Automate Spamcop Submissions

hausmasta writes "Spamcop is pretty much dependent on user input. If no one submits and verifies spam, then they will have no blacklist. However that whole submission and verification process is a bit annoying. Why should I bother to actually submit spam to Spamcop and have it verified? If I just delete it, that will take less time.. This tutorial shows how to automate the Spam Cop submission and verification process. All I do is just put the spam into certain folders and our good old friend cron does the rest."

Comments

great...

[dhruvx]

I guess this will make it much faster to build black lists. But doesn't this also increase the potential risk of submitting wrong messages?

Re:great...

[alfs boner]

I was a religious SpamCop user for awhile. You tattle to SpamCop on a spam you receive, it checks its various databases, and then notifies various network authorities of the problem.

Problem being, that several of the network authorities are huge megacorps where the complaints get filed with the rest of 98,000 or are spamhosts themselves.

I gave up in favor of SpamAssassin and Mozilla's spam filtering, which turned out to be far more effective.

Isn't effectiveness the whole reason eight-year-olds tattle in the first place? ("Billy hit me!" Billy gets in trouble. (And Tommy gets beaten up after school.)) Somehow, I don't think enough spammers got in trouble.

Spamcop TOS?

[ArsenneLupin]

Is this compliant to Spamcop's terms of services? Automating might make it too easy to accidentally submit false positives...

Re:Spamcop TOS?

[Ph33r th3 g(O)at]

I don't think they prohibit automated reporting. I wouldn't point it at a Spamassassin-controlled junk folder, though. I would rather scan the messages and drop them into a designated folder, which is what it looks from the writeup what his approach is.

Re:Spamcop TOS?

[FOSSguy]

Not sure how it goes with the TOS, but I wrote something like this myself a year or so ago. I wrote two scripts in perl:

The first checks a particular IMAP folder for messages and if there is anything there, it bundles them up and sends them off to spamcop as MIME attachments to a single email. (Spamcop can handle *lots* of individual spam items as attachments to a single message to the submission address. I don't know exactly how many, but I've sent upwards of fifty in a single pass, and spamcop has always accepted them, never complained).

The second does a cookie-login at spamcop, checks for any parsed spam waiting to be submitted, and walks through the submission process. My script unchecks the 'third party interested in spam' recipient, 'cos I've never been entirely sure about the motivations of that company).

Both of the scripts are called by cron at appropriate intervals

As for false positives, the only ways that things get into that particular IMAP folder are if they were addressed to one of a handful of known-bad (as in so inundated with spam that they never recieve anything else and I don't use them anymore) or I've personally identified the message as spam, and physically drag/dropped it into that particular folder for processing.

If anyone wans copies of my perl code, drop me an email. I'll clean it up and pass it on. Put [slashdot spamcop] in the email Subject: line.

stupid idea

[Anonymous Coward]

please make sure to unsubscribe from all mailing lists you subscribed to before doing this.

NO NO NO

[Anonymous Coward]

Apparently you've missed the point of SpamCop. YOU are still supposed to VERIFY that EVERYTHING you submit is ACTUALLY SPAM. False reports hurt SpamCop and all SpamCop users.

If you want to cut down on Spam, then tighten you filters and reject it at SMTP level. Then anything that still makes it through, submit it to SpamCop. Automating your initial submission is okay, but DO NOT AUTOMATE THE VERIFICATION PROCESS.

Re:NO NO NO

[Ph33r th3 g(O)at]

From the FA:

"Spamfolder"
Then you need to create a folder where you put all your spam into.. . .

This looks to me like his intent is to automate the SpamCop submission process, not the verification process.

Re:NO NO NO

[Anonymous Coward]

From the FA:

Spamcop form submission script

Well, so far we have forwarded all spam emails to spamcop, received their verifcation emails containing the ID for the form submisson and sent that data to a PHP script.
Now you create...

He's automating the whole process.

Re:NO NO NO

[ljc86]

Agree in principal, but he's talking about a way to fast track the actual process - so manually placing e-mails in a folder and then not having to jump through hoops to submit.

Of course, if users then misuse it by setting up filters to automatically put mail in there...

Re:NO NO NO

[Ph33r th3 g(O)at]

The key words to me were "where you put all your spam into." I read this as meaning that a human, not a script, would be filling the folder. Unless the Spamfolder is populated automatically, this process could be compliant, and I could certainly have missed something, but I don't see where he says he's doing that. In any case, someone submitting legitimate email to SC won't keep his account long.

Re:NO NO NO

[AaronLawrence]

The point is, that YOU should CHECK the results of spamcop's parsing, to make sure something dumb hasn't happened - like listing your own provider as the spammer.

This can happen outside your control because your email provider has changed configuration and messed up headers.

Spamcop only needs small numbers of properly checked submissions. Piles of submissions don't help - it's not a statistical process like Bayesian filters.

Re:NO NO NO

[sporkmonger]

Mod parent up.

Beyond just that, blacklists like SpamCop constantly block legitimate mail, especially from webmail providers like GMail. For awhile, virtually every message I sent from GMail was blocked by various spam filters because SpamCop decided to put Google's ip addresses on their blacklist. That was a very frustrating two weeks.

Frankly, I discourage the use of SpamCop altogether. Content-based filtering does a good enough job.

Re:NO NO NO

[stunt_penguin]

Um yea true- but I think everyone's missing a point- surely a one click/step/time-setup solution is the way that spam reporting *should* work. I mean, in Thunderbird if you hit the 'J' key the machine will mark it as junk and add that mail's data to the spam filter's aggregated data.

Surely any spam software shoudl work in roughly the same way?

Re:NO NO NO

[AaronLawrence]

No, because if you make a mistake submitting to spamcop thousands of people will feel the effects (potentially). Make a mistake in your own junk mail, its only you that gets hurt.

Re:NO NO NO

[stunt_penguin]

Hang on, surely a single accidental submission to Spamcop doesn't make a significant difference to the overall picture. That would make it much too easy to do as you say, to accidentally block a valid sender, but to also maliciously blacklist an entire company's email with a few clicks. If the software isn't set up to ignore the few wild submission results from the overall spam data it gets, then it isn't worth having.

Re:NO NO NO

[Net_fiend]

I don't know what perspective you guys are reading this from, but since I work for a small ISP I see it from that point of view. And I can see how it could quickly become a problem if it were abused. ATM there has to be some manual work in digging through e-mail to determine whether something is legit or spam, and if its spame where it actually originated from. I can't count the number of times I'll get an e-mail from some ignorant person using gmail or yahoo declaring that a customer of ours is sending spam when in reality its someone spoofing our domain (which no one can prevent). Utilizing SPF is somewhat of a wash because in order for SPF to work everyone needs to use it otherwise those who don't use SPF get the spoofed messages.

Re:NO NO NO

[Chandon Seldon]

No, a couple of invalid submissions to spamcop aren't too big a problem.

The thing is, spamcop has more than one user. The people providing the service have determined that single-click accuracy is not high enough overall and therefore require that their users verify their submissions (in most cases).

Reporting from webmail (e.g. gmail, hotmail)?

[Ph33r th3 g(O)at]

Give me the ability to check my spams and submit them to SpamCop (rather than having to go through each webmail's contortions to get full headers) and I'd have lots more food for the SCBL. On my personal server, I block all of LACNIC and APNIC, so I don't get much spam there.

considering all the damage RBLs do ...

[Anonymous Coward]

... you might want to reconsider using any of them. Lots of companies that have nothing to do with spam have been targetted due to proximity in IP space, or using a provider the RBL maintainer hates.

RBLs are a waste of time, they give immense power to a few individuals and groups, more often with an axe to grind. Do you really want to do that? Rhetorical question, you don't.

Re:considering all the damage RBLs do ...

[Ph33r th3 g(O)at]

What other means do you have in mind to get providers to stop carrying spammers' traffic? If one subscribes to a pink contract ISP and can't get one's legitimate email through, the obvious solution is to change ISPs. This gets your email through and deprives the rogue ISP of revenue. There's nothing immoral or illegal about that solution--users of RBLs have a right to refuse mail from anyone they wish, and customers have the right to choose ISPs with good reputations whose IP space won't be blacklisted.

Re:considering all the damage RBLs do ...

[AaronLawrence]

Spamcop specifically avoids those two problems (though it has others).
It only blocks specific IPs identified as sources of spam.
And it only blocks due to submitted spam - no manual entries.

So, your comments are irrelevant to spamcop.

Re:considering all the damage RBLs do ...

[Russ Nelson]

Different DNSBLs have different policies. Spamcop's simply happens to suck, but that doesn't mean that everybody's does. For example, spamhaus's listing are very reliable.

Re:considering all the damage RBLs do ...

[Anonymous Coward]

RBL?

It'd be nice if you define your acronym at least the first time you use it, because I have no fucking idea what you are talking about.

Re:considering all the damage RBLs do ...

[Anonymous Coward]

According to Wikipedia, it stands for Realtime Blackhole List.

It also stands for a couple of other things, but artillery and crappy hip-hop groups don't seem as relevant to this discussion. Although I suppose they could all be used to reduce spam in some way... ;)

Re:considering all the damage RBLs do ...

[Anonymous Coward]

Anyone reading Slashdot who doesn't already know the expansion for RBL is Realtime Blackhole List and what it is, or isn't willing to take the time to Google for it, isn't informed enough to be entitled to an opinion on or to make commentary about this topic.

Re:considering all the damage RBLs do ...

[Anonymous Coward]

It only blocks specific IPs identified as sources of spam.

While this is literally true, the problem is what you mean by "identified". In practice, it means that any random schmoe on the Internet can get your IP blocked for whatever reason they feel like.

Here, let me give you some simplified example headers that got one of my IPs (mx1.mydomain.com) blocked a while back:

Received: by mailhub.isp.com from mx1.isp.com
Received: by mx1.isp.com from h4324703067.dialup.cable.net
Received: by h4324703067.dialup.cable.net from mx1.mydomain.com
Received: by mx1.mydomain.com from localhost

Do you see the problem here? Some spammer, via some random zombied PC on a cable modem forged headers to tell some random ISP that the spam it was sending it was from my IP. And SpamCop, in its infinite wisom, believed what the spammer told them and therefore "identified" my IP, and not the cable modem IP.

I think they may have fixed this particular idiocy, but the core problem with SpamCop remains (and don't even get me started on their hair-trigger, non-SPFed or DomainKeyed spamtrap addresses).

SpamCop uses easily-forgable information passed to it by random fallible or untrustworthy people on the Internet to decide whether to list you or not. And then some idiot mail admins use it as a sole factor in whether to accept your mail or not.

And SpamCop encourages them to do so! Buried in the middle of one paragraph of their docs is "don't block the mail as documented here, but store it in a separate mailbox", but they don't even hint how to do so, and all the example implementations instructions they give result in complete blockage. If you give people instructions that say "do this, do this, do this" all over the place, but then have a little footnote on another page that says "don't actually do any of that," what do you think they will do?

Re:considering all the damage RBLs do ...

[Anonymous Coward]

Why not use greylisting instead? It penalises IPs based on their mail sending behaviour, not on their allocation method.

Re:considering all the damage RBLs do ...

[hausmaus]

RBLs are a waste of time, they give immense power to a few individuals and groups, more often with an axe to grind. Do you really want to do that? Rhetorical question, you don't.

Hear, hear! You're absolutely right. What gives these few individuals the right to decide where my email goes to based on their so-called "blacklists"? The key word is "individual" - each person should control their own "blacklist", not have one gigantic problem.

This is akin to the sad state of our public education system - leave the education of children in the hands of a few and look what happens.

Spamming Spam Cop

[Anonymous Coward]

The new Darwin award goes to....

