All SpamCop Reports are emails sent by Reporters using the SpamCop Parsing and Reporting Service to System or Network Administrators, alerting those Administrators to the association between their Systems or Networks and particular pieces of particular spam messages. "Report" as a verb is the act of sending a Report(n). If the Administrator replies to the Report, the reply will go to the "Report Email Address", and on to the Reporter's secret email address. If Reports to particular Administrators bounce enough times, those Administrators' email addresses will be flagged as bouncing, and will no longer receive Reports. Some Reporters will not want to send Reports to certain Administrators, and may want to send Reports to the Administrators of upstream or networks - this is one reason for the User Notification Report. The various types of SpamCop Reports follow.
spam Source Report
User Defined Recipient Report
Third Party Source Report
Open Relay Report
Open Relay Testing System(s) Report
Spamvertized URL Report
Third Party URL Report
User Notification Report
Manual Report

A spam Source Report is a Report of the IP Address of a System or Network that was traced by the Parser as having been the source of a spam message. The Parser's immediate output labels every spam Source Report's destination email address with "(Administrator of network where email originates)". The Report History labels every spam Source Report with "( IP Address )". The subject of every spam Source Report begins with "[SpamCop (IP Address)". The first line of every spam Source Report is "[ SpamCop VParser Version ]", currently "[ SpamCop V1.471 ]". The second line of every spam Source Report is "This message is brief for your comfort. Please use links below for details.". The third line of every spam Source Report is blank. The fourth line of every spam Source Report is "Email from IP Address / Date/Time Stamp of Received Header Line". The fifth line of every spam Source Report is the Tracking URL. The sixth line of every spam Source Report may be "IP Address is open proxy, see: http://www.spamcop.net/mky-proxies.html", if appropriate. A spam Source Report that is actually sent will increase the likelihood of the reported IP Address being listed by the SCBL, or if it is already listed increase the length of the listing. The ISP Control Center thinks of a spam Source Report recipient as "source (Administrator of network where email originates)". Please see What does a SpamCop Report look like? for details on what a spam Source Report looks like.

A User Defined Recipient Report is a Report of the IP Address of a System or Network that was traced by the Parser as having been the source of a spam message, and is selected via checkbox by the Reporter as one of the addresses the Reporter may have pre-loaded into the Reporter's "Advanced Preferences" AKA "Report Handling Options" AKA "Reporting Preferences" (up to one in "Personal copies of outgoing reports" and up to 100 bytes in "Public standard report recipients"). The Parser's immediate output labels every User Defined Recipient Report's destination email address with "(User defined recipient)". The Report History labels every User Defined Recipient Report with "( Forwarded spam )". The subject of every User Defined Recipient Report begins with "[SpamCop (Forwarded spam)". The first line of every User Defined Recipient Report is "[ SpamCop VParser Version ]", currently "[ SpamCop V1.471 ]". The second line of every User Defined Recipient Report is "This message is brief for your comfort. Please use links below for details.". The third line of every User Defined Recipient Report is blank. The fourth line of every User Defined Recipient Report is "User-targeted report, see notes, if any." The fifth line of every User Defined Recipient Report is the Tracking URL. The ISP Control Center thinks of a User Defined Recipient Report recipient as "notify (User defined recipient)".

A Third Party Source Report is a Report of the IP Address of a System or Network that was traced by the Parser as having been the source of a spam message, and is optionally selected by the Reporter. The system-wide Third Party Source Report goes to spamcop[at]imaphost.com - see Cyveillance spam collection for details, noting that some Reporters don't like Cyveillance - details 1 and details 2. Third parties specifically request notification of such IP Addresses. The Parser's immediate output labels every Third Party Source Report's destination email address with "(Third party interested in email source)". The Report History labels every Third Party Source Report with "( IP Address )". The subject of every Third Party Source Report begins with "[SpamCop (IP Address)". The first line of every Third Party Source Report is "[ SpamCop VParser Version ]", currently "[ SpamCop V1.471 ]". The second line of every Third Party Source Report is "This message is brief for your comfort. Please use links below for details.". The third line of every Third Party Source Report is blank. The fourth line of every Third Party Source Report is "Email from IP Address / Date/Time Stamp of Received Header Line". The fifth line of every Third Party Source Report is the Tracking URL. The sixth line of every Third Party Source Report may be "IP Address is open proxy, see: http://www.spamcop.net/mky-proxies.html", if appropriate. The ISP Control Center thinks of a Third Party Source Report recipient as "intermediary (Administrator interested in intermediary handling of spam)".

