dbiel Posted September 16, 2005 Share Posted September 16, 2005 I do have a suggestion for SpamCop which won't solve the sigalarm situation but would allow the dumping of any such offending spams without having to purge the entire queue -- how about placing the 'Cancel' button at the top of the process page? This would hopefully allow any single spam that was capable of creating this problem to be dropped by itself. 32822[/snapback] Adding a cancel report button following the Tracking ID would hopefully clear this report and allow for the processing of the remaining item in the queue. Currently one has to dump the entire queue to clear the problem and then start over if you can remember what was in the queue at the time it locked up. Example data follows: Help | Site Map | Text size: - + Report spam Filtered Email Blocking List Statistics Login SpamCop v 1.490 Copyright © 1998-2005, IronPort Systems, Inc. All rights reserved. Here is your TRACKING URL - it may be saved for future reference: http://www.spamcop.net/sc?id=z806190795z5c...e35d4157245721z Skip to Reports X-Apparently-To: x via 68.142.199.179; Thu, 15 Sep 2005 05:51:23 -0700 X-YahooFilteredBulk: 58.141.30.132 X-Originating-IP: [58.141.30.132] Return-Path: <dcramer[at]pldi.net> Authentication-Results: mta100.biz.mail.re2.yahoo.com from=pldi.net; domainkeys=neutral (no sig) Received: from 58.141.30.132 (HELO twotiming.com) (58.141.30.132) by mta100.biz.mail.re2.yahoo.com with SMTP; Thu, 15 Sep 2005 05:51:23 -0700 Received: from pldi.net (mx1.pldi.net [64.250.192.80]) by twotiming.com (Postfix) with ESMTP id AF51C464DE for <x>; Thu, 15 Sep 2005 09:01:20 -0400 Message-ID: <1101______________________7feb[at]pldi.net> From: "Goldsmiths T. Knapsack" <dcramer[at]pldi.net> To: Craigt <x> Subject: About reality world Date: Thu, 15 Sep 2005 09:01:20 -0400 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0009_35497405.1FC0D823" X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2462.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2479.0006 X-PM-PLACEHOLDER: . View entire message Parsing header: 0: Received: from 58.141.30.132 (HELO twotiming.com) (58.141.30.132) by mta100.biz.mail.re2.yahoo.com with SMTP; Thu, 15 Sep 2005 05:51:23 -0700 No unique hostname found for source: 58.141.30.132 primary received mail from sending system 58.141.30.132 1: Received: from pldi.net (mx1.pldi.net [64.250.192.80]) by twotiming.com (Postfix) with ESMTP id AF51C464DE for <x>; Thu, 15 Sep 2005 09:01:20 -0400 Hostname verified: mx1.pldi.net Possible forgery. Supposed receiving system not associated with any of your mailhosts Will not trust anything beyond this header Tracking message source: 58.141.30.132: Routing details for 58.141.30.132 [refresh/show] Cached whois for 58.141.30.132 : pcsalts[at]cnm.co.kr Using last resort contacts pcsalts[at]cnm.co.kr Message is 15 hours old 58.141.30.132 not listed in dnsbl.njabl.org 58.141.30.132 not listed in dnsbl.njabl.org 58.141.30.132 listed in cbl.abuseat.org ( 127.0.0.2 ) 58.141.30.132 is an open proxy 58.141.30.132 not listed in accredit.habeas.com 58.141.30.132 not listed in plus.bondedsender.org 58.141.30.132 not listed in iadb.isipp.com Finding links in message body Recurse multipart: Parsing text part Parsing HTML part Resolving link obfuscation http://aefilcjkbd.capskin.info/?ghmbdxwonoyaefilzlvcjk host aefilcjkbd.capskin.info (checking ip) ip not found ; aefilcjkbd.capskin.info discarded as fake. http://fmadhikcegj.pixratio.info/?blcegjxwonoyfmzvpadhik host fmadhikcegj.pixratio.info (checking ip) ip not found ; fmadhikcegj.pixratio.info discarded as fake. http://dgkcjmbfi.flycircle.info/?aehlbfixwonoydgkzvpcjm host dgkcjmbfi.flycircle.info (checking ip) ip not found ; dgkcjmbfi.flycircle.info discarded as fake. http://chiadglmbf.flycircle.info/?ejkbfxwonoychizctadglm host chiadglmbf.flycircle.info (checking ip) ip not found ; chiadglmbf.flycircle.info discarded as fake. http://fghackbe.capskin.info/?dijlmbexwonoyfghzctack