Spamcop webmail

[daybot]

I used Spamcop's paid webmail service before Gmail came along. Naturally, it had semi-automated reporting. It took me to a reporting page with all the mail it thinks is SPAM and all those I've personally tagged and I had to tick all those I wanted to report.

I did "Select All" and went through the list looking for false positives. This process was only time consuming if you didn't do it regularly and it reassured me that I knew everything that was being reported was indeed SPAM.

Just deleting it will take longer

[Tim C]

Oh sure, it's quicker for any given email, but if you just delete it, Spamcop will never know about it. If Spamcop never knows about it, it'll never block it. If it never blocks it, you'll just keep on getting the spam. The more spam you get, the longer you spend just deleting it...

I have spamcop turned off

[JanneM]

I have spamcop checking turned off. Maybe because the service is tuned to north american audiences, I don't know, but its recommendations seem completely arbitrary and frequently mistakenly marks genuine email for me. With two emails (from a legitimate source) one can be marked OK, the other one not.

By contrast, local filtering generally works excellenty. When I finally turned off all on-line checking, I have a perceptible bump in the quality of filtering.

Re:Dependant

[Anonymous Coward]

http://dictionary.reference.com/search?q=dependant

At the bottom:

"dependant
adj 1: contingent on something else [syn: dependent, qualified]"

spamcop blows

[Anonymous Coward]

they constantly list and relist one mf my servers because it bounces mail back to them. well, it is not a bounceback. it is an auto reply to a mailing list submission that customers actually use.
measuring the mail we get from non-customers, the amount of mail that is not valid that gets a reply is negligible.

yet, spamcop decides that ALL auto replies are spam.

the only explanation I can come to is that most of that mail is from their super secret spam finding system.

wrong.

Re:spamcop blows

[Russ Nelson]

yet, spamcop decides that ALL auto replies are spam.

Yup. They're attacking the symptom of forgeries (misdirected auto replies) rather than the cause of forgeries: unsigned email. DomainKeys will get rid of 99% of all forgeries. Instead of blocking sites that send auto replies, they should be blocking sites that don't sign their email with DomainKeys.

Or perhaps less radically, they should block sites that send auto replies to email with a forged DomainKey.

Re:spamcop blows

[Anonymous Coward]

When you send an auto-reponse to a spam message which has been sent to you using a forged the envelope-from address you are sending unsolicicited email to someone who never initiated any communication with you to begin with. You are sending SPAM! If you rejected mail during SMTP you would not be sending unsolicited email at all.

How many sites publish DK/SPF anyhow? Maybe 5% at the most?

Re:spamcop blows

[Ph33r th3 g(O)at]

I publish SPF records and still get bounces from forgeries constantly. I do get the occasional enjoyment of clicking a challenge/response link that lands in my catchall address to help show people using these annoying ineffective systems the error of their ways :).

Re:spamcop blows

[alfs boner]

I used to be an avid SpamCop user for awhile. Tattle on spam to spamcop, and spamcop tells different network authorities about the problem after it looks through some databases.

Problem being, that several of the network authorities are huge megacorps where the complaints get filed with the rest of 98,000 or are spamhosts themselves.

I gave up in favor of SpamAssassin and Mozilla's spam filtering, which turned out to be far more effective.

Isn't effectiveness the whole reason eight-year-olds tattle in the first place? ("Billy hit me!" Billy gets in trouble. (And Tommy gets beaten up after school.)) Somehow, I don't think enough spammers got in trouble.

Re:spamcop blows

[Anonymous Coward]

If you rejected mail during SMTP you would not be sending unsolicited email at all.

Some kinds of backscatter are pretty much impossible to do at SMTP time if you have a reasonably distributed email architecture:
1) "Hi, I'm out of the office. I'll read your mail when I get back tomorrow. If you need something in the meantime, contact Bob."
2) "Hi, we accepted this message earlier, but it looks like the user has gone over quota and we haven't been able to deliver it. You might want to try calling them."
3) "Hi, it looks like you sent mail to foo-subscribe and are trying to subscribe to our foo mailing list. Reply to confirm and activate your subscription."

In normal circumstances, these are really nice messages to get, and guess what? Most people like them and find them valuable, and users demand them!

Sure, these can be a problem if the envelope sender didn't actually send the message, so what's an admin to do? Well, fortunately we have ways to authenticate the sender: SPF and DomainKeys. And you can also check the spam score of the message, and check for bulk or autoresponse headers and so on. These are all things a responsible admin might do in his attempts to satisfy his users and still do the right thing. And SpamCop itself recommends that you check DK/SPF.

But guess what? It won't do you any good, because:

How many sites publish DK/SPF anyhow? Maybe 5% at the most?

That's right, despite their recommendations, SpamCop's own spamtrap addresses do not publish SPF or DomainKeys records. They run a service that complains in a most vociferous way if it ever receives one tiny bit of backscatter, but they won't take even the simplest of steps to prevent it. If any site should publish SPF records, it's a spamtrap! Seriously, how hard is it to publish a freaking SPF record?

So then, you get blocked by various sites that use SpamCop as a blacklist (exactly the way SpamCop tells them to), and the pairs of users involved have no clue what's going on, and you end up trying to get a hold of some remote mailserver admin to explain SpamCop's listing policy to him and convince him that it's a good thing that his customers be able to communicate with people with whom they have business relationships, and he tells you the guy who configured the mail server was a consultant, and he has no idea how the blacklisting works, and he's running Joe'sMailServer 1.0 and wants you to help him fix it, as if you're not already behind on other projects because of this whole situation...

You see? You start off happy and trying to do the right thing by your users and by the world, and SpamCop's retarded policies come in and make you hate your life. Shouldn't email be about helping people communicate instead of walking through the anti-spam crusaders' minefields?

Re:spamcop blows

[Anonymous Coward]

yet, spamcop decides that ALL auto replies are spam.

They're bulk, and they're unsolicited. Auto-replies to forged emails are spam. As are challenge-response messages. And virus notifications.

Re:spamcop blows

[binaryspiral]

Somehow, I don't think enough spammers got in trouble.

Yeah, lets meet them at the bike racks at 3... we'll show 'em.

Re:spamcop blows

[Russ Nelson]

using a forged the envelope-from address you are sending unsolicicited email to someone who never initiated any communication with you to begin with.

As far as I can see, this is the industry consensus definition of spam: http://crynwr.com/spam/definition.html

When somebody forges one email and I bounce one email back to that address, in what POSSIBLE way is that "bulk"? Spam isn't spam unless it's sent in bulk. Undesired email is not spam. Spam has to be sent in bulk, otherwise it's just email. Unwanted, perhaps, but just email.

A frog-like idea

[gsasha]

Well, submitting the mails may be interesting, but here's a (probably) even better idea.

1. Maintain a repository of scripts for offending webshops (can be based on SF, or distributed by P2P). Each of the scripts goes to post a complaint in BlueFrog-like manner.
2. Write an extension to Thunderbird (and maybe to others as well) that, when I click a "Junk" on a mail, goes and fires the corresponding complaint script. Alternatively, have a cron job for that.
3. ???
4. Profit :)

Well, look, this is much less questionable than Blue Frog's approach - I'm actively and individually complaining on the spam I got. I don't have the registry of those who want to be exempted - just to annoy the spammers and drive them out of business. What the program actually supplies is automation of the complaint process, without which I, arguably, would not bother complaining - but if it's just one click, I may choose to do so!

You don't seem to understand how it works

[Anonymous Coward]

SpamCop parses the email, and unless you've got some great regexs in your brain, reading the email's source isn't going to give you the same output. SpamCop may read the headers or body differently than you did, possibly selecting innocents, which you're supposed to manually look at and decide on.

Re:You don't seem to understand how it works

[Anonymous Coward]

Then SC shouldn't accept submissions via email, which bypasses the manual check of the parsing process, if that's a concern for them.

Re:You don't seem to understand how it works

[Anonymous Coward]

Step 1. You submit the spam to Spamcop.
Step 2. Spamcop parses it and notifies you that it's ready for your to inspect
Step 3. You inspect the spam to verify that it is spam and no innocents are being sent reports.

Automating step 1 isn't the problem; automating step 3 is. He's using PHP to fake a form submit to automate step 3, and that will hurt SpamCop.

Re:You don't seem to understand how it works

[__aaxwdb6741]

Step 1. You submit the spam to Spamcop.

How about:
Step 1. You submit SPAM to Spamcop, that you know 100% for sure without doubt is absolutely nothing but pure, clean and uncut SPAM?

You know, a human is much better at detecting spam than any regex is. If you dont submit non-spam emails in the first place, then you dont need step 2 and 3. And what this guy is doing (As far as I understand) is to put actual SPAM in a specific folder, and letting cron take care of the needless steps 2 and 3.

Let me stress this once more - A human brain is much better at detecting spam than ANY machine. If that were not true, we wouldnt even NEED things like SpamCop or any other spam protection, because SPAM would die out on the spot if machines were better at detecting spam than humans.

If I recieve an email telling me about penis enlargement or viagra, I will without doubt know that I have never in my life asked anybody on this planet to inform me of such products.

Re:You don't seem to understand how it works

[Anonymous Coward]

Sigh... you're still not understanding how it works. SpamCop isn't a Bayesian filter. It simply scans messages you submit for the mail servers a message came through and any included links in the email. Then you have the option of sending automated messages to the admins for those netblocks/ISPs. But what if that email contains a legit website that's simply been added by the spammer to potentially hurt them? Or what if your mail route has changed slightly, causing your own ISP to appear to be the last untrusted mailer in the chain? That's why a human needs to inspect the reports. If you take that out it just creates false positives that hurt all the users.

Re:You don't seem to understand how it works

[hynakin]

Well, I also make use of Spamcop just because I dont like and on the website I normally leave anything as it is... I don't know what half of this addresses are and hence I don't care... all I want is just reduce the amount of spam I got.
So I like this approach that I filter first what I consider as spam and then let the computer do all the rest about submission and stuff...
The question now is how many of the people that submit to spamcop are people like me or people that even know less about computers and stuff... and how many are highly-advanced people that understand all of that... I dunno... but I do recommend spamcop to everyone I know because I don't like all this spam....

Have you not heard of SpamCop Quick Reports?

[Ivan Todoroski]

You can simply ask the SpamCop admins to enable so called "quick reporting" for your account. Then, you just change your address from submit.RANDOMHASH@mail.spamcop.net to quick.RANDOMHASH@mail.spamcop.net, and you're all set. The spams you forward (via attachments) to this address are auto-reported immediately, no need to go clicking on the website.

The only slight drawback to this method is that quick reports only get sent for the source of the spam, but not for the web sites advertised in them.

Re:Have you not heard of SpamCop Quick Reports?

[Lord Kano]

The only slight drawback to this method is that quick reports only get sent for the source of the spam, but not for the web sites advertised in them.

That isn't necessarily a bad thing, it makes Joe Jobs harder.

LK

Re:Have you not heard of SpamCop Quick Reports?

[Ivan Todoroski]

Agreed, that's exactly why they did it, in fact. It's only a "drawback" in the sense that if you do want to report a particular website, you have to revert to the normal reporting address (and the subsequent clicking).

Re:Have you not heard of SpamCop Quick Reports?

[RedToad]

Quick guide to SpamCop Quick Reporting

There is a good description of the process for setting up Quick Reporting in SpamCop, and the Pro's and Con's, at the CastleCops site.

Policy of use

[michelcultivo]

The user who submits the spam may comply with a "spam submission" police, after the system administrators see that's a spam then will be sent to spamcop. Never let the final user do the poor job.

Do you think anybody at spamcop cares?

[Russ Nelson]

Do you think anybody at spamcop cares about false positives? If they care, there's no evidence of it. My server was blocked by spamcop this past week. Why? I have no idea, and no way to correct the problem, because when they block you, all they say is "You sent email to one of our secret addresses."

Re:Do you think anybody at spamcop cares?

