Jump to content
Sign in to follow this  
smyers

Username in emails not removed for munged reports

Recommended Posts

I have noticed more and more lately that my username is included in the subject line and/or the message body of spam emails. SpamCop reports still include this information even for munged reports (the only kind I send). So, that along with the domain of my ISP which is left in the report gives the spammer confirmation that I received the spam.

Can't the system be modified to search for any instance of the username in the headers and the body so it can be removed for munged reports? I really appreciate the service that SpamCop offers but it seems like this is something important which has been overlooked.

Scott

Share this post


Link to post
Share on other sites
... Can't the system be modified to search for any instance of the username in the headers and the body so it can be removed for munged reports?  ...

39764[/snapback]

Hi Scott, this feature has been requested before, but evidently not given much support because the next "escalation" of any such tracking ploy by spammers is simply to encode your detail, because users can always switch to mole reporting (nothing sent to ISPs) and because there is (supposedly) no demonstrated/accepted correlation between even unmunged reporting and increased spam exposure. A slightly different request finally got down to tin tacks at about http://forum.spamcop.net/forums/index.php?...indpost&p=36740

and there have been many others. FWIW I agree with you, no harm and much logic in spamCop "lifting the bar" at least to the extent of munging whatever identification can be clearly "seen" - as part of the offer to munge.

Share this post


Link to post
Share on other sites
Hi Scott, this feature has been requested before

Hi, Farelf.

I searched for this and it looked like the latest it was mentioned was 2004. That's why I mentioned it again. I'm wondering more and more if it's worth my time to sit at the computer and tag 30 or more emails a day in MailWasher for SpamCop reporting, then spend the time finalizing sending the reports at SpamCop. I still get about as many spam emails now as I've ever gotten per day. I've been reporting spam with SpamCop for a few years.

Do any of the reporting methods really help? I used to think reporting helped but I'm not so sure anymore. I want to do my part and pitch in but it's getting VERY monotonous. I'm sure you know what I'm talking about. It's one thing to be put on a blacklist but that does not stop spammers. An email I sent to myself showed up as blacklisted once when I had reinstalled MailWasher and started from scratch without the "friends" list. I'm still trying to figure out why my own email to myself showed up as blacklisted by the SpamCop list. It was there for one email, then didn't happen again for a test just a few minutes later.

I'm just wondering if I should continue reporting. If someone can show me that it's helping, I will certainly continue.

Best regards,

Scott

Share this post


Link to post
Share on other sites

Scott, you're not going to see much/any difference in your own "spam experience" unless you use the SCBL to filter your own inwards mail but you will be feeding the SCBL for those that do and you will be part of the "making life more difficult" for the spammers generally, keeping them moving, evolving and vulnerable to detection, shut down, prosecution. There are more streamlined ways of reporting which, hopefully, those who use it in a similar set-up to yours might chip in and comment on. Bottom line, report (by whatever means) as much as you're comfortable with because it all helps. I've reduced my own reporting load greatly because it was getting too much. But I haven't given in on it.

Edited by Farelf

Share this post


Link to post
Share on other sites
Scott, you're not going to see much/any difference in your own "spam experience" unless you use the SCBL to filter your own inwards mail

I understand. I use the blacklists but as I said, my own email to myself was blacklisted for some strange reason at least once. I only discovered that because I had reinstalled MailWasher and had not reconstructed the "friends" list yet. Once an address is added to the "friends" list, the blacklist notice is replaced by "Friend." I can't trust the blacklists alone to block spam and not block wanted email. Other "friends" have shown to be blacklisted, too. I've been concerned that my emails have been blocked between me and the people I send email to because of improperly set filters. It's a horrible problem.

So, I use the blacklists but I also give a cursory look at all incoming emails with MailWasher to see which are wanted and which are spam. That takes a lot of time. That's my complaint. I'll probably keep on doing it because it's the "only way" but that doesn't mean I like it. :-(

Thanks for the encouragement. I'm not a quitter but things like this get terribly frustrating as I'm sure you well know.

Share this post


Link to post
Share on other sites
I'm just wondering if I should continue reporting.  If someone can show me that it's helping, I will certainly continue.

39771[/snapback]

Hi Scott!

This is an oft requested piece of information. Inevitably it can only be answered anecdotally.

I can say without question that as a result of the various spam filtering options I have employed I get virtually no spam into my mailbox. I do get hundreds of messages trapped each day by the filters used.

I typically report the largest batch (which arrives overnight) using the quick reporting options SpamCop provides. This takes less than a minute and removes the bulk. Later in the day I might report more fully for the few messages that come every now and then so this isn't too demanding.

So if you find reporting one-by-one tedious opt for a quick reporting method and it will all go much more quickly.

But whatever you decide, I thank you for reporting since it contributes to the effective spam filtering I'm able to employ.

Andrew

Share this post


Link to post
Share on other sites
But whatever you decide, I thank you for reporting since it contributes to the effective spam filtering I'm able to employ.

39785[/snapback]

Thanks for giving me a boost, Andrew. It's doubtful that I'll ever stop reporting spam but it takes so much time. I'm using MailWasher to handle the initial examination with blacklists and my own eyes looking at a preview quickly as I click the SpamCop box for each spam. That's fine and doesn't take all that much time but it still takes time. Then, I have to finalize the reporting for each one at SpamCop. That takes a lot of time. It isn't as automated as I'd like it to be.

Scott

Share this post


Link to post
Share on other sites

This is an explanation of 'Quick Reporting' that Andrew mentioned.

Please see the WARNING below about the danger of such speed.

Emphasis: ONLY the spam source is reported. Nothing in the body of the spam is even looked at by the parsing engine.

