[SC-Help] Re: The next step??

[antioch]

Hello Mike
Have you found that missing post yet, in the General????
My replies are spliced between mine and yours.
Thanks again for your help
Rgds
Antioch

"Mike Easter" <MikeE at ster.invalid> wrote in message 
news:e3vhsr$ia8$1 at news.spamcop.net...
> antioch wrote:
>
>> I have at last managed to submit spam for parse :-) :-) :-)
>> I started with O.E. email, then tried copy/paste into the parse box,
>> but HQ pointed out(very nicely) that I was doing all these with
>> double headers.
>
> I don't understand how you would get whatever is 'double headers' by 
> accessing the mail's properties as described in the faq for OE to paste 
> into the parser.  OE/ File/ Properties/ Details tab/ Message source 
> button. - select copy paste into the webparser.

Not difficult - here is the info sent -
>From HQ.
"There is something wrong with your submission because when I look at the 
spam you have submitted the headers appear twice.  This is resulting in an 
error, "Header data found in body, aborting link detection"."
I now use the Crt/F3/ a & c method - don't know why I didn't before!
16 of the emails submitted to SC are now marked as 'too old to file spam 
report.'  I may as well delete all of them as they are of no use.
Will have to find that out.
I have 5 others not showing this - yet.  I did not realise that there was a 
time period.  Can I take it the time(2 days) starts from the time I get the 
spam.  Then I have 48hrs to decide if I report or not??
As I have said before, how, where and to whom, I have yet to find out.

>> I have, I think, cant see how to check, signed in as a mole :-)

> If you are registered as a mole, then you won't see any 'real' address to 
> report to in the phase of the operation in which you are to report vs 
> cancel, you will only see a devnull address, ie mole <at>
> devnull.spamcop.net

Cant see any as you say with devnull etc address.  So I can't be a mole 
then.

> Mole reports don't do much of anything, most importantly they don't
> contribute to the SCbl blocklist.

>> Am I being of any use or service to SpamCop if I only send the
>> suspect spam emails.

> What is a 'suspect' spam email in this context?  Presumably a reporter 
> would only be reporting what they believe to be spam.

OK - forget the word suspect.

>> I have read about 'reporting', which I understand is when you send your 
>> suspect spam to someone else(whom to send it to I have yet to establish), 
>> but I have been put off by the scare of getting
>> retribution.
>
> In the case of regular spamcop reporting, the reporter who is not a mole 
> submits the spam to the parsing reporting algorithm.  The parser 
> determines the reporting addresses as best it can for the providers for 
> the spamsource and spamvertiser, and configurably and by default munges 
> the To address and any obvious occurrences of that address presumably 
> obfuscating the address of the reporter.  The parser reporting tool offers 
> to make the report to various entities on that basis, any and all of which 
> can be unchecked.
> If a regular reporter allows a report to be made to a spamsource
> provider address, then the spamsource IP counts toward the SC blocklist.

>> I still do not know how or what I am reading when I get the info from 
>> doing a parse.

With the most recent parsed spam I have the following 'headers'
I believe;
Parsing header
Tracking message
Finding links in message body
Please make sure email is spam
Report spam to xxxxxxxxx
Re xxxxxxxx(silent report about source mail)
Then the click button choices
Send spam report NOW:Preview Reports:Cancel
(Do I use this cancel to get rid of all the out of time ones???)
Then there is the Attention box warning etc etc
>
> The verbose version of the parse is trying to tell you how it determined 
> the source IP from the header and who it recommends to notify about that. 
> It also tells the IP of any found spamvertiser link.  The reporter is 
> supposed to have sufficient knowledge of header analysis that they won't 
> report their own provider and is supposed to recognize any found innocent 
> bystanders in the body of the spam so that they can be unchecked as 
> spamvertisers.
>
Right, so where do I get this 'sufficient knowledge'.  Is it reasonable to 
expect me to do this reporting, without this knowledge?
I think that I have gone far enough for the moment.

> -- 
> Mike Easter
> kibitzer, not SC admin
>