FAQ Entry: What is Quick Reporting? Options

[Jeff G.]

Quick Reporting allows the reporting of only spam sources, very quickly. Please see the WARNING: below about the danger of such speed.

Note: for those that would rather read a simpler, less detailed description of Quick Reporting see the following entry in the Wiki: QuickReporting

The following is a detailed description of Quick Reporting and its Dangers:

Emphasis: ONLY the spam source Nothing in the body of the spam is even looked at by the parsing engine.
Further explanatory notes found at Is quick-reporting still BETA?
Some procedural issues are addressed by Julian at Mailhosts and Quick Reporting

Email-based Quick Reporting is a feature of the SpamCop Parsing and Reporting System which may be allowed on a case-by-case basis by a SpamCop Admin. Please see To Quick Report via email (Linear Post #2 below) for details on using it.

Web-based Quick Reporting is an exclusive feature of the SpamCop Parsing and Reporting System which only SpamCop Email System Customers may access, and which can currently be used from both Systems' websites. On the SpamCop Parsing and Reporting System, that feature is part of what is variously known as VER (Very Easy Reporting), Held Email, Held Mail Log, held log, and heldlog, and in all cases resides at http://mailsc.spamcop.net/reportheld?action=heldlog. It can accessed via the "HeldMail" Button/Link in the menu bar of the SpamCop Parsing and Reporting System http://mailsc.spamcop.net/ (which can be accessed via the "Report Spam" Button/Link in Webmail) and has six Actions as follows:

CODE

 VER Action                               Webmail Capability
 ~~~~~~~~~~                               ~~~~~~~~~~~~~~~~~~
 Quick - report immediately and trash     "Report as Spam"
 Queue for reporting (and move to trash)  In Progress
 Queue for reporting (do not trash)       In Progress
 Forward (and whitelist sender)           "Release and Whitelist"
 Forward (do not whitelist sender)        Release (or Move or Open and Redirect)
 Delete                                   Delete

To "Queue for reporting" from Webmail, forward (from the message list interface only, not when viewing any particular message) to your confidential submit.16charANcodeNMBR[at]spam.spamcop.net address (your Confidential Submit Address).

However Quick Reporting happens, it will produce one or more "SpamCop Quick reporting data" email messages similar to the following:

CODE

Return-Path: <user.mkWcYgeVzP7tz6z6[at]bounces.spamcop.net>
Delivered-To: x[at]spamcop.net
Received: (qmail 15696 invoked from network); 28 Sep 2005 21:05:34 -0000
Received: from unknown (192.168.1.103)
by blade3.cesmail.net with QMQP; 28 Sep 2005 21:05:34 -0000
Received: from vmx1.spamcop.net (204.15.82.27)
by mx53.cesmail.net with SMTP; 28 Sep 2005 21:03:08 -0000
Received: from sc-app5.ironport.com (HELO spamcop.net) (204.15.82.24)
by vmx1.spamcop.net with SMTP; 28 Sep 2005 14:03:02 -0700
Wrom: GPKYLEJGDGVCJVTLBXFGGMEPYOQKEDOTWFAOBUZX
To: x <x[at]spamcop.net>
Subject: SpamCop Quick reporting data
Precedence: list
Message-ID: <qr433b0506g7533[at]msgid.spamcop.net>
Date: Wed, 28 Sep 2005 21:03:02 GMT
X-Mailer: http://www.spamcop.net/ v1.493
X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on blade3.cesmail.net
X-Spam-Level:
X-Spam-Status: hits=-98.1 tests=AWL,FORGED_RCVD_HELO,J_CHICKENPOX_63,
J_CHICKENPOX_73,J_CHICKENPOX_75,USER_IN_WHITELIST version=3.0.2
X-SpamCop-Checked: 192.168.1.103 204.15.82.27 204.15.82.24
...

SpamCop.net
Here are the results of your submission:

Processing spam: Wrom: UWLSZLKBRNVWWCUFPEGAUTFJMVRESK
Subject: ATTN: BENEFICIAL PREPOSITION


Received: (qmail 32070 invoked from network); 28 Sep 2005 15:55:23 -0000
warning:Ignored
Received: from unknown (192.168.1.101) by blade2.cesmail.net with QMQP;
28 Sep 2005 15:55:23 -0000
192.168.1.101 found
host 192.168.1.101 (getting name) no name
host 192.168.1.101 = ip192-168-1-101.z1-168-192.customer.algx.net (old cache)
warning:192.168.1.101 discarded
Received: from mail-kr.bigfoot.com (211.115.216.226) by mailgate.cesmail.net with SMTP;
28 Sep 2005 15:55:23 -0000
211.115.216.226 found
host 211.115.216.226 = mail-kr.bigfoot.com (cached)
mail-kr.bigfoot.com is 211.115.216.226
Possible spammer: 211.115.216.226
Received line accepted
Relay trusted (211.115.216.226)

Received: from hotmail.com ([65.54.185.21]) by BFLITEMAIL-KR3.bigfoot.com (LiteMail v3.03
(BFLITEMAIL-KR3)) with SMTP id 0509281145_BFLITEMAIL-KR3_464317_53569328;
Wed, 28 Sep 2005 11:51:06 -0400 EST
65.54.185.21 found
host 65.54.185.21 = bay15-f21.bay15.hotmail.com (cached)
bay15-f21.bay15.hotmail.com is 65.54.185.21
Possible spammer: 65.54.185.21
Possible relay: 211.115.216.226
211.115.216.226 not listed in relays.ordb.org.
211.115.216.226 has already been sent to relay testers
Received line accepted
Relay trusted (hotmail.com)

Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
Wed, 28 Sep 2005 08:50:58 -0700
warning:Ignored
Received: from 63.215.198.21 by by15fd.bay15.hotmail.msn.com with HTTP;
Wed, 28 Sep 2005 15:50:58 GMT
63.215.198.21 found
host 63.215.198.21 = unknown.Level3.net (cached)
Possible spammer: 63.215.198.21
Possible relay: 65.54.185.21
65.54.185.21 not listed in relays.ordb.org.
65.54.185.21 has already been sent to relay testers
Received line accepted
Sender relay: 63.215.198.21 De-referencing level3.net[at]abuse.net
abuse net level3.net = abuse[at]level3.net, spamtool[at]level3.net
Report routing for 63.215.198.21: abuse[at]level3.net, spamtool[at]level3.net
abuse[at]level3.net redirects to level3[at]admin.spamcop.net
spamtool[at]level3.net redirects to level3[at]admin.spamcop.net
Tracking message source:80.88.135.149:
Report routing for 80.88.135.149: emperion.net[at]devnull.spamcop.net
Message is 5 hours old
80.88.135.149 not listed in dnsbl.njabl.org
80.88.135.149 not listed in dnsbl.njabl.org
80.88.135.149 not listed in cbl.abuseat.org
80.88.135.149 not listed in dnsbl.sorbs.net
80.88.135.149 not listed in relays.ordb.org.
/dev/null'ing report for emperion.net[at]devnull.spamcop.net
May be saved for future reference:
http://www.spamcop.net/sc?id=z810205604z24...6e96388a8c07c6z


Processing spam: From: ycorditej[at]mailpride.com...

WARNING: Like its counterpart of normal Reporting, Quick Reporting also allows the reporting of you to your ISP or of your ISP to your ISP's ISP (both Very Bad Things), but in a more dangerous manner because it is faster and there is no verification step. Your ISP probably has various "solutions" in its arsenal to stop you from Quick Reporting yourself or it, including friendly advice, warning, suspension, deactivation, termination, fines, and even lawsuits for breach of contract, defamation, and/or interference with a contractual relationship. PLEASE make sure that your normal Reporting is working well for an extended period (never offering to report you to your ISP or your ISP to your ISP's ISP) before venturing into Quick Reporting. PLEASE also review your "SpamCop Quick reporting data" email messages to ensure that your Reports are not going to the wrong places.

Please see FAQ Entry: What is VER (Very Easy Reporting)? for details on VER (Very Easy Reporting).

Please see http://mail.spamcop.net/individuals.php for details on signing up for the SpamCop Email System.

For addiltional official uptodate comments by SpamCop Admin see the following post http://forum.spamcop.net/forums/index.php?...ost&p=37352 posted on December 7, 2005


2004/03/22 [Wazoo] Updated to reflect new "Release" Links and "Queue for reporting" workaround.
