[SC-Help] Re: The next step??

[Mike Easter]

antioch wrote:

> I have at last managed to submit spam for parse :-) :-) :-)
> I started with O.E. email, then tried copy/paste into the parse box,
> but HQ pointed out(very nicely) that I was doing all these with
> double headers.

I don't understand how you would get whatever is 'double headers' by
accessing the mail's properties as described in the faq for OE to paste
into the parser.  OE/ File/ Properties/ Details tab/ Message source
button. - select copy paste into the webparser.

> I have, I think, cant see how to check, signed in as a mole :-)

If you are registered as a mole, then you won't see any 'real' address
to report to in the phase of the operation in which you are to report vs
cancel, you will only see a devnull address, ie mole <at>
devnull.spamcop.net

Mole reports don't do much of anything, most importantly they don't
contribute to the SCbl blocklist.

> Am I being of any use or service to SpamCop if I only send the
> suspect spam emails.

What is a 'suspect' spam email in this context?  Presumably a reporter
would only be reporting what they believe to be spam.

> I have read about 'reporting', which I understand is when you send
> your suspect spam to someone else(whom to send it to I have yet to
> establish), but I have been put off by the scare of getting
> retribution.

In the case of regular spamcop reporting, the reporter who is not a mole
submits the spam to the parsing reporting algorithm.  The parser
determines the reporting addresses as best it can for the providers for
the spamsource and spamvertiser, and configurably and by default munges
the To address and any obvious occurrences of that address presumably
obfuscating the address of the reporter.  The parser reporting tool
offers to make the report to various entities on that basis, any and all
of which can be unchecked.

If a regular reporter allows a report to be made to a spamsource
provider address, then the spamsource IP counts toward the SC blocklist.

> I still do not know how or what I am reading when I get the info from
> doing a parse.

The verbose version of the parse is trying to tell you how it determined
the source IP from the header and who it recommends to notify about
that.  It also tells the IP of any found spamvertiser link.  The
reporter is supposed to have sufficient knowledge of header analysis
that they won't report their own provider and is supposed to recognize
any found innocent bystanders in the body of the spam so that they can
be unchecked as spamvertisers.


-- 
Mike Easter
kibitzer, not SC admin