Jump to content


  • Posts

  • Joined

  • Last visited

Everything posted by mshalperin

  1. No, the filtered spam is deleted, not forwarded to your new email address. There will no longer be a "held" folder on spamcop.net.
  2. Which is why when a service is cancelled, prorated refunds are offered. The that there was no mention of any in the announcement indicates that refunds are not currently being considered. Refunds may not be possible if CESmail is bankrupt or assets seized, but do you really think they had no idea if plans to terminate service Saturday afternoon (when they were still accepting payments)?
  3. Hardly infinite, and none particularly charitable. It's really irrelevant whether Cisco or CESmail initiated the termination. The "take-the-money" quip was in response to others' speculating whether there would be refunds when they were accepting payments up to the day of the announcement, and made no mention of refunds. The fact remains that the Cisco "forwarding service" is dangerous unless there is access to the culled spam or the ability to disable filtering.
  4. The exquisitely uninformative wording as well as the Saturday night massacre timing of this announcement suggest that either it was a poorly thought out last minute decision or a take-the-money-and-run scam.
  5. It remains unclear what happens to the emails trapped by Cisco Reputation system. Are they forwarded in a separate folder? If not, and they are just deleted, that creates a major risk of losing legitimate mail.
  6. I got one of these today too: http://www.spamcop.net/sc?id=z1259829433z4...324ac6c48885ecz
  7. It's likely that there were reports of these sites from other users. The KnuJon reports only shows the number reported by you.
  8. I heard from Don who found a lookup problem with my Cold Rain address which led to bounces, though it's unclear why this happened only with mail sent from Spamcop. Also, coldrain.net has no MX record. He reset the bounce counter to allow Spamcop to sent mail again to that address. I've forwarded about 30 spam reports since then over the course of the day and there hasn't been any indication of bounces or the address being deactivated again, so it appears to be working now. Cold Rain Tech./KnuJon couldn't find any problem at their end, so I'll pass it off as a glitch that resolved itself...
  9. That's how I'm doing it now since SpamCop won't forward to my KnuJon address. I use SpamCop email service and do my Spamcop reporting via VER. I also import SpamCop mail via IMAP to my email client (Entourage) and and forward the spam to KnuJon as attatchemnts. This works well, though adds another step. I don't know if KnuJon has any use for SpamCop parsing/reporting results.
  10. I'm not sure why they switched to the personal copies route as this sends copies of every report generated by a spam (source, 3rd parties, each spamvertized site, etc.) whereas the public standard sends only 1 report per spam. It does free up space in the public standard slot to use for sending reports to other agencies. I forward all spam to KnuJon and let them sort it. Many have gif spamvertized sites that I don't have time to manually parse. Many others, such as stock bump and dump and fake diplomas, don't have spamvertized sites and KnuJon is interested them.
  11. I tried it there too and it was disabled as well. The "Personal Copies" box is now the preferred way per Knujon instructions.
  12. I entered my Knujon registered user forwarding address in the Personal Copy forwarding (Bcc) box in Spamcop preferences. After reporting a few spam, Spamcop disabled forwarding to this address citing: ******<at>coldrain.net bounces (8 sent : 8 bounces) ******<at>coldrain.net does not wish to receive mail. Bcc prohibited. Knujon technical support checked the address and found it to be working and I'm able to directly forward spam to it from my computer without bounces . Previously, I used "nonregistered<at> coldrain.net" as the forwarding address and hundreds of reports were sent from SpamCop without problems. I'm not clear how long the registered address stays disabled - does it get retested? How do I get it "enabled"?
  13. OK, I see what you mean. I've never posted my email addresses (in any format) in any public forum. If my addresses are in the "public domain", they were either stolen or sold from supposedly private listings. I always refuse permission to distribute them to "affiliated" 3rd parties. Anytime I publicly post a reference email address (not mine) on a public site, I write it with "<at>" instead of "[at]" to avoid automated harvesting.
