received a response from Pobox.com about their bounced spam emails. Again, they have options for holding, flagging, bouncing, and ignoring a condition (blocklist) and I'm currently using the "hold" feature where I can release it to my SpamCop account and then report it or inspect it.

"Messages which we 'bounce' using spam Protection are messages which our server simply rejects. This means that we do not generate bounce notifications, but the servers sending to us should instead. As the people on the forum you're at are probably aware, spammers generally don't generate Bounce Notifications, instead simply dropping rejections to their servers. We don't create a lot of bounced back spam, however." -- Pobox Customer Service

Hi, Darren!

...Well, I don't have a clue what they are saying but I do thank you very much for contacting them and passing on their reply! :) <g>

...BTW, my SpamCop Forum user id is turetzsr but I prefer to be addressed as "Steve T" (pls see my sig).

Link to comment
Share on other sites

...Well, I don't have a clue what they are saying but I do thank you very much for contacting them and passing on their reply! :) <g>

It sounds to me they are doing it correctly, rejecting and letting the sending server generate the error message, though they did not use the phrasing I would have.

Link to comment
Share on other sites

It sounds to me they are doing it correctly, rejecting and letting the sending server generate the error message, though they did not use the phrasing I would have.
...The wording seems to me to be able to apply to any of the following scenarios, and perhaps others:
  • The "correct" way (a 5xx rejection)
  • Ignoring it entirely
  • "Rejecting" with a message to the "from" or "reply-to" address.

Unfortunately, they did not say exactly what it is they do....

Link to comment
Share on other sites

To my eyes, this was one of those non-threatening, non-technical, non-scary type 'explanations' that went so 'smooth' on the explanation and tried to stay away from using any 'real technical' terms .... it totally missed the mark on explaining anything of real value. But, that's just me <g>

Link to comment
Share on other sites

(pre-grin for the snippy bits) Now don't ask for me to go and have them clarify it and then balk at the answer, Steve T (and it is common practice in all my other forums to use someone's screen name regardless what the signature reads). You are all more than welcome to contact them to have them clarify it for you personally as I'm sure they are more than willing to assist. <smirk>

Link to comment
Share on other sites

<snip>

Now don't ask for me to go and have them clarify it and then balk at the answer,

...Why not? No reflection on you -- you certainly did your part and I thank you for that -- but their answer leaves a lot to be desired.
Steve T (and it is common practice in all my other forums to use someone's screen name regardless what the signature reads).

<snip>

...No biggie, just my personal preference. I must admit that I don't understand the practice in the other forums but, hey, diversity makes the world go 'round! :) <g>
Link to comment
Share on other sites

  • 3 weeks later...

I tried searching the forums here but did not find a post to help but maybe I missed it. Anyway, I would like a feature or option that allows auto-reporting of email based on several options and maybe this is what you are also asking. I check my Held Email account several times per day and 99% of all of it is able to be reported and it just gets boring to be on the 3rd day of "Check out this stock" or "<name> wrote" when it hits at a SpamAssassin rating of over 20. I would like a way to auto-report anything over a SpamAssassin level or if that country is on a Blocklist. There are options to block these and hold for review but auto-reporting would save a lot of manual reviewing.

Right now I've got 3186 messages in my held mail, the oldest one is only 10 days old. With that kind of a spam load using SpamCop becomes a huge pain in the ass. I'd love to see a feature to delete any mail with a SpamAssassin score greater than 20.

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...