From loyal at spamcop.user Thu Oct 9 23:30:02 2008 From: loyal at spamcop.user (AndrewB) Date: Thu Oct 9 23:30:04 2008 Subject: [Scmail] wrong contact information in spamcop report Message-ID: Hi A spam email that I queued for processing had a slight error in it such that one of the hosts that got a report did not belong to the domain of the ip address in question. Both were state universities, but in different counties and about 20-30 miles away from each other. Who do I send the report details so that the one university is not associated with the other? AndrewB From MikeE at ster.invalid Fri Oct 10 00:03:36 2008 From: MikeE at ster.invalid (Mike Easter) Date: Fri Oct 10 00:05:03 2008 Subject: [Scmail] Re: wrong contact information in spamcop report References: Message-ID: AndrewB wrote: > A spam email that I queued for processing had a slight error in it such > that one of the hosts that got a report did not belong to the domain of > the ip address in question. Both were state universities, but in > different counties and about 20-30 miles away from each other. SpamCop has an algorithm for deriving a reporting address. It is typically easy to 'illustrate' how such a reporting address is derived, if it is derived from the regional registrar whois -- or alternatively a notify address may be 'arranged' by a provider communicating with a deputy, which is also easily illustrated. This 'easy illustration' is not possible in the context of vague allusions to unknown state universities and their geographic proximity to each other. It seems that you are behaving like a secret agent who has hidden a note in a knot hole in an old oak tree whispering a clue to a confederate. > Who do I send the report details so that the one university is not > associated with the other? Maybe SC's algorithm has the notify address right and maybe your estimation of how it should have been otherwise notified is not correct. Have you considered that? -- Mike Easter kibitzer, not SC admin From loyal at spamcop.user Fri Oct 10 00:16:01 2008 From: loyal at spamcop.user (AndrewB) Date: Fri Oct 10 00:20:03 2008 Subject: [Scmail] Re: wrong contact information in spamcop report In-Reply-To: References: Message-ID: Mike Easter wrote: > AndrewB wrote: > >> A spam email that I queued for processing had a slight error in it such >> that one of the hosts that got a report did not belong to the domain of >> the ip address in question. Both were state universities, but in >> different counties and about 20-30 miles away from each other. > > SpamCop has an algorithm for deriving a reporting address. It is > typically easy to 'illustrate' how such a reporting address is derived, if > it is derived from the regional registrar whois -- or alternatively a > notify address may be 'arranged' by a provider communicating with a > deputy, which is also easily illustrated. > > This 'easy illustration' is not possible in the context of vague allusions > to unknown state universities and their geographic proximity to each > other. It seems that you are behaving like a secret agent who has hidden > a note in a knot hole in an old oak tree whispering a clue to a > confederate. Right. But there's a flaw in it. >> Who do I send the report details so that the one university is not >> associated with the other? > > Maybe SC's algorithm has the notify address right and maybe your > estimation of how it should have been otherwise notified is not correct. > Have you considered that? The notify address is correct, but not meant for the ip address in question. The report generated 3-4 reports to the write university, and one to the wrong university. It's like getting snail mail for the same house one or two streets over. Andrew From g.hyde at bigNOSPAMpond.net.au Fri Oct 10 04:22:59 2008 From: g.hyde at bigNOSPAMpond.net.au (Geoffrey Hyde) Date: Fri Oct 10 04:25:04 2008 Subject: [Scmail] Re: wrong contact information in spamcop report References: Message-ID: "AndrewB" wrote in message news:gcmi7o$2v0$1@news.spamcop.net... > Hi > > A spam email that I queued for processing had a slight error in it such > that one of the hosts that got a report did not belong to the domain of > the ip address in question. Both were state universities, but in > different counties and about 20-30 miles away from each other. > > Who do I send the report details so that the one university is not > associated with the other? Please post either a TRACKING URL of a munged, forged and canceled spamitem or the SpamCop TRACKING URL to the received spamitem in question. (If you're not concerned about exposing your address or private email data.) You can also write to deputies AT spamcop DOT net and if they decide SpamCop is notifying incorrectly, they can fix the routing database so that it will notify correctly. You can find your tracking URL quite easily, it says "Here is your TRACKING URL" at the top of the parse. Munging your forged spamitem for demonstration purposes will allow people to do way more than guess as to what could be the problem. Cheers ... Geoffrey Hyde From MikeE at ster.invalid Fri Oct 10 11:28:16 2008 From: MikeE at ster.invalid (Mike Easter) Date: Fri Oct 10 11:30:04 2008 Subject: [Scmail] Re: wrong contact information in spamcop report References: Message-ID: AndrewB wrote: > The notify address is correct, but not meant for the ip address in > question. The report generated 3-4 reports to the write university, and > one to the wrong university. What IP address are we (not) talking about? We can have an 'academic' discussion about how I would notify for a particular IP address, and how /you/ would notify for that IP address, and how SC 'might' notify for that address. SC's notify algorithm is slightly different for source vs spamvertiser, so there may be a difference in what a tracker would display vs what the result would be of feeding the naked IP to the webparser. It is very very common that I would choose a different notify than SC would choose -- but generally I can figure out why SC notified as it did. Sometimes the SC cache needs to be refreshed so that it can work the algo anew rather than using stale information. -- Mike Easter kibitzer, not SC admin