Jump to content

Are Country blacklists working?


Keithj

Recommended Posts

For the last few months, I've been getting occasional Chinese spams forwarded to me from Spamcop (anything from none to ten a day). I have "China the country" listed in my blacklist. When I then report the spams individually. the offending ISP is always in China.

I asked a couple of weeks ago on news.spamcop.net and got told forcefully to look on here because there was a pinned message explaining it. I'm still getting Chinese spam - and I can't see a pinned message about it.

Am I doing something wrong, or is the Country filter no longer working?

An answer that doesn't tell me I'm a blithering idiot would be much appreciated versus...

Link to comment
Share on other sites

I asked a couple of weeks ago on news.spamcop.net and got told forcefully to look on here because there was a pinned message explaining it.

Hold on a minute .... first of all, you posted into the spamcop.help newsgroup ...

First post identified;

From: Keith Jillings <keithj[at]spamcop.net>

Newsgroups: spamcop.help

Subject: Spamcop ignoring settings?

No reply, but of course, that post was so out of place, so lacking in details ... won't even go into that it was in the wrong newsgroup (that's yet another battle)

Then, we jump forward to;

From: Keith Jillings <keithj[at]spamcop.net>

Newsgroups: spamcop.help

Subject: Stock inflaters?

Date: Tue, 04 Oct 2005 01:27:59 +0100

At which a couple of replies talked to the comment "as posted above" explaining that in newsgroups, sortng is a personal (and application) preference, such that one user's "above" may be another user's "below" ...????

As to being "told forcefully" to come "here" .. well, let's also point out that you're not in the suggested Forum section to begin with ...

> You'd have found this data as a Pinned entry in the SpamCop

> E-Mail account Forum at

> http://forum.spamcop.net/forums/index.php?showtopic=5038

> in addition to the posts made in the spamcop newsgroup.  That

> it also counted as news elsewhere on 'the net' probably isn't

> important ...

Thanks for that link - I've not used the forums before - should I use

those rather than posting here?

Forcefully? Taking your "above" statement into account, previous newsgroup postings were also suggested .....

and I can't see a pinned message about it.

Am I doing something wrong, or is the Country filter no longer working?

Yet the link suggested "is" the Pinned item ... your reply almost had the ring that you actually looked at it ...????

An answer that doesn't tell me I'm a blithering idiot would be much appreciated versus...

34527[/snapback]

As I recall, you bad-mouthed folks here, you bad-mouthed folks in the newsgroups, apparently have not attempted to do some of the suggested further research in your own ....

I was curious about the likelyhood of having two kiethj users on this forum on the same day .... there was such a disparity on the registration dates, the IPs and e-mail addrsses involved, I tossed it off as purely coincidence .. now I see that both accounts are "you" ... showing that you've also ignored / failed to respond to an Announcement about the "display" of your e-mail address versus your "account name" ... haven't yet read the "Forum FAQ" that discusses multiple accounts ....

There was a thought of moving this to the more appropriate Forum section as it was dealing with the use of a SpamCop Filtered E-Mail Account ... However .... once this rant started .... I believe the Lounge "is" appropriate ...

While I'm still being in such an unhelpful mood, suggest you remove the following line from your web-page HTML;

<a>free hit counter</a>

It isn't a link and that it is vertically aligned behind other text is certainly distracting ....

Seeing as how you had the previous account (since Feb 04) deleted the account you generated earlier this month ...

Link to comment
Share on other sites

Yes, that's the kind of helpful answer I was afraid of getting.

My first post on this subject was in one of the two groups in news.spamcop.net. Given a choice between groups called "spamcop.mail" and "spamcop.help" I had to pick one. spamcop.help didn't sound so silly to me.

That first post was very polite, and received no response whatever. Nobody said "We need more information", which I would have understood. So I left it for a while and the spam carried right on flowing through Spamcop and to me.

The second request was polite - not badmouthing, just saying I hadn't had a response. I got a long and totally unhelpful diatribe from a couple of people, and a helpful and short one from another user. At the end, a user wrote "I'm sorry you got flamed, but there are posters that love to flame any posting." He was right.

