Unchecking black hats

[bleeb]

I ran into an interesting case, today. The originating server of the spam, and the web sites spamvertised, were all run by suspected black hats. In the past, LARTing them just resulted in more spam. If all LART check boxes were unchecked, the parser wouldn't do anything with the report, and it would stay stuck in the incomplete queue.

Suggestion: Have some way to indicate that report can be counted towards the BL, but don't send LARTs to originating server's contacts. (To avoid running into problems because of all the people who just check everything, maybe the first check box, defaulting to on, could be "add originating mail server to BL".)

[StevenUnderwood]

Suggestion: Have some way to indicate that report can be counted towards the BL, but don't send LARTs to originating server's contacts.  (To avoid running into problems because of all the people who just check everything, maybe the first check box, defaulting to on, could be "add originating mail server to BL".)

27670[/snapback]

IMHO, that would be against the original reason for spamcop which was to inform the ISP that complaints had been received.

It would also invalidate our replies here (forums and newsgroups) that their ISP has received complaints when someone comes in here complaining they are blocked. The line between black hat and white hat can sometimes become grey

The line between a spamtrap receiving spam and another address receiving spam is very clear.

[Jeff G.]

If you can offer proof of the color of the potential report recipient's hat, please email that to the Deputies via their address deputies <at> spamcop.net. Thanks!

[bleeb]

Would be happy to, but regretfully, no firm proof. Only statistical (roughly 10% drop in volume, after excluding this domain from LARTs for a couple of weeks.) Also, there's been anecdotal discussions about some of the more prolific spamvertising domains (i.e. chinatietong, for one), passing LARTs back to spammers, over the news groups.