SPAMCOP HOME · SPAMCOP FAQ · NEWSGROUPS · FORUM FAQ · WEBMAIL · SSL WEBMAIL · SPAMCOPWIKI


 Other words, data, places -->  SpamCop Pages V  FAQs & Words V  Newsgroups V  WebMail V  News-Recent Stuff V   Poll on menu

------>------> Latest and Current Announcements <------<------

Welcome Guest ( Log In | Register )

> This is a SpamCop.net FAQ Development/Support area

Please do NOT post any requests for help in this forum. Please post all questions in the appropriate Help Forum. This forum is reserved for the development of the SpamCop FAQ (here) and is open to all who wish to contribute to building a better FAQ. Suggestions for improvements are welcome as well as pointing out areas that are unclear or you are unable to understand as we can use those comments to improve the current FAQ (here).

 
Reply to this topicStart new topic
> SpamCop Report Types
Jeff G.
post Jul 18 2005, 12:11 PM
Post #1


T-shirt wearing out
Group Icon

Group: Membersph
Posts: 3730
Joined: 2-July 04
From: Northeast New Jersey (New York Metro Area), USA ... Please read my sig. :)
Member No.: 2041



All SpamCop Reports are emails sent by Reporters using the SpamCop Parsing and Reporting Service to System or Network Administrators, alerting those Administrators to the association between their Systems or Networks and particular pieces of particular spam messages. "Report" as a verb is the act of sending a Report(n). If the Administrator replies to the Report, the reply will go to the "Report Email Address", and on to the Reporter's secret email address. If Reports to particular Administrators bounce enough times, those Administrators' email addresses will be flagged as bouncing, and will no longer receive Reports. Some Reporters will not want to send Reports to certain Administrators, and may want to send Reports to the Administrators of upstream or networks - this is one reason for the User Notification Report. The various types of SpamCop Reports follow.
spam Source Report
User Defined Recipient Report
Third Party Source Report
Open Relay Report
Open Relay Testing System(s) Report
Spamvertized URL Report
Third Party URL Report
User Notification Report
Manual Report

A spam Source Report is a Report of the IP Address of a System or Network that was traced by the Parser as having been the source of a spam message. The Parser's immediate output labels every spam Source Report's destination email address with "(Administrator of network where email originates)". The Report History labels every spam Source Report with "( IP Address )". The subject of every spam Source Report begins with "[SpamCop (IP Address)". The first line of every spam Source Report is "[ SpamCop VParser Version ]", currently "[ SpamCop V1.471 ]". The second line of every spam Source Report is "This message is brief for your comfort. Please use links below for details.". The third line of every spam Source Report is blank. The fourth line of every spam Source Report is "Email from IP Address / Date/Time Stamp of Received Header Line". The fifth line of every spam Source Report is the Tracking URL. The sixth line of every spam Source Report may be "IP Address is open proxy, see: http://www.spamcop.net/mky-proxies.html", if appropriate. A spam Source Report that is actually sent will increase the likelihood of the reported IP Address being listed by the SCBL, or if it is already listed increase the length of the listing. The ISP Control Center thinks of a spam Source Report recipient as "source (Administrator of network where email originates)". Please see What does a SpamCop Report look like? for details on what a spam Source Report looks like.

A User Defined Recipient Report is a Report of the IP Address of a System or Network that was traced by the Parser as having been the source of a spam message, and is selected via checkbox by the Reporter as one of the addresses the Reporter may have pre-loaded into the Reporter's "Advanced Preferences" AKA "Report Handling Options" AKA "Reporting Preferences" (up to one in "Personal copies of outgoing reports" and up to 100 bytes in "Public standard report recipients"). The Parser's immediate output labels every User Defined Recipient Report's destination email address with "(User defined recipient)". The Report History labels every User Defined Recipient Report with "( Forwarded spam )". The subject of every User Defined Recipient Report begins with "[SpamCop (Forwarded spam)". The first line of every User Defined Recipient Report is "[ SpamCop VParser Version ]", currently "[ SpamCop V1.471 ]". The second line of every User Defined Recipient Report is "This message is brief for your comfort. Please use links below for details.". The third line of every User Defined Recipient Report is blank. The fourth line of every User Defined Recipient Report is "User-targeted report, see notes, if any." The fifth line of every User Defined Recipient Report is the Tracking URL. The ISP Control Center thinks of a User Defined Recipient Report recipient as "notify (User defined recipient)".

