Jump to content


  • Content Count

  • Joined

  • Last visited

Everything posted by michaelanglo

  1. michaelanglo

    Idea to help keep people reporting spam

    Yes, these serial numbers are generated per folder by SC Webmail (Horde) so you can not only see them (for the Held folder) in VER, you can also get them by a right click and copy shortcut in webmail view. http://webmail.spamcop.net/horde/imp/messa...hp?index=326200 Thus you can also see the serial number for your Inbox which may be useful to keep track of http://webmail.spamcop.net/horde/imp/message.php?index=58703 Thus 85 % of my email to date was spam. This also help to explain what happens when Horde gets confused about what folder is current.
  2. michaelanglo

    Blast from the past...

    I have just had a weirdie which may well be another symptom of the same problem or Horde getting confused about which folder it is supposed to be pointing at. I discovered (Spamcop email that reports quick reporting) that 12 emails from bottom of my inbox had been reported as spam and sent to trash. This did no harm since the emails were 10 days old and more and so no reporting was done. I think I remember (Fri, 12 Feb 2010 23:43:12 GMT - 48 hours ago) that I clicked "report as spam" on the contents of the Held folder and nothing happened or at least the Held folder didn't empty. So I did it again and it emptied. Looking at the reports, 8 emails were reported as genuine spam at that time. As I said, weird. It might be safer to use the VER screen.
  3. Yes that's what the Horde text says but in fact the evidence is that the following headers are checked against the whitelist * Envelope Sender aka Return Path * From: * Sender: --------> 13 Nov 2007 here a little looking though my folders, and I found several recent emails that have been through the Spamcop Email system and where the Return-Path: and From: differ. Results were that X-SpamCop-Whitelisted: appears for both Return-Path: and From: items and in fact a check in Feb 2010 shows that, currently, when both are in the Whitelist, the From: item is shown I did some tests, just to confirm, and the personal blacklist doesn't look at the To: or the Reply-to: just the From: etc. ---- The only cases known when data correctly entered in the personal whitelist/ blacklist is not found are when the header item is encoded, say as UTF-8. So we need a tracker of an email didn't go right and also, if possible, of one that went right.
  4. michaelanglo

    Blast from the past...

    It happens to me occasionally with both IE and Firefox, but no more often than twice a month. On every occasion going back to the proper folder and retrying the Move or whatever worked fine. There was no need to reload the browser. HTH
  5. I assume your SA trigger is 3 or less ? Since the 2010 SA bug is gone it may be some time before you see another such bug but what I see in the same situation (but delivered to Inbox) is X-SpamCop-Checked: X-SpamCop-Disposition: Blocked SpamAssassin=4 X-SpamCop-Whitelisted: [munged].co.uk Which has the lines in the usual order and no extra "X-SpamCop-Checked: " which should not be present unless the SA=4 wasn't or wasn't recognised. Suggest you do and cancel a TRACKER and report it to JT by clicking the "problem" button from webmail.
  6. michaelanglo

    Seasonal Food

    Thanks. Looking at the cookbook (cookery book in British English - 1984 Marguerite Patten) I correctly copied the recipe as printed but looking at surrounding recipes it is pretty clear that 1/2 cup was intended. I made the weight version before posting but 1 cup probably works, just gives a different result. Volume/weight see "The Kitchen Scale Manifesto": http://recipes.egullet.org/ksm.php Digital scales are less than $10 from walmart when I last checked (and I keep a $2 calculator in my knife drawer). Together they make adjusting recipes sizes trivial.
  7. I don't think you are quite correct here. I have just checked a tracker that was reported by me 3 days back and the full headers plus body is still present in the database. Here's a more recent example (which was only Quick Reported so the body wasn't used!) Here is your TRACKING URL - http://www.spamcop.net/sc?id=z3610778535zb...b5961589f14bbdz
  8. michaelanglo

    Journalist searching for historic spam data

    One bit of lateral thinking that (a) may help ( interest your readers anyway. would be to look for historic statistics on total email volumes I assume that if the current assertion that 80% of email is spam is indeed true it was lower in the past so we have an upper bound on spam level HTH
  9. michaelanglo

    Spamhaus on "The Problem of Snowshoe spam"

