Misplaced repy-to-all

[lisati]

This morning I received a response to an email complaint I'd sent using the Habul plugin for Thunderbird. It looks likes the sender hit "Reply-to-all" and ended up sending a copy of their response to the submit.xxxxxxxxxxx[at]spm.spamcop.net email address I normally use to report spam. Do I need to be worried?

[gnarlymarley]

if it was truly your submit address, then I would be worried.  That is something that only you should know.  Now if they replied to your <report_id>@reports.spamcop.net address, then that is different.  The reason why your submit address should be kept hidden from others is that folks could abuse it and it could be turned off.

If they do not know what the submit address is, you might be okay, but you might need to get a new one through Don at the deputies address.

If you are copying folks on the same email as your reporting, it would probably be best if the submit address was in the BCC field.

[Lking]

Lisati, I think you are OK.  I see two possibilities.

1.  The most likely, SC sent a spam report to the spammer's ISP.   Each spam report is sent to only one recipient and from a unique SpamCop address that includes the report id (reportid=1234567890 for example).  If the recipient does click on Reply/ReplyALL their email goes only to the unique SpamCop address. From the report ID SC can link the report to you.  If in preferences you agree to accept messages from recipients, SC then forwards the message to you.  This way SC tries protects your email.
2. The other addresses in Habul, FTC, FDA or KnujOn do not reply to spam sent to them.  The AU group does send an automatic acknowledgement each spam reported.  But only back to you (sender of email from Habul).
3. In Habul if you have included an email address(es) under "Custom Report(es) address" under the <Basic settings> Tag, they may hit ReplyAll.  If they do you should see pending spam in your SC reporting account, as if you submitted more spam (but didn't).

I use Habul to send spam to all the above, SpamCop, FTC, FDA, FnujOn.net and ACMA in Australia.  Sometimes when I get a phishing spam "from" say Fedex I add their abuse email (abuse{AT}Fedex.com) to the list of recipients.  To protect my private submit address I change the SpamCop TO: to BCC: so it does not seen by the other recipients.

[lisati]

The initial email I received had all the same email addresses I normally use with Habul, and I subsequently received a Spamcop notification indicating that there was a problem with "my" submission, as if I'd forgotten to forward something as an attachment. I have a feeling that I'm probably safe, in the past the same recipiients have seemed a bit clueless about what Spamcop is or what they do.

[Lking]

#3 above sounds like the answer.  If you change the TO: submit to BCC: that should fix it.

[lisati]

Thanks, that sounds good.