[hostguy2004]

Russ Nelson is not some rookie on his first server. For those who don't know he is a major contributor to the qmail support list. He publicly stated that he does not support spammers. But yet he is still caught because of SpamCops ridgid policies. I think his experience highlights exactly what is wrong with SpamCop and RBLs in general.

Good Tutorial

[Ythan]

Mechanize::SpamCop is another tool you can use.

Duopoly

[tepples]

If one subscribes to a pink contract ISP and can't get one's legitimate email through, the obvious solution is to change ISPs.

If both ISPs that offer service to one's geographic area are pink, then how does one find the money to move and a job in the new location?

Re:Duopoly

[Ph33r th3 g(O)at]

Unless you're talking about consumer level ISPs, there are going to be more than two options for your exit traffic. If there aren't, you can buy the right to relay via a non-pink server.

spammers avoid spamcop

[0xC2]

I'm a longtime spamcop.net user. I've used it to filter numerous email addresses through its spam filter, which is effective and accurate, and highly configurable. However the allure of GMail prompted me to forward my other addresses to GMail and begin phasing out the spamcop address. Which is when I noticed something interesting:

I don't receive spam to my spamcop.net address! This result is very interesting, mainly because my spamcop address is a "dictionary word" address. I can only conclude that spammers must avoid spamcop.net email.

Which is making me rethink my decision to phase out spamcop.net. Have any other long-time users noticed this with their spamcop.net email?

Re:spammers avoid spamcop

[evilviper]

I can only conclude that spammers must avoid spamcop.net email.

Maybe they don't bruteforce addresses @spamcop.net like they do with other providers, but they certainly don't avoid spamcop addresses all-together.

I average about 20 spams per days on my spamcop.net account after a couple years of active use (99% are correctly filtered), apparently entirely from mailing lists, since I use spamgourmet to forward everything else.

I've thought of switching to gmail myself, but I'm hesitant, since they can always pull a Yahoo and just discontinue their POP service at any time.

Blue Security

[Spy der Mann]

Why not modify Blue Security's Firefox reporting tool? It used e-mail for reporting spam from yahoo and hotmail at Blue Sec.

Re:Blue Security

[Ph33r th3 g(O)at]

That's a good idea--I didn't know the Blue Frog tool did its reporting via email, figured it opened up some kind of other connection to Blue Security. But you're right--if it's sending email already, it should be trivial to change it to a SpamCop reporting address.

Wonder what the license on that source that's floating around is (IIRC, it got pulled when Blue Security caved/was paid off/was threatened physical harm by the spammers).

Re:Blue Security

[wayne]

Why not modify Blue Security's Firefox reporting tool?

Funny, yesterday on the #okopipi IRC channel, I suggested that okopipi should automate submissions to spamcop, nanas, dcc and razor, in addition to the FTC and SEC submissions that bluefrog did. Basically, it would give the spammers several more good reasons to pay attention to okopipi's do-not-spam list.

Re:Blue Security

[Mister Whirly]

Didn't Blue Security go out of business??

http://it.slashdot.org/article.pl?sid=06/05/17/132 2258&from=rss

Re:Blue Security

[gbjbaanb]

Better still, let okopipi do its thing, and let other email-reading tools automate the sending of spam to these anti-spam tools. Then you're not duplicating effort.

Mailwasher, possibly the biggest reason BlueFrog got taken down (because before they added BlueFrog to mailwasher, no-one knew or cared about the odd BlueFrog reports, after they added it, the spammers got quite cross indeed), already automates this reporting. Currently you can enable SpamCop reports, and (defunct) BlueFrog reports.

The trouble with automating spam like this, for Spamcop, is that you end up with a big of feedback - spamcop sas something is spam, so it is marked as such, and so you then report it back to Spamcop automatically. (it isn't automatic, you do get to vet mails first using mailwasher).

Ummm, they just TOLD you what happened.

[khasim]

Do you think anybody at spamcop cares about false positives?

Yes, I think they care a lot.

My server was blocked by spamcop this past week.

No, your IP address may have been included on one of the blacklists, but your server was not "blocked".

The person controlling the server that your server was trying to send a message to was using a SpamCop blacklist as a rejection list.

If you want to complain, complain to that person.

Why? I have no idea, and no way to correct the problem, because when they block you, all they say is "You sent email to one of our secret addresses."

The reason to keep those addresses secret is because if the spammers found them, they would not be useful anymore.

If you have a static IP address, the problem is you. Someone with access to your out-bound email is sending spam.

If you have a dynamic IP address, you need to get a static address.

If you cannot get a static address, do not expect your email to always be delivered. You must monitor your logs for the rejection notices and then take whatever actions are necessary to get that site to whitelist your messages.

Don't blame SpamCop for the situation that results in your IP address being reported to them. No one is forced to used SpamCop's blacklists. They choose to use them because they believe they are useful in reducing spam.

Re:Ummm, they just TOLD you what happened.

[Anonymous Coward]

(Posting as AC, but I'm a registered user who posts often)

I work at an EMail marketing company (no, not spam) and we have had our servers placed on blacklists multiple times ... you know why? People who are competetors to our clients signup a spamtrap email to their lists, getting our mailserver blacklisted for sending mail to an address -- even though the mail is a "are you sure you wanna subscribe?" message?

Your casual attitude toward "oh well, shouldn't have sent email to $secretspamtrap" without telling us *what* email or giving us details on how to avoid it in the future (like maybe adding your spamtrap domains to our lists that trigger "oh no, spammer" in our checks), you end up making RBLs more useless, and my job harder.

Re:Ummm, they just TOLD you what happened.

[Anonymous Coward]

and my job harder.

And your job would be so much easier if everyone knew what these addresses were so that everyone could spam the addresses with each other's email headers?

Re:Ummm, they just TOLD you what happened.

[moro_666]

mod parent as informative.

we have lots of sites out there which send assurance emails to people that register, if a dummy kid who makes a dummy user and puts random data in along the way, the automated welcome or confirmation mail will be sent. if you have hundreds of thousands or millions of users, some of them can accidently trigger it off, some of them can do it on purpose if they somehow have got the knowledge of that `secret address`.

as for the article, one perl script and cron together are far better than the ultimate superscripting h4x0r thing from the article, that mess in tfa with zillion tools and confusion, looks like dental work carried out through the _other_ entrance to your digestion system.

maybe it's time for a whitelist at spamcop ? everybody can rule their domain in, if they are found really sending spam and not registration feedback, they will be blacklisted forever and if possible, fined for their actions. maybe an initial fee for getting whitelisted wouldn't be a bad idea either, that would cut off most of these chines and turkish fuggers.

have a nice day.

Re:Ummm, they just TOLD you what happened.

[lon3st4r]

My server was blocked by spamcop this past week.

No, your IP address may have been included on one of the blacklists, but your server was not "blocked". The person controlling the server that your server was trying to send a message to was using a SpamCop blacklist as a rejection list. If you want to complain, complain to that person.

Ahem, and what is he gonna reply? Why is he blocking this poor chap's server? He's only gonna say that it's because he's using SpamCop and SpamCop says his IP was reported as a spammer.

* lon3st4r *

Re:Ummm, they just TOLD you what happened.

[misleb]

Oh come on, "email marketing" is a code word for "spamming" in the biz. OK, maybe, just maybe, your messages are "legit" and maybe you really do take people off your lists when they opt-out, but the reality is that savvy users shouldn't trust opt-outs. Too many spammers use it as a way of verifying good addresses to spam. It is much easier to simply report emails from unwanted "email marketers" as spam.

-matthew

Re:Ummm, they just TOLD you what happened.

[misleb]

Your casual attitude toward "oh well, shouldn't have sent email to $secretspamtrap" without telling us *what* email or giving us details on how to avoid it in the future (like maybe adding your spamtrap domains to our lists that trigger "oh no, spammer" in our checks), you end up making RBLs more useless, and my job harder.

We WANT to make your job harder! Don't you get it?

You want to know how to avoid sending to spamtraps? Don't harvest emails from the web or buy lists from harvesters!

-matthew

Re:Ummm, they just TOLD you what happened.

[duncf]

I'm pretty sure this would be impossible if you used a double opt-in subscription system.

Plus, since they use secret spam traps, then your competitors couldn't sign them up unless somehow they knew what the spam trap addresses are. And if they did know the secret spam trap addresses, they'd probably be making money off selling the addresses to spammers so the spammers could clean their lists. They probably wouldn't worry too much about thwarting your spamming -- I mean marketing -- business.

Re:Ummm, they just TOLD you what happened.

[alienw]

E-mail marketing is spam. That's what spamcop.net is supposed to block. You are a spammer, so you need to stop bitching.

Re:Ummm, they just TOLD you what happened.

[Dan Ost]

Aren't you overlooking the fact that even if he has a static IP address
that someone might have forged their packets such that they appeared to
originate from his IP?

It seems a little harsh to assume that he's done something wrong when
there is an alternative that doesn't assign blame.

Re:Ummm, they just TOLD you what happened.

[Ph33r th3 g(O)at]

First, "double opt-in" is spammer-speak, implying some redundant step. "Verified opt-in" is more descriptive. But what the OP is complaining about is getting blacklisted for the verification email, which is a legitimate complaint if true.

Re:Ummm, they just TOLD you what happened.

[AndersM]

The reason to keep those addresses secret is because if the spammers found them, they would not be useful anymore.

If you have a static IP address, the problem is you. Someone with access to your out-bound email is sending spam.

I understand you've never administrated services for a user base which you don't completely control? How is a conscientious administrator who wants to fix the problem supposed to identify the spamdrone-infected PC if Spamcop won't even give up a queue ID to search for in the logs? With a network where several thousand clients, such as student laptops and PCs in dorms, are not under centralised administration (and thus get infected by spyware because their users run with default administrator privileges enabled), this is a real problem.

Once the email's been sent by the client it gets processed by your outgoing mail gateways, and suddenly Spamcop blacklists your outgoing mail relays. And servers all over the place start rejecting your users' email, and the users start complaining to you. And unless the spamdrone sent enough email to really make an impact on your traffic, and it actually sent its email straight to your mail gateways and not a subordinate mail server which normally has a lot of traffic, and relays through your mail gateways.

Re:Ummm, they just TOLD you what happened.

[goaliemn]

you apparently think spamcop never has false positives on their blackhole lists. I had a user that was getting alot of spam. They left my ISP and as a courtesy, I put in a .forward for the user, on their request. The new ISP thought I was relaying spam, and reported me to some blacklists. Apparently, they never bothered to actually try to relay through my mailserver, as I did have it locked down. It too me quite awhile to get removed, and most of the spots that had blacklisted me wouldn't tell me.. "you sent spam. you're bad. you're evil" is the reply I got from most.

Alot of people do get falsely listed, and its a PITA to get removed. I invited some to try to relay through me and they didn't try and didn't care.

Re:Ummm, they just TOLD you what happened.

[Anonymous Coward]

Idiot.
Try reading the damn comment, the reason they're getting blacklisted is their competitors are getting them to send confirmation emails to spam traps

Re:Ummm, they just TOLD you what happened.

[deep44]

So how are your client's competitors finding out the SpamCop email addresses? Sounds like there's _some_ way of doing it - you might want to look into that before they put you out of business.. (as opposed to complaining on Slashdot about bad guys making your job "harder")

Re:Ummm, they just TOLD you what happened.

[techno-vampire]

Not all email marketing is spam. I get regular emails from a mail order company, advertising their wares. I get them because I asked for them, and occasionally buy something. That's not spam. Spam is unsolicicted commercial email.

Re:Ummm, they just TOLD you what happened.

[Anonymous Coward]

> Oh come on, "email marketing" is a code word for "spamming" in the biz.

Fuck off twit, it's people like you who make real anti-spam activists look like kooks who hate all commerce.

