[Scspamcop] What works? Reporting hints, strategy, ...

[s. keeling]

Hi.  After years of working at it, I've come up with a system that
knocks received spam on my ISP (ca. 250/day) down to ca. 50
reportable, not yet seen by Spamassassin as being noted in rbls
(procmail):

   -----------------------------------
REPORTED    = "(domain appears in spamcop database at\
|contains an URL listed in\
|is an open proxy\
|is blacklisted in\
|received via a relay in\
|url listed in the URIBL\
|sent via a relay\
)"

:0
* ^X-Spam-Status: Yes
* $ ${REPORTED}
{
  LOG="SAReported --- "
  :0:
  ${MAILDIR}/old-spam
}
   -----------------------------------

I assume I'm just adding to the problem by reporting anything that's
obviously already been reported, yes?

Other questions:

  - Should I report spam that's eight hours old?  Four hours?

  - How about:

      Yum, this spam is fresh!
      Message is 1 hours old
      89.189.145.244 not listed in dnsbl.njabl.org
      89.189.145.244 not listed in dnsbl.njabl.org
      89.189.145.244 listed in cbl.abuseat.org ( 127.0.0.2 )
      89.189.145.244 is an open proxy
      89.189.145.244 not listed in accredit.habeas.com
      89.189.145.244 not listed in plus.bondedsender.org
      89.189.145.244 not listed in iadb.isipp.com

    It's already listed, already known to be an open proxy; why report
    it again?  Statistics?  Why?  We know what it is.  It ought
    already be dead.

  - How is it that I can report repeats for weeks, yet still come home
    to see:

      Percent unescape: ... home.hn8868.com/clogin/freecd.htm

    yet again?

Just looking for ways to improve my process.  Ideas welcome.


-- 
Any technology distinguishable from magic is insufficiently advanced.
(*)    http://www.spots.ab.ca/~keeling          Linux Counter #80292
- -    http://www.faqs.org/rfcs/rfc1855.html    Please, don't Cc: me.
       Spammers! http://www.spots.ab.ca/~keeling/emails.html