Three Ways to Report spam

[SpamCopAdmin]

1. Copy/Paste the full (raw) headers and text into the SpamCop web form after you log into your account at http://www.spamcop.net/ If the spam is HTML encoded with fonts and styles, etc, you should first expose the underlying HTML code if you want SpamCop to look for web links. You can paste the spam into either the standard reporting box, or the two-part "outlook/eudora workaround form" if SpamCop is having trouble "finding" the links in the body text.

2. Create a plain text email addressed to your "submit" or "quick" submission address that CONTAINS the full (raw) headers and text of the spam (with underlying HTML code exposed if there is any). SpamCop will look inside your email for the spam.

3. Create a plain text email addressed to your "submit" or "quick" submission address that has the spam ATTACHED to it. This is what you are doing when you "Forward as Attachment." You can attach multiple spams if you keep the numbers down. I don't know how many is too many. You'll have to determine that by trial and error.

- Don D'Minion - SpamCop Admin -

- Service[at]Admin.SpamCop.net -

.

[turetzsr]

...Proposed modifications:

• Options 2 and 3 are not permitted for Microsoft Outlook e-mails. Ref: SpamCop FAQ entry labeled "Forwarding "As Attachment" from Outlook - no longer allowed!! 6 April 2009."
  
• Option 1: If you use the standard reporting box, leave a blank line between the headers and the spam text (body).
  
• Option 2: leave a blank line between the headers and the spam text (body).
  
• Option 3: per SpamCop FAQ entry "How do I submit spam via email?" "You should not exceed 20 spams attached to a submission. The maximum size for the overall submission must not exceed 50 KB."
  

...Please do not take these proposed modifications as authoritative unless validated by one of the SpamCop staff.

[pusser_uk]

Forgive me if the way I report is wrong, I do the following....

Right click on the email (I still use Outlook Express) and select "Properties".

Click on the "Details" tab and then select "Message Source".

Ctrl-A to select all the text in the window, then copy and paste it into the spam Cop reporting box and Process.

[Farelf]

Forgive me if the way I report is wrong, I do the following.....

Looks good to me matey - only problem is with submission by e-mail from Outlook (not Outlook Express) so you're in the clear on both counts.

Problem with Outlook e-mail submissions was (sometimes) mangling of the order of "Received:" lines in the headers.

[turetzsr]

Forgive me if the way I report is wrong

<snip>

...Nope, that's right -- you're using Don's 84376[/snapback] Option 1. The only reason what you are doing seems different is that you just added the detail relevant to Outlook Express that Don describes more generally as "Copy/Paste the full (raw) headers and text into the SpamCop web form."

[j4v3d]

Newbie here! What happens once you submit the spam using the form on the website?

When can you expect to see less spam emails coming through?

[Lking]

5 hours ago, j4v3d said:

When can you expect to see less spam emails coming through?

There is no direct correlation between an individuals spam submission and a change in spam received.

An exception to that would be if your ISP (email server) uses the SpamCop Block List.  Otherwise, there would not be a notices change.

[Hanco]

On 10/1/2019 at 5:29 AM, j4v3d said:

Newbie here! What happens once you submit the spam using the form on the website?

When can you expect to see less spam emails coming through?

I wish I knew what drives inclusion of sites (or their Domain Names) in blacklists. I’ve been using SpamCop for a long time, but I’ve not worked it out. I feel like it has definitely reduced the spam I get. Many years ago I received very few every year. I stopped reporting them. Then about 18-24 months ago it started again.

Either I was in a data leak (pwned) or somehow I did get added to a list. Maybe a random bot sent email arrived and I opened it? Heaven forbid, but maybe I even replied to one?

Ive re-learned submissions, deciphering the plain text/headers and the “tricks” of the criminal idiots behind spam/phishing emails.

Now they all get reported. Average submissions time 2 hours. I also report image content when hosted off their spamvertized domain site. Some image hosting applications respond in under an hour at times, deleting the files. The spammer who continues to blast me has noticed and has to include “Can’t see the images? View unblocked email here” (or similar message at the top of their spammy emails)

I wish the blacklisting was faster. Especially SURBL, because then see the domain registrar take actual action to shut down one more spam site the spammer moves onto their next one but it causes them inconvenience which reduces the spam for a while!

Currently I’m dealing with ~24 spams per day, and all for the same three domains hosted by the same provider. Hoping for a slow down soon 😊

Best wishes.

Edited October 4, 2019 by Hanco
(I included my name eek)

[Lking]

Lets start with the SCBL deals with IP addresses not domain names. As for which IPs are blocked, have you looked at https://www.spamcop.net/spamstats.shtml  or https://www.spamcop.net/fom-serve/cache/351.html

3 hours ago, Hanco said:

wish the blacklisting was faster.

Have you looked at https://www.spamcop.net/fom-serve/cache/297.html scroll down to "Rules" Speed all depends.

[Hanco]

3 hours ago, Lking said:

Lets start with the SCBL deals with IP addresses not domain names. As for which IPs are blocked, have you looked at https://www.spamcop.net/spamstats.shtml  or https://www.spamcop.net/fom-serve/cache/351.html

Have you looked at https://www.spamcop.net/fom-serve/cache/297.html scroll down to "Rules" Speed all depends.