I get mail from Safeway every few days. Guess what, I order from them, so I actually use the mail.

As for TFA, I also work in anti-spam. I do this shit for a living. But if I were to find a cron script was automatically submitting junk, I'd /dev/null the submitter in a heartbeat. The whole damn point is human review so we can tune the automation, not the other way around. These people are sabotaging spamcop. Of course, spamcop is a competitor (and oh yes they're commercial, they're owned by Ironport), so hey feel free.

Re:Ummm, they just TOLD you what happened.

[Anonymous Coward]

> Aren't you overlooking the fact that even if he has a static IP address
that someone might have forged their packets such that they appeared to
originate from his IP?

Packet forgery is not possible with TCP. At least not without forging the whole route, which is not only hard to do, it's very obvious to the one who's been hijacked. Technically, once you hijack the route, you really aren't "forging" the IP anymore, you actually own it. Forged IP's are de rigeur in DDOS attacks, but those are typically UDP or TCP SYN attacks (which typically can include enough data to also include a GET). UDP is really vulnerable to forgery that way. SMTP is a "chatty" protocol and actually requires the sender to receive the greeting before sending -- if they don't, most well-behaved servers will hang up immediately. It's amazing how many spammers fail this part, but anyway, that's still not about forgery...

The closest thing spammers can get to "forging an IP" is an asymmetric route that sends ACKs back on a slow link while blasting out on a fast link. The mail appears to come from the slow (throwaway dialup) link. You still can't pick a random IP address to forge that way though.

More likely he's on a bad ISP that caters to spammers and his whole subnet got blocked. Good white-hat email marketers cultivate clean IP space very jealously, because most providers will throw them in the sewers with spammers.

Re:Ummm, they just TOLD you what happened.

[kimvette]

Whitelisting is impractical. I don't really think anyone needs to explain why.

Re:Ummm, they just TOLD you what happened.

[Spazmania]

No, your IP address may have been included on one of the blacklists, but your server was not "blocked".

That's like a hollywood exec saying, "I didn't blacklist that actress; I just mentioned to everyone I know that she was a communist and let them make up their own minds whether to support communism."

Fine if you're right about her. Libel if you're not.

Spamcop's secret addresses... Not secret enough. I run a huge opt-in political list. Someone entered at least one of spamcop's secret addresses in to my web signup form and damned if I can find it. Short of sending a whole new verify-your-subscription request to everyone, I'm stuck on spamcop's blacklist.

Re:Ummm, they just TOLD you what happened.

[ahodgson]

There is no way to signup a spamtrap address to a mailing list if you use confirmed opt-in.

And if you don't, you are a spammer.

So either you're a spammer, or you're lying. Which is it?

Re:Ummm, they just TOLD you what happened.

[misleb]

To be fair, I think he is talking about the confirmation emails triggering the block.

1. Competitor X signs up a spamtrap address to the "marketing" list
2. Spammer^H^H^H^H^H^HMarketer sends confirmation email to the spamtrap.
3. Marketer gets blocked because he is trying to confirming the subscription of a spamtrap address

Personally, I've never seen confirmation emails for marketting material. Mailing lists and forums, yes, but not marketing. So I am suspicious of the claim.

-matthew

Re:Ummm, they just TOLD you what happened.

[monsterlemon]

Spamtraps aren't the problem. Clueless users who sign up to something and then forget about it, or then decide they didn't want it after all... I'm sure there are more.

Frankly, Spamcop is a whole lot more trouble than it's worth.

And I don't give a damn whether Spamcop users receive mail from me or not. It's their loss, their problem, their idiot choice to use it. I sure as hell won't be bothering to jump through hoops to get my mailservers delisted if they ever get on there.

Spamcop's design and processes are (from what I have experienced) just not sensible in the Real World.

But like I said, if you want to use it...

Re:Ummm, they just TOLD you what happened.

[Anonymous Coward]

No, your IP address may have been included on one of the blacklists, but your server was not "blocked".

I see that argument a lot, but it doesn't get RBLs off the hook. If he believes he was listed improperly, perhaps instead of saying Spamcop blocked his server he should say Spamcop slandered his server.

When an RBL lists an IP address, it is making a statement it represents to be true. Other than those that just list dynamic IPs, what they are doing is accusing the operator of spamming. On the net, that's a serious accusation that had better be more than hearsay.

Re:Ummm, they just TOLD you what happened.

[hausmaus]

Don't blame SpamCop for the situation that results in your IP address being reported to them. No one is forced to used SpamCop's blacklists. They choose to use them because they believe they are useful in reducing spam.

You're right. SpamCop is generally lazy about removing people's IP addresses. I've actually used them before to pull a nasty trick (getting someone's entire static IP block listed as spam) and you know what? They did it happily, without asking.

If you're a moron and think SpamCop is worth something, then you get what you deserve. I don't run any spam filters or anything else for my business and I won't. Why?

A program can never take the place of a human's good discretion, period. Say all you want, but it won't happen. I've tried spam filters and they don't work very well - in fact, I even wrote my own to try it out and generally, it's a turkey shoot. If you're naieve enough to think that - and judging by how many people use SpamCop, there's a lot - you get what you deserve.

SpamCop was blocking my static IP. Why? Because the person before me had problems. I asked them to remove it and they gave me enough crap to fill a big septic tank. They never did, either. Thankfully I moved, got another ISP and all is well here.

If someone doesn't receive my message because their server sits here and cries and relies on a very inaccurate blacklist, then that's their problem, NOT MINE. It's funny how people are too damn lazy to just hit the Delete key or to make sure their systems don't become some spambot master's toy.

If you think that SpamCop helps stop spam, you probably think that people don't kill people, guns do. Relying on antispam programs is an intelligence crutch.

Re:Ummm, they just TOLD you what happened.

[munkay]

It could be an automated submitter like in TFA, not neccessarily one of spamcop's own addresses.

Re:Ummm, they just TOLD you what happened.

[Anonymous Coward]

> So either you're a spammer, or you're lying. Which is it? ... Or you didn't get it.

Re:Ummm, they just TOLD you what happened.

[grahammm]

You're right. SpamCop is generally lazy about removing people's IP addresses.
Does SpamCop not have automatic removal when no spam further has been reported for a few days? This is unlike some RBLs where once on the list it is very hard to get removed.

Re:Ummm, they just TOLD you what happened.

[Russ Nelson]

If you want to complain, complain to that person.

Oh, I do! I tell them that only morons use Spamcop's blocking list. I would guess from your heated reply that you are one of those morons.

I don't spam. My server accepts email and the n bounces it if it's undeliverable. Spamcop calls that spam if the email was forged from a spamtrap address.

Is there any way to get a permanent block entered into the Spamcop blocking list? I'd really rather dispose of this issue by getting rid of morons -- or converting them to intelligent people by their cessation of the use of Spamcop's blocking list.

Re:Ummm, they just TOLD you what happened.

[misleb]

Spamtraps aren't the problem. Clueless users who sign up to something and then forget about it, or then decide they didn't want it after all... I'm sure there are more.

I doubt this is a serious problem. Most of these things that people might sign up for probably aren't true opt-in anyway ("send me mail" checked by default). Speaking as someone who admins mail servers and has to fight back spam on a daily basis, I can't say I really care if a few legitmate marketing companies get blocked. My users won't miss it.

Frankly, Spamcop is a whole lot more trouble than it's worth.

Speaking also as someone who has occasionally had to get servers (not just my own) off of Spamcop's blacklist, I can say that is easily worth it. The servers were listed for valid reasons. Spamcop is a valuable service.

And I don't give a damn whether Spamcop users receive mail from me or not. It's their loss, their problem, their idiot choice to use it. I sure as hell won't be bothering to jump through hoops to get my mailservers delisted if they ever get on there.

Lets just hope you don't have any other people using your servers. I'm sure they won't be so sympathetic.

Spamcop's design and processes are (from what I have experienced) just not sensible in the Real World.

I block tons of spam based on Spamcop and similar blackhole services. The more I can block based on blacklists, the less resoruces I need to dedicate to processing and scanning the garbage. When greater than 60% of all mail coming to your servers is spam and you get millions of messages a day (gross), you'll see the sense. A couple messages lost from lazy admins such as yourself is a small price to pay.

-matthew

Re:Ummm, they just TOLD you what happened.

[Lost Race]

They could run a bot that signs up thousands of addresses scraped from webpages. Some of those are likely to be spamtraps. If they were careful and the list operators not particularly vigilant, such an attack might slip through. Of course it is arguable that the fallout of that attack (thousands of random addresses receiving subscription confirmations) is in fact spam.

Re:Ummm, they just TOLD you what happened.

[Lost Race]

I see that argument a lot, but it doesn't get RBLs off the hook.

There is no hook. Truth negates slander; if you read Spamcop's claim carefully you will see it is true. If somebody misinterprets their statement to mean, "so and so is a spammer," that's not Spamcop's fault.

Re:Ummm, they just TOLD you what happened.

[callingalloldhippies]

You all INVENTED this 'nasty little step-child' and if more of you were not profiting from same, You would think that those same inventive minds, would UN-Invent it's ability to overpower a simple User Kill Switch. yes, I know I'm not a programmer but if you were smart enough to find all the keys to get your crap into my in-box, you surely can find a way to keep it out. ONLY, it appears to me, when doing so, is more profitable then NOT doing so. When the choice comes down to personally justifying spam or eating spam...there is this thing called perspective.

Spamcop is a mail admin's worst nightmare

[Kattare]

The problem is that Spamcop encourages people to use it as a way to reject mail at the entry point, rather than as a tool for spam scoring (Spamassassin, etc.) ...

We frequently get blocked because one of our users desktops has been pwned and the virii manage to SMTP-AUTH using our users login and password. (usually not too hard to manage) These ones we can catch pretty quickly with our logging system.

The really painful ones are when someone finds a hole in an application we're hosting for someone and spews mail through it (formmail.pl, anyone. ;-) ... They eventually manage to hit one of spamcops honeypot addresses and we instantly get blocked in a manner in which we cannot track where the rogue spam came from! Spamcop does not provide copies of emails that hit their honeypot, for understandable reasons, but surely they realize that it also makes it impossible for an admin of a large organization to pin down the spammer...

Spamcop needs to adjust their website to explain how to use their list to score spam, and they need to ditch the honeypots and stick to user-submitted spam until they decide to work with the ISP's that are actually trying to eliminate it.

On the incomming mail side, we love Spamcop. We score the mail higher using their blacklist and let our users set the trigger level for either deletion or automatic filtering to a sub-folder.

Some mothers do have 'em

[Anonymous Coward]

Hmmm Betty. The cat did a whoopsee on me manual spamcop submissions.

Seriously, this just increases the risk of false positives.

Hmmm.

That is GMail's fault.

[khasim]

Google runs GMail's system so that their servers are the LAST verifiable IP address in the chain.

What that means is if I upload a message to a GMail server, their headers will NOT include the IP address of my machine.

So SpamCop has no way of identifying the IP address that originally sent the spam to the GMail server.

So SpamCop reports the GMail server as the "source" of the spam. And that IP address gets blacklisted.

Personally, I believe that the "free" email services should assign people to work with the various blacklists. Even if Google won't change the behaviour of their servers, they should still be able to help SpamCop find the correct IP address via the unique message ID of each email. And also correctly identify the IP addresses of their mail servers so SpamCop wouldn't have to guess if it was a legit GMail server or not.

I've had to whitelist GMail, HotMail, Yahoo! and even AOL's mail servers at the SMTP level because of this. And it is NOT easy finding which IP addresses belond to their mail servers. They still run through SpamAssassin (because of the Nigerian royalty scams) but they are always accepted.

It's a "solution" and it mostly works for me. I just with the "free" email services would run their own RBL's so I could verify the IP addresses of servers that HELO with *.google.com or just gmail.com.