A Third Party Source Report is a Report of the IP Address of a System or Network that was traced by the Parser as having been the source of a spam message, and is optionally selected by the Reporter. The system-wide Third Party Source Report goes to spamcop[at]imaphost.com - see Cyveillance spam collection for details, noting that some Reporters don't like Cyveillance - details 1 and details 2. Third parties specifically request notification of such IP Addresses. The Parser's immediate output labels every Third Party Source Report's destination email address with "(Third party interested in email source)". The Report History labels every Third Party Source Report with "( IP Address )". The subject of every Third Party Source Report begins with "[SpamCop (IP Address)". The first line of every Third Party Source Report is "[ SpamCop VParser Version ]", currently "[ SpamCop V1.471 ]". The second line of every Third Party Source Report is "This message is brief for your comfort. Please use links below for details.". The third line of every Third Party Source Report is blank. The fourth line of every Third Party Source Report is "Email from IP Address / Date/Time Stamp of Received Header Line". The fifth line of every Third Party Source Report is the Tracking URL. The sixth line of every Third Party Source Report may be "IP Address is open proxy, see: http://www.spamcop.net/mky-proxies.html", if appropriate. The ISP Control Center thinks of a Third Party Source Report recipient as "intermediary (Administrator interested in intermediary handling of spam)".

An Open Relay Report is a Report of the IP Address of a System or Network that was parsed as having been an Open Relay. The Parser's immediate output labels every Open Relay Report's destination email address with "(Administrator of network with open relays)". The Report History labels every Open Relay Report with "( IP Address )". The subject of every Open Relay Report begins with "[SpamCop (IP Address)". The first line of every Open Relay Report is "[ SpamCop VParser Version ]", currently "[ SpamCop V1.471 ]". The second line of every Open Relay Report is "This message is brief for your comfort. Please use links below for details.". The third line of every Open Relay Report is blank. The fourth line of every Open Relay Report is "Open relay exploited: IP Address / Date/Time Stamp of Received Header Line". The fifth line of every Open Relay Report is the Tracking URL. The ISP Control Center thinks of an Open Relay Report recipient as "relay (Administrator of network with open relays)".

An Open Relay Testing System(s) Report is report of the IP Address of a System or Network that was parsed as having been an Open Relay to one or more Open Relay Testing System(s), but it is not sent as a regular Report with a Report ID, it is instead sent in a proprietary format. The Parser's immediate output labels every Open Relay Testing System(s) report's destination email address with "(Automated open-relay testing system(s))". The Report History labels every Open Relay Testing System(s) Report with "Saved relay ip: IP Address". The form of the Open Relay Testing System(s) report has not yet been disclosed - its Preview is "Would submit to open relay tracker:IP Address". The ISP Control Center does not specifically mention an Open Relay Testing System(s) Report recipient, as the recipient(s) is/are Open Relay Testing System(s), not ISP(s).

A Spamvertized URL Report is a Report of a URL that was parsed as having been advertised in either a plain text spam message or an A Tag href in an HTML spam message (IMG Tag src URLs are not parsed due to past risk of Innocent Bystanders). The Parser's immediate output labels every Spamvertized URL Report's destination email address with "(Administrator of network hosting website referenced in spam)". The Report History labels every Spamvertized URL Report with "( URL )". The subject of every Spamvertized URL Report begins with "[SpamCop (URL)". The first line of every Spamvertized URL Report is "[ SpamCop VParser Version ]", currently "[ SpamCop V1.471 ]". The second line of every Spamvertized URL Report is "This message is brief for your comfort. Please use links below for details.". The third line of every Spamvertized URL Report is blank. The fourth line of every Spamvertized URL Report is "Spamvertised web site: URL". The fifth line of every Spamvertized URL Report is the Tracking URL. The sixth line of every Spamvertized URL Report is "URL is IP Address; Date/Time Stamp of Parsing". The ISP Control Center thinks of a Spamvertized URL Report recipient as "www (Administrator of network hosting website referenced in spam)".