    For the record Gmail does have false postives. I have all the emails from a cluster of mailing lists (Baen's Bar) sent to my gmail account - that's about 15,000 emails a month (what Gmail calls 1400 conversations). 2 spam 10 False Positives Since they are all from the same server I take it that this ii based on content though they don't look any different to me. The spam is due to the eaddress being exposed when I use Google to post on Usenet.
  10. michaelanglo

    Reporting Statistics

    Hm. Another topic (like the SC statistics) where we have no idea what is being measured or even what definition of spam is being used. Of course users of greylisting will never see or count a lot of spam and this includes me as a user of SpamCop Mail for direct-to-SC mail (10%). However, except for this I think none of may mail is filtered though it is tagged by some mail handlers (and Tiscali seems to be using Brightmail which for my profile inserts a header line "X-Brightmail: Message is probably unwanted (spam)" but doesn't tag. I wanted yearly data and found Ironport had some. http://www.senderbase.org/home/spam_watch As did message labs http://www.messagelabs.co.uk/intelligence.aspx which don't correlate of course. Postini should have some but I can't find anything.
  11. michaelanglo

    Reporting Statistics

    Well whatever, but both the blue and green lines seem to be about a third lower this last month. I have also noticed that since about the 9th September my personal spam volume which has averaged 110/day since January has dropped to 30/day. That's nice but why ? Are the actual numbers from spamcop statistics available so they can be smoothed ?
  12. This isn't a problem that affects me since in the last year Cyrillic spam is down from 100 to 12 a month. However, besides filters, Spamcop Mail (Horde) also provides the Search facility. Do Search /Held folder/ 'Entire Message for "Blocked Russian"' you can then click 'select all' on the search result then 'report as spam'. If you save that Search by name as a virtual folder you can get rid of all the Cyrillic spam with only a few more keystrokes than using a webmail filter. I currently have two such folders defined. One (SA0-5) which selects all the items with small SpamAssassin scores or SA missing. This will include all the Blocked /blocklist/ and Blocked Russian emails unless excluded and is my folder to eyeball for "ensure no legitimate emails have been trapped". This (SA0-5) Search list is of the form:- Entire message contains hits=- OR Entire message contains hits=0. OR hits=1. =2. =3. =4. =5. OR Entire message hits= NOT Found {eg SA text not present} add if you wish, something like AND Entire Message contains Blocked Russian NOT The second (NOTSA0-5) is the reverse and is used for /select all/ /report As spam/ Entire message contains hits=- NOT AND Entire message contains hits=0. NOT AND Entire message contains hits=1. NOT AND {same for =2. =3. =4. =5.} add if you wish something like OR Entire Message contains Blocked Russian Hope this or the ideas will help you.
  13. This behavior - Webmail displaying "To:" in the From: column - is just the way webmail currently works. Since it knows "who you are", if the email appears to be from "you" Webmail chooses to display the "To:" instead. Outlook and most other email clients don't do this. Another example of slightly odd behavior is in GoogleMail/ Gmail where in the same "special handling" mode if an incoming email appears to be "from you" it is copied to the Sent Mail folder. All just trying to be helpful HTH
  14. The slot this was meant to fill is "nice snack, much lower calories than bread, noodles or pasta" and yes it's vegetarian. Aubergine Scallopine (basically from Barbara Kafka, recommended) 3 oz (85 gm) Aubergine/eggplant - 2 slices each 0.5 in (1 cm) thick and 4 in (10 cm) across. 2 Tblsp (30gm) ricotta cheese (any medium or low fat soft cheese) 8 leaves fresh basil 4 oz / 0.5 cup / 80 ml fresh tomato puree or passata or concentrated paste 2 oz (50 gm) grated cheese, eg mozzarella Place slices in one layer in a shallow dish, spread soft cheese, add basil and cover with the puree, scatter grated cheese on top. Cover tightly with cling film and microwave for 5 minutes (650 watt oven), prick to release steam and rest for 1 minute. == Serve hot, cold or in sandwiches. The non-measured version is Cut some Aubergine/eggplant slices, spread with whatever seems appropriate maybe pizza sauce and/or slices of a contrasting vegetable, sprinkle with herbs and microwave covered for 2 minutes per 100 grams/ 4 oz plus 2 minutes. Serve hot or cold. Mike D (Aubergine, not fried in oil, is 15 Kcal per 100g/ 4 oz)
  15. michaelanglo

