Tracking URL: http://www.spamcop.net/sc?id=z2911520554z2...0982f39dce512az

I've had several messages similar to this recently where the instructions in the body of the email say to send replies to an email address listed in the body of the message, but SpamCop doesn't pick up on these... Here's the relevant sections from the message in the tracking URL above:
You won the sum of $750,000.00 USD. (Seven Hundred Fifty thousand
Dollars) in Our Chevron/Texaco Annual Yearly Online Programm. For
claims,contact:
Mrs Kathrine Luis E-mail:(chevrontexaco[at]secretarias.com)
Provide the Following Information

I am having to manually alert the mail host (pretty much all are Hotmail-based email domains) that their customers are using the accounts for receiving replies to their phishing/419 scams.

Why does SC not pick up these email addresses? Have the bad guys found a way around the automated reports???

Please remember that Spamcop is primarily concerned with the source of the spam as found in the headers.
The body of the spam is of a much lower priority As a result, SpamCop will fail to pick up and report many reportable items as found in the body of the message.

Yeah, I know. But I have yet to see it ever offer to report an email address in the body. I've been using SC for years, since before there was such a thing as a "spamcop email system," just a reporting system. In all that time, I can't recall SpamCop ever offering to report email addresses in the body. Sure it'll offer to report web links in the body, but it's never offered to report email addresses.

My thinking is that it's a relatively new phenomenon for spammers to put the reply instructions in the body of the message and that SpamCop just hasn't caught up to it yet. Maybe I need to add that as a "feature request"?

SpamCop totally ignores email addresses in spam. It has been tha way since SpamCop was a puppy.

- Don D'Minion - SpamCop Admin -
.

'K. That's fine. I've added my voice to the existing feature request. I have little confidence in this being implemented, but hey, if we don't ask it'll have even less chance of getting done!

The problem with e-mail addresses in spam is that they are almost always forged. It is true that 419ers etc. do have to provide "real" addresses in order to get replies, but they are in the distinct minority when it comes to spam in general. My guess is that the folks at SpamCop don't want to take on the risk of filing pointless reports by highlighting and tracing e-mail addresses.

That said, you can report these addresses yourself (I do this most of the time in the case of scam mail, and I often get messages back from the mail provider indicating that they have taken action). You will find some tips here in the wiki.

-- rick

This being said, I have seen email addresses of both mine and friends in spam I receive. When spamcop was just a reporting site, I used to report these. Good email started to be forged in spam message and I finally gave up.

For spamcop to parse and report email addresses in the body, it would need to know what is legitimate and what is a spammer's address. I do not think spamcop is big enough to maintain this kind of database.

That's a great resource Rick (appreciation on behalf of all) but, for SC users I would suggest the most convenient way to obtain an abuse address is by running the e-mail (drop box) address through the parser (that is, by itself, as a paste-in to the box in the member's submission page).True to the extent that's why it has to be a manual report, with human decision-making. The database often does include the necessary reporting address detail (otherwise does a simple look-up) once a human decides it needs service provider alerting.

F'rinstance, the one in the O/P's example, (viewers will need to have logged in to their own SC member page within the current session to see it in all its glory): http://members.spamcop.net/sc?track=chevro...secretarias.com which yields a 'better' address than the standard from SC's database in this instance (the www. generic equivalent of that lookup has just the abuse address without detail of the discovery process).

As mentioned elsewhere, a number of times, SC has 'always' had the capability but it was never/only briefly activated for reporting due to the 99% forgery factor and dark hints of past (ignorant or maybe mischievous) misuse by reporters.

In the case of that 'chevrontexaco' address it seems the good folk at MSN are on top of it: 'Namespace mining behavior', eh? Good to know that precursor activity is detectable as another tool for the discombobulation of the ungodly.

When I started using spamcop, abuse addresses for email addresses were listed by the parser. However, it wasn't long before spamcop stopped including them. There were two reasons - one, because, aside from the 419 scammers, spammers started using websites instead of email addresses as contact points. And, two, knowing that filters would be confused by lots of email addresses, spammers started including lots of legitimate addresses so that reporters often allowed false reports to be made. As was mentioned, the parser has a lot of trouble identifying which email address was the drop box. Also, I expect when the volume of spamcop reports started going up, it was a nuisance to the email provider. And, too, email providers became more savvy about preventing spammers using their service. The 419 scammers, when they get a hit, get a lot of money and can afford to take the time to set up email addresses and to avoid detection, but the run-of-the-mill spammer would get axed too quickly to get a hit.

It isn't that difficult to get an abuse address and send a manual report for email drop boxes. I prefer to do that instead of reporting more spam if I am crunched for time.

On a side note, I once got a faxed 419 with an email address for contact. It took me four days to convince hotmail that, even though it wasn't contained in an email, it was abuse!

Miss Betsy

Several eons ago SC used to report email addresses in it led to lots of misreporting so that was removed and I see no chance it will ever come back. 419'ers have used email addresses for years as well as some other work-from-home and mule-my-money type scams *however* the problems that resulted from reporting email addresses far outweigh any good that changing the code might do.

this is something you are going to have to report manually

Eons ago, like in November 2000, it made that offer.

thread "More info and other ISP replies" in the newsgroup archives should show a post by me (Mike D)