A Third Party URL Report is a Report of a URL that was parsed as having been advertised in either a plain text spam message or an A Tag href in an HTML spam message (IMG Tag src URLs are not parsed due to past risk of Innocent Bystanders), and is optionally selected by the Reporter. Third parties specifically request notification of such URLs. The Parser's immediate output labels every Third Party URL Report's destination email address with "(Third party interested in spamvertized web site)". The Report History labels every Third Party URL Report with "( URL )". The subject of every Third Party URL Report begins with "[SpamCop (URL)". The first line of every Third Party URL Report is "[ SpamCop VParser Version ]", currently "[ SpamCop V1.471 ]". The second line of every Third Party URL Report is "This message is brief for your comfort. Please use links below for details.". The third line of every Third Party URL Report is blank. The fourth line of every Third Party URL Report is "Spamvertised web site: URL". The fifth line of every Third Party URL Report is the Tracking URL. The sixth line of every Third Party URL Report is "URL is IP Address; Date/Time Stamp of Parsing". The ISP Control Center thinks of a Third Party URL Report recipient as "ns (Name server for spamvertised domain)".

A User Notification Report is a Report of the IP Address of a System or Network that was traced by the Reporter as having been the source of a spam message. The Reporter types or pastes in up to four email addresses that should be sent User Notification Report(s). The Parser's immediate output labels every User Notification Report's destination email address with "User Notification". The Report History labels every User Notification Report with "( )". The subject of every User Notification Report begins with "[SpamCop ( )". The first line of every User Notification Report is "[ SpamCop VParser Version ]", currently "[ SpamCop V1.471 ]". The second line of every User Notification Report is "This message is brief for your comfort. Please use links below for details.". The third line of every User Notification Report is blank. The fourth line of every User Notification Report is "User-targeted report, see notes, if any." The fifth line of every User Notification Report is the Tracking URL. The ISP Control Center thinks of a User Notification Report recipient as "notify (User defined recipient)". User Notification Reports are not available to Free Reporters.


Edit: 2005/07/18 16:31 EDT -0400 Jeff G. replaced "identifies" with "labels" and corrected "User Notification Report" to add the email addresses.
Edit: 2005/07/18 21:17 EDT -0400 Jeff G. addressed Miss Betsy's concerns about Reporters who don't want to send reports to Administrators that look like the spamvertiser, Reporters who don't want to report to Cyveillance, and why people use the User defined reports.
Edit: 2005/07/23 18:28 EDT -0400 Jeff G. added more Cyveillance details.
Edit: 2005/07/27 10:08 EDT -0400 Jeff G. added What does a SpamCop Report look like?.
Edit: 2005/07/31 02:12 EDT -0400 Jeff G. added new sightings "(Administrator of network with open relays)" and "(Automated open-relay testing system(s))" and Report texts.
Edit: 2005/10/27 12:55 PDT -0700 dbiel added HTML tags.
Edit: 2005/10/29 09:58 EDT -0400 Jeff G. added an HTML tag index and info from the ISP Control Center, and moved the HTML tags closer to the text they reference.
Edit: 2005/11/07 13:05 EST -0500 Jeff F. added "User Notification Reports are not available to Free Reporters."
Edit: 2005/11/16 05:32 PST -0800 dbiel added link to "Manual Report

This post has been edited by Wazoo: Jun 26 2008, 02:47 AM


--------------------
Best Regards, Jeff G. (full signature)
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Wazoo
post Jul 18 2005, 03:05 PM
Post #2


What Life?
Group Icon

Group: Forum Admin
Posts: 13194
Joined: 22-January 04
From: Iowa
Member No.: 18



added to both the Forum FAQ and the http://forum.spamcop.net/forums/index.php?act=home page. Thanks for the time and effort!
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Jeff G.
post Jul 18 2005, 08:18 PM
Post #3


T-shirt wearing out
Group Icon

Group: Membersph
Posts: 3730
Joined: 2-July 04
From: Northeast New Jersey (New York Metro Area), USA ... Please read my sig. :)
Member No.: 2041



QUOTE(Wazoo @ Jul 18 2005, 04:05 PM)
added to both the Forum FAQ and the http://forum.spamcop.net/forums/index.php?act=home page.  Thanks for the time and effort!
*

You're welcome.


--------------------
Best Regards, Jeff G. (full signature)
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
dbiel
post Oct 29 2005, 09:19 AM
Post #4


Been There
Group Icon

Group: Membersph
Posts: 2557
Joined: 20-February 04
From: San Gabriel Valley CA USA (Los Angeles)
Member No.: 447



Jeff, thanks for including the comment "moved the HTML tags closer to the text they reference" For the average user nothing was actually moved. But for the person editing the file, the move makes a big difference by displaying a blank line between entries rather than having the blank line occupied by the tag. Interesting what a difference is made by simply moving a tag one character to the right.
I think I will implement that change on the glossary as well. Thank you.


