My "average reporting time"

[Spamnophobic]

I have always striven to keep this as low as possible, by reporting spam with a "yum this spam is fresh" label (under 3 hours). This is a very sensible measure to encourage reporting as early as possible as a more heavily weighted spam report can stop the spammer while the spam run is still going on, if only the mail admin is alert and honest enough, and sc_rew the spammer's whole "business model".

I notice that the reported servers are always different, so the spammer is trying to do "snowshoe spam", trying to spread reports across multiple compromised mail servers, so that reports do not build up far enough to land the server on the SC blacklist, used by many mail admins to configure their spam filtering settings. Testimony to the effectivity of the SC blacklist.

In trying to keep my "average reporting time" low to help feed this effort, I only report spams "younger" than my average reporting time, so that it should theoretically keep going down. I cancel spam reports older than my latest "average". However I notice that my "average", even with such care for statistics, seldom goes below "9 hours" and seems to take no account whatever of the many, many spams I have reported within sometimes "0 hours" and certainly less than 3.

Obviously we are dealing with an algorithm here. Calculating an "average" using a value of 0 hours is obviously going to lead to the fraught question of dividing by zero. The BBC series "More or less" has dealt with this issue at length (though not in the context of spam).

https://www.bbc.co.uk/programmes/m0022l16

However I would have hoped that my many scores of 3 hours or less would have slotted into the algorithm perfectly well and would seem to reduce my average. This however stubbornly remains at 9 hours.

This is of course a minor issue against the more important background of fighting spam as hard as possible, but it would be nice if I could see my efforts to report as much spam as early as possible rewarded by a more accurate application of the algorithms. Can I expect any help from admins or deputies?

[ninth]

Interesting, I always reckon my average is high at 18 but not sure if stats go back to when I first joined or it could be the average for all users? The time starts when the spam hits your mailserver so how often does everyone check notifies or spam folder? Feeding the block list is the priority but it also helps the fight if dodgy links to websites are taken down quickly and the sending networks etc are notified so the more reports the better. Most spam is not reported.

What is my average reporting time?

Since October 2003, SpamCop has been tracking user's speed at reporting spam. This speed is calculated by comparing the time that the spam is received at the recipient mailserver with the time at which it is submitted as spam to SpamCop.

Turn-around time is very important for SpamCop. Quick notification lets responsible administrators take action before the damage is too great. It also makes sure irresponsible sites get blocklisted - also, before the damage is too great.

   

[petzl]

1 hour ago, ninth said:

nteresting, I always reckon my average is high at 18 but not sure if stats go back to when I first joined or it could be the average for all users?

Seem to remember this never worked and was given up on

[ninth]

Max...what is the square root of minus 1?

[lisati]

On 9/22/2024 at 6:48 PM, ninth said:

Max...what is the square root of minus 1?

I don't know......🫠

[ninth]

 

Read poskitt

[Spamnophobic]

On 9/21/2024 at 4:20 PM, Spamnophobic said:

I have always striven to keep this as low as possible, by reporting spam with a "yum this spam is fresh" label (under 3 hours). This is a very sensible measure to encourage reporting as early as possible as a more heavily weighted spam report can stop the spammer while the spam run is still going on, if only the mail admin is alert and honest enough, and sc_rew the spammer's whole "business model".

I notice that the reported servers are always different, so the spammer is trying to do "snowshoe spam", trying to spread reports across multiple compromised mail servers, so that reports do not build up far enough to land the server on the SC blacklist, used by many mail admins to configure their spam filtering settings. Testimony to the effectivity of the SC blacklist.

In trying to keep my "average reporting time" low to help feed this effort, I only report spams "younger" than my average reporting time, so that it should theoretically keep going down. I cancel spam reports older than my latest "average". However I notice that my "average", even with such care for statistics, seldom goes below "9 hours" and seems to take no account whatever of the many, many spams I have reported within sometimes "0 hours" and certainly less than 3.