Re:That is GMail's fault.

[Anonymous Coward]

Are you a fucking retard? It's a web based e-mail system. There IS no other mail server submitting shit to it, just a web browser. What would be the point in blocking a web browser? God you people are fucking stupid sometimes.

Re:That is GMail's fault.

[sporkmonger]

I've heard this before, but frankly, I like that GMail doesn't expose my IP address. As far as I'm concerned, that's a feature not a bug.

Re:That is GMail's fault.

[martin-boundary]

In this case, you happen to be the retard. There is no requirement that a Received header should only contain a SMTP transaction record. It's perfectly acceptable to have a Received header which records the handover between a web browser and an SMTP gateway.

Re:That is GMail's fault.

[Chandon Seldon]

That makes sense, unless you take into account the history of email vs. spam.

If you want to be able to send messages anonymously, use a remailer or use something other than email.

Re:That is GMail's fault.

[sporkmonger]

It's not anonymity that I'm concerned with. I mean, there is an email address attached to my messages that can be easily Googled. But let's say you're running an unsecured Window machine. You write an irate email to some loser, and he decides to respond with a denial of service attack.

Re:That is GMail's fault.

[Chandon Seldon]

I'd say that the insecure windows machine is your problem. Spam email is everyone's problem.

Re:That is GMail's fault.

[sporkmonger]

And I'd say that the PowerBook I'm actually running is not my problem. Don't make stupid assumptions.

Re:That is GMail's fault.

[Chandon Seldon]

Which is why you assumed an insecure windows machine in the post I was responding to...

Re:That is GMail's fault.

[sporkmonger]

And I clearly marked it as hypothetical?

Needless?

[JanneM]

My main address is fairly old - I have been using it for over ten years. I've also been using it with wild abandon pretty much anywhere on the net for as far back as I can remember, and it attracts an absolutely ridiculous amount of spam today. If it was a person, it would have it's own red-carpeted VIP entrance at the veneral disease department at the university hospital.

I today filter with a bayesian filter, and only with a bayesian filter - I quit using those on-line services over a year ago. In addition I pre-approve some addresses to make sure I don't miss anything from people important to me. I see perhaps one spam every third day on average. It spikes temporarily when there's a shift in tactics - I get three or four a day - and then it calms down again to one a week or thereabouts.

Re:Needless?

[Anonymous Coward]

I quit using those on-line services over a year ago. I want to manually send them every spam passing through the filters from Hotmail or Yahoo.

I've noticed when I start getting false positives from Yahoo customers writing to Hotmail,
it sure seems like a similar "retaliation" is going on at Yahoo/SBC from Hotmail customers.

All I can see is it is NOT based on IP address ranges and that it happens simultaneously.

Re:Needless?

[MichaelSmith]

I today filter with a bayesian filter, and only with a bayesian filter

I use bogofilter and it works very well once a database has been built up. The problem I have at the moment is that somebody is sending spam with one of my domains in the From: field.

If I am lucky it will be a former client of mine who uses notoriously rooted windows boxes in their office. Eventually they will stop working and my problems will be solved. Until then I have to deal with the bounces.

Investment

[Zindagi]

Think of the time spent verifying spam as an investment; use your time now and have far less spam/worries about genuine mail being marked as spam in the future. Not to mention the saved minutes that you can spend browsing slashdot more thoroughly.

So what you want to do, essentially...

[geobeck]

...is spam Spamcop?

Forgeries

[Ankh]

The more widely known your email address becomes, the greater the chance that some zombie or virus will see it in someone's address book and send spam pretending to come from you. Spamcop will generally believe that you sent the spam, as far as I can tell.

They routinely list w3.org (W3C) as a source of spam for this (incorrect) reason.

Spamcop says you should not use their results as authoratative, but only as one factor to consider, but in practice a number of large companies blacklist anyone listed by spamcop automatically.

If you are going to automate submissions to spamcop, please at least use SPF to verify that the sender was in fact associated with that domain, where SPF records are available.

Re:Forgeries

[dacarr]

Not really. The system is intelligent enough to check the headers and verify the hostnames aren't bogus when checked against the IP addresses - and if one's SMTP server is correctly set up, then it will still get the hails from the client SMTP system.

Re:Forgeries

[Ankh]

Thanks for replying. Unfortunately that's not what I've seen in practice: at least enough forged mail pretending to come from w3.org (where I work) gets through to spamcop, so that they frequently block us.

Maybe some of the forgeries are geeting smarter and adding our IP addresses in Received-by headers or something.

Liam

Re:Forgeries

[Chandon Seldon]

That shouldn't be happening unless your servers are doing something weird, or your local users are using spamcop wrong.

As I understand it, the spamcop system only considers the most recent recieved header to be a spam source.

For example, in this case it will only mark "spammer.com" as a spammer:

Recieved by: your-isp.com
Recieved by: spammer.com
Recieved by: w3c.org

Re:Forgeries

[Ankh]

Unfortunately it's not us that's doing something weird - it's other people either forwarding mail to spamcop or relying on their judgement.

I'm guessing that the problem case is if you delete the middle Received-By header in your example.

At any rate, I really just wanted to warn people not to ignore spamcop's advice in beleiving their list to be 100% accurate.

Liam

spammers avoid spamcop...not

[Jac_no_k]

I too am a long time spamcop user... But spammers do not avoid my account. However, my wife who also has a spamcop address receives almost no spam. Biggest difference I guess is my address is everywhere on the net.

Re:spammers avoid spamcop...not

[0xC2]

I guess since I've used the spamcop.net address as a "filter" address, I managed to keep it off the lists.

SpamCop is a pain in the ass

[kullnd]

There are some services provided on the internet that make your server more likely to get hit with these stupid things, and personally I think that services like this are nothing but a pain in the ass and a crutch to people trying to run some types of non-spamming sites...

In example, I run a couple online forums. These forums can be configured to send notification messages to it's users when someone replies to a post they made or sends them a private message. They can also subscribe to threads and get updates anytime someone makes a new post that meets their subscription. I was added to a blacklists in the past because suddenly someone who REQUESTED these simple notification messages (which most people find very nice to get) decided that they didnt want it and submitted it as spam.. Suddenly my entire server cant send emails to anyone running that blacklist, for no good reason whatsoever.

The problem with these services is that they require end users to be smart. Problem with that is there is alot of stupid idiots on the internet that will submit shit that should not be submitted, something they asked for that could be turned off by simply changing their profile options.

I hate those stupid services, and I will not run them on any of my servers, I'll deal with the junkmail and let each individual person deal with the junk as it arrives in their box, most email clients do offer junk mail filtering, and I figure that if they are not smart enough to use them (or ask for help setting it up) than they can deal with it. I would prefer this over people who do know how to use a computer not being able to get emails from legit senders.

Great, I guess this means more of these:

[mobby_6kl]

Technical details of permanent failure:
PERM_FAILURE: SMTP Error (state 9): 550 5.7.0 Your server IP address is in the SpamCop database, bye

No, I don't send spam, and this was bounced back to my gmail address anyway.

Cron?

[KidSock]

All I do is just putting the spam into certain folders and our good old friend cron does the rest.

Man I can't believe we're still doing this. Cron? The proper way to do this is to have a "Spam" button on your email program that triggers a script (and preferrably provide default scripts for things like SpamCop).

You may not want to read this reply. (profanity)

[khasim]

I work at an EMail marketing company (no, not spam) and we have had our servers placed on blacklists multiple times ... you know why?

Yes, it is spam.

Fuck you you little shit sucking worm. You and your "business" is the reason that SpamCop and others are necessary. And every single shit for brains like you will always start their posts "I don't send spam".

Yes you do. And I have to spend time finding ways to stop you from filling up my end users' mailboxes with your spam.

People who are competetors to our clients signup a spamtrap email to their lists, getting our mailserver blacklisted for sending mail to an address -- even though the mail is a "are you sure you wanna subscribe?" message?

So ....... your competitors know which addresses are spamtraps ... but you don't.

Sure they do.

Your casual attitude toward "oh well, shouldn't have sent email to $secretspamtrap" without telling us *what* email or giving us details on how to avoid it in the future (like maybe adding your spamtrap domains to our lists that trigger "oh no, spammer" in our checks), you end up making RBLs more useless, and my job harder.

Here's a free clue. I don't give a rat's ass how fucking hard I make your job.

Company A = you
Company B = your client
Company C = evil competitor

You were talking about working at an "EMail marketing company" ... but then you seem to be saying that the addresses you get from Company B have been previously compromised by Company C.

Right ............

So ... when Company B sends out email to those addresses, they don't get blacklisted. Or so you would seem to be saying.

Otherwise, you're taking email addresses from a blacklisted company and sending "not spam" ads to them.

And you expect me to believe that or have sympathy for you?

Hahahahahhahahahahahahahahahaha

Spamcop sucks

[Anonymous Coward]

SpamCop sucks since it blindly "trusts" anything that is submitted. I hope that spammers use this automation procedure to submit every server in the world and thus render SpamCop as the useless piece of crap that it truly is.

Re:Spamcop sucks

[Sjobeck]

idiot

Alternative method: Ypops + ISP's smtp

[Spy der Mann]

A possible alternative is to use YPops! (another sourceforge project) for gathering your Yahoo! mail's Bulk mail folder. Then, using another SMTP server (like your ISP's) forward the bulk mails to SpamCop.

ah, the "secret mailbox" bit...

[SuperBanana]

The reason to keep those addresses secret is because if the spammers found them, they would not be useful anymore. If you have a static IP address, the problem is you. Someone with access to your out-bound email is sending spam.

Only problem is that I keep hearing from friends who have really locked down mail servers but keep getting blocked by spamcop...yet spamcop claims the friend's mail server sent a message to one of their secret mailboxes.

Don't blame SpamCop for the situation that results in your IP address being reported to them.

I'm sorry, but that's pass-the-buck bullshit. If spamcop is technically incompetent, of course they should be blamed when they improperly list someone.

Parent post fixed.

[grommit]

You made a few mistakes in your post so I'm fixing them for you.

(Posting as AC, but I'm a registered user who posts often)

(Posting as AC because I know what I'm doing is wrong and I don't want people to harass me over it)

I work at an EMail marketing company (no, not spam) and we have had our servers placed on blacklists multiple times... you know why?

I drain the life blood of the internet at a Spam farm and we have had our spambots placed on blacklists multiple times because the tripe we send out is flat out spam.

People who are competetors to our clients signup a spamtrap email to their lists, getting our mailserver blacklisted for sending mail to an address -- even though the mail is a "are you sure you wanna subscribe?" message?

People who receive our spam report it to RBLs and our spambots get blocked even though our spam has circular links which verify e-mails of the people that we spam.

Your casual attitude toward "oh well, shouldn't have sent email to $secretspamtrap" without telling us *what* email or giving us details on how to avoid it in the future (like maybe adding your spamtrap domains to our lists that trigger "oh no, spammer" in our checks), you end up making RBLs more useless, and my job harder.

You are making my life as a spammer more difficult than those web pages that said that I could make $5000/month from home said it would be. Please stop. We both know you want to buy Cialis, Viagra and refinance your mortgage so just click on the links already. Sheesh.

<EOF>

There ya go, fixed your post right up. No need to thank me.

Re:You may not want to read this reply. (profanity

[Anonymous Coward]

Mod parent down please. (Registered user posting anonymously)

False positives

[orionware]

We have a client that we send out over 30,000 emails per month using campaignmonitor.com.

Their list is a double opt-in and still every month we get notified by campaign monitor that there were users in the list who complained of spam. EVERY single one of them were AOL users.

Even though there was an un-subscribe at the bottom of the newsletter they explicitly subscribed to, AOL has a nice little button for them to click if they no longer want to receive those emails. Then AOL automatically submits a spam complaint.