Edit: 2005/09/19 08:40 EDT -0400 Jeff G. updated with more info on email-based Quick Reporting (including reference to the Post below) and clarified some other language.
Edit: 2005/09/28 00:04 EDT -0400 Jeff G. added access hints for VER, a caution for quick reporting via email, and a link to the new "FAQ Entry: What is VER (Very Easy Reporting)?".
Edit: 2005/09/28 10:06 EDT -0400 Jeff G. added the WARNING (thanks to Steve T for bringing it up).
Edit: 2005/09/28 17:54 EDT -0400 Jeff G. added info about the the "SpamCop Quick reporting data" email messages to the body and the WARNING (thanks to Steven Underwood and again to Steve T for bringing it up).
Edit: 2005/12/06 11:05 PST -0800 dbiel added link to Don's December 7th post on the topic of Quick Reporting
Edit: 2006/09/03 - [Wazoo] shortend up the long Received: Lines in the [ code box ] section to resolve a user complaint of having to scroll horizintally to read this Topic/Discussion ....
Edit: 2006/12/14 - [Dbiel] added link to Wiki entry near the beginning of this post

This post has been edited by dbiel: Dec 14 2006, 09:20 AM

[Jeff G.]

To Quick Report via email (if you are authorized to do so), forward to your confidential quick.16charANcodeNMBR@spam.spamcop.net address (your Confidential Quick Address, where "quick" is substituted for "submit"). If you have never used that address, you will get authorization instructions the first time you email Confidential Quick Address. Those instructions currently read as follows for a test message that doesn't contain another message (munged for the web):

Return-Path: <spamid.0[at]bounces.spamcop.net>
Received: from vmx1.spamcop.net (204.15.82.27)
  by your mailserver with SMTP; date/time
Received: from sc-app4.ironport.com (HELO spamcop.net) (204.15.82.23)
  by vmx1.spamcop.net with SMTP; date/time
From: SpamCop AutoResponder <spamcop[at]devnull.spamcop.net>
To: you
Subject: SpamCop encountered errors
Date: date/time
Message-ID: <unique message-id[at]msgid.spamcop.net>
Content-type: text/plain
In-Reply-To: <your original message-id>
References: <your original message-id>

Quick reporting is disabled due to careless use.

It may be reactivated on a case-by-case basis.
Email service[at]admin.spamcop.net to request access.

Using normal confirmed reporting instead.
SpamCop encountered errors while saving spam for processing:
SpamCop could not find your spam message in this email:

followed by normal "SpamCop encountered errors" output including your original message as sent to your Confidential Quick Address.

Such forwarding is subject to the same restrictions as forwarding to your Confidential Submit Address - attachments are best, limit 50KBytes per message, and limit 100 attached messages per message.


Edit: 2005/09/28 00:09 EDT -0400 Jeff G. added the last paragraph..

This post has been edited by Jeff G.: Sep 27 2005, 11:09 PM

[Jeff G.]

I just updated both Posts above.

[turetzsr]

...Looks good (to someone who doesn't use Quick Reporting and therefore can not verify accuracy).
...Might it be worthwhile to include any caveats about dangers (reporting your own ISP)?

[Jeff G.]

...Looks good (to someone who doesn't use Quick Reporting and therefore can not verify accuracy).

Thanks!

...Might it be worthwhile to include any caveats about dangers (reporting your own ISP)?

Yes, thanks for the push. Please see the WARNING above. I trust that it addresses your concerns both above and in your Reply to FAQ Entry: What is VER (Very Easy Reporting)?.

[turetzsr]

<snip>
...Might it be worthwhile to include any caveats about dangers (reporting your own ISP)?

Yes, thanks for the push. Please see the WARNING above. I trust that it addresses your concerns both above and in your Reply to FAQ Entry: What is VER (Very Easy Reporting)?.

...Thanks for adding that! My only concern is that, IIUC, even after an extended period of successful reporting, a change to the ISP/MSP server infrastructure can still trigger a self-report. This has happened to me. Thus, I believe VER and Quick Reporting may be even more dangerous (at least for some of us) than even the very good warning you provided would suggest.

[StevenUnderwood]

My only concern is that, IIUC, even after an extended period of successful reporting, a change to the ISP/MSP server infrastructure can still trigger a self-report.  This has happened to me.  Thus, I believe VER and Quick Reporting may be even more dangerous (at least for some of us) than even the very good warning you  provided would suggest.

I feel that as long as people continue to monitor the quick-reporting reports, then the chance is minimized as presumably they will stop using it if errors start to be seem.

[Jeff G.]

OK, I added some more stuff. *bump*

[dle]

Just to make it clear: Quick reporting by email is available only for holders of a payed spamcop email account?

Dominik

[Wazoo]

Just to make it clear: Quick reporting by email is available only for holders of a payed spamcop email account?

"Quick-Reporting by e-mail" is the only way that it can be done by someone not using a SpamCop.net e-mail account.

[Lking]

 
"Quick-Reporting by e-mail" is the only way that it can be done by someone not using a SpamCop.net e-mail account. 

 

Not sure we are using the same english. I do not have an email account, I have a paid reporting account. I can report spam by email using either
quick.<code word>@spam.spamcop.net which processes the attached spam and sends the reports and sends me a report of what it did
or
submit.<code word>@spam.spamcop.net which processed the attached spam sends me a link (http://www.spamcop.net/sc?id=z931....) to a page that displays the proposed reports to be sent. I can then send or not send selected reports. This process mirrors the web reporting process except the submit. email replaced the cut and past of the spam into the web page.

CODE

                      submit. email  ------              quick. email -------------
                                       v                                           v