Thanks for hitting me over the head with the advice about not using the Spamcop address as "account name". Unfortunately, I didn't get that advice until AFTER the account had been set up, which is why I then changed it - as you've no doubt seen since you've been fishing around in my details.

I note that despite that advice, you felt at liberty to publish my Spamcop address on here. Different rules?

I didn't bad-mouth anyone. I asked a civil question (twice), and got several aggressive answers that were no help. It was suggested that I should look in here. I did, and found a message that one of the lists was offline but would be back soon.

I'm STILL getting Chinese spam passing through my Spamcop account. Is there anyone at Spamcop who can help - anyone who knows the answer and can give it in a civil way?

Wazoo, if you have time to burrow in the archives for previous posts, and to fish around in my personal details on the system, surely you have time to be helpful rather than flame? It would be so much more use to the people (like me) who don't know all the answers and are looking for advice. Computers aren't my trade - they're a tool that I use as best I can, and I don't know all the stuff you do. So I don't do things the way you would.

I still don't have the answer to my question, which I asked twice on the newsgroup and once in here.

It's such a shame, really. I've had an account at Spamcop for many years and until now always been very happy with the service. I've recommended dozens of others to use Spamcop, and they've been very happy, too.

I'm sorry to have bothered you, and sorry to have invaded your personal fiefdom. I'll leave you in peace to flame other people. Bye.

Link to comment
Share on other sites

Yes, that's the kind of helpful answer I was afraid of getting.

What do you want? Lookat other Topics/Duscussion in here or the newsgroups. There's more to "your" situation that you've not related. A number of other folks have stated that their filtering works just fine.

My first post on this subject was in one of the two groups in news.spamcop.net.   Given a choice between groups called "spamcop.mail" and "spamcop.help" I had to pick one.  spamcop.help didn't sound so silly to me.

You say "one of two groups" .... odd, as news://news.spamcop.net actually hosts the followng newsgroups;

spamcop

spamcop.geeks

spamcop.help

spamcop.mail

spamcop.routing

spamcop.social

spamcop.spam

spamcop.test

and of courese the now un-useful;

control

control.cancel

And if your query is about something going on with a SpamCop E-mail account ... but that's yet another story ...

That first post was very polite, and received no response whatever.   Nobody said "We need more information", which I would have understood.   So I left it for a while and the spam carried right on flowing through Spamcop and to me. 

Which I already noted ... no data, in the "wrong" newsgroup ...

The second request was polite - not badmouthing, just saying I hadn't had a response.   I got a long and totally unhelpful diatribe from a couple of people, and a helpful and short one from another user.  At the end, a user wrote "I'm sorry you got flamed, but there are posters that love to flame any posting."   He was right.

I was one of those respondants (again, see the previous post here or re-read the newsgroup thread) .. your badmouthing came later (and I'll point out, also in a couple of PMs to me) ...

Thanks for hitting me over the head with the advice about not using the Spamcop address as "account name".  Unfortunately, I didn't get that advice until AFTER the account had been set up, which is why I then changed it - as you've no doubt seen since you've been fishing around in my details.

I wasn't aware that users could change their names here ... guess I need to fo re-write the Forum FAQ to make note of this recent change. (maybe you're talking about another account elsewhere?) .. stated in the FAQs that you seem so desparate not to read, there is no linkage of the user database 'here' to any other section of SpamCop.net. The FAQs here are available without logging in .. and once again, the fact that you had already generated an account ages ago without using that e-mail address doesn't quite explain the action of generating a second account using other data ...

I note that despite that advice, you felt at liberty to publish my Spamcop address on here.   Different rules?

???? your address mentioned was "in the clear" ... I made a modification in this application to mung posted addresses ... no change in rules .. once again, read the annuncement, the FAQ, other posts, on and on with the repeated suggestion ....

I didn't bad-mouth anyone.   I asked a civil question (twice), and got several aggressive answers that were no help.   It was suggested that I should look in here.  I did, and found a message that one of the lists was offline but would be back soon.

Let me repeat, yes you did ... I even re-read your PMs to make sure I was in fact replying to the same person ... as a matter of fact, I'll suggest you re-read my second PM replying to you .. I had pointed out that I went to the extent of asking for more input from other users based on your remarks ....