We used the ORBS and spamcop modules on our email server but stopped using them because we would have lots of users complaining that they they wouldn't receive email from clients because they would get trapped. Most were just regular uers whose ISP's had IP's on the list.

I used to be one of those SPAMCOP/ORBS Nazis, taking the "at any cost" attitude to reduce spam, however in the real world, the blacklists are just too inaccurate.

No, *you're* the dumb fuck...

[Anonymous Coward]

It's clear you haven't realized that some email marketing companies are hired by people other than sleazeballs, for reasons other than distributing unsolicited ads. I belong to at least a couple of non-profit organizations that don't run their own mail servers. These organizations use third-party mailers to contact me with news and action requests related to certain political issues. And these organizations have enemies.

Do you morons ever stop to think about your role in a chain of events like the following?

1) An RIAA lobbyist writes some legislative atrocity and pays off a bunch of US congressmen to introduce it as a bill
2) The EFF catches wind of it, and uses an email marketing campaign targeted at its members who have asked to participate in such campaigns to ask its members to protest the RIAA-authored bill
3) The RIAA lobbyist, who has cleverly subscribed to the EFF's mailing list, reports the email to SpamCop
4) ...
5) Profit! (For the RIAA)

The same thing happens with AOL, where the users themselves don't have the cerebral capacity to remember which mass-mail lists they've opted into. SpamCop, by not maintaining a whitelist that allows them to ignore spurious or dishonest spam reports, is serving the interests of worse people than spammers.

But I guess you didn't think of that before you flamed the grandparent to a crispy golden brown, huh.

Re:No, *you're* the dumb fuck...

[Russ Nelson]

But I guess you didn't think of that before you flamed the grandparent to a crispy golden brown, huh.

Not hardly. Perhaps I'm a little warmer. On one side. I've had worse sunburns. Khasim is an amateur postmaster and an amateur flamer. If he was to show his head in alt.flame, and attempt to flame one of the masters, he would be a crunchy blackened cinder.

That's why I prefer Exim4.

[khasim]

Technical details of permanent failure:
PERM_FAILURE: SMTP Error (state 9): 550 5.7.0 Your server IP address is in the SpamCop database, bye

With Exim4, I can customize the rejection messages so that they include the phrase:

Please call email admin at (NNN) NNN-NNNN

Spam zombies and such won't ever call. But if you're a person, and your email server is halfway decent, you'll see the rejection notice and you can call me and I can add you to whomever's whitelist. Or you can call that person directly and s/he can add you to his/her whitelist.

Technology rocks, but people should never over-estimate it.

Always include some alternate means for a legitimate person to easily contact you to resolve the problem. Phone, fax, IM, whatever.

Think about the problem and the answer is simple.

[khasim]

I understand you've never administrated services for a user base which you don't completely control?

That would depend upon what you mean by "completely control".

How is a conscientious administrator who wants to fix the problem supposed to identify the spamdrone-infected PC if Spamcop won't even give up a queue ID to search for in the logs?

#1. Block all outgoing traffic on port 25. Except for the mail servers that you control.

#2. Rate limit the out-bound traffic on those mail servers.

#3. MONITOR your servers. If someone's queue suddenly fills up with 10,000 messages, lock it and investigate it.

With a network where several thousand clients, such as student laptops and PCs in dorms, are not under centralised administration (and thus get infected by spyware because their users run with default administrator privileges enabled), this is a real problem.

See above.

Don't focus on trying to get the info out of SpamCop.

Focus on identifying the spammer behaviour on your network BEFORE it gets to SpamCop.

Once the email's been sent by the client it gets processed by your outgoing mail gateways, and suddenly Spamcop blacklists your outgoing mail relays.

Yep. So the idea is to limit the out-going rate by user and to monitor those queues.

The problem is not sending email to a SpamTrap address.

The problem is sending out thousands of spam emails.

The SpamTrap address is just a tool to identify when an address is probably sending out thousands of spam emails.

And unless the spamdrone sent enough email to really make an impact on your traffic, and it actually sent its email straight to your mail gateways and not a subordinate mail server which normally has a lot of traffic, and relays through your mail gateways.

If you don't have the authority to correctly design the network and mail servers, then it is not your problem. It is the problem of whomever does have that authority.

10,000 messages at 4KB is "only" 40MB. You'll see more traffic than that in mp3 shares. So don't focus on the "traffic" on your network.

Again, limit the out-going email rate per account. Then monitor those queues.

If you cannot do that because you aren't allowed to, then it is not your problem.

Otherwise, do it.

Really automated spam submission

[Anonymous Coward]

Abuse has been automating spam submission to the proper autorities for a few years now. I am sure that, if necessary, it would be possible to add Spamcop to the list of recipients.

As a user, why should I worry about this?

[Mistshadow2k4]

Why put myself through this when there is an easier way? I use gmail pretty much exclusively. I just checked my account and there is currently 850 (!) spam emails in my spam folder. There was one spam email in my inbox. Nomrally I never see this at all because what doesn't register as spam with gmail gets caught by Thunderbird. Furthermore, I can set Thunderbird to download copies of my email and leave the originals on the server, so if there is spam in my inbox all I have to do is go to my gmail account in my browser, open the spam email and click the "report spam" button.

I'm not trying to troll Spamcop or anything but why deal with an anti-spam service that complicated enough to need a tutorial on how to report spam when it's much easier to do that with gmail? Plus whatever gets past gmail usually gets caught by Thunderbird's junk mail filter.

I believe Spamcop sold my "private" address

[Radi-0-head]

I was a Spamcop subscriber, using their SMTP forwarding/filtering system. I got fed up with the downtime and the false positives, and canceled the account. A month later, I start getting MASSIVE amounts of spam directed to the "secret" account that is set up for forwarding of "clean" email. Most of these messages had both my true email account and the secret account as recipients.

There's no possible way anyone could have guessed this address (it consisted of random characters), and Spamcop was the only other organization that ever had record of it, and that ever used both of these addresses together.

I don't trust them at all.

Re:I believe Spamcop sold my "private" address

[mmclean]

Amen to the don't trust them at all bit. They are more than happy to provide customer service when you are spending money to establish and account, but once they have your money forget it.

I had an account over a year ago, the real email account with storage and was having a problem with it. I emailed support, no answer. I posted in the Spamcop form and the moderator (the great and powerful Wazoo) decided that I was full of shit and my problem didn't exist. A few days later, I posted different symptoms of the problem in a new thread and the great and powerful Wazoo decided that I was reiterating the same problem (didn't even take time to read and realize that I was posting different symptoms). He then merged the threads -- essentially burying my problem report at the end of a long thread so that no one could read it without clicking through 3-4 pages of the previous post. I posted in the forum actually begging for support -- and was constantly squashed by Wazoo.

When I finally did get an answer from my email to support, the content of that email was essentially "we saw the thread in the forum and Wazoo says it's not a problem."

This was one of the worst, most pathetic customer experiences that I have ever had -- and I had previously thought Spamcop were the "good guys" and directed many different friends, relative, and clients to them -- needless to say I cancelled, a number of my friends cancelled, and they've gotten zero new business from my recommendations.

Re:I believe Spamcop sold my "private" address

[Anonymous Coward]

My favorite is the emails they send (or at least used to send) to the upstream provider. Roughly translated "So, since we're obviously perfect and have them dead to rights, will you terminate them and roast their testicles over a bonfire or are you a dirty stinking whore?" Notably absent in the multiple choice was 'this is such an obvious joe job my grandma could catch it", "moron who reported this signed up for and confirmed membership in the mailing list", and of course "we're his hosting provider and the email was his monthly invoice!".

The best bet is still Spamassassin or similar where no single RBL is enough to reject the mail.

Re:I believe Spamcop sold my "private" address

[mmclean]

Umm, no - nice try at misdirection -- but I'd not have expected much else from and AC

Thanks for getting the clue (nt)

[Anonymous Coward]

I have no text in here I was just saying thanks to the parent for understanding.

The fascinating thing is ...

[khasim]

That someone who all but admits to being a spammer is mod'ed up 3 times (after posting anon)...

While the follow-ups criticising such are mod'ed down.

Seems like there are a lot of pro-spammer accounts with mod points today.

Anyway, you're still wrong.

#1. The "competitors" you're complaining about would have to have poisoned your "clients" email listing prior to you receiving those listings. That's just unrealistic. Either they'd have to have:

  1a. Poisoned almost every company's email listings in which case SpamCop would be dead because every company would be listed on it each time it sent any mailings.

  1b. Have someone inside your company telling them who your clients are and then poisoning them BEFORE you get the listing.

#2. Your competitors have lots of accounts that they use to report your sendings to SpamCop. If your competitors have that much expertise and time, then why are they wasting it blacklisting you?

#3. Your competitors already know the SpamCop spamtraps. Why aren't they making a LOT more money as real spammers with this knowledge? Why waste any time/effort on you? They can avoid the spamtraps themselves and get their spam out.

No. None of that makes any sense. You're a spammer and you're mad that SpamCop is being used to kill your spam business.

Re:The fascinating thing is ...

[Anonymous Coward]

Actually, all the competiter needs to do is forge the FROM field so that it contains the secret spamtrap address (plus maybe putting it into the Reply-To field).

You must not understand double opt-in

[oldosadmin]

Double opt-in means when person X signs up with foo@bar.com as the email, the provider sends a "Click here to verify your subscription" link to foo@bar.com

This would make it susceptible to getting on a blacklist from a spamtrap style email account.

Re:You must not understand double opt-in

[Anonymous Coward]

We know what the term means, but it's the exact phrase "double opt-in" that is regarded with suspicion, because it's that term that was used frequently by spammers who were either twisting the definition or just outright lying. If you use "confirmed opt-in" or "verified opt-in", you won't run into such reactions. If you care about your image (you're in marketing, this should be a foregone conclusion) then you won't use such a loaded term as "double opt-in". Really rational people should look beyond historical connotations, but appealing to reason isn't exactly your job either.

Incidentally, don't bleat the term "opt-in" too loudly either, and under no circumstances proclaim how adherent you are to some spam law or another. If you're clean, you have much better ways to back up your reputation.

(my captcha is "intent" ... gotta love it)

Let me explain this to you.

[khasim]

1) An RIAA lobbyist writes some legislative atrocity and pays off a bunch of US congressmen to introduce it as a bill
2) The EFF catches wind of it, and uses an email marketing campaign targeted at its members who have asked to participate in such campaigns to ask its members to protest the RIAA-authored bill
3) The RIAA lobbyist, who has cleverly subscribed to the EFF's mailing list, reports the email to SpamCop
4) ...
5) Profit! (For the RIAA)

You fail to realize that the messages would already be delivered by the time the RIAA managed to get the server listed on SpamCop, right?

No? You didn't realize that? Then maybe you should re-evaluate your supposed expertise on the material.

So what if the EFF's IP address is blocked AFTER the mailing?

Want more? That's easy. Not only would the listing not be in effect until AFTER the mailing, but it would only affect those people who's servers block in-bound email based off of that list.

In other words, the net effect would be NOTHING.

The listing would go into effect AFTER the mailings were already received
AND
The listing would only have affected those users who's email servers blocked based off of that listing PRIOR to accepting based off of a whitelist.

But I guess you didn't think of that before you flamed the grandparent to a crispy golden brown, huh.

You'd be wrong. I deal with this every day.

But I deal with it from the point of view of an email admin who is trying to reduce the in-bound spam while making sure that all the legitimate email is allowed through.

So I have a little bit more experience in this than some spammer who is just bitching that his site keeps getting listed on SpamCop.

In order for you to be correct:

#1. The RIAA would have to get the EFF's servers listed on SpamCop PRIOR to the mailing.

#2. The RIAA would have to get a significant percentage of the mail admins of the mail servers of the users receiving that mailing to use SpamCop.