 

 

Rules:

• SCBL lists IP addresses with a large number of reports relative to reputation points. The SpamCop team manually balances the threshold in an effort to make the list as accurate as possible.

I guess I won’t know what that means in actual volume terms.

• The SCBL weights reports depending on how recently the mail was received (or "freshness"):
  • The SCBL counts the most recently received reports 4:1.

That’s me and these reports I send for sure. Avg reporting time 2 hrs now. Very fresh!

 

• The SCBL does not count reports regarding URLs or addresses in the body of the email. Therefore, the SCBL does not list websites or email addresses used to receive replies in reported email, unless that IP is also used to send the mail.

So, for spam emails that are from Amazon AWS IPs, where the body of the email is sent to drive traffic to the IP address of  “australy.win”... australy.win’s IP address will never become blacklisted through the reports I send? The Amazon AWS IP might though?

 

• The SCBL will not list an IP address with only one report filed.

I hope someone else is receiving the junk I get and is bothered enough to report

Edited October 4, 2019 by Hanco
No edit, just THANKS!

[Lking]

10 hours ago, Hanco said:

That’s me and these reports I send for sure. Avg reporting time 2 hrs now. Very fresh!

When the "Reporting Time" was added to the screen, there were lots of threads about the accuracy. Seems to fall to 2 hrs and sticks there.

10 hours ago, Hanco said:

P address will never become blacklisted through the reports I send?

And why should they??? They don's SEND any spam.  Remember the objective of the SCBL is to block/filter incoming spam, not rate all the IP in the world.  In the beginning spammers would include phony links to NY Times/ Washington Post, etc. to make it look like the spamvertised product was valid.  A dynamic process.

 

10 hours ago, Hanco said:

I hope someone else is receiving the junk I get

Thanks.  I am fairly sure that in spite of the view from your end of the "fire hose" 1k - 100k others are receiving spam for the same IP, it only takes a couple of live reports. And of course there are all the spam traps which are heavily weighted..

[Hanco]

23 hours ago, Lking said:

why should they??? They don's SEND any spam.  Remember the objective of the SCBL is to block/filter incoming spam, not rate all the IP in the world.  In the beginning spammers would include phony links to NY Times/ Washington Post, etc. to make it look like the spamvertised product was valid.  A dynamic proces

Why should they? I agree with you that innocent bystanders don’t want to be impacted. I’m talking about three specific domains/sites, which exist ONLY for spam operations.

Obviously I appreciate determination of a site existence only for this purpose is not always straightforward. And maybe this is not the place to ask about it. Just curious how a domain like “australy.bid” or “australy.win” gets on blacklists like SURBL. It certainly seems like it is not achieved by the reports sent to the host this week

[Lking]

3 hours ago, Hanco said:

gets on blacklists like SURBL.

Different block list, different objectives, different rules.

[Hanco]

30 minutes ago, Lking said:

Different block list, different objectives, different rules.

Yes, exactly. Any ideas how to help them get onto those lists? 

[Lking]

18 hours ago, Hanco said:

Any ideas how to help them get onto those lists? 

Perhaps others do, I do not.

[Outernaut]

On 10/4/2019 at 1:27 AM, Hanco said:

Rules:

• SCBL lists IP addresses

When you Gurus use acronyms, PLEASE, at least ONCE, use the full the expression. As in Gee, I Hate Acronyms (IHA) and THEN use your acronyms, even if replying to how much IHA.

It makes it easier, and faster for us noobs, and we're not aghast at trying to figure out what a baseball league has to do with spam reporting.

*BTW - SCBL by lord Google is  "Santa Clara Baseball League", and other teams belonging to the league.

Thank you

~o~

* No need to go there, I found (finally) the explanation for your SCBL.

[petzl]

probem with adding IP's/ providers to a blacklist is it becomes a political "sh*tlist 
Sometimes this is to me a good thing
I would have "Namecheap" OVH China but that is not good thing to everyone!

[gnarlymarley]

6 hours ago, Outernaut said:

*BTW - SCBL by lord Google is  "Santa Clara Baseball League", and other teams belonging to the league.

SCBL means SpamCop Blocking List or SpamCop Black List.

Also, for me google says it is "Southern Collegiate Baseball League".

[Lking]

9 hours ago, Outernaut said:

When you Gurus use acronyms, PLEASE, at least ONCE, use the full the expression.

We have tried. In most browsers you will see that SCBL is underlined. if you slowly mouse over SCBL a small window will appear. HTH

 

[Outernaut]

On 8/1/2020 at 8:26 AM, Lking said:

We have tried. In most browsers you will see that SCBL is underlined. if you slowly mouse over SCBL a small window will appear. HTH

 

Aha! So the key is "slowly" and the tooltip appears. I wondered what the dotted underline was supposed to do and since moving around and over it to find a link or something, I never went slowly. The onhover:showit(?) seems slow at this end.

As in:

<abbr title="Now I Understand">NIU</abbr>

I take it that one needs higher privileges like Admin, Mods etcetera to invoke that via this GUI. I'll stick to using * to call out a footnote.

I know topic is old, but forum isn't. Might help another noob like myself.

_{* Asterisk. Used to call out a footnote.😊}

[Lking]

 

2 hours ago, Outernaut said:

I take it that one needs higher privileges like Admin

Yes you need to go deep into the Admin area to add an acronym.

NIU  any other suggestions?