Jump to content
Sign in to follow this  
rcurzon

Filter based on a blocklist?

Recommended Posts

My perception of a timing issue...

Let's say 1000 spam items are sent to 1000 spamcop users. They arrive in 1000 inboxes before the first one is read.

When I finally read my copy... the odds are, somebody else has already blocklisted the sender.

It'd be nice if I can take advantage of the fact, instead of repeating that report (me and the other 998 readers). I.e. apply a filter to my inbox to reapply the blocklist as it is "right now", not as it was before anybody identified this spam.

Can it be done, or do I need to know more about how the blocklist works??

tx

R

Share this post


Link to post
Share on other sites

Yes, you need to take a look at What is the SpamCop Blocking List (SCBL)? An IP address doesn't get listed (or remain listed) just because "someone" worked through a report action. Once upon a time the trip-point was 2% (spam to total trafic) .. things have changed quite a bit, but .. do the math ... it takes "x" number of reports to get listed, based on the big (and not totally documentef) formula .. and if 'we' go with your scenario, there'd be no continuing flow of reports to keep the listing in place if the spew continued ... leading to the age-old question "why does this IP address continue to go on/off the BL?"

Share this post


Link to post
Share on other sites

When I finally read my copy... the odds are, somebody else has already blocklisted the sender. 

38968[/snapback]

What makes the SCBL so effective is that while a spammer tries to send millions of spam over 3 or 4 hours the SCBL can have the sending IP blocked in seconds and then bit bit the spammers spew. The SCBL acts like a radar blocking as soon as a spammer tries to send, then freeing that IP when the spam stops being reported

A problem of using SpamCop members SCBL to only bit bin spam is that, this spam goes unreported and come off the SCBL . It is best to always have blocklists sort probable spam to a "sorting" folder for releasing whitelisting and or reporting.Reporting blocked spam via Spamcop keeps the offending IP on the worlds best blocklist the SCBL

The only spam Free email account that I know of that complies with this (and more) is a SpamCop Email Account which will give you the only email address you will ever need

Edited by petzl

Share this post


Link to post
Share on other sites
When I finally read my copy... the odds are, somebody else has already blocklisted the sender. 

It'd be nice if I can take advantage of the fact, instead of repeating that report (me and the other 998 readers).  I.e. apply a filter to my inbox to reapply the blocklist as it is "right now", not as it was before anybody identified this spam.

Can it be done, or do I need to know more about how the blocklist works??

38968[/snapback]

Others have answered the specific point. Please keep on reporting. The first report alone will not cause the IP address to be listed. The 998 other reports plus yours will not only ensure the listing is made but keep the IP on the list for a lot longer than if just a dozen people report and the rest don't bother.

Andrew

Share this post


Link to post
Share on other sites

Doing work for the cause sounds right. But we still need to look at common sense...

If it's a "good thing" that items are refreshed on the list just because it was 2 days before I read the mail... why not simply extend the blocklisting by 2 days?

If I understand, the ISP no longer receives any notice of each complaint. If we are just constructing a gerbil spinwheel to keep ourselves busy, what's the point of that?

Share this post


Link to post
Share on other sites
If it's a "good thing" that items are refreshed on the list just because it was 2 days before I read the mail... why not simply extend the blocklisting by 2 days?

unknown where you picked up this concept or possibly what you really meant.

If I understand, the ISP no longer receives any notice of each complaint.  If we are just constructing a gerbil spinwheel to keep ourselves busy, what's the point of that?

39001[/snapback]

I'm totally lost on this remark. If a parse results in a report target, if the reporter selcts that target and hits the Send button, reports are sent out. Perhaps you've been reading stuff about "Mole" reporting, but ...???? Once again, there has been a lot of work by a lot of people to build a FAQ here .... have you actually followed any of the SpamCop FAQ links provided "here" ?????

Share this post


Link to post
Share on other sites
If it's a "good thing" that items are refreshed on the list just because it was 2 days before I read the mail... why not simply extend the blocklisting by 2 days?

If I understand, the ISP no longer receives any notice of each complaint.

