[SC-Help] Re: The next step??

[antioch]

Hello again
I have again spliced and clipped below

"Mike Easter" <MikeE at ster.invalid> wrote in message 
news:e409bc$2k2$1 at news.spamcop.net...
> antioch wrote:
>
>> Have you found that missing post yet, in the General????
>
> missing?  general?

Sorry - confused you with another.

>> "Mike Easter"
>>> antioch wrote:
>
>>>> double headers.
>>>
>>> I don't understand how you would get whatever is 'double headers'
>
>> From HQ.
>
> Who is HQ?  Someone at SC?

Headquarters of SC

>> "There is something wrong with your submission because when I look at
>> the spam you have submitted the headers appear twice.  This is
>> resulting in an error, "Header data found in body, aborting link
>> detection"."
>
>> I now use the Crt/F3/ a & c method - don't know why I didn't before!
>
> I have some negative comments about ctrl-F3, but it works OK if the spam 
> is either open or being previewed, but I don't recommend either one of 
> those conditions for secure spam handling.

Yes, but for the moment I am doing it this way - my mind is on other 
matters.

>
>> 16 of the emails submitted to SC are now marked as 'too old to file spam 
>> report.'  I may as well delete all of them as they are of no use.
>
> They are no good for reporting, but they would still be good for
> educational or demonstration purposes and they can still provide a
> tracker for discussing if you wanted to.  The condition of a spam too old 
> or being a mole reporter isn't really much different, as neither one 
> contribute to the SCbl.
>
>> I have 5 others not showing this - yet.  I did not realise that there
>> was a time period.  Can I take it the time(2 days) starts from the
>> time I get the spam.  Then I have 48hrs to decide if I report or not??
>
> SC has two different ways of determining the age of a spam, one designed 
> for mailhosted accounts and one for non-mailhosted.  The 'simplest' and 
> cleanest is for non-mailhosted where SC uses the timestamp of the first 
> good Received traceline.  As a general rule a nonmailhosted account's 
> spamclock starts when the item arrives in your mailbox.

Thanks for the clarification.
>
>> Cant see any as you say with devnull etc address.  So I can't be a
>> mole then.
>
> Okay.
>
>> With the most recent parsed spam I have the following 'headers'
>> I believe;
>> Parsing header
>> Tracking message
>> Finding links in message body
>> Please make sure email is spam
>> Report spam to xxxxxxxxx
>> Re xxxxxxxx(silent report about source mail)
>
> Silent sounds like a mole to me.

So I will have to change that and come out into the light to be able to 
report.

>> Then the click button choices
>> Send spam report NOW:Preview Reports:Cancel
>> (Do I use this cancel to get rid of all the out of time ones???)
>
> Generally if a spam is too old, you don't have a chance to cancel or
> report, it is just too old.

OK, so they just stay there in my record of what I have parsed.

>
>>> The reporter is supposed to have sufficient knowledge of
>>> header analysis that they won't report their own provider and is
>>> supposed to recognize any found innocent bystanders in the body of the 
>>> spam so that they can be unchecked as spamvertisers.
>>> Right, so where do I get this 'sufficient knowledge'.
>
> Heh.  Yeah.  I think you should know some things about the 'elements' of 
> the Received tracelines vis the name or IP of your own provider

That bit I do recognise - my IP - at the top of the parse result, sorry 
received tracelines.

>
> Recall that when this conversation started I was encouraging you to
> provide a tracker for one of your spam parses, and also gave you an 
> example of one of my own tracking URLs.  You still have not posted your 
> own tracker yet.  You are spending a lot of words trying to describe 
> something which I could see in much more 'vivid' and real detail if you 
> would post a tracker.  Remember what a tracker is?

I had no idea that was what you were talking about.
How is this - my latest offering - is this what you were expecting.

http://www.spamcop.net/sc?id=z940869391z3c9254dd5fe391887143f61e62e65880z


> >  Is it reasonable to expect me to do this reporting, without this 
> > knowledge?
> I am sympathetic to your fears of being a 'bad' or mistaken reporter. For 
> a long time as a spamcop neophyte, I only used the parser to parse spams 
> which reports I cancelled while reporting them manually.

Plus the thought of being made a target by one of these spammers does not 
encourage reporting just yet.

 I think that I have gone far enough for the moment.
Many thanks again - sorry for the misid.
Its bedtime here.
The hum of my comp annoys 'her indoors'
Rgds
Antioch