Jump to content

What happens AFTER I submit a spam message?


fSoft

Recommended Posts

I've read and looked and searcheed and I just can't find the answers.

I operate as a small ISP and I am using Deerfield's VisNetic MailServer 7.5.3. It is set up to use bl.smapcom.net for it's DNSBL.

This stops a lot of spam from ever getting past the mail server. However since a lot of mail was still getting through, I came here looking for answers. I found I could submit spam email to spamcop.

I have submitted over 150 emails in the past two days and I see a reduction in the amount of spam. However, I still seem to get some of the same email from the same system.

My two big questions are: What is the process taken by SpamCop when I submit an email? Do I really have to "Report the spam" email to the ISP and others?

So from the time I submit an email as spam, how long before you blacklist that IP address? How many emails from that IP do you need on that IP address before you add it?

I also have questions about the following that is included in the data when the message is parsed.

216.7.84.117 not listed in dnsbl.njabl.org
216.7.84.117 not listed in dnsbl.njabl.org
216.7.84.117 listed in cbl.abuseat.org ( 127.0.0.2 )
216.7.84.117 is an open proxy
216.7.84.117 not listed in query.bondedsender.org
216.7.84.117 not listed in iadb.isipp.com

If SpamCop knows this IP is listed in cbl.abuseat.org why isn't it being blocked?

If SpamCop knows this IP is an open proxy, why isn't it being blocked?

I'm sure I'll have more questions but it's hard to know what ot ask whenone doesn't know how something works.

Gary Funk

Link to comment
Share on other sites

Hi, Gary,

...Here are some references that may help to answer some of your questions:

...Hope these help! Please return here if you still have questions to post follow-ups.

Link to comment
Share on other sites

A lot of your questions are actually already answered in the FAQ (Frequently Asked Questions) "Read before posting" ... some are beat to death over and over in other existing discussions ...

The other BLs are based on different conditions, have different standards, and in general, are "different" .... One would want to visit those sites to find their reasons for existence. But the question (about blocking) you are asking actually deals with the actions taken by the parsing engine as compared to the IPs listed within the SpamCopDNSBL .... not the same tools at all ...

Link to comment
Share on other sites

Personally, I'm finding it hard to come up with answers here.

There is definitely a difference between the phrase "submit your spam" and "Report Now" .... the first inputs your stuff to the parser, the second deals with your verification that you (being the ultimute responsible person for where the reports go) agree with the results from the parser.

"What's with all the select items ..." .... following the links already provided you, one should have hit How should I select the recipients for my spam report? which covers a lot of ground.

I have already hit on your "other BL" question.

Link to comment
Share on other sites

I read them and not only didn't they answer the questions, they confused the issues.

From that remark, I'm going to suggest a different view on the FAQ .. try going through the one "here" as in "read before posting" .... this will at least indicate that Reporting and the BL are two totally different items.

And now you've done it. You've mentioned that two things are different but you didn't say what they are or how they are different. To be blunt and maybe too the point of being too honest, the documentaiton on hoe SpamCop works is bad. If I wrote this bad, I'd have to give up life as a journalist.

Again, try the FAQ "here" ... it includes many items not found on the www.spamcop.net pages, and those items are discussions, points, and clues developed by other users.

I want to know what "I" need to do to help "YOU" improve bl.spamcop.net. As I stated in my first post, the mail server I use, uses it to see what mail servers to block. I want to do my part to get this to 99.99%.

After you actually read the FAQ items on the BL, you should understand what it is, how it's used, and what it takes to develop its contents. And during this "discovery" you should also stumble across the connection and distinction of the reporting side of the house to the BL and its content.

Link to comment
Share on other sites

I don't get any choices. Here is a sample of what I get:

http://www.spamcop.net/sc?id=z684238967z78...3511afa5a3422ez

There are three choices at the bottom. Send, Preview, and Cancel.

I am NEVER presented with items to slelect.

I can only guess at this point at what you see on that page. If I had to guess right now, I'm leaning between your browser having issues or you have got yourself set up for "Quick-Reporting" ... Here's what I see (missing the checkboxes as graphics don't happen here ... but each line has a box in front of it)

Report spam to:

Re: 66.63.167.251 (Administrator of network where email originates)

To: sysop[at]oc3networks.com (Notes)

Re: 66.63.167.251 (Third party interested in email source)

To: abuse[at]oc3networks.com (Notes)

To: Cyveillance spam collection (Notes)

Re: http://trk.emsemail1.com/trkvb.asp?a=u&c=66... (Administrator of network hosting website referenced in spam)

To: sysop[at]oc3networks.com (Notes)

Re: http://trk.emsemail1.com/trkvb.asp?a=u&c=66... (Third party interested in spamvertized web site)

To: abuse[at]oc3networks.com (Notes)

Additional notes (optional - max 2000 characters):

Link to comment
Share on other sites

Okay. It's pretty clear you guys are as clueless as I am..