#3. The RIAA would have to get those mail admins to implement a block based off of that listing.

#4. The RIAA would have to get that block set prior to any user level whitelists.

Yeah, keep believing that all of that can/will happen and that it is the poor "EMail marketing company" that is suffering.

For my part, I'll skip the conspiracy theories and keep blocking the anonymous spammer.

Re:Let me explain this to you.

[SillyNickName4me]

So what if the EFF's IP address is blocked AFTER the mailing?

The EFF, like many such groups isn't exactly a one time afair you know..

Want more? That's easy. Not only would the listing not be in effect until AFTER the mailing, but it would only affect those people who's servers block in-bound email based off of that list.

In other words, the net effect would be NOTHING.

Thanks to the fact that most mail admins with any clue whatsoever avoid spamcop, indeed.

The listing would go into effect AFTER the mailings were already received
AND
The listing would only have affected those users who's email servers blocked based off of that listing PRIOR to accepting based off of a whitelist.

Any reason for you to repeat your correct but pretty silly comment? want to look twice as stupid maybe?

        But I guess you didn't think of that before you flamed the grandparent to a crispy golden brown, huh.

You'd be wrong. I deal with this every day.

And so do I.

But I deal with it from the point of view of an email admin who is trying to reduce the in-bound spam while making sure that all the legitimate email is allowed through.

Good luck with your job, but maybe get it into your mind that there are thousands of valid email lists around, and there are also companies running such lists for a whole bunch of reasons. That is legitimate mail, and with the attitude you display here, you would end up blocking quite some of that.

Re:Let me explain this to you.

[Anonymous Coward]

Why must the blocks be effective prior to submission? Blocking future solicited mails also harms the legitimate sender which owns a single or small block of e-mail servers, no?

By the way, belaboring your point several times and using bold text does not make it any more persuasive.

Re:Let me explain this to you.

[Russ Nelson]

But I deal with it from the point of view of an email admin who is trying to reduce the in-bound spam while making sure that all the legitimate email is allowed through.

I believe that you are lying -- perhaps mostly to yourself -- but what you are saying is not factual. The spamcop blocking list *purposefully* blocks sites which accept all email and then bounce the undeliverables. This is an industry standard practice which Spamcop has unilaterally declared nonstandard. That's fine -- everyone needs to decide for themselves what email they will accept and what they they reject -- but don't delude yourself -- you are NOT making sure that all legitimate email is allowed through. That is a lie.

Re:Let me explain this to you.

[Lost Race]

Sending NDRs to forged addresses is spam. Spamcop called that one right. If you can't verify the MAIL FROM, don't send any NDR. Best to reject with a 55x at RCPT or DATA.

I have my own DNSBL (using RABL and DSPAM)

[Anonymous Coward]

I personaly prefer to use Reactive Autonomous Blackhole List (RABL) in combination with DSPAM.

Setting up RABL is easy as 1-2-3 (with the help of this Gentoo ebuild).

Some other people I trust more then SpamCop have as well installed RABL and we do exchange the data from our blocking list.

SpamCop is all okay but I like to have DNSBL data from sources I know that I can trust them. And I like to have IP's blocked from those dummies sending spam over here in europe. SpamCop has not enought data about those spammers. Only america and asia is well covered, but european spam is still not much found in SpamCop.

Rule #1: Spammers LIE!

[khasim]

First off, that would mean that those spamtrap addresses had been compromised. So far no one has been able to demonstrate that. Just a lot of claims.

Double opt-in means when person X signs up with foo@bar.com as the email, the provider sends a "Click here to verify your subscription" link to foo@bar.com

But that does not match what the GP was claiming. From his (anonymous) claims:

I work at an EMail marketing company (no, not spam) and we have had our servers placed on blacklists multiple times ... you know why? People who are competetors to our clients signup a spamtrap email to their lists, getting our mailserver blacklisted for sending mail to an address -- even though the mail is a "are you sure you wanna subscribe?" message?

Again:

Company A -- "EMail marketing company"
Company B -- client of Company A
Company C -- evil competitor of Company B

Somehow, it is claimed, Company C finds out that Company B hired Company A.

Then, Company C sends a subscribe request to Company A with the return address of a SpamCop spamtrap.

THIS IS WHERE THE STORY FAILS

It requires that Company C KNOW that Company B hired Company A.
AND
It requires that Company C KNOW the spamtrap addresses of SpamCop.
AND
It requires that Company A be running a regular double-opt in mailing list.
AND
It requires that Company A (an "EMail marketing company") be unable to check its own email logs to find the recent subscription requests.

This would make it susceptible to getting on a blacklist from a spamtrap style email account.

Yes it would.

IF you accept that EACH of those FOUR requirements is true.

Allow me to remind you of Rule #1:
SPAMMERS LIE!

I don't know about you, but for me, it's easier to believe that the GP is lying about his "business" and SpamCop and everything else ... rather than believe that some company making widgets just happens to KNOW the spamtraps that SpamCop uses and just happens to KNOW that Company B hired Company A and then subscribes Company A's mailing list to those spamtraps.

But if you want to believe a spammer when he says that such happens to him ... that's your Right.

It seems that a lot of moderators also believe the spammer today.

Re:Rule #1: Spammers LIE!

[SillyNickName4me]

It requires that Company C KNOW that Company B hired Company A.

Which just requires them to get an earlier mailing sent by company A for company B. Not very difficult so far.

AND
It requires that Company C KNOW the spamtrap addresses of SpamCop.

No, it requires knowledge of one spamtrap, tho still highly unlikely, its by far not as difficult as you seem to suggest.

AND
It requires that Company A be running a regular double-opt in mailing list.

No, it requires company A to be running any kind of mailing list.. 'double-opt-in' or verified opt-in as I prefer, is considered better, but won't help here.. but just sending any mail will do really.

AND
It requires that Company A (an "EMail marketing company") be unable to check its own email logs to find the recent subscription requests.

That may at least help prevent future listings, and expose a spamtrap (see how difficult that really is?), but well.. try arguing with spamcop about a listing..

Were you dropped?

[Anonymous Coward]

You fail to realize that the messages would already be delivered by the time the RIAA managed to get the server listed on SpamCop, right?

Yeah, obviously, the EFF's marketing company is never going to need to transmit another legitimate mass mailing, so it's OK that the specific one about the RIAA bill didn't get blacklisted in time to stop it.

I am thankful for your insight. (I am also thankful that you work for SpamCop and not Fermilab.)

nobody reads bounce messages

[Michael Wardle]

You can also customize them in Postfix, but the nature of the message means nobody reads them anyway.

Your custom message will appear as a single line below four or five lines of technical jargon appended by the sender's own SMTP program. There is no ability to add formatting or hyperlines, as it's just plain text.

Including the web address for a blacklist lookup (e.g. "Your message was blocked because it came from a server that sent spam, please see http://sorbs.net/lookup?ip=w.x.y.z") has proved completely ineffective.

A human contact name and number is probably a little more likely to be noticed, but the problem still remains that the bounce messages are too hard to read.

My 0.02

[dw604]

Oh come on, "email marketing" is a code word for "spamming" in the biz. OK, maybe, just maybe, your messages are "legit" and maybe you really do take people off your lists when they opt-out, but the reality is that savvy users shouldn't trust opt-outs. Too many spammers use it as a way of verifying good addresses to spam. It is much easier to simply report emails from unwanted "email marketers" as spam.

Email marketing does not always mean SPAM. Email remains a powerful and easy medium of communication. Spammers need to realize it's not difficult to set up a small web site, generate hits, get signups and build a true opt-in newsletter with far higher customer loyalty and conversion rates. They are wasting their time.

I sell an email list management PHP script (LMP) that DOES honour opt-out requests (if you choose to include a "remove link" code). I will agree that even with 100% double-in lists some subscribers find it easier/safer to hit "This is Spam" than risk clicking a remove link.

There is a HUGE market for my program. People need and want to follow up on their web site visitors, prospects, and clients.
1. Sending legitimate, information-packed automated email courses are a great way to get people to come back to your site.
2. You can keep informing your former buyers about your new products - if they like one of your products and the support they receive they are MUCH more likely to buy another one from you.
3. You can send email to all of your site members, etc.
4. Don't have advanced web design skills? You can start your own e-zine/newsletter and make THAT your online business.

My view is you should not click links in anything you did not specifically request online or offline. If you have signed up to a legitimate list or purchased a product from a hard-working individual/company, however, it is counter-productive (and just plain mean) to report their messages as spam. Chances are, they use a popular TRUE opt-out email list management script like mine and your removal request WILL be honoured instantly.

I think all ISPs simply need to incorporate a feedback loop similar to the one AOL offers. By piping email to a CGI script I can detect and 'click' the returned "remove link" to automatically remove complainants. This greatly reduces complaints against future messages.

Spam trap addresses do not seem to be working and are bringing down legitimate lists. A (small) number of my clients have had problems with these addresses being subscribed and even confirmed on their lists. Furthermore, I do (invite-only) web hosting for about 30 users of my program. From time to time a hosted client will import a purchased list containing spam trap addresses. These addresses aren't usually very hard to spot, especially when they are addresses @spamtrap.xxx, etc. I usually get a few hits when I search for email addresses like %spam% across up to 15 hosted clients per server. I do not allow my clients to import purchased or 'obtained' lists, but due to the 'freedom' of my program this isn't always honoured. Of course, those clients are promptly removed and the server's reputation is never harmed (for long).

Greylisting is the answer

[burne]

I use graylisting. My mailserver gives you a temporary error, instead of a permanent one. Your mailserver will keep on trying to deliver the mail. If you got listed on spamcop for any reason other than spam, you *will* get delisted pretty quickly. A listed spammer will not try again to deliver mail. Too much effort. If some idiot with windows and a virus at your ISP does manage to earn a spamcop-listing it will delay your mail anywhere from a couple of hours to two full days, mostly depending on the alertness of your ISP. But the mail will get delivered, eventually.

This simple measure (returning a 4**-errorcode, and not a 5**) got rid of over 2000 spams per hour, without affecting the number of complaints spamfiltering generated. 1 of my 17.000 users noticed once that a specific message had spent 24 hours in a queue somewhere.

spamcop is dead

[Anonymous Coward]

since late last year. every spam I submit says too old, or cant find somthing. clearly the spammers now have spamcop busting headers in place. I havent used spamcop for over half a year now.

nails dialup, too

[Anonymous Coward]

I am on dialup and as such get a semi random IP number all the time. Several times I have written various "spam blocking" sites and complained when the IP number shows up and I am not allowed to login to some IRC server. It doesn't matter that I run linux and they say my "number" came up as a spam sender because of some named windows trojan. When all you can get is dynamic dialup assigned numbers, what can you do then? The answer is "nothing", BigIsp, Inc is not going to give me a dedicated mumber, that's for sure, so you get nailed by spammers and nailed by the anti spammers, in other words "unfortunate collateral damage" that no one cares about.

I appreciate what the spam blockers are trying to do, but I think that article from the other day had the better idea, the mass automated "opt out" messages direct to the companies using the spam for ads. Take the "stop spamming" message directly where it goes.

Content Exposure

[PhYrE2k2]

Spamcop's benefit and problem are the same- content exposure.

I used to submit all of my Spam to Spamcop as well as a few other blacklists. Of course properly, all the real spam maintaining all of the important information. The issue?

It posted the message for the Spammer to see. It sent it to the ISP. As a part of an ISP, I'm pleased when I get that, as there's nothing worse than "someone submitted something" messages. At the same time, as a user, they put my e-mail addresses in the headers. They include the unsubscribe link. They include unique identifiers in e-mails or base64 encoded addresses placed in the body or headers for tracking purposes.

Why? Someone needs to make a system that hides the message and will, upon request of the Spammer/blocked user, send _you_ the message. You can then modify it. Include only some headers. Strip anything that looks odd. Strip unique IDs. Be an educated user and just submit the important information for them to get back at the user who did it and find the proper script.

