[SpamCop-List] Re: Quick reporting?

[D. Campbell (remove obfuscation)]

"Martijn Lievaart" <m at remove.this.part.rtij.nl> wrote:

> I have several spamtraps that are 100% sure to receive only spam. I've
> monitored them for a year now and not had one false positive. Not
> surprisingly really as most of them are made up by the spammers
themselves.
>
> Would it be sensible to make these forward to my quick report address? I
> no lart them manually (as in, mailserver forwards to submit.*@spamcop, I
> receive notification and review before pressing send).
>
> As I never used auick reporting before, I'm not to sure it does what I
> want, maybe someone can explain?
>
> TIA,
> M4

Addressing only the technical issues:

You'll have to wrap the offending messages in enough MIME that they
show as an attachment.  A message simply forwarded will appear to
come from the spammer to your submission address and will as such
not include anything for the parser to see as your submission.

Doing this politely would involve letting the messages queue up a
bit before you send them to Spamcop so SC sees one mail message with
10-50 messages attached.  That reduces traffic between your mailhost
and the spamcop parser.

If you already have this working with your submit.blah at spamcop address
then you've solved the MIME wrapping issue.  Your next problem becomes
dealing with the spamcop responses.  You'll get one per submission to
spamcop, regardless of how many messages that submission contains.  If
you're submitting each message individually you'll get LOTS of responses.

To match replies with complaints you really have to hang onto those
automatic responses, which contain the spamcop report numbers and the
associated tracking URLs, for a week or two.  I submit 2-5 times per
day and keep the responses for a month.  I've had no instances where
I couldn't match a sysadmin response to a specific complaint with that
month of spamcop autoreplies online for full body searching.

If you're submitting complaints one-by-one, even with an automated
submission process, I hope you're a paid subscriber to the spamcop
service.


Addressing the non-technical issues:

Quick-reported submissions finger only the message source.  By opting
out of the review process where you stare at a web page for a few
seconds and click the yes, its spam button, you're opting out of spam
body parsing.  Links in your spam messages won't appear in Spamcop
URI-BL databases and associated blacklists.

Spamcop is built around the assumption that a human has, at some point,
looked at the message and determined it to be unwanted.  If your automatic
bypass does wind up submitting false positives, it should do so at a rate
lower than the error rate you'd expect from human-moderated submissions.


My 2c.  Paypal contributions for more advice always welcome.  :)

d.