Spamcop Mail letting picture spam through?

[Ex_Brit]

I know this has been a problem in the past but I thought SC had it licked, until my Junk Mail box here at home started filling up today with picture spam - mostly selling Cialis etc.

I reported them all manually and blacklisted the sender, for what that's worth, they usually are false anyway.

Interesting to note that on all these emails when I clicked on 'details" the "return path" was my SC email address. I gleaned the sender's supposed email address from the "From" line.

One example here. This one failed to resolve to anyone: http://www.spamcop.net/sc?id=z1276879349z6...0ea683833e40cbz

And another one here: http://www.spamcop.net/sc?id=z1276915228z0...042c35c8d882edz

If this is in the wrong area, please forgive me. I seem to be doomed to post incorrectly.

[Wazoo]

If this is in the wrong area, please forgive me. I seem to be doomed to post incorrectly.

You posted this into the section titled SpamCop Email System & Accounts .. Defined as A forum for questions and discussion about the SpamCop Email System and spamcop.net email accounts.

I know this has been a problem in the past but I thought SC had it licked, until my Junk Mail box here at home started filling up today with picture spam - mostly selling Cialis etc.

You say "my home account - junk mail folder" ... but don't actually say how SpamCop.net is involved ... POP, Forward, IMAP ...????

I reported them all manually and blacklisted the sender, for what that's worth, they usually are false anyway.

Where? Your system, in your SpamCop.net e-mail account ...????

Interesting to note that on all these emails when I clicked on 'details" the "return path" was my SC email address.

Implication that you may have your own address white-listed ...???

One example here. This one failed to resolve to anyone: http://www.spamcop.net/sc?id=z1276879349z6...0ea683833e40cbz

And another one here: http://www.spamcop.net/sc?id=z1276915228z0...042c35c8d882edz

Both samples show extremely high SpamAssassin scores .... are you using SpamAssassin at all?

First one is totally screwed as far as format ... header/body goes ...

Second one looks just as bad ....

So now am going to have to ask just how those are bing submitted, as something appears to have gone wrong .....

(Really tiring to have to handle firewall alerts due to your off-site sig graphic)

[Ex_Brit]

Wazoo, the last time I posted a similar question in the Reporting forum you told me it belonged here because I am a SC email system subscriber.

My email client (Incredimail or Outlook Express or Windows mail, I use either depending on which system I'm signed into at the time) pops the filtered mail from the SC servers which has all my webmail forwarded to it. (Exception hotmail which is popped by SC from MSN)

My SC email address was whitelisted (I thought it had to be) but would that explain it appearing in the "Return-Path" ?

Yes I'm using Spamassassin. I have all the DNS filters on and Spamassassin is ticked and set to "1".

Strange that they were let through if the score is so high.

Format - that's the way they arrived.

I submitted them by opening them, clicking Properties, highlighting the details copying and pasting into http://mailsc.spamcop.net/ and reporting them there being careful to place a gap between the last "To" address and the subject line.

I'll remove my linked signature....maybe that should be publicised a little more? First complaint I've ever had in 5 years and I use it almost everywhere.

[Telarin]

My SC email address was whitelisted (I thought it had to be) but would that explain it appearing in the "Return-Path" ?

Your email address only needs to be whitelisted if you send yourself email from your own address and are having a problem receiving it. If your email address is whitelisted, anything the spammers send you that claims to be from your own address (a common spammer tactic), will automatically bypass the spamassassing filters because of the whitelisting. You address is in the return-path of the message because the spammer put it there, in the hopes of getting around filters, which appears to have worked. Removing your own address from your whitelist should solve that particular problem.

[Ex_Brit]

Thanks. That would certasinly explain it. I'm going to go there now and make sure none of my other email addresses are whitelisted.

Thanks again.

[Wazoo]

Wazoo, the last time I posted a similar question in the Reporting forum you told me it belonged here because I am a SC email system subscriber.

That may have been how you read it ... I can't come up with why I would state that as defined. It's the 'issue' that would define 'where' it would best be placed. In this case, the appearances were that it was the filtering / tagging mode associated with a SpamCop.net e-mail account that was being questioned. Thus was agreeing in this case that you selected the right spot.

My email client (Incredimail or Outlook Express or Windows mail, I use either depending on which system I'm signed into at the time) pops the filtered mail from the SC servers which has all my webmail forwarded to it. (Exception hotmail which is popped by SC from MSN)

Part of the reason for asking .... some 'filter' actions do not take place unless/until one logs into the web-mail account.

My SC email address was whitelisted (I thought it had to be) but would that explain it appearing in the "Return-Path" ?

Yes I'm using Spamassassin. I have all the DNS filters on and Spamassassin is ticked and set to "1".

Strange that they were let through if the score is so high.

Telerin already answered, including why the high SpamAssassin scores were 'nullified' ...

Format - that's the way they arrived.

I submitted them by opening them, clicking Properties, highlighting the details copying and pasting into http://mailsc.spamcop.net/ and reporting them there being careful to place a gap between the last "To" address and the subject line.

Trying to follow along, but I can't .... the line break you say you explicitly add is absolutely the wrong spot and thing to do .... in both of your example, the 'gap' appears to be 'needed' after the lines;

X-SpamCop-Checked:

X-SpamCop-Disposition: Blocked SpamAssassin=16

X-SpamCop-Whitelisted: x

<the body of the e-mail starting here>

Wow, when not in the mode of falling asleep/waiting for the coffee to percolate/wondering whether to answer the door or the phone first .... had I not stopped scanning down the submitted stuff when I saw the 'blank line' in the wrong place .... I wouldn't have had to do the conjecturing/querying .. the 'answer' was in fact there ...

I'll remove my linked signature....maybe that should be publicised a little more? First complaint I've ever had in 5 years and I use it almost everywhere.

Thanks. There are probably very few people that run with systems as locked down as I do ... so few probably never notice the situation. As far as making it more publicised;

Some other folks have had their posts edited to change their 'image' links to actually be just simple URL links..

..explanation includes the fact that many folks are still dial-up, some on cell-phone/PDA ... so there is no reason to try to 'force' everyone reading the subject matter to make the attempt to download the (sometimes massive) graphic ... leaving the URL in place does allow for those that want to see it to then make the decision to have a look ... all involved (that questioned it) understood the logic and changed the way they handled this in their next posts ... so basically an issue that's only come up a few dozen times, at best, all handled at the time ...

Thus far, there has only been a single case of me editing a user's signature due to included graphic links ... the link there was to a 1.8Meg graphic file ..... this user got very excited over that action .... it took a number of PMs and e-mails for him to grasp the concept that people didn't need to know his rankings on 30+ on-line games in order to try to handle his issues with the SpamCop.net toolset ....

I was thinking at that time that this was something that needed to be inserted into the Forum FAQ and/or a Terms of Use/Policy statement .... looked at it .. then realized that once I started ..... geeze ...

[Ex_Brit]

Thanks for the information Wazoo.