Quick Reporting is a feature of the SpamCop Parsing and Reporting System which is available to free reporters, paid reporting only accounts, and SpamCop email service customers. SpamCop will automatically report several spam without any further action on your part and then send you an email about what it did. The SpamCop return email containing the record of what was reported cannot be turned off.

A condition of enabling Quick Reporting is that the user has to run the Mailhost configuration utility first so that SpamCop can create a list of the services that handle his email so that the SpamCop system will know what servers to trust when he reports his spam.

Free Reporting & Paid Reporting only accounts

If you are authorized to do so, forward to your confidential quick.16charANcodeNMBR[at]spam.spamcop.net address (your Confidential Quick Address, where "quick" is substituted for "submit") just as you submit spam by email.

Such forwarding is subject to the same restrictions as forwarding to your Confidential Submit Address - attachments are best, limit 50KBytes per message, and limit 100 attached messages per message.

PLEASE also review your "SpamCop Quick Reporting data" email messages to ensure that your Reports are not going to the wrong places.

Anyone wanting Quick Reporting enabled should send their login username (email address they registered for an account with SpamCop) to service [at] admin.spamcop.net.

Miss Betsy

Share this post


Link to post
Share on other sites

Of course, one could ask if that last was from the FAQ, the Glossary, the Dictonary, the SCKB, or is something that needs to be posted somewhere else as a new entry <g>

Share this post


Link to post
Share on other sites
This is an explanation of 'Quick Reporting' that Andrew mentioned.

Thanks, Miss Betsy. I did not know there was such as thing as quick reporting available here. When that was mentioned earlier, I didn't understand what it was. In my recent browsing of the SpamCop help pages, I did not see any mention of this.

I'll try it and see how I like it. Anything to speed up reporting for me will be a great help.

Scott

Share this post


Link to post
Share on other sites
Thanks, Miss Betsy.  I did not know there was such as thing as quick reporting available here.  When that was mentioned earlier, I didn't understand what it was.  In my recent browsing of the SpamCop help pages, I did not see any mention of this.

40223[/snapback]

This has come up several times in just the last couple of days. I tried to solve part of the issue with the Start Here ... link on the Front page .... which takes on to the listing of various resources showing on What is SpamCop? .... The links provided at the top of these Forum pages .... SpamCop FAQ and even the cryptic SCKB take one to items developed because of the years of complaints about the FAQ list available on the www.spamcop.net pages.

Share this post


Link to post
Share on other sites
This has come up several times in just the last couple of days.  I tried to solve part of the issue with the Start Here ... link on the Front page

Sure, I understand. When I started this topic, I was asking about something else and had no idea that there was anything such as quick reporting to even know to search for it. I did search for posts about munged reports and the last thing I found was from a year or two ago. Now that I know there are things in the forum FAQs which are not in the SpamCop FAQs, I'll take a look at the ones in the forum to see what I've been missing.

I've been using the quick reporting for a couple of days and I like it. I frees me from having to sit at the computer for such a long time finishing the reporting at the SpamCop site. From the looks of it, it's just as effective as "normal" reporting and takes much less time. Of course, I do take a look at each email in MailWasher before I submit it so that I know it's not from someone trusted.

Thanks to all of you for the help.

Scott

Share this post


Link to post
Share on other sites
<snip>

I've been using the quick reporting for a couple of days and I like it.  I frees me from having to sit at the computer for such a long time finishing the reporting at the SpamCop site.  From the looks of it, it's just as effective as "normal" reporting and takes much less time.  Of course, I do take a look at each email in MailWasher before I submit it so that I know it's not from someone trusted.

<snip>

40283[/snapback]

Hi, Scott!

...Glad the replies were able to help you.

...Something else to check is that SpamCop is not sending reports to your own ISP or MSP (e-Mail Service Provider). This can happen if your provider changes or adds outgoing mail servers.

Share this post


Link to post
Share on other sites
Hi, Scott!

...Glad the replies were able to help you.

...Something else to check is that SpamCop is not sending reports to your own ISP or MSP (e-Mail Service Provider). This can happen if your provider changes or adds outgoing mail servers.

40402[/snapback]

I haven't seen any reports going back to my own provider(s) that didn't seem to need to go there (the spammer was on the same ISP and was not identified as coming from my address, in other words).

I have seen some emails which show "ORCPT xxx[at]xxx.com" where xxx[at]xxx.com indicates an account that I forward to the one I actually use and report from. After some brief tests, it looked like this meant the original email was addressed to the forwarded account and was then sent through to my main account. It also appeared that the ISP of the forwarded account was only being notified of spam if the real sender was from the same ISP (and was not being reported as spam for merely being forwarded).

Without getting specific with real addresses here in the open, does that sound like the way it should work?

Scott

Share this post


Link to post
Share on other sites
Without getting specific with real addresses here in the open, does that sound like the way it should work?

40443[/snapback]

Yes, it does, thanks!

Share this post


Link to post
Share on other sites
I haven't seen any reports going back to my own provider(s) that didn't seem to need to go there (the spammer was on the same ISP and was not identified as coming from my address, in other words).

<snip>

40443[/snapback]

...That's a good thing! Just be aware that a change can happen "overnight" that can result in the SpamCop parser incorrectly identifying your ISP as the spam source. I went for many months of smooth reporting before this happened to me. And such an experience has happened to me twice!

Share this post


Link to post
Share on other sites
...Just be aware that a change can happen "overnight" that can result in the SpamCop parser incorrectly identifying your ISP as the spam source.

40463[/snapback]

Thanks, Jeff and Steve. Understood.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×