flagginator Posted September 7, 2004 Share Posted September 7, 2004 I get lots of spam from ha...... servers or ISPs. I know these are from Korea. I am getting frustrated by the high percentage of spam I am forwarding, then submitting. I am considering joining the ranks of Spamcoppers who only forward spam, but never go to the next level and submit the reports. Check the graphs to see what I mean. There are two classes of spamcoppers: 1. Those that forward spam. 2. Those that click on the "Report Now" link and finish the process. My understanding is step #1 puts the server or ISP on the Spamcop Blacklist (SCBL or scbl). Step #2 sends reports to the offending ISPs for follow-up. BIG QUESTION: Do ha....... servers ever come OFF the SCBL or are they incorrigible and never take real action? If they actually take action I'll continue to go the extra mile and "Report Now" but if not, I need to allocate my limited time resources to more productive copping. Link to comment Share on other sites More sharing options...
Miss Betsy Posted September 7, 2004 Share Posted September 7, 2004 I don't think that forwarding spam to spamcop does anything at all for inclusion in the blocklist. You have to finish by actually 'reporting' or it does not go on the blocklist. The way that people get around too many spam to report is either by using quick reporting (but be sure you sign up for mailhosts first) or by just submitting and following through by reporting the number that you are comfortable with. some people only report the five newest ones (a good strategy since others will have been reported already) or only the ones from ha or only the porn or only the 'grow bigger' or whatever. And yes, probably ha is permanently on the spamcop bl and several other bls also. Miss Betsy Link to comment Share on other sites More sharing options...
flagginator Posted September 7, 2004 Author Share Posted September 7, 2004 There is a gap between the green line and the blue line. The gap is white. Are you saying the greenies are wasting their time if they do not take it to the blue level? http://www.spamcop.net/spamgraph.shtml?spamyear PS: By ha..... I mean any ISP that begins with ha like hanaro hahano harano Etc. Link to comment Share on other sites More sharing options...
Wazoo Posted September 7, 2004 Share Posted September 7, 2004 Step #1 does nothing beyond feeding the parsing engine to develop the list of results. That's it. Nothing counted, nothing added, nothing calculated until Step #2 is accomplished. If Step #2 isn't performed, then the IP in question will fall off the BL due to the lack of reports/complaints. Link to comment Share on other sites More sharing options...
Wazoo Posted September 7, 2004 Share Posted September 7, 2004 There is a gap between the green line and the blue line. The gap is white. Are you saying the greenies are wasting their time if they do not take it to the blue level? http://www.spamcop.net/spamgraph.shtml?spamyear In that depiction, the green stuff is shown as a "bar" graph, whereas the blue stuff is shown as a "line" graph ... two different data sets displayed in a way that one item doesn't "cover" the other. Not an insider, but I'm guessing that the way some statistics are developed explains the "less white space" in between .... just a guess, but perhaps Julian changed from counting "all" reports to "just" reports that actually "go out somewhere else" .... again, only a guess at a possible reason for the apparent massive change .... Link to comment Share on other sites More sharing options...
Miss Betsy Posted September 7, 2004 Share Posted September 7, 2004 More probably the reason for the difference between 'spam submitted' and 'reports sent' is that there are people who cancel reports for various reasons. The most common one is probably to get addresses to report viruses and bounces. There are others who submit by email, but then don't get back in time to report in a timely fashion. And there are others who don't realize that there is a second step so never do actually report anything although they submit regularly. Miss Betsy Link to comment Share on other sites More sharing options...
flagginator Posted September 7, 2004 Author Share Posted September 7, 2004 If you search this forum there are some early replies from muck-de-mucks here to my previous posts and said M-d-M's said even if I botched my submissions that at least they got on the scbl. So, I assumed there might be a two tier logging system. Link to comment Share on other sites More sharing options...
turetzsr Posted September 7, 2004 Share Posted September 7, 2004 If you search this forum there are some early replies from muck-de-mucks here to my previous posts and said M-d-M's said even if I botched my submissions that at least they got on the scbl. So, I assumed there might be a two tier logging system. 16513[/snapback] ...Tried to search these fora for a post by that user -- received error to the effect that there is no such user. ...In any event, either M-d-M was incorrect or you misunderstood her/him. Link to comment Share on other sites More sharing options...