-M

False positives? Not really

[FOSSguy]

Not sure how it goes with the TOS, but I wrote something like this myself a year or so ago. I wrote two scripts in perl:

The first checks a particular IMAP folder for messages and if there is anything there, it bundles them up and sends them off to spamcop as MIME attachments to a single email. (Spamcop can handle *lots* of individual spam items as attachments to a single message to the submission address. I don't know exactly how many, but I've sent upwards of fifty in a single pass, and spamcop has always accepted them, never complained).

The second does a cookie-login at spamcop, checks for any parsed spam waiting to be submitted, and walks through the submission process. My script unchecks the 'third party interested in spam' recipient, 'cos I've never been entirely sure about the motivations of that company).

Both of the scripts are called by cron at appropriate intervals

As for false positives, the only ways that things get into that particular IMAP folder are if they were addressed to one of a handful of known-bad (as in so inundated with spam that they never recieve anything else and I don't use them anymore) or I've personally identified the message as spam, and physically drag/dropped it into that particular folder for processing.

If anyone wans copies of my perl code, drop me an email. I'll clean it up and pass it on. Put [slashdot spamcop] in the email Subject: line.

Simpler Script in Python

[gurubert]

Hi!

I made a simpler script in Python that does basically half of the job.
You have to submit the SPAM manually and then pipe the Spamcop reply through it.
Use at your own risk etc. pp.

Forward as attachment

[bjoeg]

Why not use SpamCops feature to submit the spam mail as an attachment.

It is a feature disabled for every user, unless you ask for permission from SpamCop admins. The reason is, many a too lazy to check whether mail is spam or not and then submit the wrong mails.
There is no submit check in this feature, simply forward the mail, you will get a report telling if the spam was submitted and to which admins reports were send.

The negative part of this feature is that it will only send reports to admins of the networks where mail origin. Spamvertized links will not be reported.

Spamcop Sucks!

[Anonymous Coward]

Spamcop is using a rather aggressive strategy to identify possible spam sources. They will count how many spam mails and how many good emails were sent from a certain IP address and calculate a score from that with a strong weight on the spam thus creating many false positives.

My university's mail setup is that all faculty email will pass university's mail servers. Those mailservers a rather frequently listed on the Spamcop blacklist because from the 10000 users there will always be someone who imports an infected laptop or something which will then send spam via the university's mail servers.

Once the university's mail servers are blacklisted everybody from the whole university will run into trouble. Regardless of how many good emails are being sent as well. And let me tell you, nothing is less fun than a professor who will see a project slipping because he cannot submit a proposal to some partner. And no, they don't care about the technical details, which will put the poor system administrator into a really bad position.

Spamcop sucks because it is creating a lot of pressure to fight spam, but sometimes the pressure hits the wrong target!

If you are running Lotus Notes

[iconnor]

You can still submit them with this Lotusscript agent:

http://ianconnor.blogspot.com/2006/05/reporting-sp am-to-spamcop-from-lotus.html

I would rather have a semiautomatic...

[Anonymous Coward]

If I could select a mail message in Thunderbird and with right-click submit its source into window on SpamCop form, that would be satisfactory. I (human message selector) would remain in loop and I would handpick what to submit and what to pull out. One thing would be even better: client side message parser that would tell me the message arrival time (so that I can dismiss it myself if it had rotted already) and where it came from (if I wish to file complaint myself, which I actually did before I got overwhelmed and resorted to using SpamCop) - because alerting zombusers is more beneficial - they get bitten, hopefuly get a slap on their wrist, learn their responsibilities about their Internet station (sounds bombastic, but each of connected boxes we own is like a twoway radio station - could be abused to jam others and it is owners responsibility to keep them secured) security.

Don't bother yourself.

[khasim]

Yes, you are completely correct. It is spam.

But you will not change his opinion. I believe he is the anonymous "EMail marketing company" from earlier in this thread.

He claims that "This is an industry standard practice..." but that phrase means whatever anyone wants it to mean.

That practice has been vilified for YEARS as "collateral spam". Here is a reference from FIVE YEARS AGO http://www.ja.net/CERT/JANET-CERT/mail/junk/collat eral.html

Again, always remember Rule #1.

Spammers lie. He is a spammer. He lies.

One of the reasons I prefer Exim4 is that it is possible to kill all rNDR collateral spam by simply adding an X-header to my out-bound email and checking for such on any in-bound "NDR" messages.

Re:Don't bother yourself.

[Lost Race]

I'm pretty sure Russ Nelson is neither anonymous nor affiliated with any kind of "email marketing". I have great respect for his accomplishments and philosphy (see his web page) but wish he would change his mind about autoresponses (including NDRs). After AOL, Yahoo, and Hotmail saw the light my backscatter spam load went down tremendously; now we just need to spread the word to the remaining few thousand mail admins still living in the 20th century.

He must have been replying out of order then.

[khasim]

Here's his post http://slashdot.org/comments.pl?sid=186884&cid=154 24457

He may be confusing his post with the anonymous post to which I was replying.

Or he may be saying that he was the one who was posting anonymously.

I have great respect for his accomplishments and philosphy (see his web page) but wish he would change his mind about autoresponses (including NDRs).

I can agree with you on the NDR issue, but I haven't seen anything from Russ that would merit any respect from me. In fact, the opposite is in evidence in this thread. Another link http://slashdot.org/comments.pl?sid=186884&cid=154 24442

After AOL, Yahoo, and Hotmail saw the light my backscatter spam load went down tremendously; now we just need to spread the word to the remaining few thousand mail admins still living in the 20th century.

:)
Good luck with that. We have clients who's email servers HELO with "exchange_server". We have clients who don't accept email to "postmaster". We have one client who is running GroupWise 6.0 and won't even patch it. A few weeks ago, one of our clients was running an open relay.

The real issue (as I see it) is that people see email as someone else's problem. In every one of those instances above, I've been told by their IT department that there is no problem because they can send and receive email to/from everyone.

Which seems to be the same core issue that Russ Nelson has. As long as it isn't annoying him, it doesn't matter that it may be annoying someone else (look up "joe job"). And claiming it is "industry standard practice" is just more evidence that he does not know what he's talking about.

Particularly when he started this thread with confusion about his server vs his IP address and whether SpamCop had "blocked" him vs other email admins using SpamCop's blacklists.

I'm with you 100% on DNR's. But I believe Russ Nelson has only a superficial understanding of email and is ignorant of the depth of his ignorance.

Case in point: His SpamCop claims. If he was running a double-opt-in list, then his address would only have been flagged for 24 hours when he sent the verification email. And it would only have affected those users who's email admins blocked based off of that.

I don't know many admins that do that. Even SpamCop's FAQ says not to. I'm sure they're out there. But since he should be seeing the rejection notices, why not just send a note with a clip from SpamCop's FAQ to those admins?

So ... (multiple choice):
#1. He's wrong about how his mailing list works

#2. He's complaining about a tiny minority that he isn't doing anything to educate

#3. He really is a spammer

Re:He must have been replying out of order then.

[Russ Nelson]

But I believe Russ Nelson has only a superficial understanding of email and is ignorant of the depth of his ignorance.

I was an Internet postmaster when your mother was still wiping shit off your butt.

If he was running a double-opt-in list, then his address would only have been flagged for 24 hours when he sent the verification email.

You see how confused you are? Double-opt-in (which, by the way, is a SPAMMER term, so who's the spammer here?) is the industry standard for ensuring that a mailing list does not spam. So, a spambot forges email to a mailing list subscription address from one of your sooper-sekrit spamtraps. My mailing list software sends a confirmation email to your spamtrap, and I'm blocked for 24 hours. Why? For following the industry-standard practice of confirming all subscriptions.

Yer an idiot, Khasim. You think that spamcop wants people to not use bl.spamcop.net? How gullible can you be? Of course they want people to use it. Why else would they bother running it? They only tell people NOT to use it for legal cover -- cover that will last about ten seconds -- which is how long the judge will take to give it the good belly laugh that it deserves.

I've said in another thread (which you apparently didn't read) that Spamcop is trying to solve the wrong problem. No possible solution can solve a wrong problem. Spamcop is trying to reduce spam, which is good. They're attacking autoresponses, which is bad, because autoresponses are indistinguishable from mailing list confirmations. They should attack forgeries instead. DomainKeys will prevent forgeries.

rhsbls are much more effective than ip-based lists

[Anonymous Coward]

RHSBL's such as http://www.uribl.com/ maintain (and publishes via white.uribl.com) a very large whitelist for domains resulting in much less chance of FP on their black.uribl.com list. spamcop doesnt seem to believe in whitelisting ips/subnets, as hosters such as gmail, aol, sbc, and the like seem to get listed about every other week.

give it a shot, the spam accuracy will hang around 70-80%... which is better than you'll ever get from spamcop.

Cry me a river.

[khasim]

I was an Internet postmaster when your mother was still wiping shit off your butt.

Sure you were.

You see how confused you are?

No, why don't you explain it?

Double-opt-in (which, by the way, is a SPAMMER term, so who's the spammer here?) is the industry standard for ensuring that a mailing list does not spam.

Let's see, I would say that the spammer was the one of us who was listed by SpamCop.

Oh, you don't like the terms I use? I guess that is too bad for you.

I'm not the one listed by SpamCop, you are.

So, a spambot forges email to a mailing list subscription address from one of your sooper-sekrit spamtraps. My mailing list software sends a confirmation email to your spamtrap, and I'm blocked for 24 hours. Why? For following the industry-standard practice of confirming all subscriptions.

Yep.

Now, the question is ... why is a spammer wasting machine time (that could be used to send spam) subscribing SpamCop spamtrap addresses to your mailing list?

What's the point?

All that will be accomplished is SpamCop learning which spamtraps have been compromised.

So what if your list is blocked for 24 hours by people who haven't read SpamCop's FAQ? That doesn't get more spam out for the spammer. That doesn't get more spam hits. That doesn't do anything for the spammer. Nor does it hurt SpamCop.

Yer an idiot, Khasim.

Maybe, but I'm not the one who is making claims he cannot support. Nor am I the one confused about the process of replying in a thread.

Either you were posting anonymously as that spammer
or
You can't tell which post is the GP or GGP to another post.

Those are the facts and I can substantiate them. In this thread.

You think that spamcop wants people to not use bl.spamcop.net?

It seems you have trouble comprehending basic English, too.

Of course SpamCop would like people to use their blacklists. Maybe you also have trouble reading exactly what they post on their site? Here it is: http://www.spamcop.net/fom-serve/cache/291.html

We recommend that when using any spam filtering method, users be given access to the filtered mail - don't block the mail as documented here, but store it in a separate mailbox. Or tag it and provide users documentation so that they can filter based on the tags in their own MUA. We provide this information only for administrators who cannot use a more subtle approach for whatever reason.

They even tell you not to use it to block email.

I can read that. I can post that. I can understand that.

But you seem to have a problem.

They only tell people NOT to use it for legal cover -- cover that will last about ten seconds -- which is how long the judge will take to give it the good belly laugh that it deserves.

So their FAQ and their repeated instructions in their forums are all part of an elaborate ruse that only you have the intelligence to see through.

Yeah, sure. You're not wrong because even when it is plainly written in black and white and it contradicts you, well, they didn't really mean it. They just wrote that to keep the lawyers away.

They do have a legal defense fund. But I guess you'd find some way of rationalizing that away, too.

I've said in another thread (which you apparently didn't read) that Spamcop is trying to solve the wrong problem.

You've already claimed that their posted instructions (often repeated in their forums) are false. So why should I care to read what you believe they are doing "wrong" in pursuit of their true agenda?

It all comes down to one simple statement:
Either you are the anonymous spammer
or