Reporting spam on a Mac

[rconner]

I use Pocketknife Peek to view Outlook mail headers, text and HTML (seperately) without opening.

I started using this app as well on my work computer (maybe you or someone else gave me a pointer here). Much more convenient to use with SpamCop web reporting than trying to get at all the little bits via Outlook. It does not seem to tackle kindly to message bodies in some character sets -- today I had to report a very rare KOI-8 encoded Cyrillic spam in my work inbox, and I had to go back to Standard (Microsoft) Operating Procedure to deal with it.

Also, Peek doesn't deal well with the massive munging that Outlook/Exchange inflicts on the raw SMTP packet. I wish Outlook/Exchange would not clobber these messages, but what I wish doesn't figure into MS's strategic plans. Fortunately, SpamCop seems to be able to cobble the message back together in some fashion.

Bringing the discussion back to Macs, I am now at home and have done some poking around on my PowerBook.

1. I did not have an "official" Junk Folder in Apple Mail.
   
2. I changed my preferences to have junk mail moved to the "junk folder;" this created the official Junk Folder, and moved a handful of messages there (ones that Mail had flagged as junk).
   
3. I was not prevented from seeing embedded images or clicking on links in any of these.
   

I also found out that Apple Mail has a "bounce" feature that lets you "pretend-bounce" messages back to the sender. I tried bouncing one from myself to myself (at different addresses), and got what looks at a glance like a genuine DSN. However, when I tested the message in the SC parser, I found that the header was botched and listed my own DSL pool address as the source. It looked like a direct-to-MX trick.

The Apple Mail Help for this feature seems to be a bit behind the times:

Many unsolicited ("spam") messages do not have valid return addresses, and cannot be bounced back to the original sender. If you try to bounce a message that has an invalid return address, it is returned to you as undeliverable.

No mention of the fact that from-addresses in spam are sometimes NOT invalid, and bouncing to them can result in bombarding some innocent dope with unwanted mail. Plus, if the recipient reports this to SpamCop, it would be a black mark against the sender's own IP. I'd warn folks to use this feature very sparingly or not at all. It will certainly not deter hardcore spammers in the least.

-- rick

[Rapakiwi]

<SNIP, SNIP>

Bringing the discussion back to Macs, I am now at home and have done some poking around on my PowerBook.

1. I did not have an "official" Junk Folder in Apple Mail.
   
2. I changed my preferences to have junk mail moved to the "junk folder;" this created the official Junk Folder, and moved a handful of messages there (ones that Mail had flagged as junk).
   
3. I was not prevented from seeing embedded images or clicking on links in any of these.
   

0. In Mail preferences, I enabled the junk filter and chose to exempt those in my address book, exempt previous recipients, but trust my ISP's spam filter to override these choices. Then I chose to keep junk in the Inbox, for a while.

1. The Apple procedure, I believe, is to first put your friends in the address book. This is now your white list. Now all mail in the Inbox except mail from them will be tagged 'Junk': it will display embedded images native to HTML, but not remote images (web bugs). Other safely restrictions apply to letters tagged junk, as discussed elsewhere. 1.1 You may wish to add whether letters have attachments or not to your list window.

2. If you mail someone, that address will be added to your white list.

3. If a letter you are reading is not junk, you can add it to your white list in two ways. You can always place (above the dates) a little icon to add that address to your address book. This will always work, and is the only way for POP servers; but it is not terribly tidy. On IMAP servers, just clicking the letter 'not junk' (button on the letter) should add this to the server's duplicate white list, when Apple Mail synchronizes. Because I never really understood this, I just mark the letter as 'not junk', then resort to the address book icon if this doesn't work.

4. The 'not junk' button doesn't load images, for you may be using a modem on an IMAP server. Click 'load images' to download them from your server.

5. After you find yourself not doing the above anymore, you can create a Junk Folder. I empty mine daily.

6. After your junk folder is really accurate, you may wish to positively identify and classify your spam. When you set up such a filter, you can have an AppleScript process any mail that satisfies it. For example, mail with 'Viagra' in the subject line can automatically be whisked away to SpamCop the moment you receive it, or to 'rx[at]coldrain.net', at KunjOn, using a slight modification of the scri_pt you suggested earlier. Tuning this with time would eliminate all spam but the questionable. Check Mail Help for 'automation'.

7. You can place the icon for 'View Long Headers' above the date column. This can help identify mystery messages as spam without opening it, if (like me) you're all too familiar with the ip addresses of your favorite spammers.

-----------------

8. You can ask that any IMAP server not send you images until you request them. Good if you have a modem and your friends insist on mailing you movies. Also good for avoiding web bugs.

I also found out that Apple Mail has a "bounce" feature that lets you "pretend-bounce" messages back to the sender.

-- rick

Silence is golden. :-) You can also set your firewall to not respond to pings.

Rapakiwi

PS. People on my tiny, friendly ISP are getting phish from Denmark requesting their usernames & passwords. I was threatened in one spam letter.

[StevenUnderwood]

Today my wife received an unsolicited letter advertising

For me, that is as far as you need to go... this is Unsolicited and Commercial (UCE). It is spam.

Now, how you want to handle this spam takes more information. You may want to ignore it, send a letter back to the company, SPamCop report, or some of the more intensive reporting.

[Rapakiwi]

For me, that is as far as you need to go... this is Unsolicited and Commercial (UCE). It is spam.

Sorry, the post wasn't well written. My wife belongs to some business associations. It wasn't until after reading the content of the letter - noting the wrong street, missing city, and 'web bugs' - that I inferred its sole purpose was deceptive: to check the validity of an email address acquired by bot or CD. Hence I inferred it was unsolicited.

The complete envelope was correct: the from line was the correct sender, clearly registered as an electronic advertising agency. So, that alone didn't help.

The point, I suppose, was that some mail needs a close reading to be recognized as spam. It needs to be opened. (I just trashed this one, opened in the Junk folder, since this was the first she has ever received.)

Rapakiwi