    Setback for the 419 industry

    I think a 419 is most likely to be transmitted from an internet cafe "somewhere in Europe" so the bombardment will continue unabated.
  16. Except for "replica" I think SA doesn't use real words much since the Viagra etc. lot just went over to misspelling. To investigate this properly would need a look at what SA tests were effective both now and in the past - I found the URL tests were the usual trigger - and what might be made more effective. You don't say how many Spams a month you get (index numbers in VER or Held make this quite easy to record). I have SA=2.0 3622 spams (121/d), 46 leakers (=1.3 %) for June with all Blocklists including pbl in spite of the false positives caused by the SC implementation. There is a trick to let you just look at the borderline SA values so going from SA=5.0 to SA=2.0 is no risk nor requires more than a few to be eyballed. Thus using SC Webmail Search on the held folder (and save as a virtual folder) Search 'Entire messagel' for any of "hits=0.", "hits=1.", "hits=2.", "hits=3.", "hits=4." plus for good measure any that don't contain "hits=" at all This should show you all the low SA and blocklist items which (for me) is only 1-5 a day. HTH
  17. I observe that Windows-1251 as well as KOI8-R trigger 'Blocked Russian' in SC Mail. I found no examples of KOI8-U so I can't say for that. Windows-1251 example Here is your TRACKING URL http://www.spamcop.net/sc?id=z3053524212z6...31fa4f6bac34c7z
  18. Oops, I was just trying to clarify. The '"' don't appear in the filter. You might also try piggy-backing on the webmail "Blocked Russian" feature Filter Self-defined header/ X-SpamCop-Disposition contains Russian
  19. Looking back, I was successful with a filter Filter Self-defined header/ content-type contains KOI8-R I have the feeling that Filter and Search gave different results with Subject contains "KOI8-R" except when the subject had KOI8-R as text rather than a encode marker so perhaps the header text that the filter is seeing is decoded and no longer contains ?KOI8-R? ? I suggest you make up a test folder with KOI8-R in every possible location and report on results.
  20. michaelanglo

    The never ending story cnc-noc.net

    Back in October 2007 I noted 53 % of spam received had a source reportable to a Chinese ISP (since I use quick reporting I didn't realise this before - I analysed the text of the emails that quick reporting sends). Since SpamAssassin does an pretty good job I seldom see such. If SA thinks that a site hosted in China ups the score then that's another plus (VBG).
  21. michaelanglo

    Graylisting and Yahoo Groups

    Just add "returns.groups.yahoo.com", the constant right-hand portion of the Return-Path: to SC Mail's Personal Whitelist. This is also whitelisting's (and blacklisting's) partial equivalent to wildcarding, thus Blacklist CN will stop any email with a Return-Path, From or Sender purporting to be in China. The only side effect is that Yahoo groups mail will be whitelisted even for spam with a high SpamAssassin level. More discussion in the Greylisting and How I use SC Mail Topics. HTH
  22. michaelanglo

    "Header data found in body"

    As I recall, the message used to appear before 22 January 2008 so not a recent change. I had only seen this message in broken spams so my interest was solely in the fact that missing certain fields would stop the parsing of the header itself, ie not even Quick Reporting occurred. The above date was a newsgroup post by - Don D'Minion - SpamCop Admin - whicch I noted as confirming that neither adding From: nofrom nor Subject: no subject were allowable alterations
  23. michaelanglo

    "Header data found in body"

    I've seen the message from time to time. I don't think the To: matters but here is an example with Subject: present but all blanks IIRC Subject: missing is the same. -- Header data found in body, aborting link detection Here is your TRACKING URL http://www.spamcop.net/sc?id=z2945463582z6...93cabd8ddf5fb9z Changing this to Subject: none causes the message to go away. -- Parsing text part, no links found Here is your TRACKING URL http://www.spamcop.net/sc?id=z2945489639z8...7299b29c0ca344z These have "Sender:" rather than "From:" but I don't think that matters either. HTH
  24. michaelanglo

    Spamcop not reporting emails in the body

    Eons ago, like in November 2000, it made that offer. thread "More info and other ISP replies" in the newsgroup archives should show a post by me (Mike D)
  25. michaelanglo

    FR: aditional email protection in reports

    Back in December 2008 I posted trackers in the newsgroup for an example pair in one of which the "From:" was not munged (which is what commonly happens) and in the other the munging occured. They were otherwise very similar and no one had any suggestions as to why. Yes, "Return-Path:" can be munged and is, even in a case where "From:" is not.