reputation points

[nomorespam]

I was looking over the SCBL FAQ and the listing rules and something struck me. Once I recovered from the blow, I searched for an answer to no avail.

In regards to "reputation points" which the FAQ states "A mail sender receives a reputation point for each SCBL query that is not reported as spam.", what constitutes a SCBL query?

Does using nslookup on 61.74.65.102.bl.spamcop.net for example, or using http://www.spamcop.net/bl.shtml give reputation points out? I gather that the points are intended to be attributed based on MTA lookups, but how are these two forms of queries (MTA vs nslookup) separable on the receiving end?

I regularly use the above url to investigate IPs of spam I receive, in part to determine if reporting a slightly stale spam is worth it or not. For example, if the spam was a little stale (8-24h) I'd consider reporting it if there was no other evidence against that IP, but if my lookups are handing out scooby snacks to the spammer's credit, it would work against getting the IP address listed, no?

On the malicious side, couldn't a spammer use an automated lookup mechansim to hammer the bl lookup for their IP addresses artificially raising their reputation point count and potentially keeping themselves out of the SCBL?

I hope I'm wrong and the non-MTA lookups don't give out reputation points, but I had to ask.

Thanks.

[Jeff G.]

Given the security considerations, I wouldn't expect an answer.

[StevenUnderwood]

The way I heard it described once (and it might have changed since then) is that there is a list of "trusted" servers around the world that are used to gather this "normal" traffic number.

When a lookup comes from one of those IP's it is counted as the normal traffic.

[Wazoo]

Actually pretty funny. From a bit of dialog a couple of weeks back, asking for a number of FAQ changes / updates, here's a bit of something back from RW about that particular item;

-=-=-=-=-=-=-=-

> http://www.spamcop.net/fom-serve/cache/297.html

> Under "SCBL Rules", third dark bullet ...

> "reputation" should probably be "repetition"

Reputation may not be the best word, but is correct in this case. This

is talking about the sending IP's 'reputation' or 'record'.

-=-=-=-=-=-

In regards to look-ups, your scans don't apply. Best left to the phrase "trusted servers" to cover the traffic that counts ....