If you had checked, you'd have noted that the referenced link to the "off-line" status of a site had been updated with the data that this "external" resource (not a SpamCop.net asset) was "mostly" / "kind of" back on-line .. but once again, it appears that following suggested pointers to data in response to your query is ...??? too much work, perhaps?

I'm STILL getting Chinese spam passing through my Spamcop account.   Is there anyone at Spamcop who can help - anyone who knows the answer and can give it in a civil way?

Please start with following the link that you stepped over getting "here" ... Start Here .. Before you post Then specifically follow those instructions in red letters ... Then check out the SpamCop FAQ link (at the top of this page) and check out the various FAQ entries on filters under the E-Mail Account section ... then try to ask something a bit more specific after picking up what you can from all that research, such that there just might be a way for someone to "guess" at what's going on with "your" account (configuration?)

And, after doing a bt of reading and research, you should have accidentally stumbled across the concept that there's nothing quite like a Tracking URL of a spam item to get to the bottom of that specific ....

Wazoo, if you have time to burrow in the archives for previous posts, and to fish around in my personal details on the system, surely you have time to be helpful rather than flame?   It would be so much more use to the people (like me) who don't know all the answers and are looking for advice.   Computers aren't my trade - they're a tool that I use as best I can, and I don't know all the stuff you do.   So I don't do things the way you would.

I am sitting in the Admin position of this Forum .. you noted that in your PMs ... I replied to you both here and in the newsgroups as part of my daily routine of doing that SpamCop.net support thing. Your characterization of "stalking" you is simply rediculous. You've thus far ignored suggestions, ignored things deliberatley placed in your way that were put there to offer help without havng to "deal with people like me" .. you violated some 'rules' I put in place here ... oh, and did I mention the badmouthing of the folks that did try to help ....

I still don't have the answer to my question, which I asked twice on the newsgroup and once in here.  

It's such a shame, really.   I've had an account at Spamcop for many years and until now always been very happy with the service.  I've recommended dozens of others to use Spamcop, and they've been very happy, too.

I'm sorry to have bothered you, and sorry to have invaded your personal fiefdom.   I'll leave you in peace to flame other people.  Bye.

34917[/snapback]

Take your flame thoughts, your expressed attitude, and please try to apply all that energy once again to take the time to follow up on "all" of the offered suggestions and pointers .. you had valid data presented to you in both venues, and yet ... once again, no data, no specifics, no examples, .. oh, and did I mention badmouthing?

Link to comment
Share on other sites

You say "one of two groups" .... odd, as news://news.spamcop.net actually hosts the followng newsgroups;

spamcop

spamcop.geeks

spamcop.help

spamcop.mail

spamcop.routing

spamcop.social

spamcop.spam

spamcop.test

and of courese the now un-useful;

control

control.cancel

Not in Europe it doesn't, I'm afraid. My ISP offers a choice of two:

spamcopnews.jpg

But never mind.

Link to comment
Share on other sites

Not in Europe it doesn't, I'm afraid.  My ISP offers a choice of two:

spamcopnews.jpg

But never mind.

34947[/snapback]

Perhaps, you have only subscribed to the two of them. As Wazoo stated, you are pulling that information directly from the server so your ISP is not involved.

Link to comment
Share on other sites

Not in Europe it doesn't, I'm afraid.  My ISP offers a choice of two

34947[/snapback]

Unless your ISP has implemented draconian NNTP filters, that's your NNTP client software only showing you the two newsgroups you've subscribed to - please try asking it to subscribe to more. If you tell us what NNTP client software, we might even be able to tell you how to do that.

Also, if you're in Europe, why does your profile Keithj say that your local time is 12:50 PM, as if you were in the Central United States (specifically, CDT or EST -0500)?

Link to comment
Share on other sites

Also, if you're in Europe, why does your profile Keithj say that your local time is 12:50 PM, as if you were in the Central United States (specifically, CDT or EST -0500)?

34961[/snapback]

I have no idea. I set up my spamcop account many years ago, and don't recall it asking me what time zone I'm in. I just looked at "Profile" and didn't see anything in there about time zone or how to change it.