19075[/snapback]

...No, actually, since I've taken the time to read pretty much all the messages here, all the relevant links from the SpamCop home page and pretty much all the pinned items in these fora, I'm very clued in, thank you very much. Sure, there are things I don't know about the nitty-gritty details but, then again, I haven't a clue how my cars or phones (or even my computer) work, either, but that doesn't stop me from operating them intelligently.... :) <g>

I'm out of here.

19075[/snapback]

...Well, I'm staying. I learn a lot from the others who post in these fora.... :) <g>
Link to comment
Share on other sites

  • 2 weeks later...
If SpamCop knows this IP is listed in cbl.abuseat.org why isn't it being blocked?

19057[/snapback]

The SCBL does not automatically incorporate the CBL. If you want to block using the CBL, please add cbl.abuseat.org to your mailserver's list of DNSBLs. If you have trouble doing that, please contact the tech support team for the organization of your mailserver's vendor and/or developer.
Link to comment
Share on other sites

My two big questions are: What is the process taken by SpamCop when I submit an email? Do I really have to "Report the spam" email to the ISP and others?

So from the time I submit an email as spam, how long before you blacklist that IP address? How many emails from that IP do you need on that IP address before you add it?

If SpamCop knows this IP is listed in cbl.abuseat.org why isn't it being blocked?

If SpamCop knows this IP is an open proxy, why isn't it being blocked?

Yes, you have to send the reports in order to feed our blocking list database. "Submitting" the spam is only half of the process. The only way to put a server on our list is by using our service to sent complaints.

An IP is added to our blocking list the instant it qualifies (within 20 minutes or so). How many reports it takes to put the IP on our list depends on the amount of legitimate mail the server is sending, but two or three reports in quick succession should do it. One report will not do it, and two only puts it on our list for a short period while we wait to see if more reports are coming. There are other variables involved in the listing decision.

SpamCop uses other blocking lists as a small part of the decision making process. We do *not* add servers to our list just because they appear on another list. Except for ORBD, but the IP has to send spam to our system or we won't know it's on the ORBD list.

- Don -

Link to comment
Share on other sites

Okay. It's pretty clear you guys are as clueless as I am.

I'm out of here.

19075[/snapback]

Pure comedy. If you're clueless about how a blocklist works, then you need to give up the ISP business. The SpamCop list is just like every other blocklist, only its FAR larger, so you have to finish the reporting process to record the IP (though I've had to report a person 10 times before he was finally put on the BL). Incase you haven't realized by now, spam comes from certain ISPs, because they're either black-hat or compromised systems.

geez.. I'm a noob and I know that stuff.

Link to comment
Share on other sites

Pure comedy.  If you're clueless about how a blocklist works, then you need to give up the ISP business.  The SpamCop list is just like every other blocklist, only its FAR larger, so you have to finish the reporting process to record the IP (though I've had to report a person 10 times before he was finally put on the BL).  Incase you haven't realized by now, spam comes from certain ISPs, because they're either black-hat or compromised systems. 

geez.. I'm a noob and I know that stuff.

19527[/snapback]

Thank you for letting me know your response was going to be comedy.

I could spend the next 1000 words explaining to you here how your every point is wrong, but I'll just highlight a couple.

First, I stated I 'act' as a small ISP. I never stated I am an ISP.

Second, I know how a blacklist works. But I had questions about how SpamCop worked.

Third, yes, your a noob, but you will grow out of it.

Link to comment
Share on other sites

Welcome back.  However, that you've got a handful of responses trying to clear up your issues, it's kind of disturbing that you only wanted to top your "I'm out of here" post with one talking about being a "noob" ....

19576[/snapback]

Just another muntchkin troll making it on my ignore list!

Link to comment
Share on other sites

IPB has an ignore list? <gd&r>

Click on the name, last item under Profile Options. Though I could sure see some issues at responding in some Topics without "knowing" everything that had actually gone on before in that discussion.

