cannot parse header

[fashon]

As for "material changes to spam," making these changes seems to be the only way SpamCop can parse the spam I report. If this is not acceptable, I will have to consider not reporting my spam as it would not seem to be doing any good; I get no direct value reporting as a mole.

A much higher percentage of my spam now contains a "fixed" subject line to mess up SpamCop parsing. The subject line is altered to include a line break in front of, and a varying number of unprintable characters after "Subject:" I will continue to report the spam to SpamCop after deleting the spurious characters unless and until I am told to stop.

[turetzsr]

As for "material changes to spam," making these changes seems to be the only way SpamCop can parse the spam I report. If this is not acceptable, I will have to consider not reporting my spam as it would not seem to be doing any good; I get no direct value reporting as a mole.

...Did you ask the SpamCop Deputies (deputies[at]admin.spamcop.net) as to whether your edits are acceptable? Only they can tell you authoritatively whether what you are doing is appropriate.

<snip>

I will continue to report the spam to SpamCop after deleting the spurious characters unless and until I am told to stop.

...As I understand it, you have it reversed: the SpamCop admins/deputies are under no obligation to tell you to stop before suspending your reporting privileges. For what it's worth, if I were you, I would stop reporting the spam with these odd characters through SpamCop (although I might report them manually, using the abuse addresses found by the parser with the edited spam, after Canceling the reports).

[rconner]

As for "material changes to spam," making these changes seems to be the only way SpamCop can parse the spam I report. If this is not acceptable, I will have to consider not reporting my spam as it would not seem to be doing any good; I get no direct value reporting as a mole.

In the examples I posted above, SpamCop is able to find the mail sources and appears to file reports on them. It does not find the website link in the body, and perhaps this is due to the mangling of the header line, but in any case I suspect that SpamCop wouldn't have bothered with these links even if the header were clean.

If you also are seeing that SpamCop finds the mail sources for your spam despite the head defect, then I think you can continue to report them without de-munging the header.

-- rick

[Farelf]

As for "material changes to spam," making these changes seems to be the only way SpamCop can parse the spam I report. If this is not acceptable, I will have to consider not reporting my spam as it would not seem to be doing any good; I get no direct value reporting as a mole. ...

Well, these "tricks" usually run their course and fade into obscurity (until "next time") which sort of makes it seem they're not actually aimed at SC (or any other) parsing - just more inadvertent, cluelss, unfathomable spammer behavior. But don't rely on SC staff seeing your post here - you should email the Deputies if you want approval to continue.

A much higher percentage of my spam now contains a "fixed" subject line to mess up SpamCop parsing. The subject line is altered to include a line break in front of, and a varying number of unprintable characters after "Subject:" I will continue to report the spam to SpamCop after deleting the spurious characters unless and until I am told to stop.

You should send manual reports, going by the book. Okay, you're a mole, you don't send reports. Personal observation - I haven't noticed any particular increase in nasties hitting my mail since I changed over from mole to straight reporting. I have to admit my provider is now filtering like mad (inwards and outwards, and discarding without notice, the clueless twits). But they weren't always, certainly not when I made the change or for a year or so after so I think my observation is valid. Others have tales of woe to gainsay this - but I think most such comments are made on experience over a very short time-base, probable cause is just random variation and coincidence.

[Miss Betsy]

The 'material' changes that spamcop will not allow under any circumstances are changes to the headers that might change where the source is. Obviously for spamcop's credibility, the headers of spam that is reported has to be exactly as it was received. That goes also for spamvertized links. Some ISPs and hosts take spamcop reports seriously and spamcop does not ever want to be responsible for a cancellation based on a faulty spamcop report.

If you want to take the chance, you could keep reporting them since your changes (which IIUC are in the subject line only and therefore are not crucial to finding the source) are not likely to be detected by spamcop.

I think that it is very unlikely that anyone will either tell you to stop or that it is all right to continue if I am correct that that kind of change is not crucial to the parsing process. For years, people have been adding 'no body present' to spam that is sent with no body and IIRC, even changing the Content type line when that screws up parsing and there has yet to be an 'official' word on whether that is allowed material change or not. OTOH, if it is crucial, a deputy will probably contribute to this topic and tell you that you can't. They don't post often, but they should be looking for posts such as this.

Or, as was suggested, simply wait until this spammer figures out how to work his program so the subject line is not screwed up. Eventually, there will be some filter that filters on those pesky characters so even if the spammer is doing it on purpose, it will no longer be effective and he will no longer use it.

If you are reporting as a mole, it doesn't give direct value to anyone as your reports are only used for statistics.

Miss Betsy

[fashon]

It should be obvious from my posts that I am pretty green.

In reading the FAQ on SpamCop Parsing and Reporting Service, I saw that filing reports directly would frequently result in my address being deleted from the spammers list, which would be "good for the person filing the complaint, but it is bad for spam defense in general..." I inferred from this and other statements in the FAQ file that mole reporting was a good thing.

Now I have read the explanation of mole reporting under Preferences: spam Munging and find that it may only be a second or third best way of reporting.

This may be moot as I have always selected "Send spam Report(s) Now" button, which may or may not actually result in a report being sent for someone who has selected mole reporting. In any case, I think I'll change to straight reporting and continue to delete the spurious characters when they appear in the subject line.