Obviously we are dealing with an algorithm here. Calculating an "average" using a value of 0 hours is obviously going to lead to the fraught question of dividing by zero. The BBC series "More or less" has dealt with this issue at length (though not in the context of spam).

https://www.bbc.co.uk/programmes/m0022l16

However I would have hoped that my many scores of 3 hours or less would have slotted into the algorithm perfectly well and would seem to reduce my average. This however stubbornly remains at 9 hours.

This is of course a minor issue against the more important background of fighting spam as hard as possible, but it would be nice if I could see my efforts to report as much spam as early as possible rewarded by a more accurate application of the algorithms. Can I expect any help from admins or deputies?

Apparently not, as I have had no feedback from admins or deputies. If, as suggested, it never worked and was given up on, why is it still available and apparently calculated for reports, generating a false sense that reporting is helping in proportion to the rapidity of reports?

Any reaction, admins or deputies?

I will keep reporting, but should I also report "older" spams, which until now I have been discarding?

I still note that the reported relays / proxies are different every time, giving me a sense that I can clobber these at any "age" of spams. I still hope that one day we will get them all. And still hope that people will stop falling for the terrifying extortion spams.

[Lking]

On 9/21/2024 at 8:22 PM, petzl said:

Seem to remember this never worked and was given up on

I believe @petzlis correct. Back in the day my average reporting time quickly dropped to 2 hours, and has not moved since no matter what I do/did. Even catching up on reporting after a "day off" does not have an effect.

On the other hand, "yum this spam is fresh" does still encourage quickly reporting received spam. The quicker an IP is added to the SCBL the better to protect users before the end of the spam serge. Trying to get the "barn door" shut before...

As illustrated recently when the system stopped working, the parser is a large system with many "old" interlocking, interdependent, pieces. Cleaning up the remanet of a no longer functioning feature, could cause unexpected results.

[petzl]

3 hours ago, Lking said:

I believe @petzlis correct. Back in the day my average reporting time quickly dropped to 2 hours, and has not moved since no matter what I do/did. Even catching up on reporting after a "day off" does not have an effect.

On the other hand, "yum this spam is fresh" does still encourage quickly reporting received spam. The quicker an IP is added to the SCBL the better to protect users before the end of the spam serge. Trying to get the "barn door" shut before...

As illustrated recently when the system stopped working, the parser is a large system with many "old" interlocking, interdependent, pieces. Cleaning up the remanet of a no longer functioning feature, could cause unexpected results.

The picture  @Lking is very correct
"99 little bugs in the code. 99 little bugs in the code. Take one down, patch it around. 127 little bugs in the code."

The SpamCop Bot seems to be more of a artwork than a program/science.
spam reports are needed to be under 24 hours before it counts on the SpamCop Block list (SCBL), which is actually a spam radar 
When spam flood starts it is activated, when spam stops the SCBL deactivates after 24 hours of last spam report.
My remembrance is that a actual SC report counts more towards SCBL activation than a secret spamtrap email hit does.
As always fresh is best
Not sure, but even if more than reporting than 24 hours after (but less than 3 days), still reduces the activation point/algorithm of the SCBL, for that reported IP address?

Edited September 26 by petzl

[ninth]

Most of the computer systems in the world are running legacy code. The issue with a wish list to improve to the user interface or reporting system is finding the resources namely time and cost? Note the beware1.gif is still on the forum homepage for apparently no reason but not doing any harm.

Edited September 27 by ninth
add

[Lking]

11 hours ago, ninth said:

Note the beware1.gif is still on the forum homepage for apparently no reason but not doing any harm.

"No reason"???? If you go to https{COLON}// spamcop{DOT}com you will be redirected....

[petzl]

4 hours ago, Lking said:

"No reason"???? If you go to https{COLON}// spamcop{DOT}com you will be redirected....

Yes. Had a look ended up sent/redirected to a created in 2006 Godaddy registrar web site with a Thai language page for gambling SLOT's 

Good warning still
Beware of Cheap Imitations
ESTABLISHED
spamcop.net
1998

Edited September 27 by petzl

[ninth]

Invision gives us a choice of forum themes...black or spamcop blue.