Link to comment
Share on other sites

Click on the name, last item under Profile Options.  Though I could sure see some issues at responding in some Topics without "knowing" everything that had actually gone on before in that discussion.

19583[/snapback]

Thanks. Sometimes it's helpful just to have the technical capability to back up plonking threats and/or recommend that the annoyed plonk the annoyers.
Link to comment
Share on other sites

Welcome back.  However, that you've got a handful of responses trying to clear up your issues, it's kind of disturbing that you only wanted to top your "I'm out of here" post with one talking about being a "noob" ....

19576[/snapback]

I read them. I only found the need to reply to the one. By-the-way, I only see one responce worth reading. And you disturb way to easily.

Oh, and just so you know, I'm donig research on an article for ISP-Planet. I just finished a review on VMS and the guys from Deerfield suggested SamCop was a good DNSBL; I'm trying to figure out why.

I'll be sure to include your comments. Or if you want, I'll move on and not bother with SpamCop.

Link to comment
Share on other sites

Thank you for letting me know your response was going to be comedy.

I could spend the next 1000 words explaining to you here how your every point is wrong, but I'll just highlight a couple.

First, I stated I 'act' as a small ISP. I never stated I am an ISP.

Second, I know how a blacklist works. But I had questions about how SpamCop worked.

Third, yes, your a noob, but you will grow out of it.

19572[/snapback]

"ACT" as an ISP... oh gee, thank you oh great master of the internet. Carry on with your quest for knowledge

Link to comment
Share on other sites

"ACT" as an ISP... oh gee, thank you oh great master of the internet.  Carry on with your quest for knowledge

19600[/snapback]

No, I'm a journalist. You guys are making SpamCop look real good. No wonder the spammers are winning.

Link to comment
Share on other sites

No, I'm a journalist. You guys are making SpamCop look real good. No wonder the spammers are winning.

19601[/snapback]

I don't represent SpamCop, I'm simply posting to a messageboard. If you think all people that post to messageboards are associated with the entity/business, you're a pathetic journalist.

Instead of this whole diatribe, why not just state you're a journalist, looking for information, instead of trying to be sly about it. You could have contacted many of the SPAMCOP Admins and they could have told you all about it... but you chose to come here and find information? weak work man.

Link to comment
Share on other sites

I read them. I only found the need to reply to the one. By-the-way, I only see one responce worth reading. And you disturb way to easily.

You could have made a note about the possibility of being signed up as a mole reporter or using Quick-Reporting for one thing. You also didn't make any noise about trying a different browser, computer, trying to change a display toggle, etc. to rule any of that out. Where I copied stuff directly off my screen that showed the "options to check" where you say you saw nothing .... and yet, this is exactly what your starting query seemed to deal with.

Oh, and just so you know, I'm donig research on an article for ISP-Planet. I just finished a review on VMS and the guys from Deerfield suggested SamCop was a good DNSBL; I'm trying to figure out why.

Tossing out an issue and complaining that you can't see something on your screen (that I in turn cut and pasted into a responding post), yet not concerning yourself in talking to that issue seems more than a bit odd. Is this "doing research" supposed to mean something in reference to troubleshooting your original "problem" ..??? I don't see the relevance.

I'll be sure to include your comments. Or if you want, I'll move on and not bother with SpamCop.

If you are talking about "my" comments, feel free (though again, wondering what relevance trying to resolve your "problem" has to do with anything else) If you are talking about the inclusion of any other comments, then I'd request that they be offered in full context. I don't see that you did yourself any favors thus far.

As far as why the SpamCop DNSBL has been recommended, yet again, read the FAQ ... read other postings here and/or over in the SpamCop newsgroups ... find out why the SpamCop DNSBL is different that the others and you'll have your answer. If you actually want to discuss this vice the alleged "problem" .. please start your new Topic up in the Lounge area.

Link to comment
Share on other sites

No, I'm a journalist. You guys are making SpamCop look real good. No wonder the spammers are winning.

Obviously the 'Hearst' Kind of journalist. If you think veiled threats like that will get you a better story, then you are an idiot.

Unfortunately there are many people who will lap up your story about being battered by anti-spam advocates because Americans always like an underdog.

If you are really a journalist, there are plenty of reasoned discussions about blocklists and about spamcop blocklist in particular in the archives.

I don't know what your original question/post was about. Whatever it was, you have a lot to learn about interviewing if what you wanted was information about why spamcop users use spamcop.

Miss Betsy

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...