Jump to content
SpamCopAdmin

Three Ways to Report spam

Recommended Posts

1. Copy/Paste the full (raw) headers and text into the SpamCop web form after you log into your account at http://www.spamcop.net/ If the spam is HTML encoded with fonts and styles, etc, you should first expose the underlying HTML code if you want SpamCop to look for web links. You can paste the spam into either the standard reporting box, or the two-part "outlook/eudora workaround form" if SpamCop is having trouble "finding" the links in the body text.

2. Create a plain text email addressed to your "submit" or "quick" submission address that CONTAINS the full (raw) headers and text of the spam (with underlying HTML code exposed if there is any). SpamCop will look inside your email for the spam.

3. Create a plain text email addressed to your "submit" or "quick" submission address that has the spam ATTACHED to it. This is what you are doing when you "Forward as Attachment." You can attach multiple spams if you keep the numbers down. I don't know how many is too many. You'll have to determine that by trial and error.

- Don D'Minion - SpamCop Admin -

- Service[at]Admin.SpamCop.net -

.

Share this post


Link to post
Share on other sites

...Proposed modifications:

  • Options 2 and 3 are not permitted for Microsoft Outlook e-mails. Ref: SpamCop FAQ entry labeled "Forwarding "As Attachment" from Outlook - no longer allowed!! 6 April 2009."
  • Option 1: If you use the standard reporting box, leave a blank line between the headers and the spam text (body).
  • Option 2: leave a blank line between the headers and the spam text (body).
  • Option 3: per SpamCop FAQ entry "How do I submit spam via email?" "You should not exceed 20 spams attached to a submission. The maximum size for the overall submission must not exceed 50 KB."

...Please do not take these proposed modifications as authoritative unless validated by one of the SpamCop staff.

Share this post


Link to post
Share on other sites

Forgive me if the way I report is wrong, I do the following....

Right click on the email (I still use Outlook Express) and select "Properties".

Click on the "Details" tab and then select "Message Source".

Ctrl-A to select all the text in the window, then copy and paste it into the spam Cop reporting box and Process.

Share this post


Link to post
Share on other sites

Forgive me if the way I report is wrong, I do the following.....

Looks good to me matey - only problem is with submission by e-mail from Outlook (not Outlook Express) so you're in the clear on both counts.

Problem with Outlook e-mail submissions was (sometimes) mangling of the order of "Received:" lines in the headers.

Share this post


Link to post
Share on other sites
Forgive me if the way I report is wrong

<snip>

...Nope, that's right -- you're using Don's 84376[/snapback] Option 1. The only reason what you are doing seems different is that you just added the detail relevant to Outlook Express that Don describes more generally as "Copy/Paste the full (raw) headers and text into the SpamCop web form."

Share this post


Link to post
Share on other sites

Newbie here! What happens once you submit the spam using the form on the website?

When can you expect to see less spam emails coming through?

Share this post


Link to post
Share on other sites
5 hours ago, j4v3d said:

When can you expect to see less spam emails coming through?

There is no direct correlation between an individuals spam submission and a change in spam received.

An exception to that would be if your ISP (email server) uses the SpamCop Block List.  Otherwise, there would not be a notices change.

Share this post


Link to post
Share on other sites
Posted (edited)
On 10/1/2019 at 5:29 AM, j4v3d said:

Newbie here! What happens once you submit the spam using the form on the website?

When can you expect to see less spam emails coming through?

I wish I knew what drives inclusion of sites (or their Domain Names) in blacklists. I’ve been using SpamCop for a long time, but I’ve not worked it out. I feel like it has definitely reduced the spam I get. Many years ago I received very few every year. I stopped reporting them. Then about 18-24 months ago it started again.

Either I was in a data leak (pwned) or somehow I did get added to a list. Maybe a random bot sent email arrived and I opened it? Heaven forbid, but maybe I even replied to one?

Ive re-learned submissions, deciphering the plain text/headers and the “tricks” of the criminal idiots behind spam/phishing emails.

Now they all get reported. Average submissions time 2 hours. I also report image content when hosted off their spamvertized domain site. Some image hosting applications respond in under an hour at times, deleting the files. The spammer who continues to blast me has noticed and has to include “Can’t see the images? View unblocked email here” (or similar message at the top of their spammy emails)

I wish the blacklisting was faster. Especially SURBL, because then see the domain registrar take actual action to shut down one more spam site the spammer moves onto their next one but it causes them inconvenience which reduces the spam for a while!