Miss Betsy Posted September 7, 2004 Share Posted September 7, 2004 I searched also, but didn't see anything in f's posts that might indicate he was just submitting at one time without reporting so didn't go any further. However, 'submitting' and 'reporting' are used sometimes interchangeably by some posters (perhaps even I do it) which does cause confusion. Whenever the old hands start to ask questions which seem picky, remember that the difference between lightening and a lightening bug is choosing the correct word to describe what you are doing! There was a great line in the ng by a new poster today: the regulars will help you with things that you couldn't even imagine you needed help with! (that's a little mangled, I think) Miss Betsy Link to comment Share on other sites More sharing options...
dbiel Posted September 8, 2004 Share Posted September 8, 2004 <snip>even if I botched my submissions that at least they got on the scbl. So, I assumed there might be a two tier logging system. 16513[/snapback] Wrong assumption. To repeat what Wazoo said, If the report is not sent, absolutely nothing happens Forwarding spam and not reporting it is a total waste of your time and SpamCop hard disk space. As far as a two tier logging system, there is some truth to that, BUT it is based on other differences Quick Reporting vs Full Reporting Mole Reporting vs Munge Reporting vs UnMunge reporting or copied from the preference page: spam Munging Obscure identifying information Leave spam copies intact Become a "mole" - Don't even send reports (mostly pointless) Link to comment Share on other sites More sharing options...
flagginator Posted September 8, 2004 Author Share Posted September 8, 2004 More on the mole program please. Link to comment Share on other sites More sharing options...
Wazoo Posted September 8, 2004 Share Posted September 8, 2004 More on the mole program please. Announcements Forum has some dialog on the issue of the changing FAQ, changes in the use of mole reports, etc. Link to comment Share on other sites More sharing options...
turetzsr Posted September 8, 2004 Share Posted September 8, 2004 More on the mole program please.16529[/snapback] ...Doing a Search of the FAQ: SpamCop FAQ: What is "mole" reporting?. ...Doing a search of the forums: Mole Reporting is Back. Link to comment Share on other sites More sharing options...
flagginator Posted September 8, 2004 Author Share Posted September 8, 2004 I do not get any spam on my POP3, Yahoo, and Gmail accounts. I only get tons of spam on my Pine account. Reporting takes too much time and I will cease soon with my non-POP3 account. I would like to be a mole so I can continue to submit spam, but without the time it takes to do forty a day. How do I do it? Is it still possible? Thanks. Link to comment Share on other sites More sharing options...
turetzsr Posted September 8, 2004 Share Posted September 8, 2004 I do not get any spam on my POP3, Yahoo, and Gmail accounts. I only get tons of spam on my Pine account. Reporting takes too much time and I will cease soon with my non-POP3 account. I would like to be a mole so I can continue to submit spam, but without the time it takes to do forty a day. How do I do it? Is it still possible? Thanks. 16532[/snapback] ...What gave you the impression you were required to do forty (or any particular number) a day? <g> Why not just do what you have the time and inclination to do? I don't know if mole reporting will accomplish what you are trying to accomplish, it will just not send reports to the people who most need to see them -- admins of networks with compromised machines. Link to comment Share on other sites More sharing options...
dbiel Posted September 8, 2004 Share Posted September 8, 2004 Also Mole reporting does NOT save any time. It uses the exact same process as standard full reporting. The only difference is in what gets reported which for mole reporting is not much of anything. It provides the utmost protection to the reporter, nobody outside spamcop administration will ever know who you are. Munged reporting can not guarantee that every reference to you is munged, so it may be possible for the ISP and spammer to discover who the reporter was based on embedded information was could not be munged. It is a higher level of reporting than mole, but remember some ISP will not accept munged reports resulting in fewer reports being sent. The only faster way to report is to use quick reporting but remember that it is a stripped down version of reporting so does not provide the same results as full reporting and is prone to many more errors. There are faster ways to submit spam to the parser for full reporting, but you still have to process each submitted message individually. But back to what SteveT said. You do not have to report every spam you get. Report what you can and forget the rest. Remember every little bit helps. Link to comment Share on other sites More sharing options...
flagginator Posted September 8, 2004 Author Share Posted September 8, 2004 The way spam ebbs and flows sometimes it seems that reporting spam even with munged reports leads to more spam. It comes in waves. Sundays are bad. I just do not see the reason to report spam too many times. Once spam has reached a threshold Spamcop should tell us, "no need to report this one, we already have enough to bust their chops". That way we wouldn't have to go the extra four miles to report it after we've forwarded it. Hey, listen up please, this is a productive suggestion Link to comment Share on other sites More sharing options...
dbiel Posted September 8, 2004 Share Posted September 8, 2004 <snip>That way we wouldn't have to go the extra four miles to report it after we've forwarded it.<snip>16537[/snapback] I am afraid that you still do not get it! Forwarding with out reporting is a total waste of time. It basicly amounts to Spamming SpamCop. Link to comment Share on other sites More sharing options...
flagginator Posted September 8, 2004 Author Share Posted September 8, 2004 You're not understanding my suggestion. The "Report Now" is the slow part of the process. If Spamcop already has enough reports on a spam they don't need mine too. It could save me the extra step and I would abort the complete spam submission process. This would save me time and it would not shortchange Spamcop at all. If enough is enough then isn't it time for good enough? I'm not the brightest bulb in my City, but I didn't just fall off the turnip truck either. So, cut it with the belittling remarks or I'll beat you with an IDE ribbon cable you tin foil cap wearing propeller headed knock-kneed pocket protector wearing five colored pencils in it weenie whining pimp slapper! Now, settle down, that's supposed to be funny Link to comment Share on other sites More sharing options...