host fghackbe.capskin.info (checking ip) ip not found ; fghackbe.capskin.info discarded as fake. http://dghklmajbc.thanksflo.info/?efibcxwonoydghklmzlvaj host dghklmajbc.thanksflo.info (checking ip) ip not found ; dghklmajbc.thanksflo.info discarded as fake. Tracking link: http://chiadglmbf.flycircle.info/?ejkbfxwonoychizctadglm No recent reports, no history available Cannot resolve http://chiadglmbf.flycircle.info/?ejkbfxwonoychizctadglm Tracking link: http://aefilcjkbd.capskin.info/?ghmbdxwonoyaefilzlvcjk No recent reports, no history available Cannot resolve http://aefilcjkbd.capskin.info/?ghmbdxwonoyaefilzlvcjk Tracking link: http://dghklmajbc.thanksflo.info/?efibcxwonoydghklmzlvaj No recent reports, no history available Cannot resolve http://dghklmajbc.thanksflo.info/?efibcxwonoydghklmzlvaj Tracking link: http://fmadhikcegj.pixratio.info/?blcegjxwonoyfmzvpadhik No recent reports, no history available Cannot resolve http://fmadhikcegj.pixratio.info/?blcegjxwonoyfmzvpadhik Tracking link: http://fghackbe.capskin.info/?dijlmbexwonoyfghzctack No recent reports, no history available Cannot resolve http://fghackbe.capskin.info/?dijlmbexwonoyfghzctack Tracking link: http://dgkcjmbfi.flycircle.info/?aehlbfixwonoydgkzvpcjm No recent reports, no history available got sigalarm, taking too long to process, aborted. Perhaps you can wait a few minutes and reload? Link to comment Share on other sites More sharing options...
Jeff G. Posted September 16, 2005 Share Posted September 16, 2005 Next to that new "Cancel" Button (which should IMHO duplicate the existing "Cancel" Button) I suggest a new "Parse Header Only" Button, which would IMHO come closer to the intent of the attempted Reporter, still allowing the Reporting of the source of any spam which has a sigalarm-producing body. Link to comment Share on other sites More sharing options...
craigt Posted September 16, 2005 Share Posted September 16, 2005 "Parse Header Only" Button 32825[/snapback] If possible add this to the 'preferences' section -- I would prefer processing all spam ignoring the body anyway. And, yes, I realize that the 'quick report' feature attempts this but doesn't allow me to check the button to 'un-munge' my info for ISP's that I recognize who don't accept munged reports. Link to comment Share on other sites More sharing options...
Jeff G. Posted September 16, 2005 Share Posted September 16, 2005 "Parse Header Only" Button32825[/snapback] If possible add this to the 'preferences' section -- I would prefer processing all spam ignoring the body anyway. And, yes, I realize that the 'quick report' feature attempts this but doesn't allow me to check the button to 'un-munge' my info for ISP's that I recognize who don't accept munged reports.32827[/snapback] Why not put it in both places? There could be a Preference of, say, "Parse headers only" that defaults to unchecked, or a Preference of, say, "Parse body for spamvertized URLs" that defaults to checked, as well as a "Parse Header Only" Button for the rest of us and a "Parse Body Too" Button for Craig and like-minded Reporters that have a new pet spammer or whatever for which they do want to parse the body. That is, there'd be a Preference of each flavor, and a post-Parse exception capability to counteract that Preference. This option could actually save the considerable CPU time currently being spent chasing down all those pesky URLs via all those slow dodgy/zombified DNS servers. FYI, I've yet to correlate any changes in my spam volume with my decision quite some time ago to stop munging my SpamCop Reports. I've now reported over half a million spam emails Link to comment Share on other sites More sharing options...
craigt Posted September 19, 2005 Share Posted September 19, 2005 Adding a cancel report button following the Tracking ID... 32823[/snapback] Or alternatively have a 'cancel' button generated as part of the sigalarm notification Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.