Link to comment
Share on other sites

I have no idea.  I set up my spamcop account many years ago, and don't recall it asking me what time zone I'm in.  I just looked at "Profile" and didn't see anything in there about time zone or how to change it.

35001[/snapback]

...Man, it is hard to find! I had to do some digging but:
  1. Go to your profile page
  2. Click the link labeled "Edit my Profile" (it's near the bottom, the right-most of three hyperlinks)
  3. Click the link labeled "Board Settings" (it's in the left-hand menu under "Options"
  4. The timezone setting is the first entry under "Welcome to your control panel"

Link to comment
Share on other sites

I have no idea.   I set up my spamcop account many years ago, and don't recall it asking me what time zone I'm in.   I just looked at "Profile" and didn't see anything in there about time zone or how to change it.

35001[/snapback]

This Forum hasn't been around for that long. The original "sipport" thing was using AnyBoard, but that was dropped "years ago" and switched over to use NNTP newsgroups to handle interaction between Julian and SpamCop.net users ... yet again, there is no sharing of user data between this Forum, SpamCop.net Reporting accounts, or SpamCop.net E-Mail accounts.

  1. Go to your profile page
  2. Click the link labeled "Edit my Profile" (it's near the bottom, the right-most of three hyperlinks)
  3. Click the link labeled "Board Settings" (it's in the left-hand menu under "Options"
  4. The timezone setting is the first entry under "Welcome to your control panel"

Thanks, I'll add this to the "8-page document that is too big to read and doesn't help anyone at all!"

Oops! It is already there ... http://forum.spamcop.net/forums/index.php?...indpost&p=29126 ...

4d: Forum Settings & Options:

Q. Were can I change my Time Zone?

A. My Controls > Board Settings

Link to comment
Share on other sites

And yet still no tracking URL.  Talk about thick.

35020[/snapback]

What a helpful post.

What's a tracking URL? You'll have to excuse me - I'm just an ordinary person, not a computer expert.

Yes, I'm thick when it comes to computers. Those who aren't, tend not to be very helpful, I'm afraid.

Link to comment
Share on other sites

For only what seems to be the millionth time .. try reading some of the FAQ data that a fair number of folks spent a lot of their own (apparently wasted) time on making information available to all, even "ordinary" people ... As I pointed out in a previous post here, I was going to add that "new" data posted about setting "your" time zone, only to find that I had actually already had that data available in the thing called the Forum FAQ .... Tracking URL is defined in the SpamCop Glossary, which is also linked to from the Forum version of the SpamCop FAQ ... and I have pointed out a great starting page to you at least four times now, that has links to all kinds of good stuff ... this repeated pointer stuff is not needed ... do some reading .. then ask questions, provide data, do something different and surprise us with your next post ....

Link to comment
Share on other sites

<snip>

What's a tracking URL?

35055[/snapback]

...Please go to Announcement: [How-to] Post a Question and search for "Tracking." There's a hyperlink there that will take you to the SpamCop glossary entry that explains what a Tracking URL is.
You'll have to excuse me - I'm just an ordinary person, not a computer expert.

35055[/snapback]

...In this case, nothing to do with computer expertise -- it's terminology used within SpamCop.
Yes, I'm thick when it comes to computers.  Those who aren't, tend not to be very helpful, I'm afraid.

35055[/snapback]

...Sorry, I'm trying -- really. :) <g>
Link to comment
Share on other sites

Wow. Here are the most simple instructions I can give you. Scroll up to the top of this page you are looking at right now. Look for the link that says SpamCop FAQ, it's on the left side just above your logged in as name, click on it. This will take you to a new screen and show you the FAQ. In that FAQ is another link on how to find your tracking URL for a spam you have reported, just scroll down and search for it. BTW you can find a whole bunch of other useful information in that FAQ.

(We're all trying)

Link to comment
Share on other sites

Wow.  Here are the most simple instructions I can give you. 

Thanks! That helped a lot, and is appreciated. I've just spent 3 hard hours following that up and learning what some of this stuff means. I don' t know that I'm a whole lot wiser, but it helps. The article on "How To Ask Questions The Smart Way" was an eye-opener.