--------------------
This forum is a user support forum. The Moderators and Forum Admin are volunteers (not paid) and have no special direct relationship with SpamCop.net.
If you have been unable to receive the assistance you need here please see How To Contact SpamCop Staff
Thank you for your participation in our peer to peer, user based forums.
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Jeff G.
post Oct 29 2005, 09:38 AM
Post #5


T-shirt wearing out
Group Icon

Group: Membersph
Posts: 3730
Joined: 2-July 04
From: Northeast New Jersey (New York Metro Area), USA ... Please read my sig. :)
Member No.: 2041



You're welcome. Actually, the user does see a difference (one more line of text on the screen my way than your way).

This post has been edited by Jeff G.: Oct 29 2005, 09:40 AM


--------------------
Best Regards, Jeff G. (full signature)
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
dbiel
post Oct 29 2005, 10:14 AM
Post #6


Been There
Group Icon

Group: Membersph
Posts: 2557
Joined: 20-February 04
From: San Gabriel Valley CA USA (Los Angeles)
Member No.: 447



CODE
QUOTE(Jeff G. @ Oct 29 2005, 07:38 AM)
Actually, the user does see a difference (one more line of text on the screen my way than your way).
*
I am sorry, but I do not understand what you mean by "one more line of text"
Are you saying two blank lines between entries?
If so it must be a browser issue as I still only see one blank line between entries using OE 5.5
Or are you saying that the blank line between entries did not display on your screen until you made the change?
If that is the case, can you take a look at the Glossary and let me known how it displays for you,
example one no blank line
example two tag sitting in blank line
example three blank line followed with tag starting next line.

Example one: (on my screen "Worm Poop" does not start on a new line but reads as follows:
....hit in the cache, it reports "Cached whois".Worm Poop
QUOTE
WHOIS
WHOIS is a service and protocol defined by RFC 1032 DOMAIN ADMINISTRATORS GUIDE, RFC 954 NICNAME/WHOIS, and their predecessors for providing information about allocated Domain Names and IP Addresses. When the Parser does lookup and finds a hit in the cache, it reports "Cached whois".Worm Poop
Viruses, worms, and anything that generates a mail message to the forged address in a worm or a virus.
Example two:
QUOTE
WHOIS
WHOIS is a service and protocol defined by RFC 1032 DOMAIN ADMINISTRATORS GUIDE, RFC 954 NICNAME/WHOIS, and their predecessors for providing information about allocated Domain Names and IP Addresses. When the Parser does lookup and finds a hit in the cache, it reports "Cached whois".

Worm Poop
Viruses, worms, and anything that generates a mail message to the forged address in a worm or a virus.
Example three: (On my screen there is no difference between example two and three, both display a single blank line between entries.
QUOTE
WHOIS
WHOIS is a service and protocol defined by RFC 1032 DOMAIN ADMINISTRATORS GUIDE, RFC 954 NICNAME/WHOIS, and their predecessors for providing information about allocated Domain Names and IP Addresses. When the Parser does lookup and finds a hit in the cache, it reports "Cached whois".

Worm Poop
Viruses, worms, and anything that generates a mail message to the forged address in a worm or a virus.
Edit: lengthy post put inside code box to reduce screen space as issue has been resolved.


--------------------
This forum is a user support forum. The Moderators and Forum Admin are volunteers (not paid) and have no special direct relationship with SpamCop.net.
If you have been unable to receive the assistance you need here please see How To Contact SpamCop Staff
Thank you for your participation in our peer to peer, user based forums.
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Jeff G.
post Oct 29 2005, 11:08 AM
Post #7


T-shirt wearing out
Group Icon

Group: Membersph
Posts: 3730
Joined: 2-July 04
From: Northeast New Jersey (New York Metro Area), USA ... Please read my sig. :)
Member No.: 2041



No, what I mean is that if I go to "your style" tag, there is a blank line at the top of my window, before the text I want to read, whereas if I go to "my style" tag, the blank line has scrolled off the top of the window, and I get to see more of what I want to read (no blank line at the top, one more line of text at the bottom). There is one blank line either way.


--------------------
Best Regards, Jeff G. (full signature)
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
dbiel
post Oct 29 2005, 01:11 PM
Post #8


Been There
Group Icon

Group: Membersph
Posts: 2557
Joined: 20-February 04
From: San Gabriel Valley CA USA (Los Angeles)
Member No.: 447



Thank you Jeff. Sorry I did not understand it the first time. For some dumb reason I was thinking about the wrong window, that is the main document rather than the jump to window.