An Open Relay Report is a Report of the IP Address of a System or Network that was parsed as having been an Open Relay. The Parser's immediate output labels every Open Relay Report's destination email address with "(Administrator of network with open relays)". The Report History labels every Open Relay Report with "( IP Address )". The subject of every Open Relay Report begins with "[SpamCop (IP Address)". The first line of every Open Relay Report is "[ SpamCop VParser Version ]", currently "[ SpamCop V1.471 ]". The second line of every Open Relay Report is "This message is brief for your comfort. Please use links below for details.". The third line of every Open Relay Report is blank. The fourth line of every Open Relay Report is "Open relay exploited: IP Address / Date/Time Stamp of Received Header Line". The fifth line of every Open Relay Report is the Tracking URL. The ISP Control Center thinks of an Open Relay Report recipient as "relay (Administrator of network with open relays)".

An Open Relay Testing System(s) Report is report of the IP Address of a System or Network that was parsed as having been an Open Relay to one or more Open Relay Testing System(s), but it is not sent as a regular Report with a Report ID, it is instead sent in a proprietary format. The Parser's immediate output labels every Open Relay Testing System(s) report's destination email address with "(Automated open-relay testing system(s))". The Report History labels every Open Relay Testing System(s) Report with "Saved relay ip: IP Address". The form of the Open Relay Testing System(s) report has not yet been disclosed - its Preview is "Would submit to open relay tracker:IP Address". The ISP Control Center does not specifically mention an Open Relay Testing System(s) Report recipient, as the recipient(s) is/are Open Relay Testing System(s), not ISP(s).

A Spamvertized URL Report is a Report of a URL that was parsed as having been advertised in either a plain text spam message or an A Tag href in an HTML spam message (IMG Tag src URLs are not parsed due to past risk of Innocent Bystanders). The Parser's immediate output labels every Spamvertized URL Report's destination email address with "(Administrator of network hosting website referenced in spam)". The Report History labels every Spamvertized URL Report with "( URL )". The subject of every Spamvertized URL Report begins with "[SpamCop (URL)". The first line of every Spamvertized URL Report is "[ SpamCop VParser Version ]", currently "[ SpamCop V1.471 ]". The second line of every Spamvertized URL Report is "This message is brief for your comfort. Please use links below for details.". The third line of every Spamvertized URL Report is blank. The fourth line of every Spamvertized URL Report is "Spamvertised web site: URL". The fifth line of every Spamvertized URL Report is the Tracking URL. The sixth line of every Spamvertized URL Report is "URL is IP Address; Date/Time Stamp of Parsing". The ISP Control Center thinks of a Spamvertized URL Report recipient as "www (Administrator of network hosting website referenced in spam)".

A Third Party URL Report is a Report of a URL that was parsed as having been advertised in either a plain text spam message or an A Tag href in an HTML spam message (IMG Tag src URLs are not parsed due to past risk of Innocent Bystanders), and is optionally selected by the Reporter. Third parties specifically request notification of such URLs. The Parser's immediate output labels every Third Party URL Report's destination email address with "(Third party interested in spamvertized web site)". The Report History labels every Third Party URL Report with "( URL )". The subject of every Third Party URL Report begins with "[SpamCop (URL)". The first line of every Third Party URL Report is "[ SpamCop VParser Version ]", currently "[ SpamCop V1.471 ]". The second line of every Third Party URL Report is "This message is brief for your comfort. Please use links below for details.". The third line of every Third Party URL Report is blank. The fourth line of every Third Party URL Report is "Spamvertised web site: URL". The fifth line of every Third Party URL Report is the Tracking URL. The sixth line of every Third Party URL Report is "URL is IP Address; Date/Time Stamp of Parsing". The ISP Control Center thinks of a Third Party URL Report recipient as "ns (Name server for spamvertised domain)".