                     receive emil with link to                                     v
                                       v                                            v
web cut/past spam -> process botton --> process results screen -> report botton -->
                                                                                  v
                                          receive emil with list of reports sent

sorry for the crude graphics (IMG:style_emoticons/default/blush.gif)

[Wazoo]

Have to agree ... I don't see how your explanation of the "by e-mail" examples changes what I said .... but then the waters got cloudy when you then said "mirrors the web reporting process" ...?????

Use of the web-form - no option for "Quick-Reporting"
E-mail submittals - meet the requirements, get the flag set, Quick-Reporting is an option
Submitting from a SpamCop E-mail Account - I'll point back the the FAQ and the How-to-Use .... Forum sections ...

My point was .. there is no way to "Quick-Report" in any other fashion than by e-mail outside of the various buttons/functions found on the SpamCop.net webmail interface ....

[Lking]

To quote an old movie "What we have here is a failure to communicate."

and I missed your point which I see now.

What I meant by "mirrors" was that when using a submit email and following the link returned by spamcop, you end up on a spamcop web page that is the same as the one that would have been displayed if you had entered to spam on the web and pressed the process button.

Looking at my grades, you would think I was taking english as a second language so it understandable my 'failure to communicate.'

This post has been edited by Lking: Apr 29 2006, 11:37 PM

[Wazoo]

To quote an old movie "What we have here is a failure to communicate." 

While looking at this Topic, I realized that some activity discussed within the spamcop newsgroup earler this month still had not been actioned by anyone. (see http://news.spamcop.net/pipermail/spamcop-...ril/110435.html ) So, I'll do it myself .... from an earlier post within that same thread;

Skiwi offers -
[snip]
>
> Another alternative is quick reporting, which has requirements and
> disadvantages.  The requirements for quick reporting are that your
> request to quick report has to be approved, and you also have to be
> configured for a mailhosted account, which is described here
> http://www.spamcop.net/fom-serve/cache/397.html  How do I configure
> Mailhosts for SpamCop?

[snip]

> If a reporter is both mailhosted and approved to be a quick reporter,
> then many spams can be submitted by email at one time, and all of the
> spams are parsed for spamsource and reported without any approval
> process by the reporter.  That lack of oversight can cause a reporter to
> report their own mailhost many times if the parser makes an error, which
> could result in the reporter's own provider becoming blocklisted and
> causing significant grief to the reporter -- including loss of email
> account.

[snip]

To help avoid this, I personally 'fully report' 4 to 5 spams a days
(i.e., "Queue for reporting and send to trash") to try and make sure
that the mailhost config. has not been changed - and then report the
rest (majority) by "Quick reporting"

[TerryNZ]

How to request and set up Quick Reporting to Spamcop

I have read all of the supposed guide to requesting and setting up Quick Reporting to Spamcop. It is utterly confusing, and seems designed to obfuscate rather than inform.

There is a more "English as a first language" description of the process located at Spamcop Quick Reporting set-up guide

Would you consider importing that here, and using it as a more informative guide? Then you could append the subtle distinctions of Spamcop's web-mail reporting versus user SMTP reporting if that is considered necessary. You could also add a table with -
What quick reporting does on one side and What individual submit reporting does on the other.

Just an idea.

[StevenUnderwood]

One note, that text says nothing about checking the received reports for improperly reported messages, whether because they were not spam (noticed later) or because they went to the wrong location. While in general it is fairly safe to use quick reporting, things in the background can change causing spamcop to report the users ISP account. That warning should always be included, IMHO.

[dbiel]

The ability to disable SpamCop's automatic response to "Quick" spam submissions is now available as a user option.

- Don D'Minion - SpamCop Admin -

[Wazoo]

Pinned Don's Announcement in the Reporting Forum ....
Not posted here yet, newsgroup traffic is "Where's it at?" thus far ....

[Wazoo]

From: SpamCop Admin <nobody[at]devnull.spamcop.net>
Newsgroups: spamcop.help
Subject: Re: Quick reporting data Reports
Date: Tue, 16 May 2006 00:36:07 -0600
Message-ID: <qgsi625os1he8l7u738rukjhv7u4atutpt[at]4ax.com>

Alan Brown wrote:
>-I just looked and did not see this feature. Which options panel is this
>-found on?

It's in the "Report Handling Options" section under the "Preferences"
tab on the reporting server.

Log in at:

http://www.spamcop.net
http://members.spamcop.net
http://mailsc.spamcop.net


- Don -

[Miss Betsy]

How to request and set up Quick Reporting to Spamcop

I have read all of the supposed guide to requesting and setting up Quick Reporting to Spamcop. It is utterly confusing, and seems designed to obfuscate rather than inform.

There is a more "English as a first language" description of the process located at Spamcop Quick Reporting set-up guide

Would you consider importing that here, and using it as a more informative guide? Then you could append the subtle distinctions of Spamcop's web-mail reporting versus user SMTP reporting if that is considered necessary. You could also add a table with -
What quick reporting does on one side and What individual submit reporting does on the other.

Just an idea.

It is definitely a good idea. I have made edits to the existing user created FAQ but they were not implemented.

Miss Betsy