Spam Missing From Spamcop Inbox

[grwsmith]

Hello,

Like most of us I am receiving Viagra spam but one format is getting through the filters and then does not appear in my Spamcop inbox.

That is the spasm (From: VIAGRA ® Official Site) downloads into my Outlook inbox but when I go to the Spamcop inbox, to report and delete, they are not there! What is occurring please?

Regards, Guy.

[dbiel]

I am sorry, but I am going to have to ask you to be a bit more specific.

"downloads into my Outlook inbox " would imply to me that the mail had already been POPed by your Outlook client so I would not expect it to still be in your SpamCop inbox. So just what is happening? How does mail get forwarded to SpamCop in the first place and how do you have SpamCop set up to process the mail that bypasses the HeldMail folder, and how is Outlook setup as to retrieving mail from other sources, specifically from your SpamCop account? What filters do you have in place and how are they configured?

[Spamnophobic]

If you are referring to the Inbox in your Spamcop webmail (in which case an administrator will no doubt be along soon to move your post to the "Spamcop Email System & Accounts" section) then the following questions apply.

If this format is not appearing in your Spamcop Inbox, how do you know it is getting through the filters? Are the filters perhaps placing it in your Held Mail box? If so, then the filters are doing what they are supposed to do.

Once the spam has been downloaded into your Outlook inbox, then it will no longer be in your (presumed: webmail) Inbox. This is what POP3 (the protocol by which Outlook pulls mail from the Spamcop server) is supposed to do.

In my experience, trying to report spam once it has reached your Outlook inbox is an uphill struggle because Outlook messes up the headers so that the Spamcop engine (called the parser) reports errors and doesn't process the spam. So I always report spam while it is still in webmail. Besides, I do my utmost to avoid spam ever coming down to my PC, so as not to afford it bandwidth, but also, I have to admit, because the very idea of the filthy stuff getting on to my PC at all revolts me!

[DavidT]

In my experience, trying to report spam once it has reached your Outlook inbox is an uphill struggle because Outlook messes up the headers so that the Spamcop engine (called the parser) reports errors and doesn't process the spam. So I always report spam while it is still in webmail.

I don't use Outlook (on principle, and out of self-protection -- I missed out on all those worms and exploits over the years!), but if I wanted to "put the genie back in the bottle" (put the spam messages from Outlook back onto the SpamCop email server), then I'd set up IMAP access in Outlook, at which point you should be able to simply move the offending items back into your Held mail folder on the SpamCop server, assuming you've got a SpamCop email account.

DT

[Spamnophobic]

simply move the offending items back into your Held mail folder on the SpamCop server

Would that restore the header to its original parseable state?

[DavidT]

Would that restore the header to its original parseable state?

It *should*, but since you're dealing with Micro$loth software, I'm not making any promises. :-)

It works fine in my Pegasus Mail.

DT

[turetzsr]

<snip>

In my experience, trying to report spam once it has reached your Outlook inbox is an uphill struggle because Outlook messes up the headers so that the Spamcop engine (called the parser) reports errors and doesn't process the spam.

<snip>

...And in my experience, there's no problem with reporting spam by forwarding as an attachment from Outlook. Please see my reply in forum thread "forwarding as attachment, OL2000, pdf spam, sending a pdf spam email as an attachment, SpamCop could not find your" and the discussion that follows it.

...Disclaimer: I am not claiming anything, other than that it works for me. I am not denying that in some configurations (such as Spamnophobic's), it does not work.

[grwsmith]

Hello,

Thanks for your replies.

""downloads into my Outlook inbox " would imply to me that the mail had already been POPed by your Outlook client so I would not expect it to still be in your SpamCop inbox."

My Spamcop account takes the emails from my Pipex mail account. I then use Outlook which is set to leave messages on the server for 14days, so that I can then go back to my Spamcop inbox and report any messages that have got through Spamcop using Spamcop's reporting procedure (which I prefer).

"If this format is not appearing in your Spamcop Inbox, how do you know it is getting through the filters? Are the filters perhaps placing it in your Held Mail box? If so, then the filters are doing what they are supposed to do."

I thought of that and no the missing spasm do not appear in the Held Mail page.

"What filters do you have in place and how are they configured?"

I do not use any Spamcop filters, just the blacklists mine, and theirs.

Guy.

[dbiel]

"What filters do you have in place and how are they configured?"

I do not use any Spamcop filters, just the blacklists mine, and theirs.

What are your blacklists configuered to do? Could it be that they are the cause of your problem? Have you checked the trash folders on both our SpamCop account and in Outlook to see if the messages are being moved there? Dependant on your trash folder settings you may be only able to check during the current session.

[Spamnophobic]

Guy, has all your mail gone from webmail when you return to it, or just some? If just some, can you see anything the "vanishing" mail has in common which might indicate, or help us to find, the cause?