Sorry, Wazoo - I was working off a different "interpersonal relationships" model. I'm expected always to be totally polite, courteous, helpful, and sympathetic in what I do. The Internet seems to be a very different world - very much "shoot from the hip" with some inevitable collateral damage, unless you know what to expect. I do, now.

I still don't know why the Chinese spam is/was getting past the filters, but the next batch that comes, I'll post some tracking URLs in an appropriate place (I know what they are now).

Link to comment
Share on other sites

  • 1 month later...

Well, I'm still getting up to ten a day spams from China that go straight through Spamcop and to me. Most are from the well-known ISPs such as chinanet.cn.net and mail.online.sh.cn. I have .cn in my blacklist, and also chinanet.cn.net since it doesn't end .cn.

Here's a tracking URL from today.

http://www.spamcop.net/sc?id=z841219712z8e...d1b97655163d88z

What am I doing wrong that Spamcop isn't catching these?

Link to comment
Share on other sites

/snip

What am I doing wrong that Spamcop isn't catching these?

37822[/snapback]

...I get a lot of those myself, many are through hijacked servers...comcast, road runner, verizon..they all have in common web-advertized domains, chinamobile seems to be dominant these days, so blacklisting by country would obviously not work with such spam...Very few in fact come through China, Korean domains are more common for sending spam..

Link to comment
Share on other sites

Well, I'm still getting up to ten a day spams from China that go straight through Spamcop and to me.   Most are from the well-known ISPs such as chinanet.cn.net and mail.online.sh.cn.  I have .cn in my blacklist, and also chinanet.cn.net since it doesn't end .cn.

37822[/snapback]

The personal blacklist ONLY looks at the senders email address (in this case: From: "Braelym" <selana[at]id.ru>) which is why that filter is not catching them. There is another thread here in the Blocklist forum about some of the country lists not working. You should check those threads. Here is one of them: http://forum.spamcop.net/forums/index.php?showtopic=5176
Link to comment
Share on other sites

The personal blacklist ONLY looks at the senders email address (...

Thank you Steven, I was just about to say that myself, yet, I too am not yet clear how does one go about filtering by country IP. None of the blocking options in the webmail interface seem to be country based, cbl, sorbs, etc. am I correct in that assumption?

Link to comment
Share on other sites

Thank you Steven, I was just about to say that myself, yet, I too am not yet clear how does one go about filtering by country IP. None of the blocking options in the webmail interface seem to be country based, cbl, sorbs, etc. am I correct in that assumption?

37828[/snapback]

No, Options, SpamCop Tools, Select your email filtering blacklists. ( https://webmail.spamcop.net/horde/imp/spamcop/blacklists.php ) All of the DNS Blacklists at the bottom are IP based lists. There are reports that some are not working as well as they should however.

In the past 2 days, I have seen hits on:

(Blocked xbl.spamhaus.org)

(Blocked dnsbl.sorbs.net)

(Blocked bl.spamcop.net)

(Blocked SpamAssassin=x)

Most are stopped by the SpamAssassin rule since that is not applied first.

Edit: Jeff G. struck out "not" above.

Link to comment
Share on other sites

From that report, I see:

Tracking message source: 218.80.168.210:

Routing details for 218.80.168.210

Report routing for 218.80.168.210: ip-admin[at]mail.online.sh.cn

Message is 40 hours old

218.80.168.210 listed in dnsbl.njabl.org ( 127.0.0.9 )

218.80.168.210 listed in dnsbl.njabl.org ( 127.0.0.9 )

218.80.168.210 is an open proxy

218.80.168.210 not listed in accredit.habeas.com

218.80.168.210 not listed in plus.bondedsender.org

218.80.168.210 not listed in iadb.isipp.com

So it is listed on the DNS list, which I personally use to filter mail. Aside from that, I wasn't aware China had a BL. To be honest, I'd love nothing more than to block all Chinese and Korean IPs.. but that will likely never happen.

I've found that the only time I get mail that's BL'd into my inbox, is when I've whitelisted my email address and that's the address the spammer sent to.

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...