dbiel Posted September 8, 2004 Share Posted September 8, 2004 OK, I see where you are coming from. But I believe that there is one major problem with the logic and that is under the current process I believe that the spam is not identified until after it is parsed, ie after pressing the Report Now button. To do what you want would most likely require a major rewrite of the software. An alternate way to save time for the reporter would be to have the parse run automaticly at the time of submission requiring only a review of the results before actually sending out the reports. But again this would most likely require a major rewrite of the software. How would you recommend that SpamCop identify spam messages as being the same spam? A single spam message can generate multiple reports. The "same" spam message going to different users may take different paths resulting in different results. The body copy of a "same" spam may be altered slightly for each message sent to help get arround spam filters. So back to the same question, what makes a spam message the same as another spam message. The body copy may look the same but have slight differences The headers will almost allways be different. I guess you could say that taking the results of the parse and cataloging the results and then comparing each new spam against that catalog to find an exact match could qualify for the definition of "same" spam, but at what cost on system hardware and processing time to accomplish it. If every spam message only reported a single IP address then what you are asking for would be a whole lot simpler, but as it is, it looks like a programming nightmare to me. How would you recommend programing it? Ignore the code, just think about the basic logic that would be required. I would be interested in seeing your concept of how this could be accomplished. The current method keeps track of the individual reports that are filed and cross references them back to the individual parse that created it. So there would be a list of number of reports sent to a given source, but there is no record kept as to whether the reports came from 1,000 different messages types or from one common message; or if the other reports generated from each spam message went to the same place or different places. PS interesting rant. Additionally each report filed does have an impact on how long an IP remains listed or conversely how soon it gets delisted. So by reducing the number of reports filed you automaticly reduce the amount of time an IP will be listed. I tend to think that this is not your intended goal. Link to comment Share on other sites More sharing options...
Miss Betsy Posted September 8, 2004 Share Posted September 8, 2004 The "Report Now" is the slow part of the process. If Spamcop already has enough reports on a spam they don't need mine too. Since there are people who are taking the time to report spam in the hundreds, reporting 40 is a drop in the bucket. compared to the statistics. I am not very good at figuring odds, but I think the odds are that whether you report 5 or 40, the chances of making a difference in the listing are about the same. And the odds of making a difference probably increase if you only report the latest 5 received. I don't even bother reporting spam that hasn't actually arrived the day I report it. There are server admins on duty Sunday (or someone who only has time on Sunday) that have made all the reports necessary for spam sent on Sunday. Carpe Diem! Miss Betsy Link to comment Share on other sites More sharing options...
dbiel Posted September 8, 2004 Share Posted September 8, 2004 Please do not read Miss Besty's statement wrong. Every little bit does help. But if reporting is causing you grief and agravation, your not reporting some spam is not going to hurt the SpamCop system. Link to comment Share on other sites More sharing options...
flagginator Posted September 8, 2004 Author Share Posted September 8, 2004 I report spam quickly and frequently. One curious thing is let's say my reporting time average is four hours. I submit some spams and it goes up to five hours. Then I submit several zero hours spams. My average stays at five hours. My point is the average goes up, but never (rarely) goes down. A bunch of zero hours spam should really sink my average, but maybe the average-inator routine cannot handle zeros? Link to comment Share on other sites More sharing options...
DavidT Posted September 8, 2004 Share Posted September 8, 2004 Mine is sitting at five hours also. Once you've submitted a LOT of spam, it's mathematically very difficult to bring it down under that, unless you never submit the spam that arrives overnight or when you're away from your computer for four hours or more. IMO, lowering the number isn't a goal that's worth any effort whatsoever. DT Link to comment Share on other sites More sharing options...
turetzsr Posted September 8, 2004 Share Posted September 8, 2004 <snip> If Spamcop already has enough reports on a spam they don't need mine too. <snip> 16539[/snapback] ...Not (necessarily) true. Even if SpamCop were able to determine that it's already seen your spam (actually, not as difficult as might otherwise appear, because what's important isn't the spam, itself, but rather the IP address that represents the machine through which it was sent), the blacklist works on a formula that includes the time since the last spam reported was received by the person reporting it (you, in this case). So, if you are submitting spam that was last received by a reporter two hours ago, your reporting it could have the effect of keeping the IP address on the blocklist for two hours longer than if you had not reported it. That may or may not be significant in the real world. ...Bottom line, it's up to you to determine how much time and effort you wish to put into reporting spam. <g> Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.