Penny

[grwsmith]

Guy, has all your mail gone from webmail when you return to it, or just some? If just some, can you see anything the "vanishing" mail has in common which might indicate, or help us to find, the cause?

Penny

Penny,

The missing messages are just these particular spam messages. All the other messages stay on the webmail page.

This has happened occasionally before but not enough to be a problem. But I have no record of them so I cannot compare them.

The ones that are getting through currently are all of the form:

Display Name - VIAGRA ® Official Site.

Email address - grwsmith[at]spamcop.net (mine).

Subject - October 76% OFF.

Message (Source format) –

<style>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html dir="ltr">

<head>

<meta http-equiv=Content-Type content="text/html; charset=unicode">

<meta name=Generator content="Microsoft SafeHTML">

<title>WL 90-day Email 1a</title>

<table width=550 border=0 cellpadding=0 cellspacing=0 bgcolor="#999999">

</tr>

<tr valign=top>

<td colspan=5><img src="http://ads1.$A$A$A.com/ads/pronws/CIQ3536/1a_banner.jpg" alt="Windows

Live Hotmail" width=548 height=224 border=0></td>

</tr>

<tr valign=top>

<td> </td>

<td> </td>

<td colspan=2> </td>

<td> </td>

</tr>

<tr valign=top>

<td> </td>

<td><img src="http://ads1.$A$A$A.com/ads/pronws/CIQ3536/1a_hotmail.jpg" alt="Hotmail Inbox" width=122 height=130 border=0></td>

<td colspan=2><font face="Verdana, Arial, Helvetica, sans-serif" style="font-size:14px;font-weight:bold;color:#0099ff">Changes you'll

appreciate as a loyal Hotmail user</font>

<font face="Verdana, Arial, Helvetica, sans-serif" style="font-size:11px">

<br>

Let's hear it for a clean, customizable design! The results? Less

clutter on the page and the ability to choose your own color theme.

Whether you prefer blue, black, red, or green — now you can make

it suit your mood. Plus, check out the improved navigation for quicker

access to your folders and mail and use search mail to easily find that

message you sent last month!

<br>

<a href="http://cimail15.$A$A$A.com/Key=5289.DgYJ.C.C.Hlqzpy" style="color:#0099ff" target="_blank"> Find out what else has

changed</a></font></td>

<td> </td>

</tr>

<tr valign=top>

<td> </td>

<td> </td>

<td> </td>

<td> </td>

<td> </td>

</tr>

<tr valign=top>

<td> </td>

<td colspan=2><font face="Verdana, Arial, Helvetica, sans-serif" style="font-size:14px;font-weight:bold;color:#0099ff">Manage your

spam</font> <font face="Verdana, Arial, Helvetica, sans-serif" style="font-size:11px"> <br>

Thanks to color codes (yellow and red) on incoming messages, you'll be

alerted to suspicious e-mail. Now you decide what to mark as "safe" and

"unsafe" for improved spam protection on your incoming mail. When you

do so, "unsafe" mail is automatically reported to help improve the spam

protection on the Hotmail servers. Good news: this can help you receive

less spam over time!<br>

<br>

<a href="http://cimail15.$A$A$A.com/Key=5289.DgYJ.D.C.HzpRwb" style="color:#0099ff" target="_blank">Manage your spam—here's

how</a></font></td>

<td><img src="http://ads1.$A$A$A.com/ads/pronws/CIQ3536/1a_spam.jpg" alt=spam width=119 height=83 border=0></td>

<td> </td>

</tr>

</style>

<p><font color="#FF0000"><a href="http://www.coatmountain.com"><b><font size="+2">Click to buy Viagra for as low as $1.53 <b></a></font></p>

<style>

<tr valign=top>

<td> </td>

<td> </td>

<td> </td>

<td> </td>

<td> </td>

</tr>

<tr valign=top>

<td> </td>

<td><img src="http://ads1.$A$A$A.com/ads/pronws/CIQ3536/1a_inbox.jpg" alt=Inbox width=122 height=104 border=0></td>

<td colspan=2><font face="Verdana, Arial, Helvetica, sans-serif" style="font-size:14px;font-weight:bold;color:#0099ff">It's your

inbox, so choose <em>your</em> view</font> <font face="Verdana, Arial,

Helvetica, sans-serif" style="font-size:11px"> <br>

You choose the way you want to see and use your e-mail:

<br>

<br>

Choose classic version if you want a fast, simple way to read and

manage your e-mail. It's perfect if you have a slower connection or

prefer the traditional inbox view of just your e-mail listed.

