[SpamCop-List] Re: sending report directly to the spammer? Why

[Mike Easter]

eddie wrote:
> Again, I use SC's website for all my spam processing and reporting.
> If you put the above IP into SC's online web parser you will see the
> result I got which is:

The best way to 'talk about' how SC wants to notify for an IP or url is
to post the tracking url rather than simply isolate the IP and feed it
to the webparser.  What you posted below looks like it is copied and
pasted from the verbose output, which has a tracking url at the top.  A
tracking url looks like this in context:

This page may be saved for future reference:
http://www.spamcop.net/sc?id=z544619786z2d58afe844b85bea6bc28bceafc4aeec
z

but I usually just post the 'www' so it won't break at the wrap

www.spamcop.net/sc?id=z544619786z2d58afe844b85bea6bc28bceafc4aeecz

When SC parses a 'real' spam, it is 'willing' to show you more
information about how it concluded about routing for a particular block
of IP addresses than it is willing to show you when you simply plugin an
IP address.

> "whois 61.253.119.190 at whois.krnic.net" (Getting contact from
>  whois.krnic.net) - not found
> host 61.253.119.190 (getting name) no name Falling back on IP
> addressing:postmaster@[61.253.119.190] Statistics:
> 61.253.119.190 listed in bl.spamcop.net (127.0.0.2) More Information..
> 61.253.119.190 not listed in dnsbl.njabl.org 61.253.119.190 not
> listed in dnsbl.njabl.org 61.253.119.190 listed in cbl.abuseat.org (
> 127.0.0.2 )
> 61.253.119.190 not listed in relays.ordb.org.
>
> Reporting addresses:
> postmaster@[61.253.119.190]

That stuff above comes from a 'real' parse.  Just pasting the IP gives
you/me this:

Parsing input: 61.253.119.190
host 61.253.119.190 (getting name) no name
Reporting addresses:
postmaster@[61.253.119.190]

> again, SC is telling me to report to the sender

That kind of address is not 'the same as' addressing something to the
'sender' where the 'sender' is the 'owner' or user of that IP address.
That kind of address is 'sorta' similar to sending the item to the
postmaster of the domain which the IP is in which we don't know because
the rDNS doesn't work.

> Try it yourself by putting the IP into the box on SC's "report spam"
> box. When I get these, which is occasionally, I uncheck that box on
> the SC report form and wind up only reporting to the IP of the
> spamvertized site. I do not pursue it any further than that.

It would be better to be talking about the spamitem rather than talking
about the notify for the IP.  We will all benefit more from these
discussions if we are talking about what *really* happened, namely that
a spam was processed and suchandsuch was the result.  That is in the
tracker, just one line, which reflects the entire story much better than
you are doing here or anyone else is doing here, because we are talking
about something more hypothetical than it was in the first place.

In the first place it was some part of a spamitem.  We should be talking
about that spamitem, not that IP.  We or I have been trying to get you
to post tracking URLs for some time.  It seems as if you don't know what
a tracking URL is.  It looks like what I posted up there before, I'll do
it again.

This page may be saved for future reference:
http://www.spamcop.net/sc?id=z544619786z2d58afe844b85bea6bc28bceafc4aeec
z

> Again, I suggest that SC install a "Report problem to SC" box on the
> report form, with a box for comments, to be sent to a deputy or
> someone who, like you, understands the problem better than I do.
> A feedback button or something like that. It would allow SC to collect
> some of the failed parsings and do something about it.

The better way to handle those issues is to talk about them here, as the
tracking url, and then if someone or a deputy wants to handling
something as a routing issue, there's a way to be dealing with that.

You aren't doing it right yet.

-- 
Mike Easter
kibitzer, not SC admin