Existing FAQ


All SpamCop Reports are emails sent by Reporters using the SpamCop Parsing and Reporting Service to System or Network Administrators, alerting those Administrators to the association between their Systems or Networks and particular pieces of particular spam messages.

"Report" as a verb is the act of sending a Report(n). If the Administrator replies to the Report, the reply will go to the "Report Email Address", and on to the Reporter's secret email address. If Reports to particular Administrators bounce enough times, those Administrators' email addresses will be flagged as bouncing, and will no longer receive Reports. Some Reporters will not want to send Reports to certain Administrators, and may want to send Reports to the Administrators of upstream or networks - this is one reason for the User Notification Report. The various types of SpamCop Reports follow.
spam Source Report
User Defined Recipient Report
Third Party Source Report
Spamvertized URL Report
Third Party URL Report
User Notification Report

[edit - I don't believe that the reporter has a choice in reporting the following two reports: Open Relay Report and Open Relay Testing System(s) Report]

A Manual Report is a report sent by the reporter directly to the abuse address. The report address may have been found by using the spamcop parser, but the report was not sent via spamcop.

In addition to Reporter generated reports, ISPs can receive statistical reports which include summaries of mole reporting and regular reporting

ISP Statistical Reports
"Periodic Summary Reports"
"Aggregate reports will be sent only if there is spam:"

The default for these reports are "Daily", but can be changed by selecting "Hourly" (under Periodic Summary Reports) and "Frequency:" (on the Preferences Tab) OR if the "Hourly" Radio Button on the "Request Reports" Tab is selected for "Aggregate reports will be sent only if there is spam:" when specifically requesting Reports. The other Radio Buttons in both cases are "Never" and "Daily".

There appear to be separate columns for Mole Reports vs. Regular Reports vs. Spamtrap Receipts.

Here is the text of the Daily Summary Report created for the FAQ.

[ SpamCop V1.514 Summary Report ]
-- See footer for key to columns and notes about this report --

IP_Address Start/Length Trap User Mole Simp Comments
RDNS

199.79.137.66 Dec 16 01h/0 0 1 0 0 marked resolved
mail.kopin.com.


-- Key to Columns --
IP Address: The numeric address.
Start: The first date (within the past week) that spam was
reported to have originated from the IP address.
Length: The duration of the incident in # of days
Trap: Messages received at traps.
User: Messages reported by registered users.
Mole: Messages reported by registered users who prefer to remain
anonymous.
Simp: Simple reports - messages submitted by unregistered users.
Comments: Notes reflect blocking-list status and issue-resolved status.
RDNS: Reverse dns name of ip address (must pass forward and reverse)

-- Summary Report Notes --
o All times are GMT, exact time of incident withheld.
o Time of this report is: Fri Dec 16 20:15:20 2005
o To close an issue, or get more details, log into your account:
http://www.spamcop.net/
o Issues are sorted with the newest reports first. Resolving new
issues first heads off additional spam from in-progress sources.
o This email is intended to be viewed with a fixed-width font.
o This email was requested in your SpamCop preferences page - where
it may be disabled.
o This report is sent periodically, but only if there have been changes.
(research by Steven Underwood)
[edited by Miss Betsy 6/21/2008]