39001[/snapback]

I think you may have misunderstood or not fully grasped how the reporting process works or I am misunderstanding your explanation. :blink: Always possible.

I'd recommend a review of these pages...

http://www.spamcop.net/fom-serve/cache/3.html

http://www.spamcop.net/fom-serve/cache/89.html

http://www.spamcop.net/fom-serve/cache/297.html

Andrew

Share this post


Link to post
Share on other sites

Thanks for the links.

I have been a spamcop user/reporter for several years. But I've only dug into details a few times. Those times the answers have been in forums, often with the comment "the docs are a bit out of date".

I did read somewhere that due to list-washing and other black-hat use of spam reports they weren't being sent to ISPs any more. I gather I took that out of context, and my reports are going to the ISP?

---

I guess the smart thing to do would be to report to spamcop, but receive my mail at an ISP who uses the spamcop bl, several hours later. Then I'd actually get the benefit of the Held Mail filtering of other spamcop users!

-tx

Richard

Share this post


Link to post
Share on other sites
I guess the smart thing to do would be to report to spamcop, but receive my mail at an ISP who uses the spamcop bl, several hours later.  Then I'd actually get the benefit of the Held Mail filtering of other spamcop users!

;-)

Not unless they had a delay in delivering mail... There must be ISPs who delay filling the inbox by a bit to give spam reports a bit of time to come through?

That'd be cool: let everything on the whitelist thru right away, but hold the other stuff pending spam reports.

Still, the most responsible and efficient setup seems to me, let me use the blocklist somehow in my own filtering.

--R

Share this post


Link to post
Share on other sites

Well, if you were using POP to retrieve your email, and had filters at your mail client, they wouldn't be applied until you retrieved your email, rather than when it was delivered to your mail server. This would essentially accomplish your "delayed filtering" that you are looking for.

Share this post


Link to post
Share on other sites
Well, if you were using POP to retrieve your email, and had filters at your mail client, they wouldn't be applied until you retrieved your email, rather than when it was delivered to your mail server. This would essentially accomplish your "delayed filtering" that you are looking for.

39102[/snapback]

That's interesting... is there a way to do that with a lot of work... get the spamcop blocklist myself apply it to my mail client inbox?

tx

Richard

Share this post


Link to post
Share on other sites
That's interesting... is there a way to do that with a lot of work... get the spamcop blocklist myself apply it to my mail client inbox?

39131[/snapback]

The repeated references/suggestions to take a look at the FAQ are getting old ... there's a link between Frequently Asked Questions and FAQ .... to answer this last question, take a look at How can I use the blocklist without a mailserver?

To answer a whole lot of questions, please follow the Start Here - before you make your first Post link of the 'front' page of the Forum.

Share this post


Link to post
Share on other sites

Another idea...

I have a couple of POP3 servers that forward email to spamcop.

Now if I cancel that forwarding, and instead configure horde mail to go get it.

Options | Tools : "Enter the POP server you would like checked"

Then in effect the block list is applied... when I log in? Or when, how often?

That'd be great, but not sure if the timing would be much different.

-R

Share this post


Link to post
Share on other sites
the block list is applied... when I log in?  Or when, how often?

39990[/snapback]

It appears that the SpamCop Email System's "Blacklist Filters" specified on https://webmail.spamcop.net/horde/imp/spamcop/blacklists.php or http://webmail.spamcop.net/horde/imp/spamcop/blacklists.php are all applied to each message individually by the blade servers as the message is on its way from the System's inbound mailservers or mailgate to your mailboxes (and possibly on to your "Forwarding Address"). The System's "Filter Rules" are not applied until you login, at the very earliest - see the "Filter Options" on https://webmail.spamcop.net/horde/imp/filterprefs.php or http://webmail.spamcop.net/horde/imp/filterprefs.php for finer details.

Changing the mechanics of email message movement from (having your old ISP forward to your SpamCop Email System email address) to (having the SpamCop Email System POP from your old ISP's POP server) would introduce a delay of up to about 15 minutes per email message, so I don't recommend it.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×