--------------------
This forum is a user support forum. The Moderators and Forum Admin are volunteers (not paid) and have no special direct relationship with SpamCop.net.
If you have been unable to receive the assistance you need here please see How To Contact SpamCop Staff
Thank you for your participation in our peer to peer, user based forums.
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
dbiel
post Nov 16 2005, 08:40 AM
Post #9


Been There
Group Icon

Group: Membersph
Posts: 2557
Joined: 20-February 04
From: San Gabriel Valley CA USA (Los Angeles)
Member No.: 447



Jeff, I added a link to "Manual Report" found in the glossary.
You may want to delete the glossary entry and add / rewrite the manual report entry into your post; or you may want to leave it as is.
Personally I think it would flow better if it were rewritten to follow the same pattern as the rest of the report types, but that is only my opinion.
But I did feel that it was important to add it as a report type to your list of reports, even though it is not generated by SpamCop, it is still a valid report type.


--------------------
This forum is a user support forum. The Moderators and Forum Admin are volunteers (not paid) and have no special direct relationship with SpamCop.net.
If you have been unable to receive the assistance you need here please see How To Contact SpamCop Staff
Thank you for your participation in our peer to peer, user based forums.
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Fuhrmanator
post Aug 10 2007, 02:09 PM
Post #10


Member
**

Group: Members
Posts: 15
Joined: 14-October 04
Member No.: 2847



Hi guys,

I didn't see any reference to the "unsolicited bounce" messages that SpamCop sends out (and for which I proposed a new FAQ entry in this same area).

Should you include this kind of report on this page, or is this stuff migrating to the Wiki?
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Miss Betsy
post Aug 10 2007, 04:53 PM
Post #11


T-shirt wearing out
Group Icon

Group: Membersph
Posts: 3336
Joined: 2-February 04
Member No.: 174



QUOTE(Fuhrmanator @ Aug 10 2007, 03:09 PM) *
Hi guys,

I didn't see any reference to the "unsolicited bounce" messages that SpamCop sends out (and for which I proposed a new FAQ entry in this same area).

Should you include this kind of report on this page, or is this stuff migrating to the Wiki?

The 'unsolicited bounce' message is a typical Spamcop source report AFAIK. I don't have any past reports handy of a submission of a 'bounce' so I can't look to see if there is different language, but I doubt it.

Glad to see someone interested in adding and clarifying the FAQ!

Miss Betsy


--------------------
an almost new internet user
if you don't think your post has been answered sufficiently, please email service[at]admin.spamcop.net
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Fuhrmanator
post Aug 12 2007, 09:50 PM
Post #12


Member
**

Group: Members
Posts: 15
Joined: 14-October 04
Member No.: 2847



QUOTE(Miss Betsy @ Aug 10 2007, 05:53 PM) *

The 'unsolicited bounce' message is a typical Spamcop source report AFAIK. I don't have any past reports handy of a submission of a 'bounce' so I can't look to see if there is different language, but I doubt it.

Here's what one looks like (I BCC'd myself on one recently, using the SpamCop preference to receive 'Personal copies of outgoing reports'):

CODE
[ SpamCop V640 ]
This message is brief for your comfort.  Please use links below for details.
...
(IP address) appears to be sending unsolicited bounces, please see:
http://www.spamcop.net/fom-serve/cache/329.html

[ Offending message ]
...

User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Farelf
post Aug 13 2007, 12:27 AM
Post #13


What Life?
Group Icon

Group: Membersph
Posts: 6335
Joined: 23-February 04
From: Western Australia
Member No.: 491



QUOTE(Fuhrmanator @ Aug 13 2007, 10:50 AM) *
CODE
(IP address) appears to be sending unsolicited bounces, please see:
http://www.spamcop.net/fom-serve/cache/329.html
...
And that link is the specific "Why are auto responders bad?" FAQ.

Thanks Fuhrmanator.
QUOTE(Fuhrmanator @ Aug 11 2007, 03:09 AM) *
...Should you include this kind of report on this page, or is this stuff migrating to the Wiki?
The intention is to populate the Wiki. There remain topics/items from the FAQ in the forum (to which this refers) which have not "migrated" - but supporting two venues with new material is clearly sub-optimal. So, creating directly in the Wiki would be my recommendation. See the registration details starting from the entry page there.


--------------------
Plus ça change, plus c’est la même chose
User is offlineProfile CardPM
Go to the top of the page
+Quote Post

Reply to this topicStart new topic
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:

 

- Lo-Fi Version Time is now: 23rd April 2014 - 02:15 AM