<br>

<br>

Use full version if you're on a broadband connection to get access to

more features like address auto-complete, reading pane, and

drag-and-drop. If you're a Microsoft® Office Outlook® user,

you'll feel right at home.<br>

<br>

<a href="http://cimail15.$A$A$A.com/Key=5289.DgYJ.F.C.HqpJkn" style="color:#0099ff" target="_blank">Learn more about classic and full

version</a></font></td>

<td> </td>

</tr>

<tr valign=top>

<td> </td>

<td colspan=3>

<hr style="height:1px">

</td>

<td> </td>

</tr>

<tr valign=top>

<td> </td>

<td colspan=3><font face="Verdana, Arial, Helvetica, sans-serif" style="font-size:11px">Microsoft respects your privacy. To learn more,

please read our online <a href="http://cimail15.$A$A$A.com/Key=5289.DgYJ.G.C.Htf6gp" style="color:#0099ff" target="_blank">Privacy Statement</a>. <br>

<br>

Microsoft Corporation, One Microsoft Way, Redmond, WA 98052</font></td>

<td> </td>

</tr>

<tr valign=top>

<td colspan=5> </td>

</tr>

</table>

</td>

</tr>

<tr>

<td align=center valign=middle><img src="http://ads1.$A$A$A.com/ads/pronws/CIQ3536/spacer.gif" alt=" " width=122 height=1 border=0></td>

</tr>

</table>

</div>

</div>

</div>

</body>

</html>

</style>

[dbiel]

Have you confirmed that the ONLY account that Outlook is POPing is your SpamCop Account?

[Spamnophobic]

Guy,

Did you check your webmail before downloading to Outlook, that the spam was there then, i.e. that Spamcop did receive it in the first place?

I've tried playing around with Outlook's "Leave a copy of messages on the server" options, but have so far been unable to reproduce your problem. Be aware though that Outlook could well be removing messages from your webmail as a result of these settings, more than x days old for instance. Some spams try to "pretend" to be old, possibly in the hope the Spamcop parser will discard them as being too old to process.

Another idea struck me. Are you looking at your real Inbox in webmail or at your "Virtual Inbox"? The latter doesn't display any mail marked as read.

Sorry to seem to fire so many questions at you, the hope is that one of them may give you a new idea!

[agsteele]

Also, could you have any filters set up in your mailbox that are triggered when you login to webmail?

Andrew

[grwsmith]

Have you confirmed that the ONLY account that Outlook is POPing is your SpamCop Account?

Yes, Outlook is only POPing Spamcop account.

Also, could you have any filters set up in your mailbox that are triggered when you login to webmail?

No filters active.

Did you check your webmail before downloading to Outlook, that the spam was there then, i.e. that Spamcop did receive it in the first place?

I am running my mail without Outlook for a couple of days to see all incomming mail onatural so to speak. Then I will compair the download results.

All mail is shown in my webmail page Read and unread.

[Spamnophobic]

I received such a spam as you first quoted. I set my "Remove from server after" to 4 days in Outlook, and downloaded the horrible thing. I had forwarded the horrible thing manually from my DDS mail; normally anything like it would not get forwarded. So perhaps not a perfect subject for experiment. Headers different.

After a download to Outlook with a delete after date of 4 days old, which should have saved all mail in my Inbox which was all younger than that, I see all the mail, including the one you quoted, marked as read. Nothing has been lost.

However I am now going to delete, and permanently, that little "jewel", so I expect it will thereafter also be gone from the server, so I can't and won't experiment further with it.

Could it have been that you also deleted the filthy things completely from your Outlook, but that the checkbox/tickbox "Remove from server when deleted from 'Deleted Items'?" in the Internet E-mail Settings was also ticked?

[Spamnophobic]

Update to the above: when I looked on the server it was actually still there. However to delete it permanently from Outlook I did a shift-delete. I realised that "Remove from server when deleted from 'Deleted Items'" probably means very precisely what it says. So you may be able to permanently delete the item from your mail client, which I'm sure you would want to, but leave it on the server by doing a shift-delete.

Another thought: Do you use more than one Outlook profile? The "leave on server, days" number is associated with the profile, so could it be that another profile is removing the message earlier?

If all else fails you could run a packet capture tool during the POP3 session to see if and where Outlook is telling the server to delete the mail.

[grwsmith]

Could it have been that you also deleted the filthy things completely from your Outlook, but that the checkbox/tickbox "Remove from server when deleted from 'Deleted Items'?" in the Internet E-mail Settings was also ticked?

The "Delete items from server when deleted from deleted folder" was not ticked. But it is now - saves some time?!

I still have no idea where the messages are coming from. However, I have installed SpamSource as an Outlook add-on and thereby reporting the illusive spam direct from Outlook. This also save me going into the Spamcop webpage to individually report the spam that get through Spamcop filters.

Another question: What do people do with the spam that goes into the HeldMail folder? I have been quick reporting them, is there any point doing this?

[dbiel]

Another question: What do people do with the spam that goes into the HeldMail folder? I have been quick reporting them, is there any point doing this?

The answer is yes, it adds another report to the file which then is used to determine just how long the IP address remains on the SCBL. Also note, there are other filtes that can put mail in the held folder and those filters have nothing to do with the SCBL, so the only way to affect the SCBL is to report th mail.