  14. I'm not sure what you mean by "posting in bot readable format". The addresses you found were only given to ( apparently) legitimate businesses, forums, etc,, that I deal with and always given as confidential. For the last 6 months I have submitted SpamCop reports un-munged without any dramatic change in spam volume or sources. I have other addresses that I've kept private which haven't been spammed so far. My spam volume is still manageable, so I've left the "public" addresses active partly as my personal spam traps.
  15. Maybe, but last month when SpamAssassin was broken on some servers, I still didn't see anything picked off by the SCBL. A lot more were caught by various other BLs, but not SCBL. I don't know in what order they are applied - possibly the SCBL is last. All I can say is at that time I got large amounts of spam in my inbox and what did get held wasn't by the SCBL.
  16. Maybe that's it. I have all available BLs activated (reset all of them to be sure) and SpamAssassin threshold set to 2. i used to get at least some filtered by SCBL... Recently I've been getting more with geocities as the spamvertized site sent from probable bots, which often makes to to the inbox and is never filtered by any BL. Most of it is drug, phony loan, penny stock, Nigerian, porn, etc., with spamvertized sites form China, Korea Pacific Rim, Russia, Brazil, etc. spewed from botnets.
  17. For the last 3 or more months and >5000 filtered spams, I've seen absolutely zero spam filtered the SC BL in my Held folder. SPamAssassin filters 90-95%, but the remaining are caught by the other BLs. Even during the period last month when SpamAssassin was malfunctioning and far greater percentage was filtered by the BLs none was caught by the SpamCop BL. Has there been a change in the implementation of the SC BL in the SC webmail service? At this point, it would make no difference at all if I disabled the SC BL, leaving the others functioning.
  18. Thanks, I did find my address in my whitelist and deleted it - don't remember ever putting it there. In these cases the spammer is specifically inserting the "To" address into the return-path. I'm not seeing bounce-backs where my address is being used for a whole batch of spam and it seems to me it is a tactic to invoke whitelisting. Is there a distinction between "return-path" and "from"? - Is there any legitimate reason for there being different values for these?
  19. Recently I've been seeing multiple gif type spam in my inbox because it is "whitelisted", though the "From" address isn't on my whitelist. The header shows my cessmail address as the Return-Path which apparently gets it auto-whitelisted as if I sent the message to myself. I don't know enough about the header to understand how "return-path" gets to be different from the "From" entry, but this seems to be a very simple way to force whitelisting on this system http://www.spamcop.net/sc?id=z1153258077z9...ea1e8461a09da1z
  20. At the time it appeared to me that I didn't get the "logged on from 1800Specialoffers.com" message if I turned off an addware blocking feature of PopupDummy. On your advice I contacted the PopupDummy author who could see no connection. With more investigation, the association with PopupDummy settings was spurious - just random. There is no connection between 1800Specialoffers.com and PopupDummy or any other vendor.
  21. I originally started this thread in July 2004 because I would get a message from the SpamCop Webmail site that I had logged on from "1800Specialoffers.com." I got the same feedback from other sites as well. It turned out to be due to my assigned static IP address having this as its reverse DNS listing (but no forward DNS listing for 1800Specialoffers.com). Presumably, this entity once used this IP address and didn't get cleared out of the reverse DNS. DNSstuff.com had that IP address listed as on one or more spam BL's under that name as well. I got a new IP address and this issue was resolved.
  22. Hmmm, I wonder... My concern was that it was a new addition - I've sent reports to these spamvertised sites in the recent past without any 3rd party reference and it appeared in 2 spams with different sites. Anyway - it's gone now...
  23. http://www.spamcop.net/sc?id=z872533773z90...9ae181cd593875z In this the parser assigns [at]devnull.spamcop.net as a 3rd party interested in both the source ( and an illegal med spamvertised site ( indicating that (ThePlanet.com) produced repeated bounces and created the devnull for "statistical tracking." What is the point of statistically tacking interested 3rd parties? http://www.spamcop.net/sc?id=z872533785z6b...3591cb744ab97fz This one uses the same devnull address as a 3rd party interested in a different drug related spamvertised site ( I get the feeling that could have a spammer connection to the source and spamvertised sites it's "interested" in.
  24. Also - static IP addresses are per modem, not computer; typically with several computers sharing an internet IP address from a router.
  • Create New...