Currently I’m dealing with ~24 spams per day, and all for the same three domains hosted by the same provider. Hoping for a slow down soon 😊

Best wishes.

Edited by Hanco
(I included my name eek)

Share this post


Link to post
Share on other sites

Lets start with the SCBL deals with IP addresses not domain names. As for which IPs are blocked, have you looked at https://www.spamcop.net/spamstats.shtml  or https://www.spamcop.net/fom-serve/cache/351.html

3 hours ago, Hanco said:

wish the blacklisting was faster.

Have you looked at https://www.spamcop.net/fom-serve/cache/297.html scroll down to "Rules" Speed all depends.

Share this post


Link to post
Share on other sites
Posted (edited)
3 hours ago, Lking said:

Lets start with the SCBL deals with IP addresses not domain names. As for which IPs are blocked, have you looked at https://www.spamcop.net/spamstats.shtml  or https://www.spamcop.net/fom-serve/cache/351.html

Have you looked at https://www.spamcop.net/fom-serve/cache/297.html scroll down to "Rules" Speed all depends.

 

 

Rules:

  • SCBL lists IP addresses with a large number of reports relative to reputation points. The SpamCop team manually balances the threshold in an effort to make the list as accurate as possible.

I guess I won’t know what that means in actual volume terms.

  • The SCBL weights reports depending on how recently the mail was received (or "freshness"):
    • The SCBL counts the most recently received reports 4:1.

That’s me and these reports I send for sure. Avg reporting time 2 hrs now. Very fresh!

 

  • The SCBL does not count reports regarding URLs or addresses in the body of the email. Therefore, the SCBL does not list websites or email addresses used to receive replies in reported email, unless that IP is also used to send the mail.

So, for spam emails that are from Amazon AWS IPs, where the body of the email is sent to drive traffic to the IP address of  “australy.win”... australy.win’s IP address will never become blacklisted through the reports I send? The Amazon AWS IP might though?

 

  • The SCBL will not list an IP address with only one report filed.

I hope someone else is receiving the junk I get and is bothered enough to report

Edited by Hanco
No edit, just THANKS!

Share this post


Link to post
Share on other sites
10 hours ago, Hanco said:

That’s me and these reports I send for sure. Avg reporting time 2 hrs now. Very fresh!

When the "Reporting Time" was added to the screen, there were lots of threads about the accuracy. Seems to fall to 2 hrs and sticks there.

10 hours ago, Hanco said:

P address will never become blacklisted through the reports I send?

And why should they??? They don's SEND any spam.  Remember the objective of the SCBL is to block/filter incoming spam, not rate all the IP in the world.  In the beginning spammers would include phony links to NY Times/ Washington Post, etc. to make it look like the spamvertised product was valid.  A dynamic process.

 

10 hours ago, Hanco said:

I hope someone else is receiving the junk I get

Thanks.  I am fairly sure that in spite of the view from your end of the "fire hose" 1k - 100k others are receiving spam for the same IP, it only takes a couple of live reports. And of course there are all the spam traps which are heavily weighted..

Share this post


Link to post
Share on other sites
23 hours ago, Lking said:

why should they??? They don's SEND any spam.  Remember the objective of the SCBL is to block/filter incoming spam, not rate all the IP in the world.  In the beginning spammers would include phony links to NY Times/ Washington Post, etc. to make it look like the spamvertised product was valid.  A dynamic proces

Why should they? I agree with you that innocent bystanders don’t want to be impacted. I’m talking about three specific domains/sites, which exist ONLY for spam operations.

Obviously I appreciate determination of a site existence only for this purpose is not always straightforward. And maybe this is not the place to ask about it. Just curious how a domain like “australy.bid” or “australy.win” gets on blacklists like SURBL. It certainly seems like it is not achieved by the reports sent to the host this week :(

Share this post


Link to post
Share on other sites
3 hours ago, Hanco said:

gets on blacklists like SURBL.

Different block list, different objectives, different rules.

Share this post


Link to post
Share on other sites
30 minutes ago, Lking said:

Different block list, different objectives, different rules.

Yes, exactly. Any ideas how to help them get onto those lists? 

Share this post


Link to post
Share on other sites
18 hours ago, Hanco said:

Any ideas how to help them get onto those lists? 

Perhaps others do, I do not.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×