[Resolved] munging address option general question

[kae]

I have a general question about munged headers/addresses. I know that this has to have been asked before, but I can't find anything that addresses this in particular.

There seems to be two sides to reporting email. The one side is reporting email as spam from webmail, the other side is "Reporting spam" using the mailsc.spamcop.net webform. The only munge option that I've seen is in the preferences tab of the mailsc.spamcop.net webform. I currently have that set to not munge my reports, but most of my reporting is from the webmail form (either reporting held mail or from the inbox) which generally comes from accounts that are different from my spamcop email account.

When I first started my spamcop account, I chose to munge headers, then I got the impression from the forum (a while back) that munging wasn't good and that munged headers were not used for reporting but only for statistics. So, I went back and changed my preferences in the mailsc webform to not munge headers. Anyway, I've noticed that the spammers are now putting email addresses in their Subject lines. Here's a tracking URL: Sample Message.

When you pull up the tracking URL, the email address is replaced with 'x' (even in the Subject line), but when you select the link "View Entire Message" the email information is put back. At least when I started writing this it was there. I'm assuming that the spammer is putting my email address in the Subject line so that they can tell who is reporting them.

I guess my question is this: Am I still munging headers (since the email addresses are x'ed in the tracking URL), or am I no longer munging headers (since viewing the entire message shows the email) or at least it did show my email address?

As a side note, the spammer also put my email address as the sender, which seems to always show.

[Miss Betsy]

As long as there is an "x" where your email address was, your preferences are set to munging. However, you mentioned that, in the beginning, you were submitting only for statistics - that's 'mole reporting' and is not the same as munging your email address in reports. Munged reports are not accepted by all ISPs, but otherwise the munged reports are sent just as unmunged reports and are counted against the spamcop blocklist. Mole reporting does not generate a report and does not count against the blocklist. Munging (or having spamcop replace your email address with an 'x' or replacing it yourself before submitting) is not used by many reporters because it is not acceptable to all ISPs; spamcop misses a lot of instances and it is too tedious to replace them by hand; and it doesn't seem to make a lot of difference in the amount of spam. When spam reporting first started, the argument for munging was to protect oneself from retaliation and to prevent the spammer from 'listwashing' (removing your email address from his mailing list so that he wouldn't get reported again). Now, there are too many reporters for retaliation to be effective and since most spam is sent from zombies, spammers don't worry about getting reported because there is no one to shut them down. The current tactic is to send to as many addresses as they can get their hands on, hoping that some of them will be real addresses. They even harvest addresses from spamcop reports (another reason munging is still practiced by some).

There is probably no ulterior motive about having an email address in the subject. It may be a ploy to get past filters and probably is done just the way email addresses in the FROM are. You probably aren't the only one getting your email address - everyone for that part of the spam run is getting the same thing.

Since I don't have a spamcop email account, I am not sure whether setting your preferences on the spamcop website changes the preferences for your spamcop email account. I would think that it would, but possibly not.

I hope this answers your question. I have a feeling that it might raise more questions.

Miss Betsy

[kae]

Thanks for your reply Miss Betsy. It did answer the munging question I had. It confirms that my reports still munge (or expunge) my email address out of the headers.

At this point, my reason for reporting is to be as helpful as possible in order to get the spam reported. If that means it's better to not munge, then I'd opt for that. I'm assuming at this point that not munging reports adds additional places that will accept my spamcop reports.

The only "retaliation" that I've gotten is that once in a while a spammer sends out a bunch of email spoofing the from address with my email address. When that happens, I usually get about 60-100 return messages for email addresses that are either no longer valid or whose inbox is full. It usually only lasts for a day and then it's back to my normal load of unsolicited email.

I do have my "spam Munging" preference set to "Leave spam copies intact", which brings up the question, how to I get the reporting engine to stop munging?

I looked through the webmail options and didn't see anything that talked about munging, so I'm guessing that the spamcop reporting preference page must drive the reporting engine, but I guess if that's the case, is there a known problem with changing the munge/mole/unmunge preferences? Maybe once you choose, then that's the option you have to stay with.

You were right Miss Betsy, it did bring up more questions. ugh. Sorry about that. I'll go back and do some more searching in the forum and FAQ. Maybe there's something there. I know this isn't the first time this has come up and I swear that I've read this in the forum somewhere.

Thanks again!

I did find this on mole reporting, which is the forum discussion that I wrongly remembered as munged reports. Miss Betsy correctly pointed out that it was "mole reporting" that only updates the statistics and not the block list. My bad.

Maybe I should send a Problem report?

[Wazoo]

Mixing and mashing many things in your query.

Yes, WebMail has nothing to do with the actions taken by the Reporting system. Once again, these two functions happen on hardware located on different coasts of the U.S. ... hardware is owned, run, and maintained by different companies/people ,, your method of Reporting that is actually addressed and defined in the SpamCop FAQ here, Wiki, Glossary, Dictionary, etc. is actually a bit of a software hack, basically asking the Reporting System to reach across to the WebMail system and pull data from "your" Held Folder ....

Your suggested retaliation would be better described as your luck-of-the-draw as to what address the spammer(tool) added into the From: / Reply-To: address bits on the spam headers.

Your munging results .... different data displayed between the actual Reporting phase and the 'historical' mode via a Tracking URL. spam content 'saved' on the Reporting System (for approximately 90 days) is munged. To see what actually went out, you want to look at the Preview of the Report when it is generated (before you hit the Send/Submit button) There is also the difference between you viewing your spam Report and someone else looking at that spam Report.

[Miss Betsy]

I frequently cannot find what I want to know in any FAQ - some people seem to have the knack and some don't. This time I was looking for something that would answer your question about how to change your options.

Wazoo confirmed that the reporting side preferences are what control the munging. You might just try reviewing your preferences to make sure that everything is set the way you want. Sometimes I could have sworn that I had something checked and when I looked it wasn't. And, check to make sure that what you are looking at is current as Wazoo points out.

Also, he is correct that 'retaliation' is not the word for seeing your email address in the FROM and getting misdirected bounces. It is simply a random effect of the way spammers work.

Sorry that I cannot be more explicit.

Miss Betsy

[kae]

Thanks for the responses. As Wazoo pointed out, I was able to see that my reports were not being munged in the Preview Reports. I didn't know that the stored reports in the Tracking URL database are always munged, so that puzzlement was answered. Now I know that I'm not munging anything, which is good.

I had put "retaliation" in quotes as a way of really saying that it didn't seem like much of a retaliation. I does certainly make it less personal to know that it was probably just picked randomly out of a list of email addresses.

Thanks again!