A User Notification Report is a Report of the IP Address of a System or Network that was traced by the Reporter as having been the source of a spam message. The Reporter types or pastes in up to four email addresses that should be sent User Notification Report(s). The Parser's immediate output labels every User Notification Report's destination email address with "User Notification". The Report History labels every User Notification Report with "( )". The subject of every User Notification Report begins with "[SpamCop ( )". The first line of every User Notification Report is "[ SpamCop VParser Version ]", currently "[ SpamCop V1.471 ]". The second line of every User Notification Report is "This message is brief for your comfort. Please use links below for details.". The third line of every User Notification Report is blank. The fourth line of every User Notification Report is "User-targeted report, see notes, if any." The fifth line of every User Notification Report is the Tracking URL. The ISP Control Center thinks of a User Notification Report recipient as "notify (User defined recipient)". User Notification Reports are not available to Free Reporters.


Edit: 2005/07/18 16:31 EDT -0400 Jeff G. replaced "identifies" with "labels" and corrected "User Notification Report" to add the email addresses.
Edit: 2005/07/18 21:17 EDT -0400 Jeff G. addressed Miss Betsy's concerns about Reporters who don't want to send reports to Administrators that look like the spamvertiser, Reporters who don't want to report to Cyveillance, and why people use the User defined reports.
Edit: 2005/07/23 18:28 EDT -0400 Jeff G. added more Cyveillance details.
Edit: 2005/07/27 10:08 EDT -0400 Jeff G. added What does a SpamCop Report look like?.
Edit: 2005/07/31 02:12 EDT -0400 Jeff G. added new sightings "(Administrator of network with open relays)" and "(Automated open-relay testing system(s))" and Report texts.
Edit: 2005/10/27 12:55 PDT -0700 dbiel added HTML tags.
Edit: 2005/10/29 09:58 EDT -0400 Jeff G. added an HTML tag index and info from the ISP Control Center, and moved the HTML tags closer to the text they reference.
Edit: 2005/11/07 13:05 EST -0500 Jeff F. added "User Notification Reports are not available to Free Reporters."
Edit: 2005/11/16 05:32 PST -0800 dbiel added link to "Manual Report

added to both the Forum FAQ and the http://forum.spamcop.net/forums/index.php?act=home page. Thanks for the time and effort!

You're welcome.

Jeff, thanks for including the comment "moved the HTML tags closer to the text they reference" For the average user nothing was actually moved. But for the person editing the file, the move makes a big difference by displaying a blank line between entries rather than having the blank line occupied by the tag. Interesting what a difference is made by simply moving a tag one character to the right.
I think I will implement that change on the glossary as well. Thank you.

You're welcome. Actually, the user does see a difference (one more line of text on the screen my way than your way).

Edit: lengthy post put inside code box to reduce screen space as issue has been resolved.

No, what I mean is that if I go to "your style" tag, there is a blank line at the top of my window, before the text I want to read, whereas if I go to "my style" tag, the blank line has scrolled off the top of the window, and I get to see more of what I want to read (no blank line at the top, one more line of text at the bottom). There is one blank line either way.

Thank you Jeff. Sorry I did not understand it the first time. For some dumb reason I was thinking about the wrong window, that is the main document rather than the jump to window.

Jeff, I added a link to "Manual Report" found in the glossary.
You may want to delete the glossary entry and add / rewrite the manual report entry into your post; or you may want to leave it as is.
Personally I think it would flow better if it were rewritten to follow the same pattern as the rest of the report types, but that is only my opinion.
But I did feel that it was important to add it as a report type to your list of reports, even though it is not generated by SpamCop, it is still a valid report type.

Hi guys,

I didn't see any reference to the "unsolicited bounce" messages that SpamCop sends out (and for which I proposed a new FAQ entry in this same area).

Should you include this kind of report on this page, or is this stuff migrating to the Wiki?

The 'unsolicited bounce' message is a typical Spamcop source report AFAIK. I don't have any past reports handy of a submission of a 'bounce' so I can't look to see if there is different language, but I doubt it.

Glad to see someone interested in adding and clarifying the FAQ!

Miss Betsy

Here's what one looks like (I BCC'd myself on one recently, using the SpamCop preference to receive 'Personal copies of outgoing reports'):

And that link is the specific "Why are auto responders bad?" FAQ.

Thanks Fuhrmanator.The intention is to populate the Wiki. There remain topics/items from the FAQ in the forum (to which this refers) which have not "migrated" - but supporting two venues with new material is clearly sub-optimal. So, creating directly in the Wiki would be my recommendation. See the registration details starting from the entry page there.