[SC-Help] Re: spam that looks like bounces

[Martin Edwards]

Mike Easter wrote:
> keith wrote:
> 
>>I'm sure this has been raised at some point, but there seems to be an
>>increasing amount of junk mail (leaving out the netsky stuff) that
>>looks like a bounce but with a prominent URL in it
> 
> 
> Bounces can have the original spam and the spamvertisement
> included/attached.
> 
> 
>>Is this a way of circumventing SpamCop's reporting system and is
>>there a way round it, like putting a false return address in the
>>headers and then removing it before reporting to SC?
> 
> 
> Almost all 'bounces' are actually bounces and cannot be spamcop
> reported.  The only 'way round' permissible is to use the parser on the
> original spamitem 'under' the bounce headers but to only report it
> /manually/, not with spamcop.  That is, spamcop can only be used in that
> way to determine the notify addresses for your /own/ manual report - not
> as a spamcop report.
> 
> This also applies to those items in which you have decided to 'read the
> mind' of the spammer and think that s/he was /thinking of/ 'bounce
> spamming' in the first place.  Even if you /can/ read the mind of a
> spammer, bounce spams are not spamcop reportable.
> 
I can't agree with your first comment: I get dozens of false bounces, 
many of them on a Netscape account, which show clearly that they were 
virus-generated because they have been stripped.  On days when the spam 
is not too heavy I do what you say: parse the header and report them 
manually.